Top stories.
- Russian threat actor targets US civil engineering firm.
- FBI says $262 million has been stolen in account takeover scams this year.
- HashJack attack tricks AI browser assistants.
- London councils disrupted by cyberattacks.
Russian threat actor targets US civil engineering firm.
The Russia-aligned threat actor "RomCom" used the SocGolish to breach a US-based civil engineering company that had done work for Ukraine, according to researchers at Arctic Wolf. While SocGolish is operated by a criminal malware-as-a-service group, Arctic Wolf "assesses with a medium-to-high confidence level that Russia’s GRU unit 29155 is utilizing SocGholish to target victims."
The researchers note, "This SocGholish activity demonstrates the ongoing exploitation of compromised legitimate websites as a malware delivery framework, turning routine web browsing into a potential vector for ransomware access. Even a single interaction with a malicious fake update prompt can provide threat actors with an entry point that may escalate into full network compromise, data theft, and ransomware deployment, posing a significant risk to organizations globally."

