Cybersecurity Roundup: Tchap Breach, Phishing Campaigns and Threat Actor Arrest
Summary
This roundup covers a breach of France’s Tchap messaging service, phishing and ransomware-group activity, an arrest in Spain over government data leaks, a website malware campaign, botnet expansion, and a spear-phishing campaign targeting Afghan officials.
Key points
- Attackers accessed France’s Tchap messaging platform through a compromised user account. Authorities alerted users and notified the CNIL; the threat actor’s claims of credential theft and large-scale data exfiltration remain unconfirmed.
- The FBI warned that Kali365 uses OAuth device-code phishing to steal Microsoft 365 session tokens and bypass MFA.
- Silent Ransom Group has targeted law firms and other organizations through impersonation, phishing, remote access tools, and reported in-person access attempts to steal data.
- Spanish police arrested an individual suspected of leaking data associated with government and national security organizations; reported records may have been compiled from breaches, credential dumps, and OSINT.
- DriveSurge reportedly compromised thousands of websites to distribute malware through ClickFix and FakeUpdates, and sells access to infected systems.
- Researchers reported that the JDY botnet grew to more than 1,500 compromised SOHO and IoT devices, with U.S. military and related networks among its targets.
- A SideCopy-linked campaign targeting Afghan government entities used spear-phishing, a malicious LNK file, and Xeno RAT.
Article Details
- Event Type
- Cybersecurity incidents and threat activity, including account compromise, social engineering, data theft, phishing, botnet reconnaissance, and malware distribution.
- Impact
- Reported and alleged impacts include compromised messaging and Microsoft 365 accounts, possible exposure or theft of personal and sensitive data, and targeting of government, military, legal, financial, and professional-services organizations. Some claims, including the scale of data exfiltration in the Tchap breach, were not confirmed by the affected organization.
Threat Actors
DriveSurgeThreat actor reported to use compromised websites to distribute malware through ClickFix and FakeUpdates activity, and to sell access to infected systems.SideCopyPakistan-aligned threat group believed to be behind a spear-phishing campaign targeting Afghanistan’s Ministry of Finance and other government entities.Silent Ransom GroupGroup reported to target law firms and other organizations through social engineering, remote access, extortion, and in-person data theft.SRGSource-stated abbreviation for Silent Ransom Group; reported to target law firms through social engineering and in-person data theft.Volt TyphoonNamed as an example of Chinese threat actors previously linked to the JDY botnet.
Malware
Products
Microsoft 365 Apps for Enterprise2. FBI Warns of Phishing-as-a-Service Platform Compromising Microsoft 365 – ic3Microsoft EdgeThis file executes obfuscated JavaScript in memory, establishes persistence by impersonating Microsoft Edge through Registry modifications, and deploys Xeno RAT 1.8.7 using a DLL-based loader.TchapFrance’s digital affairs directorate (DINUM) disclosed a breach of Tchap, the French government’s encrypted messaging platform, after attackers gained access through a compromised user account.
Tools
Countries
Afghanistan8. Pakistan-Linked SideCopy Targets Afghanistan Finance Ministry with Xeno RAT – The Hacker NewsChina7. China-linked JDY botnet expands targeting of U.S. military networks – Bleeping ComputerFranceFrance’s digital affairs directorate (DINUM) disclosed a breach of Tchap, the French government’s encrypted messaging platform, after attackers gained access through a compromised user account.Pakistan8. Pakistan-Linked SideCopy Targets Afghanistan Finance Ministry with Xeno RAT – The Hacker NewsSpain4. Spain arrests doxer leaking sensitive data of govt employees – Bleeping ComputerUnited StatesResearchers at Black Lotus Labs report that JDY remains heavily focused on the United States, particularly military and related networks.
Industries
financialAccording to Mandiant, SRG targeted dozens of organizations across the legal, financial, and professional services sectors between January and May 2026.GovernmentFrance’s digital affairs directorate (DINUM) disclosed a breach of Tchap, the French government’s encrypted messaging platform, after attackers gained access through a compromised user account.LegalAccording to Mandiant, SRG targeted dozens of organizations across the legal, financial, and professional services sectors between January and May 2026.Military7. China-linked JDY botnet expands targeting of U.S. military networks – Bleeping ComputerProfessional ServicesAccording to Mandiant, SRG targeted dozens of organizations across the legal, financial, and professional services sectors between January and May 2026.