← Cybersecurity Headlines
Cybersecurity Headlines
US healthcare breach affects 140k, experts warn against replicating humans, Shai-Hulud-like worm targets devs
00:08:17
Loading summary
Transcript3 lines
- [00:00]
A
From the CISO series. It's Cybersecurity Headlines
- [00:07]
B
these are the cybersecurity headlines for Tuesday, February 24, 2026. I'm Sara Lane 140,000 affected by US healthcare breach Nearly 140,000 people were affected by a data breach tied to South Carolina based VCOR Scientific and now rebranded as Vanta Diagnostics, According to the U.S. department of Health and Human Services. The Everest Ransomware Group claimed responsibility for the incident, but the reach appears to have originated at Catalyst rcm, a revenue cycle management provider that detected compromised credentials in its file management system. Exposed data included names, dates of birth, payment card details, medical information and health insurance information. Data Advocates warn against Replicating humans Data protection authorities from 61 countries, including many across Europe, also Canada, South Korea, the uae, Mexico, Argentina and Peru are warning generative AI companies to prevent systems from creating realistic images or videos of identifiable people without consent. This follows backlash over the Grok chatbot generating millions of notified images of real individuals. The regulators want safeguards against non consensual intimate imagery, defamatory content, cyberbullying and child exploitation. UK Prime Minister Keir Starmer also announced plans to require platforms to remove non consensual intimate images within 48 hours or face fines of up to 10% of global revenue. Shai Huluud like Worm targets Developers Researchers at Socket uncovered a supply chain worm dubbed SanWormMode, spreading through at least 19 malicious npm packages. Published under two aliases, it uses typo squatting to mimic popular Node, JS and AI development tools executing hidden multi stage payloads that steal developer and CI credentials, CryptoKeys and API tokens. It also targets AI coding assistance by injecting rogue MCP servers into tools like Claude, desktop, cursor and vscode. Continue harvesting secrets from local environments. NPM, GitHub and Cloudflare have removed the malicious infrastructure and affected developers are advised to rotate credentials and audit repositories and CI workflows. Suspected Anonymous members Detained in Spain Spanish police arrested four suspected members of Anonymous Phoenix for allegedly launching DDoS attacks against government ministries, political parties and public institutions following the deadly 2024 Dana floods, which killed more than 230 people. The group claimed the government was responsible for mishandling the disaster. Authorities seized the group's X, YouTube and Telegram accounts and said several attacks were successful. Huge thanks to our sponsor, Adaptive Security. This episode is brought to you by Adaptive Security, the first security awareness platform built to stop AI powered social engineering. Today's phishing doesn't just hit inboxes, it can sound like your CFO or look like your CEO on Zoom. AI, voice, video and deep fakes are turning trust into the attack surface. Adaptive fights back with AI driven risk scoring deepfake simulations featuring your own executives and interactive training your team will actually Remember. Take a three minute tour or request a CEO deepfake demo at adaptivesecurity.com Round Cube flaws exploited in attacks CISA has added two recently patched RoundCube webmail flaws, a critical remote code execution bug, and an unauthenticated XSS vulnerability to its known exploited vulnerabilities. Catalog warning they're being actively abused in attacks federal agencies have been ordered to patch by March 13th. Roundcube is widely used via cPanel and has more than 46,000 Internet exposed instances. Its vulnerabilities have previously been targeted by cybercrime and Russia state linked groups. Fraud Investigation reveals Python Malware A fraud investigation into unauthorized PayPal transfers uncovered a sophisticated python based malware campaign involving obfuscation, disposable infrastructure and commercial hacking tools. Researchers at Secuinfra found the infection used hidden PowerShell commands to download a fake make svchost executable from infrastructure linked to Tencent, establish persistence and deploy a concealed Python environment. Memory forensics revealed heavily obfuscated payloads including XWarmrat, Htran and Cobalt strike Beacon, along with credential theft targeting browser, autofill data and crypto wallets. The system was deemed fully compromised, though the initial infection vector remains unknown. The with phishing or malicious downloads suspected Ukrainian heads to US Prison for aiding North Korean Fraud Ukrainian national Oleksandr Dudenko was sentenced to five years in US Prison for selling stolen US Identities to North Korean IT workers and helping operate laptop farms that let them secure remote jobs at US companies. Through the upworkcell.com domain, Dudenko managed 871 proxy identities and facilitated payments and access to the US financial system, letting overseas workers earn hundreds of thousands of dollars from about 40 US firms. He pleaded guilty to wire fraud, conspiracy and aggravated identity theft, agreed to forfeit more than $1.4 million and was ordered to pay restitution after being extradited from Poland. Air Cote d' Ivoire confirms cyber attack the airline Air Cote d' Ivoire confirmed it was hit by a cyber attack on February 8th after the Inc. Ransomware gang claimed it stole 208 gigabytes of data and demanded payment by February 24th. The airline said parts of its information systems were affected and that it notified French and Ivorian authorities while investigators assessed the scope of the breach flights continue to operate normally. The INC gang has previously targeted government entities and U.S. municipalities. We see third party breaches in the news all the time. Odds are most of those companies produced clean audit reports and filled in questionnaires. If all of that didn't actually reduce risk, why are we still being consumed with this compliance theater? Busy work. That's what we're trying to answer on this week's episode of the CISO Series podcast. Look for the episode if we can't do better, at least do it faster. Wherever you get your podcasts. And if you have thoughts on the news from today or about our show in general, be sure to reach out to us@feedbackisoseries.com we'd love to hear from you. I am Sarah Lane reporting for the CISO Series. Stay safe and warm out there and we will talk to you tomorrow.
- [08:02]
A
Cybersecurity headlines are available every weekday. Head to CISO series.com for the full stories behind the headlines sat.