Breach Roundup: Microsoft, Cloudflare Dismantle RaccoonO365

Every week, Information Security Media Group rounds up cybersecurity incidents and breaches around the world. This week, Microsoft hit RaccoonO365, outages persist at Colt Technology Services, Finland charged a U.S. citizen for his alleged role in the Vastaamo psychotherapy center hack. RevengeHotels hackers used AI, Meta can’t overturn a jury verdict in a California privacy case and Chinese hackers unleashed spear-phishing attacks. Prosper confirmed a data breach, as did luxury fashion houses Gucci, Alexander McQueen and Balenciaga.

See Also: Why Cyberattackers Love ‘Living Off the Land’

A burgeoning phishing-as-a-platform operation that specialized in targeting users of the Microsoft 365 suite of productivity software took a major hit following a federal court order permitting Microsoft to seize 338 web domains.

Microsoft and Health-ISAC, a cyberthreat intel association for the health sector, sued operators of the platform, RaccoonO365, identifying its leader as Nigerian national Joshua Ogundipe. Since July 2024, RaccoonO365’s kits have been used to steal at least 5,000 Microsoft credentials from 94 countries, the computing giant said. It told a federal judge that RaccoonO365 activist has caused it more than $650,000 in damages. The company said it identified Ogundipe after tracking a leaked crypto wallet and identifying at least $100,000 in cryptocurrency payments.

Cloudflare, which participated in the seizure of identified RaccoonO365 domains, said operators sold access to the platform on Telegram, where customers could buy a 30-day plan for $355 and a 90-day plan for $999. As of Aug. 25, the Telegram channel had 835 members.

Its operators boasted of using bulletproof hosting and offering features such as Cloudflare Turnstile CAPTCHAs and bot detection to evade security tools. RaccoonO365 operators have told customers to migrate to new domains and promised extra subscription time as compensation.

Since its launch in September 2024, RaccoonO365 has impersonated trusted brands like Microsoft, DocuSign, Adobe, SharePoint and Maersk to harvest credentials, paving the way for malware and ransomware attacks. Microsoft said the service allows customers to target up to 9,000 email addresses per day and bypass multifactor authentication. It recently added an “AI-MailCheck” feature to improve attack success rates.

The Health-ISAC said in the complaint against Ogundipe and unidentified co-conspirators that “healthcare employees are particularly vulnerable to phishing due to the high volume of emails they receive daily and the urgency often associated with their work.”

British-based multinational telecom Colt Technology Services continues to grapple with ongoing customer portal and support outages following a cyber incident that began in mid-August.

“Important foundational work in our recovery program is now complete, and we are moving at pace on the restoration of our core processes and systems, which we will bring back in a deliberate sequence,” the company said Friday, estimating that “the majority of recovery efforts” will be complete within 8 to 10 weeks.

Colt confirmed an internal system was compromised, but emphasized that customer infrastructure remains safe. Ransomware group WarLock claimed responsibility, alleging theft of around one million documents, including employee salaries, customer contact details, emails and internal executive information. The stolen data is reportedly being offered up for a $200,000 ransom.

Security researcher Kevin Beaumont verified the legitimacy of a leaked sample list of roughly 400,000 files that included performance reviews and other internal documents. Beaumont also flagged a possible attack vector: a Microsoft SharePoint vulnerability, ToolShell, associated with the sharehelp.colt.net.

Finnish prosecutors charged U.S. national Daniel Lee Newhard, 28, with aiding and abetting attempted aggravated extortion in the notorious Vastaamo psychotherapy center hack. Newhard denied the allegations and prosecutors have not confirmed if he is in custody. His case will be heard at the District Court of Western Uusimaa.

The charges come shortly after Aleksanteri Kivimäki – the primary suspect convicted of over 20,000 counts of attempted extortion – was released pending appeal. Prosecutors said Newhard’s charges focus solely on the attempted extortion of Vastaamo itself, not its patients, and dropped charges related to dissemination of stolen data, citing the disproportionate cost of prosecution.

