MSP cybersecurity news digest, June 30, 2025

This report summarizes multiple active threats: attackers exploited authenticode stuffing to create signed ConnectWise ScreenConnect-based remote access malware distributed via phishing and cloud-hosted payloads; insurance firms Aflac and Erie Insurance were breached with potential exposure of sensitive data; the Dire Wolf ransomware group has conducted double-extortion attacks against 16 organizations in 11 countries using Golang encryptors and strong cryptography; the OneClik campaign abuses ClickOnce to deploy a Golang backdoor (RunnerBeacon) against energy/oil/gas firms using cloud infrastructure for C2; and new social-engineering variants (FileFix and Trezor-related phishing) increase the risk of credential and seed theft. Organizations are advised to patch, harden endpoints, monitor for suspicious signed binaries and cloud C2 activity, and reinforce phishing defenses.