March Roundup of Trending News in Cybersecurity

Read more cybersecurity news in this edition of NetSecNews.

• 

  Jessica Owens

  MSSP Training & Development Coordinator, T2 SOC Analyst

Iran-Backed Hackers Claim Wiper Attack on Medtech Firm Stryker 

Hacktivist group Handala claims responsibility for a large-scale data-wiping cyberattack on medical technology company Stryker. The attackers say they erased data on more than 200,000 systems, servers, and mobile devices, forcing Stryker to shut down offices in 79 countries. (Krebs on Security)

“Handala is known for its hack-and-leak activity primarily by capitalizing on compromised IT-focused services to reach downstream victims. Their opportunistic use of supply chain have remained largely consistent, with newly observed NetBird deployment to tunnel traffic into the victim’s network while blending into legitimate operations. Compromised VPN accounts have been their hallmark for primary access; Though phishing campaigns, payload delivery via commercial file-sharing services, and of course abuse of legitimate management platforms like Intune have all been recently noted.” –Jessica Owens, MSSP Training and Development Coordinator at C3 Integrated Solutions

45,000 Malicious IP Addresses Taken Down in International Cyber Operation 

An international crime operation brought together law enforcement from 72 countries to dismantle over 45,000 malicious IP addresses and servers used for phishing, malware, and ransomware. (Interpol)

Storm-2561 Uses SEO Poisoning to Distribute Fake VPN Clients for Credential Theft 

Microsoft warns that threat actor Storm2561 is using SEO-poisoned search results to trick users into downloading fake, digitally signed VPN clients that steal credentials via malicious ZIPhosted trojans. The practice highlights how threat actors exploit trusted platforms, software branding, and reliance on search results to avoid user suspicion. (Microsoft Security)

Investigating a New Click-Fix Variant 

Researchers uncovered a new ClickFix variant that uses a deceptive Win+R command sequence to map an external network drive and execute a hidden batch script, ultimately deploying a trojanized WorkFlowy app as a C2 beacon and malware dropper. (TheHackerNews) 

Chrome 146 Update Patches Two Exploited Zero-Days  

Google released an emergency Chrome 146 update to patch two actively exploited zero–day flaws in the Skia graphics library and V8 JavaScript engine, urging users to update immediately to prevent potential code–execution attacks. (SecurityWeek)