MetLife Denies RansomHub Cyberattack Claims

Every week, Information Security Media Group rounds up cybersecurity incidents and breaches around the world. This week, MetLife denied a RansomHub cyberattack claim, RI Health System cyberattack update, npm package deployed Quasar RAT, Germany charges three with espionage for Russia, North Korea’s contagious interview campaign deployed new malware.

See Also: Live Webinar | North Korea’s Secret IT Army and How to Combat It

Cybercriminal group RansomHub claimed responsibility on Tuesday for a breach of MetLife’s operations in Latin America. MetLife Wednesday denied the allegations, stating there was no impact on its core systems. The company acknowledged a separate cyber incident involving Fondo Genesis, a subsidiary operating solely in Ecuador, but stressed the incident is unrelated to the broader MetLife infrastructure.

Ransomware group Brain Cipher claimed responsibility for breaching Rhode Island’s RIBridges system, which oversees critical programs like Medicaid, SNAP and HealthSource RI. State Gov. Dan McKee confirmed that approximately 650,000 individuals’ personal data, including Social Security and bank account numbers, was stolen. The hackers set a ransom deadline before releasing the files, which have since been posted on the darkweb (see: Thousands Affected by Data Theft Hack of Smallest US State).

McKee said there will be no disruption to benefits from programs relying on RIBridges. The sytem has been offline since Dec. 13 but the state plans to have RIBridges back online by mid-January. HealthSource RI has extended its open enrollment through February.

Cybersecurity researchers identified a malicious npm package, ethereumvulncontracthandler, masquerading as a tool for detecting vulnerabilities in Ethereum smart contracts. Published last month by “solidit-dev-416,” the package deploys the Quasar remote access trojan.

The package executes a heavily obfuscated script, retrieving and running malware from a remote server. It avoids detection through multiple encoding layers and sandbox checks. The malware modifies the Windows registry to establish persistence and communicates with a command-and-control server to exfiltrate sensitive data and execute commands.

Quasar RAT, initially detected in 2014, has a history of use in cybercrime and espionage. Attackers use it to manage infected devices, monitor systems and deploy additional payloads.

German prosecutors charged three Russian-German nationals with espionage and sabotage activities for Russia. Prosecutors allege a man only identified as Dieter S. communicated with a Russian secret service contact and planned sabotage targeting German military infrastructure supporting Ukraine. He reportedly scouted sites, including U.S. military facilities in Bavaria, collecting intelligence and proposing arson and explosive attacks on railways transporting military goods.

Two other individuals, Alexander J. and Alex D., allegedly participated in the planning stage starting no later than March 2024. Their targets included a loading station, a tool manufacturer and U.S. military operations.

North Korean hackers behind the Contagious Interview campaign are now using a JavaScript malware, OtterCookie, to enhance their attacks, said cybersecurity company NTT Security Holdings. Posing as recruiters, the group lures job seekers into downloading malware disguised as interview tools, deploying threats like BeaverTail and InvisibleFerret through videoconferencing apps and npm packages.

OtterCookie, first detected in September 2024, establishes communication with command-and-control servers and executes shell commands to steal files, clipboard content and cryptocurrency wallet keys. Updates show added sophistication, signaling the campaign’s evolution and effectiveness.

Separately, South Korea sanctioned 15 individuals and one organization linked to North Korea’s IT worker schemes that fund nuclear and missile development. These operations deploy North Korean personnel globally, targeting freelance and corporate roles, with revenue funneled back to the regime.

Other Stories From Last Week