Week of June 16, 2025: Scattered Spider turns to insurers as Aflac discloses a breach, and Nobitex is drained

What mattered to security leaders in the week of June 16, 2025? Google's threat intelligence group warned on Monday that intrusions bearing Scattered Spider's hallmarks had moved into the US insurance industry, and on Friday Aflac filed an 8-K saying it had found unauthorized access to its network on June 12. In the Israel-Iran conflict, the pro-Israel group Predatory Sparrow drained more than $90 million from Iran's largest crypto exchange, and Nucor told investors that attackers behind its May incident had taken some data.

Google warns Scattered Spider has moved on to US insurers

On June 16 John Hultquist of Google Threat Intelligence Group said GTIG was aware of multiple US intrusions bearing all the hallmarks of Scattered Spider, now in the insurance industry, after the group earlier worked through UK and then US retailers. Because it tends to take one sector at a time, he said insurers should be on high alert and watch for social engineering of help desks and call centers. Philadelphia Insurance Companies and Erie Insurance had both disclosed disruptive incidents earlier in June. Help desk identity verification was the control to test. (BleepingComputer)

Aflac discloses unauthorized access to its US network

In an 8-K filed June 20 under Item 8.01, Aflac said it identified unauthorized access to its network on June 12 and believes it contained the intrusion within hours. Its systems were not affected by ransomware and it continued to underwrite policies and handle claims. Potentially affected files include claims and health information, Social Security numbers and other personal data about customers, beneficiaries, employees and agents in its US business; the number of people affected was not yet known. The disclosure followed Google's warning to the sector by four days. (Aflac Incorporated (SEC EDGAR))

Predatory Sparrow drains and burns $90 million from Nobitex

The pro-Israel group Predatory Sparrow claimed an attack on Nobitex, Iran's largest crypto exchange, on June 18, following an earlier claimed attack on Bank Sepah, which the group tied to the IRGC. Blockchain analysts at Elliptic said more than $90 million was moved out of Nobitex wallets, and the group sent nearly all of it to vanity addresses carrying anti-IRGC messages, effectively destroying the funds. It also threatened to publish the exchange's source code, and Nobitex's website stayed offline. The attack showed geopolitically motivated operations aimed at destruction rather than profit. (BleepingComputer)

Nucor confirms data exfiltration in its May cyber incident

Steelmaker Nucor filed an amended 8-K on June 20 adding detail under Item 1.05 to its May 14 disclosure. Its investigation found that a threat actor illegally accessed its IT systems and exfiltrated limited data, and that the company had temporarily halted some production as a precaution. Nucor said affected operations and applications had since been restored, that it restored data from backups, and that it believed the attacker no longer had access. It planned notifications to affected parties and regulators as required. (Nucor Corporation (SEC EDGAR))

Keyloggers found on Outlook on the Web login pages worldwide

Positive Technologies reported on June 17 that unknown actors had compromised internet-facing Microsoft Exchange servers at government bodies and companies and injected browser keyloggers into their Outlook on the Web login pages. Some scripts wrote captured credentials to a file on the server, while others sent them to Telegram bots or Discord. Most compromised servers were at government organizations, 22 of them, followed by IT, industrial and logistics firms, across Asia, Europe, Africa and the Middle East. How the attackers got in is unknown, though some servers were still exposed to ProxyLogon and ProxyShell. (Help Net Security)

Qualys chains two Linux flaws to reach root on most distributions

Qualys disclosed CVE-2025-6018, a PAM configuration flaw in openSUSE Leap 15 and SUSE Linux Enterprise 15 that gives an unprivileged remote SSH user the allow_active privileges of a user at the console, and CVE-2025-6019 in libblockdev, which those privileges can then exploit to become root. Qualys said the chain works on most Linux distributions with minimal effort, and root access lets an attacker switch off EDR agents and plant backdoors. (Help Net Security)

Apple and TP-Link flaws added to the KEV catalog

On June 16 CISA added two actively exploited vulnerabilities to its KEV catalog: CVE-2025-43200, an unspecified vulnerability in multiple Apple products, and CVE-2023-33538, a command injection flaw in multiple TP-Link routers. Old consumer-grade routers in branch or home-office use remain a quiet exposure for many organizations. (CISA)