Your Cyber Security Bulletin: Stay informed and secure

Australian healthcare provider Partnered Health has confirmed that cyber criminals stole sensitive patient information following an attack on its network, affecting 21 medical clinics across Australia.

The organisation became aware of the incident on 23 June, with investigations confirming that attackers accessed and exfiltrated personal information, including patient identities, consultation notes, medical histories and other health records. The breach has been reported to the Australian Cyber Security Centre, the Office of the Australian Information Commissioner and law enforcement, while affected patients are being notified. The incident is another reminder that healthcare organisations remain one of the most attractive targets for cyber criminals, as medical records contain highly valuable personal information that cannot simply be changed or replaced like passwords or payment cards.

📌 Learn more

Two British hackers have pleaded guilty to offences relating to the 2024 cyber attack on Transport for London, an incident now estimated to have cost around £39 million.

The breach disrupted services for several months, affected customer data and required a significant recovery effort across TfL’s IT infrastructure. The case serves as a reminder that the financial impact of a cyber attack often extends well beyond the initial compromise, with recovery, investigation and remediation frequently becoming the highest costs.

📌 Learn more

Security researchers have disclosed active exploitation of a critical vulnerability affecting ServiceNow, one of the world’s most widely used enterprise workflow platforms.

The flaw could allow attackers to gain elevated access to vulnerable customer environments if left unpatched. Organisations using ServiceNow are being urged to review vendor guidance and apply the latest security updates promptly, reinforcing the importance of keeping cloud platforms and business-critical applications fully patched.

📌 Learn more

A critical vulnerability affecting the open source AI gateway LiteLLM has been added to CISA’s Known Exploited Vulnerabilities catalogue after attackers were found actively exploiting the flaw.

The command injection vulnerability could allow an authenticated attacker to execute arbitrary commands on affected servers, with researchers warning that, in some configurations, it could potentially be chained with other weaknesses to achieve remote code execution. Organisations using AI infrastructure are advised to update affected versions without delay.

📌 Learn more

GitHub investigated unauthorised access to thousands of internal repositories after attackers compromised an employee device.

GitHub has confirmed it is investigating unauthorised access to approximately 3,800 internal repositories after an employee device was compromised through a malicious Visual Studio Code extension. The attackers are believed to have stolen internal source code, development tools and organisational data before advertising the information for sale on cybercrime forums. GitHub said there is currently no evidence that customer repositories or hosted code were affected, but the incident highlights the growing threat posed by attacks targeting software developers and the software supply chain.

📌 Learn more

Grafana Labs has revealed further details of a cyber attack that allowed threat actors to access its GitHub environment after exploiting a compromised software dependency in the TanStack npm ecosystem.

Attackers downloaded public and private source code, along with internal operational repositories and business contact information, before issuing a ransom demand. Grafana confirmed there is no evidence that customer production environments or Grafana Cloud services were compromised and has since strengthened its GitHub security controls, rotated credentials and enhanced monitoring across its development pipelines.

📌 Learn more

Cyber attacks are not just limited to Organised Crime Groups (OCGs) hacking organisations and holding them to ransom; geo-political tensions are a major contributor.

According to Hackmanac, in the week of the 8th to the 14th April, the UK surged to 3rd in the list of the most affected countries, with 25 cyber-attacks. The USA (1st, 79 attacks) and Israel (2nd, 40 attacks) were also attacked, with the current war in Iran likely having an impact.

Richard Horne, the head of the NCSC, has warned that cyber-attacks against the UK could rise should we become involved in international conflict.

📌 Learn more

UK Biobank suffered a data breach in which the anonymised health data of 500,000 participants was offered for sale on Alibaba.

Technology minister Ian Murray said that whilst names, addresses, contact details and telephone numbers are not included in the breach, the data being sold could include participants’ gender, age, month and year of birth, socioeconomic status, lifestyle habits, and measures from biological samples.

UK Biobank has reported that the listings were removed before any sales were made.

📌 Read more about the breach

A group currently being tracked as UNC6692 have been found to be impersonating IT Help Desks via Microsoft Teams to deliver custom malware.

