cyber.hendryadrian.com
Security News · thehackernews.com

ThreatsDay roundup covers CEO-targeted phishing kits, 5,000 compromised Dropbox accounts and more

· Original article ↗

Summary

The ThreatsDay roundup covers Teams-based impersonation and remote access, ransomware and phishing services, about 5,000 compromised Dropbox accounts tied to a legacy Lenovo ID integration, alleged mass ID theft, OAuth consent phishing and software/package abuse.

Key points

  • Microsoft warned that attackers impersonating IT staff through Teams used remote access tools to install malware and move through victim networks. A related operation, Spring Ring, targeted more than 150 employees across at least 10 companies.
  • Sophos said The Gentlemen ransomware operation claimed 683 victims by the end of July 2026 and described affiliates using privilege escalation, data theft, defense evasion, backup disruption and encryption.
  • Outsider phishing-as-a-service produced more than 700 new phishing pages in a month after law-enforcement action against related domains. BlueKit used browser-in-the-middle phishing to target financial-sector CEOs and, in selected cases, deliver ScreenConnect.
  • Dropbox disclosed that about 5,000 accounts were compromised through a legacy Lenovo ID integration affecting accounts without two-factor authentication; Dropbox terminated sessions authenticated through Lenovo ID.
  • The FBI is investigating Nexus, a service that claims to offer more than 153 million U.S. and Canadian driver’s-license scans. The service was reportedly linked to data from IDScan.net; the company said it was investigating.
  • Researchers found that Clerk’s llms.txt referenced a package name that an unknown actor had registered with code to transmit installer and machine details. Clerk has addressed the issue.
  • Other coverage included RevStealer distributed through trojanized Electron apps, attackers abusing Faronics Deploy to install ScreenConnect, and CRPx0 ransomware delivered through ClickFix.

Article Details

Event Type
Cybersecurity threat roundup covering phishing, ransomware, account compromise, malware distribution, and security changes.
Impact
Reported activity includes remote access obtained through Teams impersonation and social engineering; ransomware operations involving data theft, defense evasion, and encryption; phishing campaigns targeting executives and public figures; and about 5,000 compromised Dropbox accounts linked to Lenovo ID. Other reports describe identity-document data offered for sale, malware and payload distribution, and an npm package used to transmit installer information. The article does not provide an overall impact estimate.

Indicators of compromise

TypeIndicatorContext
DOMAINwww[.]mxsetuplogi[.]comCounterfeit site used to distribute a fake privacy browser that simulated mouse and keyboard input on victims' machines.

MITRE ATT&CK

T1021.006 · Windows Remote ManagementThe Teams intrusion campaign pivoted across the enterprise over Windows Remote Management.T1059.001 · PowerShellThe Teams intrusion campaign used PowerShell to download and silently install a malicious MSI package.T1105 · Ingress Tool TransferThe reported campaigns downloaded additional payloads using scripts and malicious installers.T1113 · Screen CaptureThe Teams intrusion campaign periodically captured screenshots of victims' desktops.T1219 · Remote Access ToolsAttackers used remote monitoring and management software and ScreenConnect to obtain or maintain remote access to compromised endpoints.T1486 · Data Encrypted for ImpactRansomware operations described in the article encrypted victim files.T1490 · Inhibit System RecoveryThe Gentlemen ransomware affiliates disrupted backups before deploying ransomware.T1557 · Adversary-in-the-MiddleA Teams vishing operation escalated to an NTLM relay attack aimed at an organization's domain controller.T1562.001 · Disable or Modify ToolsThe Gentlemen ransomware affiliates used defense evasion and BYOVD-based EDR killers; SnowKiller was also described as terminating security software.T1566.002 · Spearphishing LinkReported campaigns sent malicious links through messages, including SMS phishing and links presented as file-sharing or event invitations.T1566.004 · Spearphishing VoiceAttackers used voice phishing, including calls impersonating IT help desk personnel, to coerce victims into running remote-access tools or malware.T1574.002 · DLL Side-LoadingA tax-themed campaign used a hidden malicious DLL alongside a legitimate signed executable to load malicious code.

People

Alon HertzResearcher quoted about registering package names found in llms.txt files and embedding phone-home callbacks.Brian KrebsSecurity journalist whose reporting described the Nexus identity-document service.Kaveh AzarhooshWhisper Security researcher quoted about infrastructure associated with Prince of Persia.

Threat Actors

ChenLunThreat actor identified as the operator of the Outsider phishing-as-a-service platform.GOLD SHERWOODName Sophos uses to track The Gentlemen ransomware operation.Prince of PersiaIranian hacking group reported to operate malware families used to profile victims and harvest sensitive data.The GentlemenRansomware operation reported by Sophos to have claimed 683 victims by the end of July 2026.ThorGroup tracked by F6; VantaCore is assessed by F6 to be its rebranding.VantaCoreRansomware group reported to have targeted at least seven Russian companies.

