Hunters International ransomware claims attack on Tata Technologies - Related to technologies, toronto, ransomware, fixes, authorities

Google fixes Android zero-day exploited by Serbian authorities

Google has released patches for 43 vulnerabilities in Android's March 2025 security revision, including two zero-days exploited in targeted attacks.

Serbian authorities have used one of the zero-days, a high-severity information disclosure security vulnerability (CVE-2024-50302) in the Linux kernel's driver for Human Interface Devices, to unlock confiscated devices.

The flaw was reportedly exploited as part of an Android zero-day exploit chain developed by Israeli digital forensics enterprise Cellebrite to unlock confiscated devices.

The exploit chain—which also includes a USB Video Class zero-day (CVE-2024-53104) patched last month and an ALSA USB-sound driver zero-day)—was found by Amnesty International's Security Lab in mid-2024 while analyzing the logs found on a device unlocked by Serbian authorities.

Google told BleepingComputer last week that they shared fixes for these flaws with OEM partners in January.

"We were aware of these vulnerabilities and exploitation risk prior to these reports and promptly developed fixes for Android. Fixes were shared with OEM partners in a partner advisory on January 18," a Google spokesperson told BleepingComputer.

The second zero-day fixed this month (CVE-2024-43093) is an Android Framework privilege escalation vulnerability that allows local attackers to access sensitive directories due to incorrect unicode normalization by exploiting a file path filter bypass without additional execution privileges or user interaction.

This month's Android security updates also address 11 vulnerabilities that can let attackers gain remote code execution on vulnerable devices.

Google has issued two sets of security patches, the 2025-03-01 and 2025-03-01 security patch levels. The latter comes with all fixes from the first batch and patches for closed-source third-party and kernel subcomponents, which may not apply to all Android devices.

Google Pixel devices receive the updates immediately, while other vendors will often take longer to test and fine-tune the security patches for their hardware configurations.

Manufacturers can also prioritize the earlier patch set for quicker updates, which does not necessarily indicate increased exploitation risk.

In November, the enterprise patched another Android zero-day (CVE-2024-43047), which was first tagged as exploited by Google Project Zero in October 2024 and used by the Serbian government in NoviSpy spyware attacks targeting the Android devices of activists, journalists, and protestors.

A new botnet malware named 'Eleven11bot' has infected over 86,000 IoT devices, primarily security cameras and network video recorders (NVRs), to condu......

Scammers are impersonating the BianLian ransomware gang in fake ransom notes sent to US companies via snail mail through the United States Postal Serv......

New research has uncovered further links between the Black Basta and Cactus ransomware gangs, with members of both groups utilizing the same social en......

Hunters International ransomware claims attack on Tata Technologies

The Hunters International ransomware gang has claimed responsibility for a January cyberattack attack on Tata Technologies, stating they stole [website] of data from the business.

Tata Technologies provides engineering and digital solutions for manufacturing industries worldwide. Founded in 1989 and based in Pune, it operates in 27 countries with over 12,500 employees, specializing in automotive, aerospace, and industrial sectors with product development and digital transformation services.

The Indian tech giant reported in January 2025 that it had suffered a security breach by ransomware actors, which disrupted parts of its IT systems. The organization noted that the incident's impact on its operations was minimal, while client delivery services were not affected at all.

Tata noted it was already restoring impacted IT systems and promised to share more updates as soon as its internal investigations, aided by experts in the field, produced results.

With no further updates have been shared by the firm for over a month, Hunters International added an entry of Tata Technologies on its extortion page on the dark web, claiming responsibility for the attack.

Tata Technologies listed on Hunters International extortion page.

The threat actors claim to have stolen [website] of data from Tata Technologies, consisting of 730,000 files. The ransomware gang threatens to release the stolen files in exactly one week if a ransom demand is not met.

However, Hunters International did not post any samples of the stolen files or elaborate on what kind of documents they hold.

BleepingComputer has contacted Tata Technologies about the threat actor's allegations, but a comment wasn't immediately available.

Hunters International is a ransomware group that had had high-profile attacks since late 2023, when it emerged as a potential rebrand of Hive. The gang's attacks include breaches of [website] Navy contractor Austal USA and Japanese optics giant Hoya.

The threat group also became notorious for showing no ethical barriers, even engaging in individual extortion targeting Fred Hutch cancer patients.

Although many of their implies were validated, there have been cases of dispute, like the one from the [website] Marshals Service in August 2024, which denied that its systems were breached by Hunters contrary to the threat actor's allegations.

Mit Erscheinen von iOS 18 hatte Apple im September zahlreiche, auch schwere Sicherheitslücken gestopft. Das dazugehörige Supportdokument mit weiteren ......

Microsoft hat Windows 365 Disaster Recovery Plus vorgestellt. Zum jetzigen Zeitpunkt liegt das Disaster-Recovery-Tool als lizenzpflichtiges Add-on für......

​The Polish Space Agency (POLSA) has been offline since it disconnected its systems from the Internet over the weekend to contain a breach of its IT i......

Toronto Zoo shares update on last year's ransomware attack

The Toronto Zoo, the largest zoo in Canada, has provided more information about the data stolen during a ransomware attack in January 2024.

In a final notification regarding the cyberattack, the Toronto Zoo stated the resulting data breach impacts varying combinations of personal and financial information belonging to employees, former employees, volunteers, and donors.

The exposed information includes transaction data such as impacted individuals' names, street address information, phone numbers, and e-mail addresses. It also contains the last four digits of credit card numbers and associated expiration dates for guests and members who made credit card transactions between January 2022 and April 2023.

"The data includes information about all guests and members who engaged the following types of transactions between 2000 to April 2023: general admission and membership purchases," it expressed.

The zoo disclosed the incident on January 8, saying the attack did not impact the animals' well-being or day-to-day operations.

Toronto Zoo has reported the data breach to the Office of the Information and Privacy Commissioner of Ontario (the IPC) and advises those affected to monitor financial account statements for suspicious activity.

While Toronto Zoo has not officially linked the incident to a specific threat actor or hacking group, the Akira ransomware operation claimed the breach in January 2024 and has since .

Akira states they've stolen 133GB of files from the zoo's compromised file server, including database backups, ticket information, and other user data.

In early February, the cybercrime gang started seeding a torrent file containing multiple archives containing over 35GB of this data.

TorontoZoo entry on Akira's leak site (BleepingComputer).

"Lots of NDAs and confidential agreements are represented in the data. Some personal files (driver licenses and so on) can be found in the files. And of course, lots of interesting info about animals," the ransomware group says on its leak site.

​Akira emerged two years ago, in March 2023, and has quickly gained notoriety after adding a long string of victims worldwide across various industry verticals.

Based on negotiation chats seen by BleepingComputer, Akira demands ransoms ranging from $200,000 to millions of dollars, depending on the size of the compromised organization.

So far, Akira has claimed multiple high-profile victims, including Stanford University, Nissan Oceania, and Nissan Australia. Since it surfaced, the gang has added over 300 organizations to its dark web leak site.

, Akira ransomware operators have breached over 250 organizations and collected roughly $42 million in ransom payments until April 2024.

A new campaign is targeting companies in Taiwan with malware known as Winos [website] as part of phishing emails masquerading as the country's National Taxa......

We’ve all heard a million times: growing demand for robust cybersecurity in the face of rising cyber threats is undeniable. Globally small and medium-......

Separate fixes to macOS and iOS patch respective flaws in the kernel and WebKit that can allow threat actors to take over devices and are under attack......