Fancy Bear in Schmanzy OpSec Failure

Every week, Information Security Media Group rounds up cybersecurity incidents and breaches around the world. This week, Russian nation-state hackers in OpSec failure, an Interpol-coordinated international law enforcement operation, the FBI added an alleged ATM jackpotting ringleader to its most wanted list and Telus Digital disclosed a cyberattack amid claims of massive data theft. Microsoft announced default hotpatching for Windows enterprise systems, attackers exploited a Wing FTP flaw and Poland said it blocked a cyberattack on a nuclear research center. Researchers detailed a long-running China-linked espionage campaign targeting Southeast Asian military networks, while a U.S. ambulance provider reported a sharp rise in breach victims.

See Also: Why Cyberattackers Love ‘Living Off the Land’

Russian state intelligence hackers exposed a directory on a command-and-control server identified by Ukrainian cyber defenders as malicious nearly 18 months ago, allowing cybersecurity researchers to rummage through it for source code, payloads and stolen data.

Security researchers at Ctrl-Alt-Intel said they found more than 2,800 emails stolen from military and government inboxes, more than 240 sets of stolen credentials and a slew of downloaded contact lists, “mapping entire communication networks.”

The Computer Emergency Response Team of Ukraine flagged in October 2024 the server’s IP address as likely belonging to the Unit 26165 of the Russian Main Intelligence Directorate, the nation-state hacking outfit commonly tracked as Fancy Bear or APT 28.

“Fancy Bear continued to operate from the same server that was publicly attributed to Fancy Bear over 500 days ago,” marveled Ctrl-Alt-Intel researchers. On a scale of things that are difficult for hackers to control, changing an IP address is “easy.”

Another OpSec mistake was to forget to open a directory stream with opendir and forget to close it. “Due to the operational-tempo of performing cyberattacks, threat actors often get distracted and forget to close these – which can in some cases expose data to the public that should’ve private,” researchers wrote.

Among the files researchers found was a cross-site scripting payload targeting Roundcube Webmail, a recurring target of Russian hackers (see: Ukraine Tracks Multiple Spear-Phishing Campaigns From Russia).

Researchers also found ClickFix lures, malware and logs. “After digging through these, and the corresponding logs, we had an almost complete picture of how Fancy Bear operated and targeted its victims,” they wrote. Among the group’s capabilities is a multi-platform exploitation toolkit “where a victim simply opening a malicious email – with no further clicks – could result in their credentials stolen, their 2FA bypassed, emails within their mailbox exfiltrated and a silent forwarding rule established that persists indefinitely,” they warned.

A coordinated cybercrime crackdown involving Interpol, law enforcement agencies across 72 countries and private firms Group-IB, Trend Micro and S2W took down more than 45,000 malicious IP addresses and servers tied to phishing, malware, ransomware campaigns, romance scams, sextortion and credit card fraud.

The operation, dubbed Synergia III, ran from July 2025 to January. Authorities arrested 94 suspects, with another 110 under investigation, and seized 212 devices and servers used to support cybercriminal activity. The effort focused on dismantling underlying infrastructure that enable attacks at scale.

Investigators in Macau identified more than 33,000 phishing and fraudulent websites impersonating banks, casinos, government services and payment platforms. In Togo, police dismantled a fraud ring that hacked social media accounts and impersonated victims to manipulate their contacts into transferring money. Raids in Bangladesh nabbed 40 suspects and more than 130 devices linked to loan, job and identity scams.

The FBI added alleged cybercriminal Aníbal Alexander Canelón Aguirre to its 10 Most Wanted Fugitives list.

Authorities say Canelón Aguirre, a Venezuelan national, led a large-scale ATM jackpotting operation that used malware to force machines into dispensing cash. The scam allegedly deployed multiple crews across the United States, stealing millions of dollars.

Investigators allege the proceeds were funneled to Tren de Aragua, a Venezuela-origin criminal organization with expanding global reach. The group has been linked to a range of illicit activities, and U.S. officials describe the operation as a coordinated effort combining cyber-enabled fraud with traditional organized crime structures.

U.S. authorities tracked nearly 1,900 jackpotting incidents since 2020, with more than 700 attacks and over $20 million in losses recorded in 2025 alone. The attacks rely on malware such as Ploutus, which targets the ATM itself rather than bank accounts, enabling rapid cash-outs once access is gained (see: Cashing Out: ATM Jackpotting Attacks Surging Across US).

Telus Digital disclosed a cyberattack that resulted in unauthorized access to a limited number of internal systems, the company said Thursday.

The Canadian business process outsourcing giant said it contained the incident and secured affected systems and that there has been no disruption to customer-facing operations.

