Tag: group
-
Hamas Linked Hackers Using AshTag Malware Against Diplomatic Offices
New report by Unit 42 reveals the Hamas-linked Ashen Lepus (WIRTE) group is using the AshTag malware suite to target Middle Eastern diplomatic and government entities with advanced, hidden tactics. First seen on hackread.com Jump to article: hackread.com/hamas-hackers-ashtag-malware-diplomats/
-
Google links more Chinese hacking groups to React2Shell attacks
Over the weekend, Google’s threat intelligence team linked five more Chinese hacking groups to attacks exploiting the maximum-severity “React2Shell” remote code execution vulnerability. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/google-links-more-chinese-hacking-groups-to-react2shell-attacks/
-
Google links more Chinese hacking groups to React2Shell attacks
Over the weekend, Google’s threat intelligence team linked five more Chinese hacking groups to attacks exploiting the maximum-severity “React2Shell” remote code execution vulnerability. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/google-links-more-chinese-hacking-groups-to-react2shell-attacks/
-
A Browser Extension Risk Guide After the ShadyPanda Campaign
In early December 2025, security researchers exposed a cybercrime campaign that had quietly hijacked popular Chrome and Edge browser extensions on a massive scale.A threat group dubbed ShadyPanda spent seven years playing the long game, publishing or acquiring harmless extensions, letting them run clean for years to build trust and gain millions of installs, then…
-
Asahi to Launch Cybersecurity Overhaul After Crippling Cyber-Attack
Asahi Group’s CEO said he is considering creating a dedicated cyber unit following the ransomware attack that crippled the company First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/asahi-launch-cybersecurity/
-
Asahi to Launch Cybersecurity Overhaul After Crippling Cyber-Attack
Asahi Group’s CEO said he is considering creating a dedicated cyber unit following the ransomware attack that crippled the company First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/asahi-launch-cybersecurity/
-
Asahi to Launch Cybersecurity Overhaul After Crippling Cyber-Attack
Asahi Group’s CEO said he is considering creating a dedicated cyber unit following the ransomware attack that crippled the company First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/asahi-launch-cybersecurity/
-
Asahi to Launch Cybersecurity Overhaul After Crippling Cyber-Attack
Asahi Group’s CEO said he is considering creating a dedicated cyber unit following the ransomware attack that crippled the company First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/asahi-launch-cybersecurity/
-
Storm-0249: EDR Process Sideloading to Conceal Malicious Activity
Initial access broker Storm-0249 has evolved from a mass phishing operation into a sophisticated threat actor weaponizing legitimate Endpoint Detection and Response (EDR) processes through sideloading techniques to conceal malicious activity as routine security operations. This represents a significant escalation in the group’s capabilities and poses a critical risk to organizations relying on traditional defense…
-
New VolkLocker Ransomware Variant Targets Both Linux and Windows Systems
CyberVolk, a pro-Russia hacktivist group first documented in late 2024, has resurfaced with a sophisticated ransomware-as-a-service (RaaS) offering called VolkLocker after months of dormancy caused by Telegram enforcement actions. The group returned in August 2025 with version 2.x, featuring advanced Telegram-based automation and cross-platform capabilities targeting both Linux and Windows systems. VolkLocker is built in…
-
Storm-0249: EDR Process Sideloading to Conceal Malicious Activity
Initial access broker Storm-0249 has evolved from a mass phishing operation into a sophisticated threat actor weaponizing legitimate Endpoint Detection and Response (EDR) processes through sideloading techniques to conceal malicious activity as routine security operations. This represents a significant escalation in the group’s capabilities and poses a critical risk to organizations relying on traditional defense…
-
New VolkLocker Ransomware Variant Targets Both Linux and Windows Systems
CyberVolk, a pro-Russia hacktivist group first documented in late 2024, has resurfaced with a sophisticated ransomware-as-a-service (RaaS) offering called VolkLocker after months of dormancy caused by Telegram enforcement actions. The group returned in August 2025 with version 2.x, featuring advanced Telegram-based automation and cross-platform capabilities targeting both Linux and Windows systems. VolkLocker is built in…
-
Gentlemen Ransomware Emerges as a Threat to Corporate Networks
A sophisticated new ransomware group known as >>Gentlemen
-
Asahi Cyberattack Forces Shift to Zero-Trust Model, Delays Earnings by Over 50 Days
Tags: corporate, cyber, cyberattack, cybersecurity, data-breach, finance, group, ransomware, vulnerability, zero-trustAsahi Group Holdings Ltd. is weighing the creation of a dedicated cybersecurity unit as it continues to deal with the prolonged impact of a ransomware incident that struck the company in late September. The Asahi cyberattack disrupted core operations, delayed financial reporting, and exposed vulnerabilities in both the company’s internal systems and Japan’s broader corporate…
-
VolkLocker Ransomware Exposed by Hard-Coded Master Key Allowing Free Decryption
The pro-Russian hacktivist group known as CyberVolk (aka GLORIAMIST) has resurfaced with a new ransomware-as-a-service (RaaS) offering called VolkLocker that suffers from implementation lapses in test artifacts, allowing users to decrypt files without paying an extortion fee.According to SentinelOne, VolkLocker (aka CyberVolk 2.x) emerged in August 2025 and is capable of targeting both Windows First…
-
Russian Ring Using Ex-Immigrant Data to Fuel Fake ID Sales
Telegram-Based Market Is Exploiting Gaps in US Tracking of Departed Visa Holders. A Russian darknet marketplace is exploiting a major blind spot for U.S. financial institutions by trafficking in the identities of former legal immigrants. Telegram-based group Karma Fullz has built a profitable criminal enterprise with highly convincing synthetic identities. First seen on govinfosecurity.com Jump…
