An exceptionally unusual Windows backdoor remained undetected on a single corporate computer for years. Astonishingly, it concealed its command-and-control server address in an incredibly obscure location. It utilized the specific number of consecutive spaces...
An old address on the internet can appear far more trustworthy than a brand-new one – even after its original owner has long since abandoned it. In a series of reports, researchers at Infoblox...
A novel Android malware variant currently enables cybercriminals to hijack a victim’s smartphone. This hijacking occurs specifically while the user interacts with banking applications and cryptocurrency wallets. Furthermore, the malware successfully intercepts confirmation codes...
Security specialists at Acronis uncovered an active cyberespionage campaign targeting telecommunications companies in Afghanistan. Furthermore, the attackers focus heavily on government agencies and critical infrastructure facilities across South Asia. To execute these attacks, threat...
The threat group HoneyMyte, also tracked as Mustang Panda, has begun deploying an updated version of its CoolClient backdoor alongside a signed Windows kernel-level driver. Kaspersky’s Securelist team documented the campaign in detail, revealing...
A home router can appear entirely functional – broadcasting Wi-Fi and sitting quietly on a shelf for years – while silently routing someone else’s attack traffic. Researchers have identified approximately 296,000 devices infected with...
A single phone call with a fraudster can now result, within the same session, in a loan taken out in the victim’s name and unauthorized purchases charged to their bank card. Researchers at Group-IB...
Many defensive systems monitor domain name queries as their primary window into outbound malicious activity – but malware families are increasingly circumventing this approach by communicating with command-and-control servers directly over raw IP addresses,...
The Initial JavaScript Breach A single installation of a routine JavaScript library could expose a company’s cloud infrastructure, repositories, and internal services to attackers. The Shai-Hulud npm worm infiltrated highly popular packages. Users download...
The Resurgence of XCSSET Following several months of quiet activity, a notorious malware family targeting software developers has returned with a stealthy upgrade. This malicious tool leaves almost no trace on local disk drives....
North Korean cyber syndicates have long sought a method to cloak their command servers. Therefore, they want to render them untraceable and immune to blockades. Now, they utilize a seemingly ordinary cryptocurrency transfer. This...
The Appeal of VPN Gateways Organizations install VPN gateways at the edge of their corporate networks. They do this specifically so remote employees can securely connect to internal systems. Consequently, these devices frequently become...