Telus did not disclose the initial access vector or the duration of the intrusion. The disclosure follows claims by hack-and-leak group ShinyHunters, which said it exfiltrated close to 1 petabyte of data, including personal information and internal records. The threat actor also claimed using Google Cloud Platform credentials obtained from the data exposed in a prior Salesloft Drift breach (see: ShinyHunters Counts 1.5 Billion Stolen Salesforce Records).

ShinyHunters said they began extorting Telus in February, demanding $65 million ransom to prevent the release of the data. Telus did not respond to a request for comment.

Tech giant Microsoft will switch on rebootless “hotpatch” updates by default in Windows Autopatch starting May.

The feature applies to eligible Windows Enterprise devices managed via Intune or Microsoft Graph. Hotpatching allows security updates to be applied in memory without requiring an immediate system restart, enabling patches to take effect while systems remain online.

Monthly updates will be delivered as hotpatches, while periodic baseline updates, typically quarterly, will still require a reboot. Microsoft said this approach reduces the gap between update installation and protection by eliminating delays tied to restart cycles.

Windows Autopatch will continue to use staged “ring”-based deployments to rollout updates across device groups. Existing update policies, including deferrals and ring settings, remain in place and are not overridden by the new default.

Attackers are exploiting a Wing FTP Server flaw that exposes the application’s installation path.

The vulnerability, tracked as CVE-2025-47813, stems from improper error message generation in the loginok.html page during web authentication. Specifically, when an attacker supplies an overlong value in the UID cookie, the server returns an error message that leaks the full installation path of the application.

The bug is an information disclosure issue with a CVSS score of 4.3. But in practice, it lowers the barrier for more serious compromise. The U.S. Cybersecurity and Infrastructure Security Agency on Monday added the flaw to its catalog of known exploited vulnerabilities.

Security researchers say exposing the server’s file path can help attackers chain exploits – particularly with CVE-2025-47812, a critical flaw in the same product with a CVSS score of 10.0 that enables remote code execution with root privileges. That RCE bug has already been exploited in prior attacks to download and execute malicious Lua files and install remote monitoring and management tools.

Poland’s National Center for Nuclear Research said it blocked a cyberattack targeting its IT infrastructure, with no impact on operations or nuclear safety systems.

The attempted intrusion was detected and stopped by internal security controls before attackers could gain access, the institute said. No production, research or operational processes were disrupted, and the research reactor continues to run at full capacity.

The attack, disclosed on March 12, caused no data compromise or system integrity issues, the center said. Indicators point to infrastructure linked to Iran, according to Poland’s Minister of Digital Affairs Krzysztof Gawkowski.

A cyberespionage group tied to China with moderate confidence is conducted a long-running campaign targeting military organizations in Southeast Asia, focusing on highly specific intelligence collection rather than broad data theft, Palo Alto Networks found.

The cybersecurity company tracks the group as CL-STA-1087. Threat actor activity dates to at least 2020 and shows what researchers describe as “strategic operational patience. Attackers maintain access to compromised networks for months while quietly harvesting sensitive military data.”

The threat actor sought information on military capabilities, organizational structures and cooperation with Western armed forces.

Researchers identified a custom toolset underpinning the campaign, including newly discovered AppleChris and MemFun backdoors and a credential harvester dubbed Getpass. These tools enabled persistent access and targeted data extraction while minimizing detection.

Infrastructure linked to the campaign includes command-and-control servers hosted on China-based cloud services, with at least one login interface written in Simplified Chinese.

The campaign stands out for its precision. Rather than sweeping exfiltration, operators conducted focused searches for mission-relevant files, indicating an intelligence-driven objective aligned with state-sponsored espionage priorities.

Researchers said the group demonstrated strong operational security, maintaining stable infrastructure and avoiding exposure while sustaining long-term access to high-value military targets.

Bell Ambulance, the largest ambulance company in Wisconsin, said the number of individuals affected by a hacking incident first identified in February 2025 has more than doubled.

The firm told regulators the incident now affects nearly 238,000 individuals, up from about 114,000 people it disclosed in an April breach notification (see: Yale New Haven Health Notifying 5.5 Million of March Hack).

The incident potentially compromised information including patient date of birth, Social Security number, driver’s license number, financial account information, medical information and health insurance information.

An investigation confirmed an unauthorized individual accessed data within the Bell network,” the company said. A “thorough” review of the impacted data continued over the last year and completed on Feb. 20, confirming the additional individuals who were affected, Bell Ambulance said.

Milwaukee-based Bell Ambulance said it has 750 employees and answers more than 140,000 calls for ambulance service each year.

Other Stories From This Week

With reporting from Information Security Media Group’s Marianne Kolbasuk McGee in the Boston exurbs and David Perera in Northern Virginia.