The group, who are targeting executives and senior management, are using social engineering tactics to trick victims into initiating Teams chats. ReliaQuest reports that the attackers bombard the victims with emails, tricking the victims into installing remote monitoring and management (RMM) tools to gain initial access to the environment. Mandiant report slightly different tactics by having the victims install an ‘update’ to prevent spam emails, again providing the attackers with initial access to the environment.

Both attacks create a sense of urgency and panic, often seen in social engineering attacks, with the end goal for the attackers being to steal sensitive data from the victim.

Learn more

A cyber attack on the European Commission in March has highlighted ongoing risks across public sector infrastructure.

The breach, detected on 24 March 2026, targeted the Commission’s Europa web platform, which supports multiple EU institutions. The ShinyHunters group claimed responsibility, releasing over 90GB of data, including emails, user directories, and cloud configuration details on the dark web.

While core internal systems were reportedly unaffected, the incident shows how attackers continue to exploit cloud environments and shared platforms. The Commission has since moved to contain the breach and notify affected parties, but the scale of exposed data underlines the growing impact of credential theft and extortion-led attacks across government systems.

Learn more

New details emerged in March around one of the UK’s largest data breaches, reinforcing the long tail impact of cyber incidents.

A hacker provided the BBC with a dataset linked to the Transport for London breach, confirming that around 10 million individuals had their personal data exposed.

The data included names, addresses, and contact details, significantly exceeding earlier estimates. The attack, linked to the Scattered Spider group, shows how initial incident reports can understate the real scale of exposure. It also highlights the reputational and operational risk organisations face long after the initial breach occurs.

📌 Read more about the breach

A group currently being tracked as UNC6692 have been found to be impersonating IT Help Desks via Microsoft Teams to deliver custom malware.

The group, who are targeting executives and senior management, are using social engineering tactics to trick victims into initiating Teams chats. ReliaQuest reports that the attackers bombard the victims with emails, tricking the victims into installing remote monitoring and management (RMM) tools to gain initial access to the environment. Mandiant report slightly different tactics by having the victims install an ‘update’ to prevent spam emails, again providing the attackers with initial access to the environment.

Both attacks create a sense of urgency and panic, often seen in social engineering attacks, with the end goal for the attackers being to steal sensitive data from the victim.

Learn more

February saw active exploitation of zero-day vulnerabilities impacting government systems, with implications for UK organisations.

Attacks targeting Ivanti EPMM vulnerabilities exposed sensitive staff data, including names, emails, and phone numbers, within European government environments.

These incidents required urgent response from national agencies and reinforced a consistent pattern: attackers are moving quickly to exploit newly disclosed vulnerabilities before organisations can patch. The speed and coordination of these attacks point to a continued shift towards opportunistic, high-impact exploitation of widely used enterprise tools.

Read more

The CEO of the world’s largest Crypto Currency exchange, Coinbase, has released details of an investigation into attackers paying outsourced customer service agents to leak sensitive customer information.

Coinbase outsourced customer support to TaskUs, and a customer services agent based in India has been arrested for “joining the conspiracy by agreeing to sell highly sensitive Coinbase user data to those criminals” for $200 per record. Coinbase were subsequently hit with a ransom of $20m. The customer service agent has since been arrested, with more agents having been identified. 

This trend follows other high profile insider recruitment by attackers, including a CrowdStrike employee allegedly being paid £25,000 to provide access to their systems. Separately, a Discord subcontractor was allegedly paid £500 to provide access to Discord user data. 

Three cybersecurity professionals working in Incident Response have pleaded guilty to attacking 4 US-based companies using the now-defunct BlackCat (APLHV) ransomware-as-a-service (RaaS), demanding a total of $16.3 million.

Two of the defendants worked as ransomware threat negotiators, and the other worked as an Incident Response Manager. 

One of the negotiators became an affiliate of BlackCat, which provided them with access to the ransomware strain, with an agreement that 20% of the proceeds would be paid to BlackCat, whilst the remaining 80% was split between the three co-conspirators. 

The attackers’ companies have since released them from employment, and the attackers are due to be sentenced in the US in March and face a maximum 20-year prison sentence. 

LastPass, a password management tool, have been fined £1.2m by the Information Commissioner’s Office (ICO).