Court filings link Newhard to a server allegedly used by Kivimäki in the hack, with logs connecting an IP address to Newhard’s Estonian residence.

Hacking group RevengeHotels is using artificial intelligence to enhance its attacks on hotels in Brazil and beyond, said Kaspersky. Active since 2015, RevengeHotels specializes in stealing payment card data from hotel guests and front-desk systems.

In its latest campaign, the group sends phishing emails disguised as invoices or job applications to hotel staff to manipulate them into opening malicious attachments. These deliver VenomRAT, a remote access trojan based on QuasarRAT, capable of stealing credentials, exfiltrating data and remotely controlling infected computers.

Kaspersky researchers said that much of the malware code appears to have been generated using large language models, resulting in more polished, well-documented code. While Brazil remains the primary target, the group is also hitting hotels and tourism firms in Mexico, Argentina, Chile, Costa Rica and Spain. Past campaigns have impacted hotels in Russia, Belarus and Turkey.

A San Francisco federal judge rejected Meta’s bid to overturn an August jury verdict finding the company liable for illegally collecting reproductive health data from millions of women through the period-tracking app Flo.

U.S. District Judge James Donato refused Meta’s request for a new trial, dismissing its argument that data gathered via Flo’s software development kit was “secondhand” and exempt from the California privacy law. Donato said evidence showed Meta was “directly acquiring the content of the user’s communications with the Flo App in real-time,” including when users checked boxes to log cycles or pregnancy plans.

Donato criticized Meta’s arguments as an improper attempt to nullify the verdict and said the company’s claims about user consent were speculative and unsupported by evidence presented during trial.

China-aligned threat group TA415 launched a new wave of spear-phishing attacks targeting the U.S. government, think tanks and academic institutions focused on U.S.-China trade and policy, said Proofpoint.

Researchers observed the campaigns in July and August, which impersonated the House Select Committee on Strategic Competition and the U.S.-China Business Council, luring victims with invitations to closed-door briefings on U.S.-Taiwan and U.S.-China affairs.

Emails were sent from schina@zohomail.com and used the Cloudflare Warp VPN to mask their origin. Attached password-protected archives contained a Windows shortcut that executed a hidden batch script while displaying a decoy PDF. The script deployed WhirlCoil, an obfuscated Python loader, which set up scheduled tasks with system privileges for persistence and established a Visual Studio Code remote tunnel.

The tunnel gave attackers persistent backdoor access, enabling them to harvest system data and execute commands remotely. Proofpoint said that TA415’s use of VS Code tunnels dates to September 2024, with incremental updates to its infection chain.

Hackers breached databases maintained by online peer-to-peer lending marketplace Prosper and stole customer data.

San Francisco-based Prosper, which runs the Prosper Marketplace, said Wednesday it first observed hackers breaking into systems containing “proprietary and confidential information” on Sept. 1.

Prosper said in a data breach notification posted to its website that “customer-facing operations continue uninterrupted,” and that attackers don’t appear to have accessed customers’ accounts or funds.

The company said the attack appears to have been contained on Sept. 1 and that it is still reviewing the breached data to determine how many personal records were exposed. When the attack began remains unclear.

“We have evidence that confidential, proprietary and personal information, including Social Security numbers, were obtained, including through unauthorized queries made on company databases that store customer information and applicant data,” it said.

Luxury fashion houses Gucci, Alexander McQueen and Balenciaga suffered a data breach impacting 7.4 million unique customer email addresses, in an attack attributed to the ShinyHunters hacking group.

ShinyHunters shared a sample of stolen files with the BBC, reportedly containing thousands of genuine customer records, including spending history. The group claimed to have breached the brands through their parent company Kering in April and contacted the firm in June seeking a ransom.

Kering said an unauthorized party accessed limited customer data in June but said that no financial information, bank account numbers, credit card data, or government-issued IDs were compromised. The company denied engaging with the hackers.

Other Stories From Last Week

With reporting from Information Security Media Group’s Gregory Sirico in New Jersey and Mathew Schwartz in Scotland.