Tag: group
-
New Analysis Reveals LockBit 5.0’s Core Features and Dual-Stage Attack Model
LockBit has remained one of the most dominant ransomware-as-a-service (RaaS) groups in the world since its emergence as ABCD ransomware in 2019 and official launch as LockBit in 2020. Despite high-profile setbacks including international law enforcement takedowns in early 2024 and a damaging affiliate panel leak in May 2025 the group continues to update its…
-
Russia-linked APT InedibleOchotense impersonates ESET to deploy backdoor on Ukrainian systems
Russia-linked group InedibleOchotense used fake ESET installers in phishing attacks on Ukrainian targets in May 2025. Russia-linked group InedibleOchotense used trojanized ESET installers in phishing attacks against Ukrainian entities detected in May 2025. The campaign used emails and Signal messages to deliver trojanized ESET installers that installed both legitimate software and the Kalambur backdoor. >>Another…
-
Russia-linked APT InedibleOchotense impersonates ESET to deploy backdoor on Ukrainian systems
Russia-linked group InedibleOchotense used fake ESET installers in phishing attacks on Ukrainian targets in May 2025. Russia-linked group InedibleOchotense used trojanized ESET installers in phishing attacks against Ukrainian entities detected in May 2025. The campaign used emails and Signal messages to deliver trojanized ESET installers that installed both legitimate software and the Kalambur backdoor. >>Another…
-
Google Threat Intelligence Group zeigt im AI Threat Tracker wie Bedrohungsakteure KI nutzen
Google nutzt seine Threat Intelligence, um die Aktivitäten von Angreifern zu vereiteln und zu unterbinden einschließlich der Cyberaktivitäten durch staatlich unterstützte Akteure. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/google-threat-intelligence-group-zeigt-im-ai-threat-tracker-wie-bedrohungsakteure-ki-nutzen/a42643/
-
Influence of Chinese Hacker Organizations on U.S. Foreign Policy
Chinese cyber-espionage groups have once again demonstrated their determination and technical prowess in targeting U.S. organizations with ties to international policy-making, highlighting the persistent and evolving threat posed by state-linked cyber actors. Evidence indicates that the attackers sought to establish a stealthy, persistent presence within their target’s network. The initial breach was preceded by a…
-
Influence of Chinese Hacker Organizations on U.S. Foreign Policy
Chinese cyber-espionage groups have once again demonstrated their determination and technical prowess in targeting U.S. organizations with ties to international policy-making, highlighting the persistent and evolving threat posed by state-linked cyber actors. Evidence indicates that the attackers sought to establish a stealthy, persistent presence within their target’s network. The initial breach was preceded by a…
-
Metrics don’t lie, but they can be misleading when they only tell IT’s side of the story
In this Help Net Security interview, Rik Mistry, Managing Partner at Interval Group, discusses how to align IT strategy with business goals. He explains how security, … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/11/07/rik-mistry-interval-group-it-security-metrics/
-
Sandworm Hackers Target Ukrainian Organizations With Data-Wiping Malware
Russia-aligned threat actor Sandworm has intensified its destructive cyber operations against Ukrainian organizations, deploying data wiper malware to cripple critical infrastructure and weaken the nation’s economy. Unlike other Russia-aligned advanced persistent threat groups that primarily engage in cyberespionage activities, Sandworm’s operations are characterized by their explicitly destructive intent. According to the latest ESET APT Activity…
-
Clop Ransomware group claims the breach of The Washington Post
The Clop Ransomware group claims the breach of The Washington Post and added the Americandaily newspaperto its Tor data leak site. The Clop Ransomware group announced the hack of the prestigious Americandaily newspaper The Washington Post. The cybercrime group created a page for the university on its Tor data leak site and announced it will…
-
Google sounds alarm on self-modifying AI malware
Google warns malware now uses AI to mutate, adapt, and collect data during execution, boosting evasion and persistence. Google’s Threat Intelligence Group (GTIG) warn of a new generation of malware that is using AI during execution to mutate, adapt, and collect data in real time, helping it evade detection more effectively. Cybercriminals increasingly use AI…
-
Cryptohack Roundup: Europol Busts 600M Euro Fraud Network
