The IT Nerd

Comparitech is reporting that a ransomware group, Lynx, yesterday claimed a cyberattack against Lakelands Public Health in Ontario, Canada. The attack has not yet been confirmed. Bit seeing as this is in my backyard, I’m interested in following this story:

Commenting on this news is Rebecca Moody, Head of Data Research at Comparitech: 

“As Lakelands Public Health continues to grapple with this attack, it’s important it provides an update on its investigation and Lynx’s ransomware claim as soon as possible. That way, anyone involved can begin to mitigate any potential risks that may arise from the breach (e.g. by monitoring accounts for unauthorized activities and being on high alert for potential phishing messages).

Lynx has been around for nearly two years now and doesn’t tend to fabricate claims. Therefore, I think it’s highly likely there has been some kind of breach of data in this attack. Hopefully, it will be limited. According to our data, Lynx is responsible for the breach of nearly 213,500 records across 17 separate attacks (where breach figures and notifications have been provided).”

If or when this is confirmed, I would be very interested in what the Privacy Commissioner of Ontario has to say as this would have to be reported to them at the very least. That would be very instructive.

Today we’re covering Operation Neusploit, the advanced cyberespionage campaign identified by Zscaler ThreatLabz attributed with confidence to the Russia-linked APT28 (A.K.A. Fancy Bear) threat group, we’re sharing this perspective on its 7.8 score.

Neusploit weaponizes CVE-2026-21509, a Microsoft Office zero-day security bypass vulnerablity, to target government and executive organizations in Ukraine, Slovakia, and Romania. It uses native language social engineering ploys to launch multi-stage infection chains that begin by monitoring login events and forwarding emails to attackers. A dropper then downloads further malicious implants and a post-exploitation framework for command and control as well as lateral movement.

Given the campaign’s potential impact, some have questioned the vuln’s 7.8 Common Vulnerability Scoring System (CVSS) score vs. a higher one.

Sunil Gottumukkala, CEO of Averlon, explained:

   “A 7.8 CVSS score for this vulnerability is based on the prerequisites needed for exploitation: #1 the payload (in this case the specially crafted office file) to be delivered locally, and #2 the local user to open it. It cannot be exploited without end user interaction at that early and specific point in time.

“However, scoring that single specific slice of the exploit chain fails to capture just how effective modern, highly targeted social engineering has become, especially with AI. In campaigns like this, overcoming the user interaction prerequisite is becoming straightforward, and that initial foothold becomes the first step in a sophisticated attack chain that can quickly expand before organizations are able to patch.”

This is a big hint that the scoring of vulnerabilities needs a rethink to reflect the modern reality of cybersecurity. But I for one do not thing that this will happen anytime soon.