Daily Briefing for 08.18.25

At a glance.

• Workday discloses data breach.
• Warlock ransomware gang claims attack on telecom giant Colt.
• US Justice Department seizes nearly $3 million in cryptocurrency from alleged ransomware operator.

Workday discloses data breach.

HR software provider Workday is the latest organization to fall victim to a wave of social engineering attacks targeting Salesforce instances, BleepingComputer reports. The company didn't name Salesforce, but referred to "a recent social engineering campaign targeting many large organizations, including Workday." The company said in a press release, "We recently identified that Workday had been targeted, and threat actors were able to access some information from our third-party CRM platform. There is no indication of access to customer tenants or the data within them. We acted quickly to cut the access and have added extra safeguards to protect against similar incidents in the future. The type of information the actor obtained was primarily commonly available business contact information, like names, email addresses, and phone numbers, potentially to further their social engineering scams."

BleepingComputer notes that the ShinyHunters extortion group is behind the wave of Salesforce attacks, previously hitting Adidas, Qantas, Allianz Life, Louis Vuitton, Dior, Tiffany & Co., Chanel, and Google. The threat actor uses voice phishing attacks to trick employees into linking a malicious OAuth app to their company's Salesforce instance. Salesforce advises customers to follow its security guidance to prevent these attacks.

Warlock ransomware gang claims attack on telecom giant Colt.

Colt, a London-headquartered telecommunications giant operating in thirty countries, has disclosed that a "cyber incident" has been disrupting some of its operations over the past week, the Register reports. The disruptions began on August 12th, taking down the company's customer service portal and Voice API platforms.

Colt hasn't shared details on the nature of the attack, but the WarLock ransomware group claimed responsibility for the incident and is offering to sell stolen data for $200,000. The gang claims to have stolen a million company documents with employees' personal information and salary details. The crooks' claims are unconfirmed.

US Justice Department seizes nearly $3 million in cryptocurrency from alleged ransomware operator.

The US Justice Department has unsealed six indictments authorizing the seizure of over $2.8 million in cryptocurrency from a wallet controlled by Ianis Aleksandrovich Antropenko, who has been charged with operating the Zeppelin ransomware. The Justice Department alleges, "[T]he cryptocurrency and other assets are proceeds of (or were involved in laundering the proceeds of) ransomware activity. Those assets were laundered in various ways, including by using the cryptocurrency mixing service ChipMixer, which was taken down in a coordinated international operation in 2023. Antropenko also laundered cryptocurrency by exchanging cryptocurrency for cash and depositing the cash in structured cash deposits."