Archive for October 12, 2026

MoneyGram hack claimed by The Gentleman, 60M customers at risk

Posted in Commentary with tags on October 12, 2026 by itnerd

The Gentlemen ransomware gang has claimed an attack on MoneyGram, one of the world’s largest payment networks, and is threatening to release the stolen data. MoneyGram serves 60 million active customers across more than 200 countries. 

Rebecca Moody, Head of Data Research at Comparitech: 

“The Gentlemen has become one of the most prolific ransomware groups of recent years and isn’t known for fabricating its claims. MoneyGram needs to issue a statement as soon as possible to either reassure its customers that a breach hasn’t occurred or warn them of any potential unauthorized access to its systems.

Financial organizations are a key target for ransomware groups because of the highly sensitive data they deal with. The Gentlemen has claimed 46 attacks on such entities so far this year. 

Also of note is its attack on a South African tech company, MIP Holdings. This took place in June 2026, with MIP paying The Gentlemen a ransom to delete the stolen data. However, The Gentlemen has now started targeting MIP’s clients and is issuing them with their own ransom demand. This serves as a key reminder that paying a ransomware group to delete data doesn’t guarantee any data will be deleted. In MoneyGram’s case, regardless of whether or not negotiations are successful, individual customers could be contacted by the group. Therefore, MoneyGram’s customers and employees should be on high alert for any potential phishing messages and unauthorized account activity.”

Brian Higgins, Security Specialist at Comparitech:

“It’s very early in the incident response timeline but that’s no reason for anyone who may be affected should this attack prove genuine not to be extra vigilant whilst more details become available. It’s not MoneyGram’s first rodeo so there’s a good chance they will be able to offer decent information and advice as things progress, so it would be a good idea to monitor their comms output. Unfortunately these days more and more people are aware of the personal mitigations they should be considering; changing passwords, monitoring accounts, ignoring and reporting unsolicited contact and checking they have two-factor authentication applied wherever possible etc, but given the volume and diversity of the potentially vulnerable client base on this occasion it’s worth checking in with family, friends and others in your community to make sure they are doing the same. Nobody wants to be worried about their personal financial info being compromised going into Thanksgiving and Christmas so it can only help to look after each other where you can.”

Comparitech in August published a study of The Gentleman ransomware, which can be read here: https://www.comparitech.com/news/the-gentlemen-ransomware-stats-on-attacks-ransoms-data-breaches/

Leave a comment »

Inside ICMacOS: From an Infostealer to a Persistent RAT

Posted in Commentary with tags on October 12, 2026 by itnerd

SOCRadar researchers have just published a new analysis of ICMacOS (also marketed as Icarus macOS), a Malware-as-a-Service infostealer for macOS that has been actively advertised on Russian-speaking cybercrime forums, including XSS, Exploit.in, and Rehub, since early September 2026.

Key findings include:

  • Rapid evolution: Within weeks of its public launch, ICMacOS moved from one-shot credential and wallet theft to a persistent remote access trojan, adding LaunchAgent persistence and a live WebSocket-based shell that lets operators run commands on infected Macs in real time
  • Developer and enterprise exposure: The malware specifically harvests SSH keys, AWS, Kubernetes and cloud CLI credentials, Git tokens, and .env files, creating a potential pathway from a single compromised Mac into broader enterprise infrastructure and the software supply chain
  • Convincing social engineering: ICMacOS is delivered through ClickFix pages that trick victims into pasting terminal commands, then displays a fake “System Preferences” dialog to capture the user’s login password and validates it against the local Keychain
  • Wide collection scope: Targets include browser credentials and cookies across Chromium, Safari, and Firefox, 29 browser extensions covering crypto wallets and password managers, desktop crypto wallets, the macOS Keychain, Telegram, WhatsApp, Discord, iMessage, and Apple Notes; the latest version adds Steam, Outlook, clipboard contents, and additional password managers
  • Commercial operation: The stealer is sold by an actor using the handle GlowComa, operating under the MADHASH crypto-draining affiliate group, at $699 per week, $1,199 every two weeks, or $1,699 per month, and it is configured to avoid infecting systems in Russia and CIS countries

For full details, the analysis can be found here: https://socradar.io/blog/icmacos-infostealer-rat/

Leave a comment »

Amazon Fire TV Cube hacked using 4-year-old vulnerability

Posted in Commentary with tags on October 12, 2026 by itnerd

Amazon’s Fire TV Cube 3rd Gen has been hacked using a four-year-old GPU vulnerability, allowing users to gain complete control over the device, Cybernews reports.

The discovery has sparked excitement among home theater enthusiasts, who are exploiting the flaw to turn the Cube into a powerful media player. However, the same vulnerability could also pose security risks.

Here are the key findings:

  • The vulnerability (CVE-2022-38181), rated 8.8/10 in severity, allows arbitrary kernel code execution and root access.
  • ARM patched the flaw in August 2022, two months before the Fire TV Cube 3rd Gen was released.
  • Enthusiasts are using the exploit to install custom operating systems, remove Amazon’s software, and unlock advanced video and audio playback capabilities.
  • Attackers could potentially exploit the vulnerability to spy on users, steal data, or incorporate devices into botnets, although there’s no evidence of active exploitation in the wild.

Amazon told Cybernews that the demonstrated method poses little risk to customers, as it requires physical access and deliberate, multi-step modifications. The company says it’s reviewing the details and will take appropriate action if needed.

You can read the full story here: https://cybernews.com/security/amazon-fire-tv-cube-root-exploit-enables-full-unlock/ 

Leave a comment »

Park Place Technologies Extends Microsoft Cloud Capability Across U.S. and Canada

Posted in Commentary with tags on October 12, 2026 by itnerd

Park Place Technologies has extended its Microsoft Cloud Solution Provider (CSP) capability for Microsoft Azure to customers across the United States and Canada. This extension brings a cloud practice already established in Europe to two of the company’s largest and fastest-growing markets.  

Park Place Technologies is now able to license, provision, support and manage Microsoft Cloud services for customers throughout the United States and Canada, with support for Microsoft 365, Azure, Azure Virtual Desktop (AVD) and Microsoft’s broader business, data and AI platforms. 

The significance of this expansion is what it enables for customers: a more direct, accountable path to Microsoft cloud and applications. It also empowers customers to make enhanced infrastructure decisions with the support of a partner that already understands their estates.  

Park Place has built its reputation by supporting complex, business-critical infrastructure for more than 35 years, a foundation that remains a key advantage as customer estates become more hybrid, distributed and outcome-driven. The company’s cloud practice is underpinned by a firm commitment to continuously innovate, expand and add new routes to value without losing sight of the infrastructure realities customers depend on daily. 

Bringing CSP capability in-house removes a layer of complexity for customers and puts Park Place’s own engineers and account teams behind every Azure engagement, from design through ongoing support.  

For customers in the U.S. and Canada, Park Place’s CSP capability includes cost optimization and management, security and identity services and managed cloud operations across Azure Virtual Desktop, Microsoft 365, SQL, Dynamics and Copilot. This complements the company’s broader Microsoft competencies, supporting the full journey from migration and modernization planning to ongoing Microsoft environment support. It also strengthens Park Place’s broader Infrastructure Managed Services and Software Technical Support portfolio solutions, allowing customers to leverage a single partner for cloud, Microsoft environments and the infrastructure that supports them. 

Park Place’s expanded Microsoft Cloud Solution Provider CSP capability is available now to customers and partners across the United States and Canada. Organizations interested in learning more can contact their Park Place representative or visit ParkPlaceTechnologies.com. 

Leave a comment »