Security Leftovers and Windows TCO

posted by Roy Schestowitz on Aug 30, 2025

• Security Week ☛ Google Confirms Workspace Accounts Also Hit in Salesfarce–Salesloft Drift Data Theft Campaign

  Google says the same OAuth token compromise that enabled Salesfarce data theft also let hackers access a small number of Workspace accounts via the Salesloft Drift integration.

• Security Week ☛ TransUnion Data Breach Impacts 4.4 Million

  The credit reporting firm did not name the third-party application involved in the incident, only noting that it was used for its US consumer support operations.

• Security Week ☛ VerifTools Fake ID Operation Dismantled by Law Enforcement

  Authorities say VerifTools sold fake driver’s licenses and passports worldwide, enabling fraudsters to bypass KYC checks and access online accounts.

• Security Week ☛ Nevada Confirms Ransomware Attack Behind Statewide Service Disruptions

  State officials confirm ransomware forced office closures, disrupted services, and led to data theft, as Nevada works with CISA and law enforcement to restore critical systems.

• HackRead ☛ First AI-Powered Ransomware PromptLock Targets Windows, Linux and macOS

  ESET has identified PromptLock, the first AI-powered ransomware, using OpenAI models to generate scripts that target Windows, Linux and macOS.

• Windows TCO / Windows Bot Nets

  • Security Week ☛ Ransomware Group Exploits Hybrid Cloud Gaps, Gains Full Microsoft trap Azure Control in Enterprise Attacks

    Storm-0501 has been leveraging cloud-native capabilities for data exfiltration and deletion, without deploying file-encrypting malware.

  • Tech Central (South Africa) ☛ Hackers target [sic] Ingonyama Trust in ransomware attack

    Exclusive | Hacker group NightSpire has claimed 30GB of potentially highly sensitive data was stolen in the attack.

  • Cyble Inc ☛ Nevada Hit By Cyberattack, Services Disrupted

    Governor Joe Lombardo and state officials confirmed this week that while some systems have begun to come back online, key agencies, including the Department of Motor Vehicles (DMV) and the Nevada Health Authority, remain heavily impacted. The scope of the Nevada cyberattack, described as a ransomware attack, is still being investigated, and officials have not yet determined what kind of data was compromised.

  • Bitdefender ☛ Sweden scrambles after ransomware attack puts sensitive worker data at risk

    Software firm Miljödata, which provides a significant proportion of Sweden's municipalities with "smart systems for a healthy work environment" handling such things as long-term sick leave and work-related injuries, is at the heart of the incident which has left around 200 of the country's organisations scrambling.