LastPass were subjected to a cyber-attack in 2022, resulting in the personal information of 1.6 million customers being stolen by the attackers, including customer names, emails, phone numbers, and stored website URLs. 

The ICO state their investigation found that LastPass “failed to implement sufficiently robust technical and security measures, which ultimately enabled a hacker to gain unauthorised access to its backup database”. 

The ICO also stated that their investigation found no evidence that encrypted passwords and other credentials were breached, as master passwords required to access the vaults are stored on the customer’s device and are not shared with LastPass. 

Salesforce suffered a major data breach attributed to a new alliance called “Scattered LAPSUS$ Hunters”, a merger of Scattered Spider, LAPSUS$, and ShinyHunters.

The group stole roughly 1 billion customer records, impacting even cybersecurity companies using the Salesforce platform.

This breach reflects a wider trend as threats are accelerating. Ransomware-as-a-Service crews like LockBit, Quilin, and DragonForce are now pooling infrastructure, tools, and tactics to boost their profits and increase the scale of their operations.

Read more here.

Cyber security firm Proofpoint have identified an attack technique whereby threat actors are able to remain inside a victims environment even after password and MFA resets. The attack leverages ‘second-party’, or internal, applications to maintain persistence by registering these legitimate OAuth services inside cloud environments.

Second-party, or internal applications, are applications that belong to your own organisation and are registered inside your cloud environment. This makes the attack more difficult to detect as the applications are legitimate, and internal applications can easily blend in. Should a compromised account have its password and MFA reset, the application still persists within the victim environment, allowing the attackers to maintain persistent access.

What you can do: To defend against this threat, organisations should regularly review second-party apps to ensure only those authorised by the business are registered. Further prevention and detection mechanisms can include limiting who within the business can register a second-party application and creating SEIM rules to detect when a new app is registered and alert your security team.

A new phishing campaign has been identified by cybersecurity researchers that uses hidden AI prompts to avoid detection. Investigations into the campaign have uncovered attackers sending password expiry notices from Gmail to trick victims into changing their passwords.

However, hidden within the email is a command that instructs email scanners to loop back during their checks instead of marking them as phishing, allowing the email to bypass filters.

The attackers are utilising SendGrid, an email service used by businesses to send marketing emails, to increase the legitimacy of their phishing emails.

What you can do: It can be difficult to defend against these types of attacks, as somewhere along the line, phishing emails will bypass email filters and users will fall victim to the attack, particularly where the attackers are targeting AI defences. User awareness is key in defending against phishing attacks, and having regular training decreases the chances of a successful attack.

Read more here.

FreeVPN[.]One, a Chrome browser extension verified on Google’s Chrome Web Store offering a ‘free VPN’ for users, has been found to contain malicious features that capture information from the user’s device and send this to an external server (aitd[.]one).

The information collected by the extension includes system information, IP geolocation, and screenshots. FreeVPN has been around since 2020, offering users a free VPN service; however, the information-capturing features were introduced in April 2025 in a phased approach.

When questioned on the information-capturing features by Koi Security, the developer claimed that screenshots are only captured for ‘suspicious’ websites; however, Koi’s investigation found that websites, including Google Sheets and Google Photos, had screenshots taken and sent to the external server.

This highlights the importance of regularly reviewing the browser extensions in use within your organisation, which can often be an overlooked process.

What you can do: Similar to approved software, maintaining a list of approved browser extensions for business devices can help reduce the risk posed by malicious extensions.

More information about this attack can be found at Kio’s website.

The threat actor groups known as Scattered Spider and ShinyHunters are alleged to have joined forces and are responsible for the recent Salesforce data breach.

ShinyHunters appear to have adopted Scattered Spider’s advanced social engineering tactics, including vishing calls, deployment of applications disguised as legitimate tools, and the use of Okta-themed credential harvesting pages to enable their attacks.

Both groups are said to be responsible for high-profile attacks, with Scattered Spider responsible for the attack on Marks and Spencer earlier this year, and ShinyHunters responsible for the Santander and Ticketmaster breaches in 2024.

Both groups should be considered an active and credible threat.

What you can do: By raising employee awareness and tightening controls around social engineering, cloud access, and credentials, businesses can take steps to mitigate the risks posed by these groups.

More information on the attacks can be found on the Hacker News website.

