A phishing email campaign targeting users in Poland and Germany has been delivering various payloads such as Agent Tesla, Snake Keylogger, and a previously unknown backdoor called TorNet via PureCrypter. The threat actor disconnects the victim machine from the network before dropping the payload and then reconnecting, helping them to evade detection by cloud antimalware solutions. The attacks usually start with phishing emails impersonating financial institutions and manufacturing and logistics companies.

DuPage County sheriff, court affected by ‘cyber incident,' officials say – FOX 32 Chicago
DuPage County officials have reported a cyber incident affecting the sheriff’s office and court systems. In response, the county established a Cybersecurity Task Force to