A significant cyberattack disrupted Nevada’s state government network on August 24, forcing all state office branches to shut down operations for 48 hours.

The intrusion began with the exploitation of an unpatched VPN gateway, allowing the threat actor to gain initial foothold on the internal network.

Within hours, the attackers deployed a custom malware payload designed to escalate privileges, move laterally across critical servers, and exfiltrate sensitive data.

This event marks one of the most severe disruptions of state IT services in recent history, affecting email, public records access, and internal communication channels.

Governor Lombardo Press Office analysts noted that the malware leveraged a multi-stage attack vector: a lightweight dropper written in PowerShell, which in turn fetched a second-stage binary from a compromised web server.

This binary contained encrypted configuration files, indicating the attackers’ intent to remain undetected while mapping the network topology.

Please see the memo related to the August 24 network security incident below. pic.twitter.com/PvXcSpO63G

— Governor Lombardo Press Office (@Lombardo_Press) August 25, 2025

As state technicians worked to isolate infected endpoints, normal user authentication services were rerouted to offline backups, further complicating the recovery process.

Initial forensic analysis revealed that the dropper script used the following pattern to establish persistence on reboot:-

$TaskAction = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument '-NoProfile -WindowStyle Hidden -File C:\Windows\Temp\svc_update.ps1'
$Trigger    = New-ScheduledTaskTrigger -AtStartup
Register-ScheduledTask -TaskName 'WindowsUpdateSvc' -Action $TaskAction -Trigger $Trigger -Description 'System Update Service'

This technique allowed the malware to relaunch silently, even after endpoint patches were applied.

Governor Lombardo Press Office researchers identified the dropper’s code similarities to known APT toolkits, suggesting that the perpetrators possess advanced capabilities and extensive reconnaissance data on state infrastructure.

Infection Mechanism

Delving deeper into the infection mechanism, the second-stage binary employs a custom communications protocol over HTTPS, masquerading its traffic as benign REST API calls to evade intrusion detection systems.

Upon execution, the binary loads a DLL into the Windows Management Instrumentation (WMI) host process (wmiprvse.exe), effectively concealing its operations within legitimate system processes.

The DLL decrypts embedded payloads in memory, deploying modules that scan for domain controllers and file shares.

Once targets are identified, encrypted archives of critical files are staged for exfiltration using chunked uploads to a remote C2 server.

The malware transition from initial code execution to data exfiltration without triggering standard network security alarms.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post Nevada IT Systems Hit by Cyberattack – State Office Closed for Two Days appeared first on Cyber Security News.

Farmers Insurance Exchange and its subsidiaries recently disclosed a significant security incident that compromised personal information of approximately 1.1 million customers through an unauthorized access to a third-party vendor’s database.

The breach, which occurred on May 29, 2025, represents one of the largest insurance industry data exposures of the year, affecting customer records containing names, addresses, dates of birth, driver’s license numbers, and partial Social Security numbers.

The attack timeline reveals a sophisticated intrusion that went undetected for approximately 24 hours before the vendor’s monitoring systems identified suspicious activity.

On May 30, 2025, the unnamed third-party vendor alerted Farmers to the unauthorized database access, triggering immediate containment measures and blocking the threat actor.

The vendor’s existing monitoring infrastructure proved crucial in limiting the exposure window, though investigators later confirmed that data acquisition had already occurred during the initial breach period.

Following the incident discovery, Farmers analysts worked alongside external cybersecurity experts to conduct a comprehensive forensic investigation spanning nearly two months.

The investigation revealed that the unauthorized actor had successfully penetrated the vendor’s database defenses and exfiltrated sensitive customer information before detection systems could intervene.

Farmers researchers noted that the attack specifically targeted customer databases containing insurance policy holder information, suggesting a deliberate focus on high-value personal data.

Database Infiltration and Persistence Mechanisms

The attack vector analysis indicates the threat actor employed advanced persistent techniques to maintain unauthorized database access.

While specific technical details remain undisclosed for security reasons, the prolonged investigation period suggests complex data extraction methods were utilized.

The attacker’s ability to access and acquire substantial customer data within a compressed timeframe points to sophisticated database querying capabilities and potential privilege escalation within the vendor’s systems.

