Crooks phish for guests; spies phish for drone operators. ZenRAT is used in an info-stealing campaign. More MOVEit-related incidents (some involving Cl0p). DeFi platforms hit. The UK hunts forward.

An advanced phishing campaign hits hospitality industry. An information-stealing campaign deploys ZenRAT. More MOVEit-related data breaches are disclosed. Mixin Network suspends deposits and withdrawals. The OpenSea NFT market warns of third-party risk to its API. Phishing for Ukrainian military drone operators. Mr. Security Answer Person John Pescatore shares thoughts in Cisco acquiring Splunk. Ann Johnson from the Afternoon Cyber Tea podcast interviews Deb Cupp sharing a lesson in leadership. And the UK adopts a hunt-forward approach to cyber war.

Selected reading.

Luxury Hotels Major Target of Ongoing Social Engineering Attack (Cofense) 

ZenRAT: Malware Brings More Chaos Than Calm (Proofpoint) 

More MOVEit-related data breaches are disclosed. (CyberWire)

Mixin Network suspends deposits and withdrawals.  (CyberWire)

OpenSea NFT market warns of third-party risk to its API.  (CyberWire)

Threat Labs Security Advisory: New STARK#VORTEX Attack Campaign: Threat Actors Use Drone Manual Lures to Deliver MerlinAgent Payloads (Securonix) 

Ukrainian Military Targeted in Phishing Campaign Leveraging Drone Manuals (The Hacker News) 

British Army general says UK now conducting ‘hunt forward’ operations (Record)