May 12, 2025

Eyes up, Digital Defenders! 🛡️

AI is working on both sides of the cyber battle, from blocking scams to slipping past weak defenses. Ransomware groups are facing pressure from more than just law enforcement, while trusted workplace software is being turned into a weapon. Trust is being tested—and so is your readiness.

Let’s see what’s keeping security teams on high alert.

Here’s what you need to know:

Chrome’s new AI protection scans sites in real time to block scams
Schools hit with renewed extortion after PowerSchool ransom payment
Google uncovers espionage malware aimed at NGOs and military personnel
LockBit ransomware gang breached, backend data dumped online

Advertise in Cybersecurity Insider

Zero-Day Download

Chrome’s New AI Watches for Scams as You Click

Google’s rolling out a smarter Chrome, now equipped with “Enhanced Protection,” an AI-powered feature that flags scammy sites the moment you open them. Powered by Gemini Nano, the tool analyzes pages directly on your device to detect fake logins and phishing traps—without sending your data to the cloud.

Source: SlashGear

If you’ve ever hovered over a sketchy link, unsure whether to click, this one’s for you. The protection is fast, private, and always on, with no add-ons required. Uncertain if it’s active? Now’s the time to check your settings.

96% of Organizations Aren’t Ready for AI-Driven Threats, Cisco Finds

Cisco’s new Cybersecurity Readiness Index paints a sobering picture: just 4% of global organizations are “mature” in their cyber defenses. Most are struggling to keep up with AI-fueled attacks, despite 86% facing at least one AI-related security incident last year.

The gap isn’t just about tools—it’s about people and planning. Cisco’s report shows that many teams lack the understanding and training to recognize AI-driven threats, let alone stop them.

As threat actors embrace automation and generative AI, defenders must move just as fast.

Hackers Double-Cross PowerSchool After Ransom Paid

PowerSchool, a major edtech firm, paid off hackers after a breach. But the extortion didn’t stop there.

The attack compromised sensitive data, including student names, birth dates, contact details, and Social Security numbers from multiple school districts. Despite the attackers’ promise to delete the stolen data after payment, several districts—including Toronto—have reported receiving new ransom demands tied to the same breach.

Paying a ransom doesn’t end the damage. This incident is a clear warning for schools to strengthen defenses before data is stolen. Once attackers break in, they rarely stop at just one demand.

Share this newsletter!

Threat Tracker

Russia’s Cold River Deploys New ‘LOSTKEYS’ Malware

Google has identified a new malware strain, dubbed “LOSTKEYS,” linked to the Russian hacking group Cold River, also known as APT29.

This malware can steal files and transmit system data back to attackers. Recent campaigns have targeted Western government advisors, military personnel, journalists, and NGOs. It also uses compromised websites to deliver malicious documents via phishing emails.

Russia’s Cold River Deploys New ‘LOSTKEYS’ Malware

Source: Fresh Security

Anyone handling sensitive information should stay alert as these campaigns are precise, persistent, and built to evade basic defenses.

LockBit Ransomware Gang Breached, Internal Data Leaked

The LockBit ransomware group—once among the most active and feared—has been hacked.

Unknown actors defaced its dark web portals and leaked a trove of internal data, including negotiation transcripts, victim lists, and details about its infrastructure. The MySQL dump also exposed how LockBit coordinated with affiliates, revealing just how structured and business-like these operations have become.

The breach exposes how ransomware gangs negotiate, stall for time, and pressure victims into paying. Check your incident response plan and ensure your team knows how to act quickly if ransomware hits.

Kickidler Monitoring Software Exploited in Ransomware Attacks

Attackers are misusing Kickidler, a legitimate employee tracking tool, as part of targeted ransomware operations. Once inside, they deploy the software to monitor keystrokes and capture credentials before launching their payload. It’s being used to quietly prepare attacks from within compromised environments.

If your organization uses remote monitoring tools, now is the time to audit access controls and monitor what’s running in your environment.

Snackable Bytes

Take control of credentials before attackers do. NinjaOne’s endpoint management platform helps IT teams lock down devices, automate patching, and reduce exposure across the board—from one centralized dashboard.
Looking to break into cybersecurity? Microsoft’s Cybersecurity Analyst course on Coursera covers the tools, techniques, and skills hiring managers want—no experience required.

🛡️ This section contains sponsored cybersecurity insights.

Security Tip of the Day

Don’t Assume Hackers Keep Their Word

PowerSchool paid a ransom after a major breach, only to face new extortion demands. It's a clear example of why the FBI advises against paying. Cybercriminals often break promises, reuse stolen data, or come back for more.

Source: CybelAngel

Here’s how to protect your organization before and after an attack:

Keep secure, offline backups: Backups disconnected from your network ensure you can restore systems without relying on a criminal’s word or tool.
Expect data reuse or resale: Even if attackers say they’ll delete your data, assume it’s already copied and will surface again.
Build and rehearse an incident response plan: Don’t wait until a breach to determine who does what. A clear, practiced plan saves time and reduces damage.
Report every incident to law enforcement: Agencies like the FBI can help investigate, track threat actors, and possibly prevent future attacks.

Ransomware hits hard. However, trusting attackers only makes recovery more complicated.

Secure Links: The Must-Reads

Global Sweep Wipes Out Major DDoS-for-Hire Sites

Law enforcement from the U.S., U.K., Germany, Poland, the Netherlands, and others carried out a coordinated takedown of nine DDoS-for-hire services under Operation PowerOFF. Domains were seized, servers dismantled, and site operators now face charges.

The operation also targeted repeat offenders and customers, aiming to disrupt supply and demand in the DDoS-for-hire market.

Global Sweep Wipes Out Major DDoS-for-Hire Sites

Source: PCMag

DDoS services may seem like a quick way to disrupt competitors or settle grudges, but they now come with serious legal consequences. If you see one, report it.

Fake Wallet Sites Flood Search Results in Crypto Theft Scam

Researchers have found over 38,000 fake subdomains linked to FreeDrain, a campaign built to lure crypto holders into giving up their wallet seed phrases. These pages use search engine optimization tricks to appear legitimate, then redirect users to phishing sites that drain funds instantly.

If you’re managing crypto, don’t trust search links. Instead, go straight to official domains…or you could lose everything.

Security Question of the Week

Have you tested your incident response plan in the last 12 months?

✅ Yes — we run regular drills.

🤔 Not yet — it’s on the to-do list.

🛑 No — we’d be scrambling in a real attack.

Meet Our Writers:

Leon Yen

Leon Yen is a cybersecurity expert and seasoned tech journalist with over a decade of experience, including founding a cyber risk startup and leading industry-focused research and reporting.

Liz Ticong

Liz Ticong is a tech writer specializing in AI and software tools, known for turning complex topics into clear, actionable insights through hands-on testing and analysis.

We're Hiring! 📝

We're looking for talented writers to help shape Cybersecurity Insider. If you're passionate about cyber security, apply to join our team!

Apply Now!

Cybersecurity Insider is a TechnologyAdvice business

TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 100, Nashville, TN 37211, USA.

Want to change how you receive these emails? Update your preferences or unsubscribe here.