Researchers have unveiled a novel menace targeting telecommunications networks: the cunning Linux-based backdoor, GTPDOOR, exploiting GPRS protocol vulnerabilities to clandestinely monitor infected devices. This malevolent software, linked to the notorious hacking collective LightBasin previously...
Researchers at Apiiro investigated a widespread campaign of attacks on the GitHub platform using malicious repositories. The experts identified over 100,000 counterfeit repositories, mimicking popular open-source projects to disseminate malware. The number of such...
Two Chinese hacking factions, known as UNC5325 and UNC3886, breached the security systems of software developed by Ivanti, which is deployed for safeguarding Virtual Private Networks (VPN). Mandiant experts discovered that UNC5325 exploited a...
An obscure hacking collective, christened SPIKEDWINE, has launched attacks against diplomats across several European nations where Indian diplomatic missions are operational. To achieve their nefarious objectives, the culprits have deployed a novel malicious backdoor...
A new Linux version of the Bifrost remote access trojan has emerged, employing a suite of novel camouflage techniques. Among its primary tools is a deceptive domain, mimicking the legitimate VMware. First identified two...
North Korean hackers from the Lazarus group exploited a vulnerability in the Windows AppLocker driver to gain kernel-level access and disable security measures, avoiding detection. Avast analysts identified and reported the hackers’ activities to...
According to the latest insights from analysts at Mandiant, the Middle East has become the focal point of an ongoing cyber espionage operation utilizing distinctive malware targeting the aerospace, aviation, and defense industries. The...
The North Korea-supported hacker group Lazarus has uploaded four malicious packages to the Python Package Index (PyPI) repository, aiming to infect developers’ systems with malevolent software. The implicated packages—“pycryptoenv,” “pycryptoconf,” “quasarlib,” and “swapmempool”—have been...
Since the outset of November 2023, Cisco Talos has reported that Mexican users have been targeted by a sophisticated phishing campaign distributing a novel Windows malware dubbed TimbreStealer. This phishing initiative employs tax-themed decoy...
U.S. federal agencies, along with their international counterparts, have issued an advisory urging users to be vigilant of the risks associated with using Ubiquiti EdgeRouter devices. This warning follows the dismantling of the MooBot...
Specialists at Bitdefender have discovered a new variant of the malicious software AMOS Stealer (or Atomic Stealer), one of the most prevalent cyber threats for macOS users over the past year. According to Bitdefender...
Cybercriminal groups Black Basta and Bl00dy have joined the mass attacks on vulnerable ScreenConnect servers, targeting all users who have not yet updated their systems. A fix for the critical authentication bypass vulnerability (CVE-2024-1709)...
A new advanced Remote Access Tool (RAT) named Xeno RAT has been published on GitHub. This Trojan, crafted in the C# programming language and compatible with Windows 10 and Windows 11 operating systems, offers...
According to a report by Morphisec, Ukrainian organizations based in Finland have been targeted by a malicious campaign distributing the Remcos Remote Access Trojan (RAT). The attack has been attributed to the group UAC-0184....
In a recent report by Trend Micro, it was revealed that the Chinese cyber espionage group Mustang Panda has intensified its operations across Asia, employing a modified variant of the PlugX malware named DOPLUGS....
Analysts warn that hackers have increasingly exploited the Google Cloud Run service for the widespread distribution of banking trojans such as Astaroth, Mekotio, and Ousaban. Google Cloud Run enables users to deploy front-end and...