-
Attackers Worldwide are Zeroing In on React2Shell Vulnerability
Bad actors that include nation-state groups to financially-motivated cybercriminals from across the globe are targeting the maximum-severity but easily exploitable React2Shell flaw, with threat researchers see everything from probes and backdoors to botnets and cryptominers. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/12/attackers-worldwide-are-zeroing-in-on-react2shell-vulnerability/
-
Grid-scale battery energy storage systems face heightened risk of cyberattack
Experts warn that state-linked threat groups are actively searching for ways to disrupt the industry amid growing power demand in the U.S. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/battery-energy-storage-systems-risk-cyberattack/807675/
-
Attackers Worldwide are Zeroing In on React2Shell Vulnerability
Bad actors that include nation-state groups to financially-motivated cybercriminals from across the globe are targeting the maximum-severity but easily exploitable React2Shell flaw, with threat researchers see everything from probes and backdoors to botnets and cryptominers. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/12/attackers-worldwide-are-zeroing-in-on-react2shell-vulnerability/
-
Hackers reportedly breach developer involved with Russia’s military draft database
A hacking group it had maintained access to the firm’s systems for several months and had destroyed parts of the company’s infrastructure. First seen on therecord.media Jump to article: therecord.media/hackers-reportedly-breach-developer-involved-in-russian-military-database
-
Pro-Russia Hacktivist Support: Ukrainian Faces US Charges
Ukrainian Victoria Dubranova, 33, faces US charges for aiding pro-Russia hacktivist groups CARR and NoName057(16) in global cyberattacks. A Ukrainian woman, Victoria Dubranova (33), has been charged in the US for allegedly aiding the pro-Russia hacktivist groups Cyber Army of Russia Reborn (CARR) and NoName057(16) in cyberattacks against critical infrastructure worldwide. Dubranova was extradited to…
-
British government sanctions Russian and Chinese groups over information warfare
The U.K.’s foreign secretary announced sanctions on seven Russian individuals and influence networks, as well as the Chinese companies i-Soon and Integrity Technology Group. First seen on therecord.media Jump to article: therecord.media/uk-sanctions-russia-china-entities-information-warfare
-
Russian State-Supported Hacktivist Groups Targeted in Dual DOJ Indictments
The U.S. Department of Justice has unveiled a series of actions against two Russian state-supported cyber collectives, CARR (also known as CyberArmyofRussia_Reborn or CyberArmyofRussia) and NoName057(16), with prosecutors unsealing dual indictments against Ukrainian national Victoria Eduardovna Dubranova, 33. Dubranova, known online as “Vika,” “Tory,” and “SovaSonya,” is accused of participating in destructive campaigns against critical…
-
Ukrainian hacker charged with helping Russian hacktivist groups
U.S. prosecutors have charged a Ukrainian national for her role in cyberattacks targeting critical infrastructure worldwide, including U.S. water systems, election systems, and nuclear facilities, on behalf of Russian state-backed hacktivist groups. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/ukrainian-hacker-charged-with-helping-russian-hacktivist-groups/
-
Warning: WinRAR Vulnerability CVE-2025-6218 Under Active Attack by Multiple Threat Groups
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a security flaw impacting the WinRAR file archiver and compression utility to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.The vulnerability, tracked as CVE-2025-6218 (CVSS score: 7.8), is a path traversal bug that could enable code execution. However, for exploitation First…
-
Warning: WinRAR Vulnerability CVE-2025-6218 Under Active Attack by Multiple Threat Groups
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a security flaw impacting the WinRAR file archiver and compression utility to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.The vulnerability, tracked as CVE-2025-6218 (CVSS score: 7.8), is a path traversal bug that could enable code execution. However, for exploitation First…
-
Ukrainian Woman in US Custody for Aiding Russian NoName057 Hacker Group
Ukrainian national Victoria Dubranova is in U.S. custody, accused of supporting Russian hacker group NoName057 in cyberattacks on critical infrastructure. She has pleaded not guilty. First seen on hackread.com Jump to article: hackread.com/ukraine-woman-us-custody-russia-noname057-hackers/
-
Ukrainian Woman in US Custody for Aiding Russian NoName057 Hacker Group
Ukrainian national Victoria Dubranova is in U.S. custody, accused of supporting Russian hacker group NoName057 in cyberattacks on critical infrastructure. She has pleaded not guilty. First seen on hackread.com Jump to article: hackread.com/ukraine-woman-us-custody-russia-noname057-hackers/
-
RSF Cyberattack Linked to Russian FSB Foiled by Staff Vigilance
Reporters Without Borders (RSF) has determined that a phishing operation targeting the organization in early 2025 was carried out by a group associated with Russia’s Federal Security Service (FSB). The RSF cyberattack conclusion First seen on thecyberexpress.com Jump to article: thecyberexpress.com/rsf-cyberattack-fsb-linked-phishing/
-
Polymorphic AI malware exists, but it’s not what you think
Tags: access, ai, api, attack, authentication, automation, business, ciso, credentials, cryptography, cyber, cybercrime, detection, edr, email, espionage, government, group, identity, infrastructure, malicious, malware, marketplace, mfa, monitoring, phishing, radius, ransomware, risk, soc, technology, theft, threat, toolwhat the code block should do, or how it’s going to evade an antivirus. It’s just working under the assumption that Gemini just instinctively knows how to evade antiviruses (it doesn’t). There’s also no entropy to ensure the ‘self-modifying’ code differs from previous versions, or any guardrails to ensure it actually works. The function was…