> InfoSec News Nuggets 11/12/2025

A jailed hacking kingpin reveals all about the gang that left a trail of destruction After years of reading about “Tank” and months of planning a visit to him in a Colorado prison, I hear the door click open before I see him walk into the room. I stand up ready to give this former cyber-crime kingpin a professional hello. But, like a cheeky cartoon character, he pokes his head around a pillar with a giant grin on his face and winks. Tank, whose real name is Vyacheslav Penchukov, climbed to the top of the cyber-underworld not so much with technical wizardry, but with criminal charm. “I am a friendly guy, I make friends easily,” the 39-year-old Ukrainian says, with a broad smile.   Phishers try to lure 5K Facebook advertisers with fake business pages More than 5,000 businesses that use Facebook for advertising were bombarded by tens of thousands of phishing emails in a credential- and data-stealing campaign. Check Point researchers say that they spotted about 40,000 phishing emails sent to their customers across the US, Europe, Canada, and Australia – and they were sent from the legitimate facebookmail.com domain. While most organizations received fewer than 300 messages, one company alone was hit with more than 4,200. To pull off this phishing expedition, the criminals created shell Facebook Business pages representing businesses that don’t exist, and then used the Business invitation feature to send phishing emails that look like the real deal. North Korean hackers exploit Google’s safety tools for remote wipe North Korea-linked threat actors have found a novel way to weaponize Google’s own security ecosystem, using it to wipe espionage data from victim phones remotely. According to findings by Genians Security Center (GSC), the attackers leveraged the Android device-tracing and management service “Find Hub” to remotely wipe data on Android phones and tablets. “While Find Hub is intended to safeguard Android devices, this is the first confirmed case in which a state-sponsored threat actor obtained remote control by compromising Google accounts, then used the service to perform location tracking and remote wipe,” GSC researchers said in a blog post. “This development demonstrates a realistic risk that the feature can be abused within APT campaigns.”   Zscaler warns industrial operations face mounting risk as IoT, OT attacks surge across energy, manufacturing sectors Zscaler ThreatLabz reported a 67% surge in Android malware, with 40% of IoT attacks now targeting critical industries and hybrid work environments. Critical infrastructure in the energy sector experienced a 387% increase in attacks compared to the previous year. This comes as mobile, IoT, and OT (operational technology) systems have become the backbone of business operations today, enabling innovation and powering critical infrastructure across industries. While mobile devices dominate global connectivity, IoT and OT systems keep manufacturing, healthcare, transportation, and smart cities running.    Google Sues Chinese Cybercriminals Behind ‘Lighthouse’ Phishing Kit Google on Tuesday announced that it has filed a lawsuit against a cybercrime group believed to be operating out of China. The group, known as Smishing Triad, has been active since at least 2023, targeting users around the world in large-scale SMS phishing (smishing) campaigns.  The group’s malicious SMS messages impersonate toll and package delivery services — Google provided E-ZPass and USPS as an example — as well as banks, healthcare organizations, online payment platforms, law enforcement, and social media services. Google has targeted Lighthouse, a recently launched phishing-as-a-service kit that enables cybercriminals to send out messages containing links to phishing sites. The malicious sites are set up to trick users into handing over email credentials, banking details, and other sensitive information.  The post InfoSec News Nuggets 11/12/2025 appeared first on AboutDFIR - The Definitive Compendium Project.