Cybersecurity researchers at Hudson Rock have recognized a brand new wave of cyber assaults by the HellCat ransomware group, this time concentrating on 4 firms throughout america and Europe. The widespread thread? Stolen Jira credentials, extracted by infostealer malware<\/a><\/strong> lengthy earlier than the precise breaches passed off.<\/p>\n

Who Obtained Hit<\/strong><\/h3>\n
On April 5, 2025, HellCat posted proof of the breaches to their leak web site, full with countdown timers and their signature `\u201cJiraware < < 3!!\u201d<\/code><\/strong> tagline. In response to their posts, they\u2019ve stolen inside recordsdata, emails, and monetary information, they usually\u2019re threatening to leak or promote the info if the businesses don\u2019t meet their calls for.<\/p>\n`
`The brand new victims embody:<\/p>\n`
`\nAsseco Poland (Poland)<\/strong> \u2013 a serious IT options supplier<\/li>\n HighWire Press (USA)<\/strong> \u2013 a platform serving scholarly publishers<\/li>\n Racami (USA)<\/strong> \u2013 a agency centered on buyer communications tech<\/li>\n`LeoVegas Group (Sweden)<\/strong> \u2013 a web-based gaming and betting firm<\/li>\n<\/ul>\nHow They Obtained In<\/strong><\/h3>\nIn response to Hudson Rock\u2019s report<\/a> <\/strong>shared with Hackread.com, the corporate traced each considered one of these breaches again to the identical root trigger: Jira credentials stolen by infostealer malware. These malware variants, StealC<\/strong><\/a>, Raccoon, Redline<\/a><\/strong>, and Lumma Stealer<\/a><\/strong>, harvested login information from contaminated worker machines months (generally years) earlier than the precise assaults.<\/p>\n As soon as HellCat obtained their palms on these credentials, they logged into every firm\u2019s Atlassian Jira setting<\/a><\/strong>. From there, they moved by means of inside methods, grabbed delicate information, and kicked off their typical ransomware course of.<\/p>\n This isn\u2019t a brand new tactic for them. HellCat has beforehand used the identical technique to breach Jaguar Land Rover, Telefonica, Schneider Electrical, and Orange, amongst others. It\u2019s a sample: discover credentials in infostealer logs, entry Jira, exfiltrate information, and demand ransom.<\/p>\n \n<\/a>Compromised infrastructure of US-based agency Racami (Screenshot: Hudson Rock)<\/figcaption><\/figure>\n<\/div>\nIt\u2019s additionally value stating {that a} latest report<\/a><\/strong> from Hudson Rock additionally revealed how infostealers, some offered for as little as $10, have compromised important infrastructure worldwide. Much more regarding, the affected methods embody worker machines on the FBI, Lockheed Martin, Honeywell, and branches of the US army.<\/p>\n Why Jira?<\/strong><\/h3>\nJira is greater than only a undertaking administration software. In lots of firms, it\u2019s the principle system linked to growth workflows, buyer information, inside documentation, and system entry controls. If attackers can get into Jira, they’ll usually get into nearly all the things else.<\/p>\n That\u2019s precisely what makes it such a high-value goal for ransomware teams like HellCat. And since many organizations don\u2019t deal with Jira accounts with the identical stage of safety as, say, e-mail or VPN entry, it turns into a straightforward win for attackers.<\/p>\nThe Larger Downside: Infostealers<\/strong><\/h3>\nResearchers consider that HellCat\u2019s modus operandi solely works as a result of infostealer malware infect person gadgets and steal saved logins, cookies, session tokens, and extra. The info is both offered on darkish net markets<\/a><\/strong> or used immediately by teams like HellCat.<\/p>\n Hudson Rock\u2019s personal information, primarily based on over 30 million contaminated methods, reveals that hundreds of firms have Jira-related credentials saved in infostealer logs. In these newest instances, the stolen credentials have been simply sitting there, unmonitored and unchanged, giving HellCat on a regular basis it wanted to organize the breach.<\/p>\n What Corporations Ought to Be Doing<\/strong><\/h3>\nThere are some steps firms can take to scale back the danger of assaults like these. First, it\u2019s essential to observe for infostealer infections utilizing instruments that may flag stolen credentials earlier than they\u2019re used. If any indicators of malware present up, compromised logins must be reset instantly, entry reviewed, and suspicious exercise tracked intently. <\/p>\n Jira, specifically, must be locked down with multi-factor authentication, restricted entry, and correct community segmentation to restrict how far an attacker can get in the event that they break in. And since many of those infections begin with phishing or dangerous downloads, common worker coaching goes a great distance in stopping them within the first place.<\/p>\n Nonetheless, HellCat isn\u2019t doing something out of the field as a result of they don\u2019t should. So long as organizations depart stolen credentials unchecked and hold utilizing single-layer authentication for instruments like Jira, teams like HellCat will hold taking up.<\/p>\n<\/p><\/div>\n <\/script> \n <\/p>\n","protected":false},"excerpt":{"rendered":" Cybersecurity researchers at Hudson Rock have recognized a brand new wave of cyber assaults by the HellCat ransomware group, this time concentrating on 4 firms throughout america and Europe. The widespread thread? Stolen Jira credentials, extracted by infostealer malware lengthy earlier than the precise breaches passed off. Who Obtained Hit On April 5, 2025, HellCat […]<\/p>\n","protected":false},"author":2,"featured_media":1165,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[58],"tags":[483,1018,1016,1017,1019,1020,500],"class_list":["post-1163","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-credentials","tag-firms","tag-hellcat","tag-hits","tag-infostealerstolen","tag-jira","tag-ransomware"],"_links":{"self":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts\/1163","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1163"}],"version-history":[{"count":1,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts\/1163\/revisions"}],"predecessor-version":[{"id":1164,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts\/1163\/revisions\/1164"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/media\/1165"}],"wp:attachment":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1163"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1163"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1163"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}