Breach Roundup: Tycoon2FA Phishing Platform Rebounds

Every week, Information Security Media Group rounds up cybersecurity incidents and breaches around the world. This week, Tycoon 2FA is back, a Trio-Tech ransomware attack turned potentially material, more warnings on Russians targeted messaging apps and a ransomware broker sentenced. Iran-linked hackers used Telegram malware, Mazda disclosed a breach. Oracle patched a critical flaw, North Korean actors weaponized VS Code, a Spanish port is using manual processes after a mostly-thwarted ransomware attack, France reported a teacher data breach and a U.S. healthcare firm saw victim counts surge.

See Also: Experts Offer Insights from Theoretical to the Realities of AI-enabled Cybercrime

Tycoon2FA, a phishing-as-a-service platform disrupted earlier this month in a coordinated international law enforcement operation, quickly rebounded to pre-disruption activity levels, cybersecurity company CrowdStrike found.

Europol, working with Microsoft and partners, announced March 4 that it had seized 330 domains forming the backbone of the Tycoon2FA platform, which enables attackers to bypass multifactor authentication and hijack enterprise email accounts (see: Authorities Take Down Tycoon 2FA Phishing-as-a-Service Platform).

CrowdStrike reported the disruption had only a short-lived impact. Attack volumes dropped to roughly 25% of normal levels immediately after the operation but quickly rebounded to pre-takedown levels, with campaign activity and cloud compromises returning to early 2026 baselines.

Tycoon2FA, active since 2023, is one of the most prolific phishing platforms globally. It has been linked to more than 30 million phishing emails per month and accounted for roughly 62% of phishing attempts blocked by Microsoft in 2025.

The platform operates as a subscription-based service, providing attackers with ready-made phishing kits that use adversary-in-the-middle techniques to intercept credentials, session cookies and MFA tokens in real time, enabling account takeover without triggering alerts.

CrowdStrike said the operators have resumed activity using largely unchanged tactics, including phishing lures that redirect victims through CAPTCHA pages and proxy authentication sessions to legitimate services.

A ransomware attack on semiconductor services firm Trio-Tech International escalated into a potential material breach after stolen data was exposed online.

The California-based semiconductor services firm disclosed in a regulatory filing that attackers breached its Singapore subsidiary on March 11, deploying file-encrypting malware across its network. The subsidiary immediately took its systems offline to contain the spread.

Trio-Tech initially assessed the incident as immaterial, but that changed days later after it spotted its data published online. “Following this development, management concluded that the incident may constitute a material cybersecurity event,” it told regulators.

The Gunra ransomware claimed responsibility, listing the company on its darkweb leak site. Active since April 2025 and built on the leaked Conti source code, the group typically gives victims a strict five-day payment deadline.

Trio-Tech defines itself as a provider of back-end solutions for the semiconductor provides semiconductor testing, manufacturing solutions and value-added distribution services.

Russian intelligence-linked threat actors are impersonating customer support services on secure messaging platforms to hijack user accounts, the FBI and U.S. Cybersecurity and Infrastructure Security Agency warned Friday.

The campaign targets Signal and similar commercial messaging applications and has already resulted in the compromise of thousands of accounts globally. The activity is focused on individuals of intelligence value, including current and former government officials, military personnel, political figures and journalists.

Threat actors pose as platform support teams and send messages warning of suspicious account activity. Victims are prompted to click malicious links or share authentication credentials, including one-time passcodes and PINs.

If successful, attackers can link their own devices to the compromised account or take full control of it, enabling them to read private communications, access contact lists and impersonate the victim to expand the campaign.

The attacks do not exploit vulnerabilities in messaging platforms or break end-to-end encryption. They rely on social engineering techniques that manipulate users into granting access, effectively bypassing encryption altogether.

The American government is only the latest to warn about Russian attempts to break into end-to-end encrypted apps. Dutch intelligence agencies earlier this month alerted users about the campaign just weeks after Germany’s domestic intelligence agency published a similar advisory. Google observed Russian hackers using the same technique on Ukrainian targets in February 2025 (see: Ukrainian Signal Users Fall to Russian Social Engineering).

A U.S. federal judge sentenced a Russian national to 81 months in prison for his role as an initial access broker who enabled ransomware, the U.S. Department of Justice announced Monday.

Aleksei Olegovich Volkov, 26, sold stolen network credentials to cybercrime groups, including ransomware operators, allowing them to infiltrate victim systems, deploy malware and extort payments. Prosecutors said Volkov operated as a key cybercrime enabler, monetizing unauthorized access to corporate networks. He pleaded guilty last October to six criminal counts including trafficking in access information, access device fraud and aggravated identity theft as well as distributing stolen identities and conspiracy to commit computer fraud and conspiracy to commit money laundering.

