The threat group HoneyMyte, also tracked as Mustang Panda, has begun deploying an updated version of its CoolClient backdoor alongside a signed Windows kernel-level driver. Kaspersky’s Securelist team documented the campaign in detail, revealing...
A home router can appear entirely functional – broadcasting Wi-Fi and sitting quietly on a shelf for years – while silently routing someone else’s attack traffic. Researchers have identified approximately 296,000 devices infected with...
A single phone call with a fraudster can now result, within the same session, in a loan taken out in the victim’s name and unauthorized purchases charged to their bank card. Researchers at Group-IB...
Many defensive systems monitor domain name queries as their primary window into outbound malicious activity – but malware families are increasingly circumventing this approach by communicating with command-and-control servers directly over raw IP addresses,...
The Initial JavaScript Breach A single installation of a routine JavaScript library could expose a company’s cloud infrastructure, repositories, and internal services to attackers. The Shai-Hulud npm worm infiltrated highly popular packages. Users download...
The Resurgence of XCSSET Following several months of quiet activity, a notorious malware family targeting software developers has returned with a stealthy upgrade. This malicious tool leaves almost no trace on local disk drives....
North Korean cyber syndicates have long sought a method to cloak their command servers. Therefore, they want to render them untraceable and immune to blockades. Now, they utilize a seemingly ordinary cryptocurrency transfer. This...
The Appeal of VPN Gateways Organizations install VPN gateways at the edge of their corporate networks. They do this specifically so remote employees can securely connect to internal systems. Consequently, these devices frequently become...
A routine internet search can culminate in a full macOS compromise – one in which a counterfeit system update prompt manipulates the user into executing a malicious command themselves, and the implanted backdoor retrieves...
The operators behind a massive, globally coordinated hacking campaign committed a fatal operational security error. They inadvertently left directories entirely open on the centralized server utilized to prepare and execute their attacks. Consequently, SOCRadar...
What initially appeared to be a routine Cobalt Strike Beacon turned out to be something considerably more dangerous. Researchers have now dissected SakDriver – a fully realized Windows rootkit capable of operating at the...
Occasionally, two ostensibly disparate cyber threats are inextricably linked by a shared arsenal of tools; South Korean cybersecurity experts have recently discovered that overlapping infrastructure likely orchestrates both a wave of website compromises and...
