April Threat Intelligence Roundup Highlights PLC Disruptions, Data Breaches and Malware Campaigns
Summary
A roundup of eight cybersecurity stories covers attacks on critical infrastructure, email and data breaches, credential theft, crypto scams, and malware targeting energy and water systems.
Key points
- Iran-linked actors reportedly disrupted U.S. critical-infrastructure PLCs through internet-exposed OT devices and manipulation of project files and HMI/SCADA displays.
- The FBI confirmed a breach of Director Kash Patel’s personal email; the Handala group claimed responsibility and released personal material.
- North Korea-linked APT37 reportedly used Facebook and Telegram social engineering to deliver RokRAT, which can capture screenshots, run commands, and gather system information.
- ShinyHunters claimed to have leaked more than 70 million Rockstar Games analytics records obtained through an incident involving Anodot and stolen authentication tokens.
- A password-spraying campaign targeted more than 300 Israeli Microsoft 365 organizations, with attackers reportedly accessing accounts and exfiltrating mailbox data.
- A fake Ledger Live app allegedly stole $9.5 million in cryptocurrency from 50 victims who entered their recovery phrases.
- Other reports describe destructive Lotus wiper attacks on Venezuelan energy organizations and ZionSiphon malware targeting Israeli water and desalination OT systems.
Article Details
- Event Type
- Weekly roundup of reported cyber incidents, threat activity, and malware targeting organizations and individuals.
- Impact
- The incidents described include disruptions to U.S. critical-infrastructure PLCs; a breach and public release of personal email and documents attributed to Handala; RokRAT delivery to targets through social engineering; a reported leak of more than 70 million Rockstar Games records; password-spraying attacks against Microsoft 365 organizations, primarily in Israel and the UAE; cryptocurrency theft of $9.5 million from 50 victims through a fake Ledger Live app; destructive attacks on Venezuelan energy and utility organizations; and malware targeting Israeli water and desalination systems.
MITRE ATT&CK
T1110.003 · Password SprayingA reported password-spraying campaign targeted Microsoft 365 organizations.T1204.002 · Malicious FileTargets were persuaded to install a specialized PDF viewer used to deliver RokRAT.T1485 · Data DestructionLotus overwrites drive contents and recursively deletes files.T1490 · Inhibit System RecoveryLotus neutralizes recovery mechanisms before its destructive actions.
People
Threat Actors
APT37Identified as the North Korean group conducting a social-engineering campaign to deliver RokRAT.HandalaClaimed responsibility for breaching Kash Patel’s personal email account; the article says the attack was in retaliation for the seizure of domains linked to the group.ShinyHuntersClaimed responsibility for a breach involving Rockstar Games data and published more than 70 million records, according to the article.
Malware
Lotus7. Lotus Wiper Malware Targets Venezuelan Energy Systems in Destructive Attack – The Hacker NewsRokRAT3. North Korea’s APT37 Uses Facebook Social Engineering to Deliver RokRAT Malware – The Hacker NewsZionSiphon8. Researchers Detect ZionSiphon Malware Targeting Israeli Water, Desalination OT Systems – The Hacker News
Vendors
Apple6. Fake Ledger Live app on Apple’s App Store stole $9.5M in crypto – Bleeping ComputerMicrosoft5. Iran-Linked Password-Spraying Campaign Targets 300+ Israeli Microsoft 365 Organizations – The Hacker NewsQihooIt can also avoid being detected by security tools like Qihoo’s 360 Total Security while hiding its malicious activity within normal-looking traffic.Rockwell Automationtechnology (OT) devices, including programmable logic controllers (PLCs) manufactured by Rockwell Automation/Allen-Bradley.“ Specifically, the activity has caused PLC disruptions across multiple U.S.ZohoThe malware uses Zoho WorkDrive as a control server.
Products
360 Total SecurityIt can also avoid being detected by security tools like Qihoo’s 360 Total Security while hiding its malicious activity within normal-looking traffic.Allen-Bradley PLCsThese attacks have targeted Rockwell Automation and Allen-Bradley PLCs used in government facilities, water and wastewater systems, and the energy sector.Apple App StoreA fake Ledger Live App, available via the Apple App Store, has stolen $9.5 million in cryptocurrency from 50 victims.Facebook3. North Korea’s APT37 Uses Facebook Social Engineering to Deliver RokRAT Malware – The Hacker NewsGrand Theft Auto Online“in-game revenue and purchase metrics, player behavior tracking, and game economy data for Grand Theft Auto Online and Red Dead Online.” Read here.Ledger Live6. Fake Ledger Live app on Apple’s App Store stole $9.5M in crypto – Bleeping ComputerMicrosoft 365 Apps for Enterprise5. Iran-Linked Password-Spraying Campaign Targets 300+ Israeli Microsoft 365 Organizations – The Hacker NewsRed Dead Onlinepurchase metrics, player behavior tracking, and game economy data for Grand Theft Auto Online and Red Dead Online.” Read here.TelegramUsing two separate accounts the threat actor employed a pretexting tactic, pretending to share encrypted PDF files with technical details about military weapons via Facebook Messenger or Telegram.Zoho WorkDriveThe malware uses Zoho WorkDrive as a control server.
Tools
Countries
Iran1. Iran-Linked Hackers Disrupt U.S. Critical Infrastructure by Targeting Internet-Exposed PLCs – The Hacker NewsIsraelCheck Point Researchers are tracking an ongoing password-spraying campaign that targets Microsoft 365 environments primarily in Israel and the UAE.North Korea3. North Korea’s APT37 Uses Facebook Social Engineering to Deliver RokRAT Malware – The Hacker NewsVenezuelaLotus, a data-wiping malware, was uploaded to a publicly accessible platform in December 2025 and subsequently used in targeted attacks against energy and utilities organizations in Venezuela.
Industries
Critical infrastructure1. Iran-Linked Hackers Disrupt U.S. Critical Infrastructure by Targeting Internet-Exposed PLCs – The Hacker NewsEnergyThese attacks have targeted Rockwell Automation and Allen-Bradley PLCs used in government facilities, water and wastewater systems, and the energy sector.GovernmentThese attacks have targeted Rockwell Automation and Allen-Bradley PLCs used in government facilities, water and wastewater systems, and the energy sector.medical technologyThe attack was carried out in retaliation for the FBI’s seizure of Handala-linked domains after its earlier cyberattack on medical technology company Stryker.Water and wastewaterThese attacks have targeted Rockwell Automation and Allen-Bradley PLCs used in government facilities, water and wastewater systems, and the energy sector.Water treatment and desalinationThe malware, ZionSiphon, was designed to target Israeli water treatment and desalination systems.