The latest is a fresher version of the ransomware pro-Ukraine researcher ContiLeaks already released, but it’s reportedly clunkier code.

https://threatpost.com/conti-ransomware-v-3-including-decryptor-leaked/179006/

A ransomware attack struck Bridgestone Americas, weeks after another Toyota supplier experienced the same and a third reported some kind of cyber hit.

https://threatpost.com/bridgestone-hit-as-ransomware-torches-toyota-supply-chain/178998/

The Russian-speaking APT behind the NotPetya attacks and the Ukrainian power grid takedown could be setting up for additional sinister attacks, researchers said.

https://threatpost.com/sandworm-asus-routers-cyclops-blink-botnet/178986/

Researchers have exposed the work of Exotic Lily, a full-time cybercriminal initial-access group that uses phishing to infiltrate organizations’ networks for further malicious activity.

https://threatpost.com/google-conti-diavol-ransomware-access-broker/178981/

In the latest software supply-chain attack, the code maintainer added malicious code to the hugely popular node-ipc library to replace files with a heart emoji and a peacenotwar module.

https://threatpost.com/dev-sabotages-popular-npm-package-protest-russian-invasion/178972/

It’s about time, AttackIQ’s Jonathan Reiber said about 24H/72H report deadlines mandated in the new spending bill. As it is, visibility into adversary behavior has been muck.

https://threatpost.com/reporting-mandates-to-clear-up-feds-hazy-look-into-threat-landscape-podcast/178947/

Scammers are bypassing Apple’s App Store security, stealing thousands of dollars’ worth of cryptocurrency from the unwitting, using the TestFlight and WebClips programs.

https://threatpost.com/cryptorom-crypto-scam-side-loaded-apple-apps/178942/

CaddyWiper is one in a barrage of data-wiping cyber-attacks to hit the country since January as the war on the ground with Russia marches on.

https://threatpost.com/destructive-wiper-organizations-ukraine/178937/

The phishing scam tried to steal login credentials by threatening account shutdown, due to users having purportedly shared “fake content.”

https://threatpost.com/phony-instagram-support-staff-emails-hit-insurance-company/178929/

Denso confirmed that cybercriminals leaked stolen, classified information from the Japan-based car-components manufacturer after an attack on one of its offices in Germany.

https://threatpost.com/pandora-ransomware-hits-giant-automotive-supplier-denso/178911/

The ransomware group’s benefits – bonuses, employee of the month, performance reviews & top-notch training – might be better than yours, says BreachQuest’s Marco Figueroa.

https://threatpost.com/staff-think-conti-group-legit-employer-podcast/178903/

They’re choosing sides in the Russia-Ukraine war, beckoning previously shunned ransomware groups and thereby reinvigorating those groups’ once-diminished power.

https://threatpost.com/cybercrooks-political-in-fighting-threatens-the-west/178899/

The credential-stealing trash panda is using the chat app to store and update C2 addresses as crooks find creative new ways to distribute the malware.

https://threatpost.com/raccoon-stealer-telegram/178881/

Be careful when downloading a tool to cyber-target Russia: It could be an infostealer wolf dressed in sheep’s clothing that grabs your cryptocurrency info instead.

https://threatpost.com/malware-posing-russia-ddos-tool-bites-pro-ukraine-hackers/178864/

Let’s blame the victim. IT decision makers’ confidence about security doesn’t jibe with their concession that repeated incidents are their own fault, says ExtraHop’s Jamie Moles.

https://threatpost.com/blaming-ransomware-victims-podcast/178799/

The ever-shifting, ever-more-powerful malware is now hijacking email threads to download malicious DLLs that inject password-stealing code into webpages, among other foul things.

https://threatpost.com/qakbot-botnet-sprouts-fangs-injects-malware-into-email-threads/178845/

Also on the rise: DDoS attacks against Ukrainian sites and phishing activity capitalizing on the conflict, with China’s Mustang Panda targeting Europe.

https://threatpost.com/russian-apts-phishing-ukraine-google/178819/

While IT automation is growing, big challenges remain. Chris Hass, director of information security and research at Automox, discusses how the future looks.

https://threatpost.com/uncertain-future-it-automation/178709/

Nvidia certificates are being used to sign malware, enabling malicious programs to pose as legitimate and slide past security safeguards on Windows machines.

https://threatpost.com/nvidias-stolen-code-signing-certs-sign-malware/178784/

Notes threatening to tank targeted companies’ stock price were embedded into the DDoS ransomware attacks as a string_of_text directed to CEOs and webops_geeks in the URL.

https://threatpost.com/massive-meris-botnet-embeds-ransomware-notes-revil/178769/