As U.S. government agencies and thousands of companies around the world assess whether they’ve been compromised in the SolarWinds breach, security experts are concerned that the full reach of the suspected hackers may only be just coming to light.

U.S. government cybersecurity agencies warned this week that the attackers behind the widespread hacking spree used weaknesses in other, non-SolarWinds products to attack high-value targets.

U.S. Justice Department officials said they had seized two internet domains purporting to belong to biotechnology firms developing treatments for the coronavirus, but which really were used to collect visitors’ personal data as part of a scam.

A threat actor is distributing fake Windows and Android installers for the Cyberpunk 2077 game that is installing a ransomware calling itself CoderWare, according to a Kaspersky researcher.

The hackers have been able to do more damage at FERC than the other agencies, and officials there have evidence of highly malicious activity, the officials said, but did not elaborate.

An ongoing law enforcement operation has disrupted aspects of a leading website where internet scammers frequently buy and sell stolen data, according to the site’s administrators.

Suspected Russian hack involving SolarWinds software that compromised parts of the U.S. government was executed on a scale that has surprised even veteran security experts.

News of Microsoft’s compromise was first reported by Reuters, which also said the company’s own products were then used to strike other victims by leveraging its cloud offerings.

The malware derives its name from GitHub, and Pastebin – which are used for propagation – and 12 different exploits for previously-known vulnerabilities.

Brute-force attacks typically are aimed at computers and devices on organizational networks to capture email addresses, passwords, passphrases, usernames, and PINs.