One of two federal indictments against Volkov shows him selling login credentials to U.S. businesses in exchange for cryptocurrency, sometimes taking a flat fee or a share of ransom proceeds.

In one instance in July 2023, Volkov sold access to a U.S.-based company’s network for $1,000 in bitcoin. He provided valid credentials belonging to an employee, enabling unauthorized access to the company’s systems.

Authorities said Volkov worked with the Yanluowang ransomware group, identifying vulnerable targets and supplying access that was later used in attacks. The group encrypted victim data and demanded payment in cryptocurrency. In all, prosecutors say Volkov facilitated dozens of ransomware attacks throughout the United States, causing more than $9 million in actual losses and more than $24 million in intended losses.

Iran-linked cyber operatives are using Telegram-based infrastructure and tailored social engineering to spy on dissidents, journalists and opposition figures, the FBI warned Friday.

FBI said operators tied to Iran’s Ministry of Intelligence and Security are deploying multi-stage malware designed to infiltrate Windows systems, establish persistence and exfiltrate sensitive data. The activity has been ongoing since at least 2023.

Attackers typically initiate access by impersonating trusted contacts or tech support across messaging platforms, sending victims malicious files disguised as legitimate applications such as Telegram installers or password managers. Once executed, the malware connects to attacker-controlled Telegram bots used as command-and-control channels, enabling remote access and data theft.

The malware supports file exfiltration, screenshot capture and, in some cases, recording activity during online meetings. The use of Telegram infrastructure helps obscure operations and blend malicious traffic with legitimate communications.

The FBI said targeting is highly selective, with lures often customized using prior reconnaissance, suggesting an intelligence-driven approach. Victims are primarily individuals critical of the Iranian regime or affiliated with opposition networks.

The campaign is also linked to hack-and-leak operations tied to Iranian intelligence’s Handala persona (see: FBI Seizes Iranian Online Leak Sites After Stryker Hack).

A cyber intrusion into Mazda’s internal systems exposed hundreds of employee and partner records after attackers exploited vulnerabilities in a warehouse management platform, the company said March 19.

The Japanese automaker said the breach stemmed from unauthorized external access to a system used for managing parts procurement linked to Thailand, with activity traced back to mid-December 2025.

Mazda said 692 records may have been exposed, including names, email addresses, user IDs, company names and business partner identifiers associated with employees, group companies and business partners. The company said no customer data resided in the affected system.

Mazda warned of potential risks such as phishing or other malicious outreach targeting affected individuals. The company said the incident is unrelated to a separate ransomware claim made against Mazda in late 2025.

Database giant Oracle issued an out-of-band security patch for a critical vulnerability in its Fusion Middleware stack that allows unauthenticated attackers to take over enterprise identity systems.

The primary flaw, tracked as CVE-2026-21992, affects Oracle Identity Manager and Oracle Web Services Manager – core components used to manage authentication, access control and service security across enterprise environments.

The vulnerability carries a CVSS score of 9.8 and is remotely exploitable over HTTP without requiring authentication or user interaction. Successful exploitation enables remote code execution, potentially giving attackers full control of affected systems.

Oracle said attackers with network access could compromise vulnerable deployments, leading to complete system takeover.

Oracle has not confirmed active exploitation but the risk is heightened by the nature of the flaw. Identity Manager sits at the center of user provisioning and access governance. Successful compromise could enable privilege escalation, lateral movement and broader network intrusion.

North Korean hackers are abusing Microsoft Visual Studio Code automation features to compromise developer environments, using malicious project files to trigger malware execution, finds research from NTT Security.

The activity is tied to the long-running “Contagious Interview” campaign in which Pyongyang hackers impersonates recruiters on LinkedIn and job boards in a bid to infect developers’ systems with malware.

This attack hinges on a weaponized .vscode tasks.json file configured with the runOn: folderOpen option. When a victim opens and clicks “Trust” in VS Code’s workspace trust prompt, the task executes automatically, downloading and running additional payloads without further user interaction.

Researchers said the technique, observed since at least December 2025, marks a shift from user-triggered execution to near-frictionless compromise by embedding malicious behavior directly into developer workflows.

The infection chain deploys a modular malware family dubbed StoatWaffle, implemented in Node.js. The malware installs Node.js if absent, ensuring cross-platform execution, and proceeds through multiple stages to establish persistence.

Once active, StoatWaffle delivers two primary capabilities: a credential-stealing component that extracts browser data and extension information, and on macOS the Keychain database, and a remote access Trojan that enables command execution, file exfiltration and system control.