Six IT contractors accused of swindling Uncle Sam out of millions

This Infosec roundup covers several active threats and enforcement actions: U.S. DOJ charges over IT procurement fraud; Human Security disrupting the large 'Phish 'n' Ships' ecommerce fraud operation that infected 1,000+ websites and stole tens of millions; IRGC-linked actors (Cotton Sandstorm/ASA) using AI and cover hosting infrastructure for operations; German arrests tied to DDoS-as-a-service promotion; and Microsoft warning that Storm-0940 leverages a Quad7 SOHO-router botnet to perform stealthy password-spray attacks. Recommended mitigations include patching, enforcing MFA, password hygiene, and caution with online deals and third-party hosting.