Cybersecurity firm CTM360 have discovered more than 15,000 fraudulent TikTok Shop domains created to steal user credentials and distribute malware. These malicious sites often use domain extensions such as .top, .shop, and .icu to appear more legitimate.

Attackers are using AI-generated videos to impersonate influencers and brand ambassadors, promoting fake offers and directing victims to these sites with promises of big discounts.

The malware involved, known as SparkKitty, targets both iOS and Android devices. It is designed to steal credentials, harvest device information, and even use optical character recognition (OCR) to scan photo galleries for cryptocurrency wallet details.

What you can do: Be cautious when buying from TikTok Shop links, particularly those advertising unusually large discounts. If an offer appears too good to be true, it likely is.

More information on the fraudulent TikTok shops can be found here.

4 UK-based suspects, aged between 17-20, have been arrested by the National Crime Agency (NCA) on suspicion of offences relating to blackmail, money laundering, and Computer Misuse Act and Serious Crime Act offences.

Although the NCA have not released any further details, it is reported that the suspects were members of the Scattered Spider threat actor group and arrested as part of the cyber-attacks that caused operational disruption to Marks and Spencer, the Co-Op, and Harrods. The attacks are estimated to have cost between £270 million – £440 million in damages.

An anonymous M&S insider revealed to Sky News (link) that the company “didn’t have a business continuity plan or cyber-attack plan”, highlighting the need for businesses to implement robust business continuity and incident response plans and testing schedules to reduce the impact of a cyber-attack and return to business as usual.

What you can do: If you are worried about the effects a cyber-attack may have on your business, our NCSC-accredited Cyber Incident Exercise (CIE) service can help you to identify gaps in your cyber-incident response and business continuity plans.

According to a report released by CTM360, 17,000 Baiting News Sites (BNS) are currently being tracked by the cyber security firm. The pages created by the threat actors are designed to look like legitimate news websites, such as the BBC and target victims who are looking to earn a passive income.

The attackers create fake news stories that have been ‘endorsed’ by celebrities, banks, and financial brands, with the end goal of luring victims into signing up to scam investment platforms and handing over their money.

The attackers will collect a ‘deposit’ from the victims to activate their account, along with other personally identifiable information (PII) which can be used in further attacks, including phishing, identity theft, and secondary fraud.

What you can do: If you are planning to invest, be aware of BNS’s purporting to be legitimate news websites, carrying clickbait headlines such as ‘you won’t believe what this celebrity just revealed’ and offering investments that appear to be too good to be true.

Telephone-Oriented Attack Delivery, or TOAD, is a social engineering method where attackers trick victims into calling them by pretending to be legitimate technical support. While the concept itself isn’t new, the tactics used are becoming increasingly sophisticated.

In a phishing campaign analysed by Cisco Talos between May and June 2025, researchers observed attackers sending spoofed PDF files. Although using malicious documents is a common tactic, the methods for gaining victims’ trust have evolved. In this instance, attackers embedded authentic QR codes within these documents that link to trusted platforms like Microsoft and DocuSign, giving the phishing attempts an air of legitimacy.

Once trust is established, the victim is then directed to call the attacker. To increase their credibility, attackers now mimic professional call centre environments by posing as customer service agents, using scripted dialogues, using hold music, and masking their caller ID through Voice over IP (VoIP). These measures make the scam appear more authentic, increasing the likelihood that the victim will comply.

The end goal of the attackers is to gain remote access to the victim’s device or steal login credentials, which can be the precursor to a much more serious cyber-attack, including data theft, card payment theft, and even ransomware.

This highlights the importance of ongoing security awareness training for employees, particularly around evolving attack methods and current cybersecurity threats.

Hackers are exploiting social media platforms to deceive users into downloading malicious software.

By capitalising on popular trends like tech hacks and free giveaways, especially on platforms such as TikTok, the attackers craft convincing videos that instruct viewers to execute specific commands on their devices.

When a user follows these instructions, they are unknowingly installing malware that grants the attacker’s unauthorised access. which can be the precursor to a much more serious cyber-attack.

What You Can Do: Stay alert to trending videos that encourage you to run commands on your device, particularly if they promise a reward or if you’re unsure what the command actually does. Always verify the source before taking any action.