Daily Briefing for 03.31.25

At a glance.

• Oracle Health informs customers of breach.
• China-linked Earth Alux conducts cyberespionage across APAC and Latin America.
• US Justice Department seizes $8.2 million stolen in romance scams.
• 99% of healthcare organizations are running systems with known exploited vulnerabilities.

Oracle Health informs customers of breach.

Oracle Health (formerly Cerner), a provider of SaaS products for the healthcare sector, has sent breach notifications informing customers that a threat actor stole patient data from legacy servers, BleepingComputer reports. The notifications state, "We are writing to inform you that, on or around February 20, 2025, we became aware of a cybersecurity event involving unauthorized access to some amount of your Cerner data that was on an old legacy server not yet migrated to the Oracle Cloud."

The company hasn't publicly acknowledged the breach. Bloomberg says the hackers stole data in an attempt to extort medical providers, and the FBI is investigating the incident.

China-linked Earth Alux conducts cyberespionage across APAC and Latin America.

Trend Micro describes cyberespionage activity by the China-linked APT "Earth Alux," noting that the threat actor is targeting the government, technology, logistics, manufacturing, telecommunications, IT services, and retail sectors across the Asia-Pacific and Latin America. The group typically gains initial access by exploiting vulnerabilities in exposed servers, then deploys its primary backdoor, dubbed "VARGEIT." Earth Alux then maintains long-term undetected access while exfiltrating "high-value and sensitive information."

US Justice Department seizes $8.2 million stolen in romance scams.

The US Justice Department has seized $8.2 million worth of cryptocurrency stolen via romance baiting scams (also known as "pig butchering"). One victim from Ohio lost over $650,000 to the scam after liquidating her retirement account. When the victim was unable to send even more money, the scammers began threatening her family. The DOJ's seizure opens a pathway for victims to get their money back.

Blockchain intelligence firm TRM Labs, which assisted in the investigation, explained, "What makes this case particularly notable is the dual legal theory used in the complaint. Funds directly traceable to fraud were forfeited under 18 U.S.C. 981(a)(1)(C) (wire fraud), and remaining funds — likely tied to additional unknown victims — were seized under 18 U.S.C. § 981(a)(1)(A) as property involved in money laundering. This allowed the DOJ to seize the full USD 8.2 million, preventing the fraudsters from recovering any portion of it, and preserving the ability to provide restitution to other victims as the investigation expands."

99% of healthcare organizations are running systems with known exploited vulnerabilities.

Claroty's Team82 researchers have published a report on cybersecurity in the healthcare sector, finding that 99% of healthcare organizations have systems with known exploited vulnerabilities (KEVs). 96% of these vulnerabilities are linked to active ransomware campaigns, which the researchers note can be particularly damaging to hospitals. Team82 notes, "A large percentage of the organizations that are managing these at-risk devices also have insecurely connected these devices to the internet. Connected devices are an increasingly indispensable necessity in healthcare, and organizations must understand the ramifications of insecure access. From our data, 93% of organizations have confirmed KEVs and insecure internet connections for [internet-of-medical-things devices]."