In today’s cybersecurity news…

European hospitality blue screen of death

Securonix researchers say suspected Russian hackers are targeting European hotels with a malware campaign, PHALT#BLYX, that uses a fake Windows “Blue Screen of Death” to deliver DCRat malware. It starts with phishing emails posing as booking-site reservation cancellations, often listing charges above €1,000 to create urgency, then pushes victims through fake browser errors that prompt them to paste malicious commands. The malware disables defenses, steals credentials and clipboard data, and maintains persistence, with Russian-language debug strings, infrastructure geolocated to Russia, and DCRat’s sale on Russian underground forums pointing to that Russian link. (The Record)

Brightspeed investigates breach

Brightspeed, a major U.S. fiber broadband provider serving rural and suburban areas across 20 states, says it is investigating breach and data theft claims made by the Crimson Collective extortion group. The hackers allege they stole personal and account data tied to more than 1 million customers, including contact details, account and session information, payment history, limited card data, and appointment records. Brightspeed confirmed it’s probing a potential cybersecurity incident but hasn’tt verified the claims. (BleepingComputer)

Convicted Bitfinex launderer freed 

Ilya Lichtenstein, who pleaded guilty to laundering billions in bitcoin stolen in the 2016 Bitfinex hack, has been released from prison just more than a year into a five-year sentence handed down in late 2024. Lichtenstein said his early release was due to the First Step Act, a bipartisan prison reform law. Officials say he served significant time and is now on home confinement. The hack led to a record $3.6 billion bitcoin seizure. (CyberScoop)

Hackers target Ukrainian military, government with Viber

The 360 Threat Intelligence Center reports that Russia-aligned hackers are targeting Ukrainian military and government entities by using the Viber messaging app to deliver malware, The campaign sends malicious ZIP files containing Windows shortcut files disguised as Word and Excel documents, which deploy Hijack Loader and ultimately install Remcos RAT for espionage and data theft. Researchers say the group has escalated its tactics by abusing messaging platforms like Viber, Signal, and Telegram to evade detection and maintain persistent access. (The Hacker News)

Huge thanks to our sponsor, Hoxhunt

Cyberattack unlikely over Greece grounded flights

Greek authorities say a radio communications failure that shut down the country’s airspace for several hours Sunday probably wasn’t a cyberattack, though investigations are ongoing. Flights were grounded, diverted, or delayed after noise disrupted all air traffic control channels, including backups, affecting about 120 flights at Athens and Thessaloniki airports and stranding thousands of passengers. Officials have launched multiple probes and formed a multi-agency investigative committee. Air traffic controllers renewed calls to replace outdated equipment. (SecurityWeek)

Kimwolf infects more than 2 million devices

New research from Synthient says the Kimwolf Android botnet has now infected more than 2 million devices, expanding on December reports that first tied it to the AISURU botnet and record-setting DDoS attacks. Investigators say Kimwolf is being actively monetized through residential proxy sales, app-install fraud, and DDoS-for-hire, with about 12 million unique IPs observed weekly. The update also links infections to exposed Android Debug Bridge services and pre-infected Android TV boxes, and confirms recent abuse of China-based proxy provider IPIDEA infrastructure before a late-December patch. (Security Affairs)

Critical ‘MongoBleed’ bug under attack

Attackers are actively exploiting a critical MongoDB vulnerability dubbed “MongoBleed” that lets unauthenticated remote attackers leak server memory and steal cleartext credentials, tokens, and sensitive data. Exploitation began around December 29th, just days after proof-of-concept code was published, prompting CISA to confirm in-the-wild attacks. The flaw affects multiple MongoDB versions when zlib compression is enabled, and security vendor Rapid7 warns that organizations need to patch and rotate exposed credentials. MongoDB urges immediate upgrades or disabling zlib compression. (Dark Reading)

New Zealand reviews ManageMyHealth cyberattack

New Zealand’s health minister has ordered a government review into a cyberattack on patient portal provider ManageMyHealth, after a breach potentially exposed data tied to more than 100,000 patients. The platform is used nationwide and manages records for about 1.85 million people, with an estimated 6–7% affected. The attacker, using the alias “Kazu,” has claimed to steal more than 428,000 files and is demanding a $60,000 ransom, threatening to release the data publicly. ManageMyHealth says the incident is contained and is working with law enforcement and cybersecurity experts to determine what data was accessed or downloaded. (The Register)