Orange Group confirms breach after hacker posts alleged stolen data.

Summary

By the CyberWire staff

At a glance.

Orange Group confirms breach after hacker posts alleged stolen data.
Chinese APT targets healthcare firms with Trojanized medical applications.
North Korean hackers tied to $1.5 billion cryptocurrency theft.

Orange Group confirms breach after hacker posts alleged stolen data.

French telecom giant Orange Group has confirmed a breach after a threat actor posted on an underground forum offering to sell thousands of internal documents allegedly stolen from the company, BleepingComputer reports. The hacker said most of the data is from the Romanian branch of the company and includes "380,000 unique email addresses, source code, invoices, contracts, customer and employee information."

Orange told BleepingComputer in a statement, "We took immediate action, and our top priority remains protecting the data and interests of our employees, customers, and partners. There has been no impact on customers’ operations, and the breach was found to occur on a non-critical back office application."

Stop Identity-Based Cybercrime with SpyCloud’s Holistic Identity Threat Protection

Stolen identity data is the hot commodity for cybercriminals. With the full scope of your users’ digital footprints at risk for exposure, traditional account-centric security is no longer enough to protect your business from cyberattacks. SpyCloud helps security teams correlate and automatically remediate individuals' hidden identity exposures from breaches, malware, and phishing across their many online personas. Eliminate identity-based cyber threats and proactively defend against account takeover, fraud, and ransomware with SpyCloud.

Chinese APT targets healthcare firms with Trojanized medical applications.

Forescout warns that a Chinese APT tracked as "Silver Fox" is targeting healthcare organizations with malware disguised as the Philips DICOM viewer, a popular software for viewing medical images. The Trojanized viewers are designed to "infect victim systems with a backdoor (ValleyRAT) for remote access and control, a keylogger to capture user activity and credentials, and a crypto miner to exploit system resources for financial gain."

Forescout notes, "While these DICOM viewers likely target patients rather than hospitals directly, as patients often use these applications to view their own medical images, the risk to [Healthcare Delivery Organizations] remains significant. In scenarios where patients bring infected devices into hospitals for diagnosis, or emerging scenarios, such as hospital-at-home programs, which rely on patient-owned technology, these infections could spread beyond individual patient devices, allowing threat actors to potentially gain an initial foothold within healthcare networks."

Many Voices. One Community.

Join Us at the RSAC 2025 Conference. Join us at RSAC, April 28 - May 1 in San Francisco and gain access to cybersecurity innovators, expert-led sessions, and hands-on workshops. Leave with new strategies, insights, and connections to elevate your cybersecurity journey.

North Korean hackers tied to $1.5 billion cryptocurrency theft.

North Korea's Lazarus Group has been tied to the theft of $1.5 billion worth of Ethereum from the Bybit cryptocurrency exchange, the Record reports. Blockchain intelligence company TRM Labs stated with "high confidence" that North Korean hackers were responsible "based on substantial overlaps observed between addresses controlled by the Bybit hackers and those linked to prior North Korean thefts." Researchers at Elliptic have attributed the hack to Pyongyang's Lazarus Group, stating in a report that the hackers are currently attempting to launder the money.

The hack, which occurred last Friday, was the largest theft of cryptocurrency in history. TRM notes, "In a single day North Korea's hackers nearly doubled the amount they stole in 2024 (roughly $800 million)." Elliptic adds that "this incident is almost certainly the single largest known theft of any kind in all time, a record previously held by Saddam Hussein, who stole $1 billion from the Iraqi Central Bank on the eve of the 2003 Iraq War."

Notes.

Today's issue includes events affecting China, France, the Democratic People's Republic of Korea, and the United States.

Attacks, Threats, and Vulnerabilities

Ghostwriter | New Campaign Targets Ukrainian Government and Belarusian Opposition (SentinelOne) Latest Ghostwriter campaign brings Belarusian opposition into its sights for the first time as it continues weaponizing XLS docs to drop malware.

Dragos: Surge of new hacking groups enter ICS space as states collaborate with private actors (CyberScoop) States are increasingly collaborating with cybercriminal groups to share resources and amplify attacks on critical infrastructure in rival nations, a new report finds.

Trends

Threat Actors Are Moving Faster Than Ever (SonicWall) SonicWall today released the 2025 SonicWall Annual Cyber Threat Report, revealing a continued onslaught of cyberattacks on small and mid-sized businesses (SMBs).

Marketplace

CrowdStrike and AWS Select 36 Startups for 2025 Cybersecurity Accelerator, with Support from NVIDIA (BusinessWire) Startups across the U.S., Israel and Europe to receive mentorship, technical support and go-to-market guidance to drive AI and cloud security innovation

RAD Security Raises $14 Million in Series A to Launch AI-Driven Cybersecurity Platform (EIN Presswire) New Funding Supports Go To Market Expansion, Partnerships, and AI Security Initiatives

SailPoint Appoints Chandra Gnanasambandam as EVP of Product and Chief Technology Officer (BusinessWire) Senior McKinsey executive brings proven track record in software and tech product and business execution

Products, Services, and Solutions

OPSWAT’s MetaDefender Optical Diode Achieves C1D2 Certification, Enhancing Safety and Cybersecurity in Hazardous Environments (OPSWAT) MetaDefender Optical Diode’s C1D2 Certification Sets a New Standard for Cybersecurity and Safety in Hazardous Industries

Snyk Launches Secure Developer Program, Deepening Investment in Open Source Ecosystem to Improve Global Cybersecurity Posture (GlobeNewswire News Room) New Program Offers Open Source Community Members Access to Enterprise-Level Platform and Expertise...

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

The Business of Space Conference (Huntsville, Alabama, Feb 23 - 25, 2025) Engage with top academics, business leaders, innovators, and policy influencers working on the new space economy. Dive into keynote presentations and discussions that foster collaboration between researchers and space economy industry stakeholders. These conversations will present the latest insights into the new space economy and shape future academic and policy research.

GovMilSpace (Washington, DC, USA, Mar 10 - 13, 2025) Demystify the future of space technology. In alignment with the SATELLITE Conference & Exhibition, GovMilSpace brings together government and military agencies, the intelligence community, and satellite and space industry partners to explore how private industry can enhance critical missions for the U.S. and its global allies.

Satellite 2025 (Washington, DC, USA, Mar 10 - 13, 2025) For 40+ years SATELLITE has gathered the global space and satellite communities for four immersive days of enterprise, insights, and innovation. This year, with the debut of GovMilSpace, SATELLITE expands its reach to address the needs and priorities of the defense sector.

WICYS 2025 (Dallas and Virtual, Texas, USA, Apr 2 - 5, 2025) WiCyS 2025 is the go-to event for cybersecurity professionals, students, and organizations. The conference is the flagship event to recruit, retain and advance women in cybersecurity.

40th Space Symposium (Denver and Virtual, Colorado, USA, Apr 7 - 10, 2025) Bringing together leaders from commercial, government and military space from around the world, the Space Symposium provides a forum to discuss, address and plan for future achievements in space. The Space Symposium program delivers exclusive networking and engagement opportunities with influential participants in one convenient and extraordinary venue. Space Symposium luncheons and dinners provide additional contact with influential participants.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 02.25.25

At a glance.

Orange Group confirms breach after hacker posts alleged stolen data.

Chinese APT targets healthcare firms with Trojanized medical applications.

North Korean hackers tied to $1.5 billion cryptocurrency theft.

Notes.

Attacks, Threats, and Vulnerabilities

Trends

Marketplace

Products, Services, and Solutions

Events