At a glance.
- Qantas discloses breach affecting up to 6 million customers.
- France describes hacking campaign targeting Ivanti appliances.
- US sanctions bulletproof hosting provider.
Qantas discloses breach affecting up to 6 million customers.
Australian airline Qantas has disclosed a data breach affecting up to 6 million customers, Reuters reports. The airline said a cybercriminal "targeted a call centre and gained access to a third party customer servicing platform," which contained customer names, email addresses, phone numbers, birth dates, and frequent flyer numbers. Qantas says it's "continuing to investigate the proportion of the data that has been stolen, though we expect it will be significant." The incident hasn't affected the airline's operations or safety.
The US FBI warned last week that the Scattered Spider cybercriminal group was targeting airlines, though Qantas hasn't attributed the attack to any particular threat actor. Scattered Spider typically gains initial access via social engineering attacks against organizations' help desks. The group is believed to be responsible for recent attacks on WestJet and Hawaiian Airlines.
France describes hacking campaign targeting Ivanti appliances.
France's cybersecurity agency, ANSSI, said yesterday that multiple government, utility, and private sector entities were hacked last year in a campaign targeting zero-days affecting Ivanti’s Cloud Service Appliance, the Record reports. ANSSI believes the campaign is connected to the China-based threat actor UNC5174, noting that the group may be an initial access broker. The agency says the threat actor "might correspond to a private entity, selling accesses and worthwhile data to several state-linked bodies while seeking its own interests leading lucrative-oriented operations."
The exploited vulnerabilities, which were disclosed last year, are tracked as CVE-2024-8190, CVE-2024-8963, and CVE-2024-9380.
US sanctions bulletproof hosting provider.
The US Treasury Department has sanctioned Aeza Group, a Russia-based bulletproof hosting provider that allegedly provides services for ransomware gangs, online drug markets, and Russian disinformation campaigns, BleepingComputer reports. Treasury says the hosting provider offered services for the Meduza, RedLine Lumma infostealer operators, as well as the BianLian ransomware and the BlackSprut drug marketplace.
Three of Aeza Group's operators, including its CEO, were arrested by Russian authorities in April on drug trafficking charges.