Security experts noted that the incident highlights critical vulnerabilities in third-party vendor management, particularly regarding database access controls and real-time monitoring systems.

The breach underscores the importance of implementing robust vendor security frameworks and continuous monitoring protocols to detect unauthorized database activities before data exfiltration occurs.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post Farmers Insurance Cyber Attack – 1.1 Million Customers Data Exposed in Salesforce Attack appeared first on Cyber Security News.

The emergence of sophisticated cybercriminal organizations continues to pose significant threats to individuals and institutions worldwide, with the UTG-Q-1000 group representing one of the most concerning developments in recent cybersecurity history.

This highly organized criminal network has demonstrated exceptional technical prowess by exploiting China’s national childcare subsidy policy, transforming what should be a beneficial government program into a vector for widespread financial fraud and data theft.

The UTG-Q-1000 organization operates through a sophisticated multi-tiered structure, with specialized divisions including the Finance Group, News and Sex Group, Design and Manufacturing Group, and Black Market Group.

The Finance Group specifically targets financial personnel and managers within enterprises and institutions, employing highly deceptive phishing campaigns disguised as legitimate financial communications such as tax audits, electronic receipts, and subsidy announcements.

Their attack methodology demonstrates remarkable sophistication, utilizing multi-stage loading mechanisms through their signature “Silver Fox” remote access trojan while leveraging legitimate cloud services like Alibaba Cloud OSS and Youdao Cloud Notes to host malicious payloads and evade security detection systems.

Qi’anxin Threat Intelligence Center researchers identified this elaborate campaign in December 2024, uncovering the group’s exploitation of the anticipated national childcare subsidy policy offering 3,600 yuan per child annually.

The cybercriminals established numerous phishing websites overnight, mass-distributed malicious QR codes, and created convincing subsidy application pages to harvest victims’ personal information, bank card details, and authentication credentials.

The attack infrastructure reveals a membership-based operation where individual threat actors are assigned unique identifiers to track their success rates in phishing campaigns.

Analysis of member “ylxuqxmz” revealed 113 successful phishing attempts, with the organization maintaining detailed victim statistics across 37 compromised systems, predominantly Windows 10 machines.

Technical Infrastructure and Evasion Mechanisms

The UTG-Q-1000 group employs remarkably sophisticated technical evasion techniques to bypass security controls and maintain operational persistence.

Their phishing pages function as complex loaders that dynamically create iframe containers to host the actual malicious content.

Before loading the targeted phishing interface, the system initiates carefully disguised fetch requests to endpoints masquerading as image resources.

The core deception mechanism involves Base64 encoding combined with XOR encryption using the key “YourSecretKey123!@#” to conceal malicious URLs within seemingly legitimate image data.

The attack code searches for a specific signature (0x21FE) within returned image files to locate encrypted data segments, then performs the decryption process to recover target URLs and seamlessly integrate them into the victim’s browsing experience.

async function loadContent() {
    var arrayBuffer = await_r.arrayBuffer();
    var bytes = new Uint8Array(arrayBuffer);
    for(var i=0;i<bytes.length-1;i++){
        if(bytes[i]===0x21 && bytes[i+1]===0xFE) {
            var slice = bytes.slice(i+3,l+3+l);
            var text = new TextDecoder().decode(slice);
            var url = atob(text);
            var decrypted = xorDecrypt(url, 'YourSecretKey123!@#');
        }
    }
}

This multi-layered obfuscation strategy effectively circumvents URL-based risk control mechanisms and static signature scanning employed by traditional security solutions.

The organization maintains real-time victim monitoring through sophisticated heartbeat mechanisms, reporting online status every second to command and control servers at https://bmppc.cn/heartbeat.php while tracking user interactions to optimize their fraudulent operations.

The UTG-Q-1000 group represents a paradigm shift in cybercriminal sophistication, combining advanced technical capabilities with psychological manipulation to exploit public trust in government benefit programs, ultimately demonstrating the critical need for enhanced cybersecurity awareness and robust detection mechanisms.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post UTG-Q-1000 Group Weaponizing Subsidy Schemes to Exfiltrate Sensitive Data appeared first on Cyber Security News.