Phony Chinese Sites Mimic Retail Brands

Every week, Information Security Media Group rounds up cybersecurity incidents and breaches around the world. This week, fake Chinese sites mimic retail brands, Spain arrests hackers behind high-profile data leaks, ransomware attack on Swiss health nonprofit, International Criminal Court probes cyberattack, UNFI restores systems, a flaw in smart tractors, RomCom RAT linked to TransferLoader malware and a U.K. man sentenced for locking employer out of network. A WordPress hack installs a Windows Trojan.

See Also: On Demand | Ransomware in 2025: Evolving Threats, Exploited Vulnerabilities, and a Unified Defense Strategy

Researchers uncovered thousands of fake retail websites impersonating major global brands such as Apple, PayPal, Nordstrom, Hermes and Michael Kors. The sites trick consumers into entering credit card information under the guise of making legitimate purchases.

Cybersecurity firm Silent Push found Wednesday the scam targets English and Spanish-speaking users worldwide. Chinese-language words and characters within a “private technical fingerprint” associated with the online infrastructure underpinning the fake sites points to cybercriminals based in China.

Some fraudulent websites use scraped product listings and checkout pages. Others are poorly constructed, such as a purported Guitar Center website selling children’s items. Some incorporate real Google Pay widgets to appear legitimate. No products are delivered after purchase.

Thousands of these sites remain active despite takedowns. Similar campaigns have used search engine manipulation to lure victims.

Spanish authorities arrested two suspects in connection with the large-scale data leaks exposing personal information of top government officials and journalists. The arrests come weeks after hackers initiated a campaign of publishing sensitive data including the national ID and personal email of Spanish President Pedro Sánchez and Catalonian regional President Salvador Illa (see: identified by Spanish press only as “Yoel O.Q., was arrested at his parents’ home in the Canary Islands. Police also arrested his alleged accomplice, “Cristian Ezequiel S.M.” Authorities say the two ran a network that stole and leaked phone numbers, ID details, addresses and emails of senior politicians, then sold access to the data and hacking tools in exchange for cryptocurrency. Both men are out of detention on provisional liberty, reported Canarias7 on Thursday.

The Ministry of the Interior described the duo as a serious national security threat, with ties to far-right Telegram channels, where they disseminated the stolen data to more than 90,000 followers.

Both suspects were transferred to Madrid to testify before the National Court and are under investigation for terrorism and cyberterrorism-related offenses, including attempting to destabilize state institutions and intimidate public figures.

Zurich-based health nonprofit Radix disclosed Monday a ransomware attack by the Sarcoma group, with stolen files published on the darkweb, included government data.

Radix stated that backups were intact and sensitive partner data was not impacted. The Swiss government said otherwise, stating that federal offices use Radix services and government data may be affected. Investigations are underway, though attackers did not access government IT systems directly.

Radix alerted privacy regulators and law enforcement and is working with the Swiss Federal Office for Cybersecurity. Its anonymous counseling platforms, SafeZone and StopSmoking, were unaffected.

Sarcoma uses double extortion and has claimed over 100 victims globally, including in the United States, Italy and Canada.

The International Criminal Court reported a “sophisticated and targeted” cyberattack detected last week. In a Monday statement, the Hague court said its security systems identified and contained the incident.

The breach follows a 2023 espionage-linked cyber incident and comes amid rising threats against ICC officials.

Created in 2002, the ICC prosecutes individuals for war crimes, genocide and crimes against humanity. It remains separate from the U.N.’s International Court of Justice, which handles disputes between nations.

U.S. grocery wholesaler United Natural Foods, a key distributor for Amazon’s Whole Foods restored its core systems following a June 5 cyberattack that disrupted customer orders and operations. The company said Thursday that electronic ordering and invoicing are back online and product deliveries have returned to “more normalized levels” (see: Whole Foods Supplier Faces Cyberattack Disrupting Operations).

In an SEC filing, UNFI warned the breach will likely have a material impact on its fourth quarter net income, citing reduced sales and increased operational costs. It also expects continued expenses related to the investigation and recovery but noted its cybersecurity insurance should cover the damages.

UNFI said the breach did not involve personal or protected health information, so no consumer notifications are planned. The company brought in external cybersecurity experts and informed law enforcement, but has not disclosed the attack’s nature or perpetrators.

Contec Patient Monitor Patch

The U.S. Food and Drug Administration said Wednesday that cyber vulnerabilities – including a hidden backdoor – disclosed in January involving certain patient monitoring devices manufactured by China-based Contec have a patch to fix the vulnerabilities (see: Alarming Backdoor Hiding in 2 Chinese Patient Monitors).

The issues affected Contec CMS8000 patient monitors and Contec monitors relabeled as Epsimed MN-120 monitors (see: CISA Warns of Contec Patient Monitoring Device Flaws).

“The patch fully removes networking functionality from the affected Contec and Epsimed devices, making them only usable for local monitoring – vital signs only observable in the physical presence of the patient,” the FDA said.

The FDA advises healthcare facilities’ IT and cybersecurity staff to reach out to Contec for the software patch and installation instructions. The patch “installation requires specialized expertise,” the FDA advised.

Researchers at Limes Security discovered a way to remotely take full control of tens of thousands of smart tractors worldwide, particularly in Asia and Europe. The vulnerability lies in the FJD AT2, an aftermarket steering system made by Chinese firm FJDynamics.

These connected tractors rely on GPS and cloud data for autonomous or remote operation. The researchers plan to detail their findings at Black Hat USA in Las Vegas. FJDynamics denies the claims but Limes Security warns that the flaw remains unpatched, leaving many farming vehicles exposed to potential hijacking and surveillance.

Researchers at Proofpoint uncovered tactical overlaps between TA829, the threat group behind RomCom RAT, and a new cluster dubbed UNK_GreenSec, linked to the TransferLoader malware. The Russia-aligned actor TA829 is known for espionage and financial attacks, including exploiting zero-days in Firefox and Windows.

Both groups rely on REM Proxy services via compromised MikroTik routers and use similar phishing tactics – spoofed sender emails, PDF lures and redirect links – to deliver malware. These campaigns use infrastructure that filters out sandboxed systems and deploy distinct payloads: TransferLoader for UNK_GreenSec and SlipScreen for TA829.

Proofpoint said the overlapping infrastructure suggests the two groups may be collaborating or even part of the same operation.

A British court sentenced Mohammed Umar Taj, 31, to over seven months in prison after he sabotaged his employer’s network following his suspension in July 2022. Taj, from Batley, retained privileged access and changed login credentials and multi-factor authentication settings, locking out the company and its clients in Germany and Bahrain. The attack caused an estimated 200,000 pounds in business losses and reputational damage.

West Yorkshire Police said Taj sought revenge for the suspension. He pleaded guilty to unauthorized acts intended to impair or hinder computer operations. Investigators recovered logs and call recordings detailing his actions.

Researchers at Sucuri uncovered a WordPress malware campaign that silently infects site visitors with a Windows Trojan. Disguised as a routine hack, the malware hides in the header.php file.

When triggered, it deploys a batch script that downloads a ZIP containing client32.exe, which is saved in %APPDATA% and set to run on startup via registry changes. The Trojan connects to a command-and-control server, giving attackers remote access.

Other Stories From Last Week

With reporting from Information Security Media Group’s Mathew Schwartz in Scotland, Gregory Sirico in New Jersey, Prajeet Nair in Bengaluru, India and Akshaya Asokan in Southern England and Marianne Kolbasuk McGee in the Boston exurbs.