Malware

FoudrePrince of Persia (aka Indy), a little-known Iranian hacking group known for deploying malware families, Foudre and Tonnerre, to profile victims and harvest sensitive data from high-value targets.RevStealerIt also highlights active threats including The Gentlemen ransomware, Outsider phishing-as-a-service, Nexus ID theft, RevStealer, BlueKit, CRPx0, and abuse tied to Lenovo ID, Dropbox, Faronics Deploy, and Clerk.SnowKillerVantaCoreRAT, a backdoor that can harvest information about infected systems and execute commands, and SnowKiller, which can terminate security software using the BYOVD technique.TonnerrePersia (aka Indy), a little-known Iranian hacking group known for deploying malware families, Foudre and Tonnerre, to profile victims and harvest sensitive data from high-value targets.VantaCoreLoaderAlso put to use in the attacks are VantaCoreLoader, to distribute the ransomware and other malicious programs, VantaCoreRAT, a backdoor that can harvest information about infected systems and execute commands, andVantaCoreRATto use in the attacks are VantaCoreLoader, to distribute the ransomware and other malicious programs, VantaCoreRAT, a backdoor that can harvest information about infected systems and execute commands, and SnowKiller,

Vendors

ClerkIt also highlights active threats including The Gentlemen ransomware, Outsider phishing-as-a-service, Nexus ID theft, RevStealer, BlueKit, CRPx0, and abuse tied to Lenovo ID, Dropbox, Faronics Deploy, and Clerk.DropboxIt also highlights active threats including The Gentlemen ransomware, Outsider phishing-as-a-service, Nexus ID theft, RevStealer, BlueKit, CRPx0, and abuse tied to Lenovo ID, Dropbox, Faronics Deploy, and Clerk.FaronicsIt also highlights active threats including The Gentlemen ransomware, Outsider phishing-as-a-service, Nexus ID theft, RevStealer, BlueKit, CRPx0, and abuse tied to Lenovo ID, Dropbox, Faronics Deploy, and Clerk.IDScan.netAccording to independent security journalist Brian Krebs, the service is said to be siphoning images collected by a widely used identity verification company called IDScan.net based in Louisiana.LenovoIt also highlights active threats including The Gentlemen ransomware, Outsider phishing-as-a-service, Nexus ID theft, RevStealer, BlueKit, CRPx0, and abuse tied to Lenovo ID, Dropbox, Faronics Deploy, and Clerk.MicrosoftMicrosoft warned of attackers using Teams to impersonate IT staff and gain remote access.

Products

ClerkIt also highlights active threats including The Gentlemen ransomware, Outsider phishing-as-a-service, Nexus ID theft, RevStealer, BlueKit, CRPx0, and abuse tied to Lenovo ID, Dropbox, Faronics Deploy, and Clerk.Dropbox DocSendIt also highlights active threats including The Gentlemen ransomware, Outsider phishing-as-a-service, Nexus ID theft, RevStealer, BlueKit, CRPx0, and abuse tied to Lenovo ID, Dropbox, Faronics Deploy, and Clerk.Faronics DeployIt also highlights active threats including The Gentlemen ransomware, Outsider phishing-as-a-service, Nexus ID theft, RevStealer, BlueKit, CRPx0, and abuse tied to Lenovo ID, Dropbox, Faronics Deploy, and Clerk.Lenovo IDIt also highlights active threats including The Gentlemen ransomware, Outsider phishing-as-a-service, Nexus ID theft, RevStealer, BlueKit, CRPx0, and abuse tied to Lenovo ID, Dropbox, Faronics Deploy, and Clerk.Microsoft TeamsMicrosoft has warned of a human-operated intrusion campaign that leverages Microsoft Teams external collaboration to impersonate IT or help desk personnel and socially engineer users into granting an interactive remoteMicrosoft Windowsperiodically captures screenshots of the victim’s desktop, executes follow-on payloads through trusted Windows binaries, and pivots across the enterprise over Windows Remote Management (WinRM) toward high-valueScreenConnectflow, selected victims were moved into a fake document-viewer workflow that delivered a legitimate ScreenConnect client configured for an attacker-used ScreenConnect cloud instance.” The service advertises access at

Countries

Canadaand Canada. According to independent security journalist Brian Krebs, the service is said to be siphoning images collected by a widely used identity verification company called IDScan.net based in Louisiana.IndiaA government-themed tax notice campaign is targeting recipients through U.A.E.- and India-themed tax assessment lures to persuade them to open a malicious disc image.U.A.E.A government-themed tax notice campaign is targeting recipients through U.A.E.- and India-themed tax assessment lures to persuade them to open a malicious disc image.UkrainePro-Ukraine Ransomware RebrandUnited StatesThe U.S. Federal Bureau of Investigation (FBI) is investigating a new ID theft service called Nexus, which claims to have digital scans of over 153 million driver’s licenses from people in the U.S.

Industries

DefenseThe Gentlemen ransomware operation combined privilege escalation, data theft, and defense evasion.GovernmentA government-themed tax notice campaign is targeting recipients through U.A.E.- and India-themed tax assessment lures to persuade them to open a malicious disc image.MediaThe activity has targeted government officials, media, and other publicly known personalities on a commercial messaging application (CMA), urging them to access a malicious link under the guise of a file-sharing service

Related Articles