Yazılar

Star Health Hacker Claims Responsibility for Death Threats and Bullet Packages Sent to Executives

/in /tarafından

The hacker known as “xenZen”, who last year leaked sensitive data from Star Health and Allied Insurance Company—India’s largest health insurer—has claimed responsibility for sending death threats and bullet cartridges to the company’s top executives, according to a March 31 email obtained by Reuters.

In a chilling escalation, xenZen said the threats were a direct reprisal for the insurer’s alleged denial of medical claims to customers. The packages, reportedly sent in February to Star Health’s headquarters in Chennai, Tamil Nadu, were addressed to CEO Anand Roy and CFO Nilesh Kambli. Inside, a note warned:

“next one will go in ur and ur peoples head. tik tik tik.”

Reuters reviewed photographs included in the hacker’s email that appear to show the threatening packages. While the news agency has not independently verified the hacker’s identity or the full accuracy of the information provided, three Indian police sources confirmed that a criminal investigation is underway. According to one source, a man in the neighboring state of Telangana has been arrested for allegedly facilitating the delivery of the packages.

Star Health declined to comment in detail, citing an “ongoing, highly sensitive criminal investigation.” CFO Kambli directed inquiries to the company’s PR team, and CEO Roy did not respond to calls for comment.

The case adds to growing concerns over executive security in the healthcare industry, especially after the murder of UnitedHealthcare CEO Brian Thompson in December — an incident that reportedly inspired xenZen’s threats.

Last year, the hacker leaked what they claimed was 7.24 terabytes of personal data related to over 31 million customers, including medical reports and insurance details. Star Health confirmed the data breach, which followed a ransom demand of $68,000. The company has since launched legal action against xenZen and Telegram, which was used to distribute the stolen data via chatbots. Those bots have since been removed.

In the latest email, xenZen claimed the threats followed requests from disgruntled customers who alleged their valid claims had been denied despite having coverage. Star Health has not responded to these specific allegations.

As the case unfolds, the incident raises urgent questions about data security, corporate accountability, and the physical safety of executives in an era where cyberattacks increasingly blur into real-world consequences.

Ransomware Gang Lockbit Reportedly Hacked in Embarrassing Leak

/in /tarafından

In an ironic twist, Lockbit — one of the world’s most notorious ransomware gangs — appears to have fallen victim to a cyberattack of its own, according to security analysts and a rogue message posted on one of the group’s darkweb sites.

On Wednesday, Lockbit’s site was replaced with a taunting message that read:

“Don’t do crime. CRIME IS BAD xoxo from Prague”
The site also included a link to what appears to be a leaked cache of internal data, potentially containing chats between Lockbit members and their victims.

While Reuters has not independently verified the data, multiple cybersecurity experts have assessed the leak and confirmed its authenticity.

“It’s legit,” said Jon DiMaggio, chief security strategist at Analyst1.
Christiaan Beek of Rapid7 noted the leak revealed Lockbit’s indiscriminate targeting — even aggressively pursuing small businesses for minor ransom payouts.
“They attack everyone,” he added.

Who hacked Lockbit remains unclear, and some of the group’s associated darkweb infrastructure is currently down, with placeholder messages stating sites will be “working soon.” However, the damage may already be done.

This is not the first time Lockbit has faced disruption. In 2023, U.K. and U.S. authorities, alongside international partners, seized parts of the gang’s infrastructure. At the time, Lockbit quickly resurfaced and defiantly declared,

“I cannot be stopped.”
But this latest incident appears more personal — and humiliating.

DiMaggio described the breach as a significant blow to the gang’s operations and credibility:

“I think it will hurt them and slow them down.”

Lockbit, once dubbed “the Walmart of ransomware” due to its prolific activity and reach, now faces a potentially destabilizing turn of events — and an unexpected reminder that even cybercriminals aren’t immune to being hacked.

Google Uncovers New Russian Malware ‘LOSTKEYS’ Linked to Cold River Hacking Group

/in /tarafından

Google’s Threat Intelligence Group announced Wednesday the discovery of a new malware strain called “LOSTKEYS”, which has been linked to the Russia-based hacking group Cold River, believed to have ties to the Russian Federal Security Service (FSB).

According to Google researcher Wesley Shields, the malware marks a significant expansion in Cold River’s cyber toolkit, with capabilities that include file theft and system reconnaissance, enabling attackers to gather intelligence on high-profile individuals and institutions.

“LOSTKEYS represents a new development in the toolset used by Cold River,” Shields stated in a blog post.

Recent Targeting Activity:

  • Attacks observed in January, March, and April 2025

  • Targets include current and former advisers to Western governments, military personnel, NGOs, journalists, think tanks, and individuals connected to Ukraine

  • Cold River continues to pursue espionage goals in line with Russian strategic interests

Background on Cold River:

Cold River gained notoriety for targeting:

  • Three U.S. nuclear research labs in 2022

  • Private email leaks of former British spymaster Richard Dearlove and other pro-Brexit figures

  • Credential theft campaigns targeting NATO governments and NGOs

The Russian embassy in Washington did not immediately respond to requests for comment.

The revelation underscores ongoing concerns about state-sponsored cyber threats emanating from Russia, particularly amid the ongoing war in Ukraine and heightened geopolitical tensions.