In today’s cybersecurity news…
250,000 affected by data breach at Texas hospital
The incident occurred at Nacogdoches Memorial Hospital (NMH) in the city of Nacogdoches, Texas, on January 31. Hospital representatives state that a threat actor hacked into its internal network and information systems and “likely accessed the information of 257,073 individuals,” with potentially compromised data including standard PII as well as medical record numbers, account numbers, health plan beneficiary numbers, and photographs. The hospital has not named any potential suspects, nor have any claims yet been made.
CISA says, “patch Citrix NetScaler bug by Thursday”
Following up on a story we covered this week, CISA has now ordered federal agencies to patch the CVE numbered bug (CVE-2026-3055) by Thursday, since reports of exploitation emerged over the weekend. This vulnerability impacts Citrix NetScaler application delivery controllers used to manage traffic and authentication. It carries a severity score of 9.3 out of 10 and has the hallmarks of CitrixBleed and Citrix Bleed Two.
Researchers uncover mining operation using ISO lures
Researchers from Elastic Security are warning of a financially motivated operation codenamed REF1695 which has been leveraging fake installers to deploy remote access trojans and cryptocurrency miners since November 2023. In addition to cryptomining, the threat actor “monetizes infections through “Cost Per Action” fraud, directing victims to content locker pages under the guise of software registration.” These attacks leverage an ISO file as the infection vector to bypass Microsoft Defender SmartScreen protections. A link to more details about this multilevel attack technique is available in the show notes to this episode.
New Storm infostealer remotely decrypts stolen credentials
This warning comes from security researchers at Varonis who say this new stealer malware harvests browser credentials, session cookies and crypto wallets. Daniel Kelley, a senior security consultant at Varonis, says this new infostealer represents a shift in how credential theft is developing. Whereas traditional infostealers used to decrypt browser credentials on the victim’s machine, endpoint security tools adapted to flag such malicious behavior. Storm instead sends encrypted files to its own infrastructure instead of decrypting them locally. It is available for enterprising cybercriminals for less than $1000 per month.
Huge thanks to our sponsor, ThreatLocker
UK Security center warns of hackers increasing WhatsApp and Signal attacks
This warning comes from the National Cyber Security Centre (NCSC) based in the UK, which has seen “growing malicious activity from Russia-based actors using messaging apps to target high-risk individuals.” This includes people working in government and politics, academia, journalism and the legal profession. This has been an ongoing story for quite a while, but this March 31 report from the NCSC raises the stakes a little by both confirming the increase in activity and also adding China state-affiliated group APT31 and hackers linked to Iran’s Islamic Revolutionary Guard Corps to the activities.
Criminals exploit vacant homes in hybrid cybercrime technique
Online fraud tutorials are now teaching hackers how to exploit publicly available data, weak identity verification processes, and operational gaps to “identify and exploit vacant residential properties to intercept sensitive mail for the purposes of enabling identity theft and financial fraud. These real residential temporarily unoccupied properties can be used to receive mail without immediately alerting the rightful occupants. In the tutorial, threat actors learn how to search real estate platforms such as Zillow, Rightmove, or Zoopla, filtering for recently listed rental properties as well as older listings to identify properties “that have remained unoccupied for extended periods, increasing their reliability as drop locations. In some cases, threat actors even recommend physically maintaining abandoned properties to make them appear occupied, reducing the risk of drawing attention while using the address for fraudulent purposes.”
Nissan says stolen data came from third-party vendor
Japanese automaker Nissan has stated that “recent claims of a data breach were related to information held by a third-party vendor.” This follows an announcement from the Everest hacking group which said it had “breached the file transfer system used by a company that offers services to Nissan and Infiniti dealerships across North America.” From this it claims to be in possession of 910 gigabytes of stolen data, including information on customers, dealerships and loans offered to car buyers. Nissan reiterated that it had found no indication that Nissan systems were compromised or that any Nissan customer information was accessed or put at risk.
Threat actors impersonate CERT-UA to spread malware
The Computer Emergency Response Team of Ukraine (CERT-UA) has itself revealed details of a phishing campaign that once again has impersonated the agency, this time to distribute a RAT called AGEWHEEZE. The campaign was carried out by a group known as UAC-0255, and which urged recipients to install “specialized software.” These recipients include “state organizations, medical centers, security companies, educational institutions, financial institutions, and software development companies.”