June's Dark Gift The Rise of Qwizzserial
This research uncovers the previously unknown family of Android SMS stealers identified during our previous investigation on Ajina. This family is named Qwizzserial, after the common Java package n...
ictsec.pl
Gamaredon in 2024 Cranking out spearphishing campaigns against Ukraine with an evolved toolset
Key points of this blogpost: Gamaredon refocused exclusively on targeting Ukrainian governmental institutions in 2024, abandoning prior attempts against NATO countries. The group significantl...
Exposed JDWP Exploited in the Wild What Happens When Debug Ports Are Left Open
During routine monitoring, the Wiz Research Team observed an exploitation attempt targeting one of our honeypot servers running TeamCity, a popular CI/CD tool. Our investigation determined that the...
Data breach reveals Catwatchful ‘stalkerware’ is spying on thousands of phones
A security vulnerability in a stealthy Android spyware operation called Catwatchful has exposed thousands of its customers, including its administrator. The bug, which was discovered by security r...
Cl0p cybercrime gang's data exfiltration tool found vulnerable to RCE attacks
Security experts have uncovered a hole in Cl0p’s data exfiltration tool that could potentially leave the cybercrime group vulnerable to attack. The vulnerability in the Python-based software, whic...
Uncovering DPRK Remote Workers Detecting Hidden Threats Through Internet Telemetry
Large and widely recognizable organizations around the world may be unknowingly funding North Korea’s cyber operations, and having their Intellectual Property, operational workflows, and general da...
Okta observes v0 AI tool used to build phishing sites
Okta Threat Intelligence has observed threat actors abusing v0, a breakthrough Generative Artificial Intelligence (GenAI) tool created by Vercel, to develop phishing sites that impersonate legitima...
Large Language Models (LLMs) Are Falling for Phishing Scams What Happens When AI Gives You the Wrong URL?
Key Data When Netcraft researchers asked a large language model where to log into various well-known platforms, the results were surprisingly dangerous. Of 131 hostnames provided in response to nat...
Iran
The Iranian regime’s fundamental objective is to ensure the survival and security of the Islamic Republic, which was founded in 1979 following the Iranian Revolution. This shapes – directly or indi...
International Criminal Court hit with cyber attack during NATO summit
The International Criminal Court has been targeted by a “sophisticated” cyberattack and is taking measures to limit any damage. The ICC said the incident, which happened last week during the NATO ...
Houken seeking a path by living on the edge with zero-days
In September 2024, ANSSI observed an attack campaign seeking initial access to French entities’ networks through the exploitation of several zero-day vulnerabilities on Ivanti Cloud Service Applian...
Crypto Operation Using Fake Investment Platforms Dismantled in Spain
A sophisticated transnational scheme was uncovered involving a criminal ring operating from Madrid and Latvia. The fraud campaign was structured and disguised as a legitimate investment platform, l...
Critical Vulnerability in Microsens Devices Exposes Systems to Hackers
A series of critical vulnerabilities have been discovered in MICROSENS NMP Web+, a widely used network management platform for industrial and critical manufacturing environments, putting thousands ...
Can You Trust that Verified Symbol? Exploiting IDE Extensions is Easier Than it Should Be
TL;DR Investigated IDEs: Visual Studio Code (VSCode), Visual Studio, IntelliJ IDEA, and Cursor Flaw: Ability to create files that maintain verified symbols while adding malicious functionality Expl...
Using AI to identify cybercrime masterminds
Online criminal forums, both on the public internet and on the “dark web” of Tor .onion sites, are a rich resource for threat intelligence researchers. The Sophos Counter Threat Unit (CTU) has a te...
Sinaloa drug cartel hired a cybersnoop to identify and kill FBI informants
A major Mexican drug cartel insider grassed on his fellow drug-peddlers back in 2018, telling the FBI that a cartel “hacker” was tracking a federal official and using their deep-rooted access to th...
Jasper Sleet North Korean remote IT workers’ evolving tactics to infiltrate organizations
Since 2024, Microsoft Threat Intelligence has observed remote information technology (IT) workers deployed by North Korea leveraging AI to improve the scale and sophistication of their operations, ...
10 Things I Hate About Attribution RomCom vs. TransferLoader
Key takeaways TA829 conducts a mixture of espionage and cybercriminal operations, which rely on services sourced from the criminal underground, and a regularly updated suite of tools built upon the...
Tracing Blind Eagle to Proton66
Trustwave SpiderLabs, which has been tracking Proton66 for the last several months, was able to make this connection by pivoting from Proton66-linked assets, which led to the identification of anot...
The People’s Liberation Army Cyberspace Force
With the launch of its Cyberspace Force, China has elevated the digital domain to a theatre of war. The Cyberspace Force of the People’s Liberation Army (PLA) is China’s newest military branch, lau...