Also: SBF Appeals Conviction, PHP Exploits Fuel Cryptomining. Every week, Information Security Media Group rounds up cybersecurity incidents in digital assets. This week, Europol’s 600 million euro fraud network bust, Sam Bankman-Fried conviction appeal, PHP exploits fueled cryptomining campaigns and sentencing set for Samourai Wallet founders. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/cryptohack-roundup-europol-busts-600m-euro-fraud-network-a-29947
-
Russia’s Destructive Wiper Attacks on Ukraine Rise Again
Nation-State Teams Tied to Grain Sector Targeting, Plus More Joined-Up Operations. Russia’s nation-state hacking groups have returned to pummeling Ukrainian targets with destructive, wiper malware, including in apparent attempts to disrupt its economically valuable grain sector, alongside the repeat targeting of allied European nations, researchers report. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/russias-destructive-wiper-attacks-on-ukraine-rise-again-a-29945
-
Cavalry Werewolf Hit Russian Government with New ShellNET Backdoor
Doctor Web uncovers a targeted cyberattack on a Russian government body by the Cavalry Werewolf group using a new ShellNET backdoor and Telegram-based control. First seen on hackread.com Jump to article: hackread.com/cavalry-werewolf-russia-government-shellnet-backdoor/
-
Cavalry Werewolf Hit Russian Government with New ShellNET Backdoor
Doctor Web uncovers a targeted cyberattack on a Russian government body by the Cavalry Werewolf group using a new ShellNET backdoor and Telegram-based control. First seen on hackread.com Jump to article: hackread.com/cavalry-werewolf-russia-government-shellnet-backdoor/
-
Threat Actors Exploit VS Code Extensions for Ransomware via GitHub C2
Tags: attack, control, cyber, espionage, exploit, github, government, group, infrastructure, malware, north-korea, ransomware, threatSecurity researchers have uncovered a sophisticated attack campaign attributed to Kimsuky, the North Korean-backed threat group known for conducting espionage operations against government entities and think tanks. Recent analysis reveals that threat actors are leveraging Visual Studio Code extensions and GitHub as command-and-control infrastructure to deliver multi-stage malware payloads capable of deploying ransomware and conducting…
-
Threat Actors Exploit VS Code Extensions for Ransomware via GitHub C2
Tags: attack, control, cyber, espionage, exploit, github, government, group, infrastructure, malware, north-korea, ransomware, threatSecurity researchers have uncovered a sophisticated attack campaign attributed to Kimsuky, the North Korean-backed threat group known for conducting espionage operations against government entities and think tanks. Recent analysis reveals that threat actors are leveraging Visual Studio Code extensions and GitHub as command-and-control infrastructure to deliver multi-stage malware payloads capable of deploying ransomware and conducting…
-
Alleged Russia-linked Curly COMrades exploit Windows Hyper-V to evade EDRs
Curly COMrades threat actors exploit Windows Hyper-V to hide Linux VMs, evade EDR tools, and deploy custom malware undetected. Bitdefender researchers, aided by Georgia’s CERT, uncovered that Curly COMrades, a group linked to Russian interests, abused Windows Hyper-V to gain covert, long-term access to victims. Threat actors created hidden Alpine Linux VMs (120MB/256MB) hosting custom…
-
Sandworm hackers use data wipers to disrupt Ukraine’s grain sector
Russian state-backed hacker group Sandworm has deployed multiple data-wiping malware families in attacks targeting Ukraine’s education, government, and the grain sector, the country’s main revenue source. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/sandworm-hackers-use-data-wipers-to-disrupt-ukraines-grain-sector/
-
Russia-linked hackers intensify attacks as global APT activity shifts
State-aligned hacking groups have spent the past six months ramping up espionage, sabotage, and cybercrime campaigns across multiple regions, according to ESET’s APT Activity … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/11/06/global-apt-activity-report-2025/
-
Sandworm hackers use data wipers to disrupt Ukraine’s grain sector
Russian state-backed hacker group Sandworm has deployed multiple data-wiping malware families in attacks targeting Ukraine’s education, government, and the grain sector, the country’s main revenue source. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/sandworm-hackers-use-data-wipers-to-disrupt-ukraines-grain-sector/
-
Russia-linked hackers intensify attacks as global APT activity shifts
State-aligned hacking groups have spent the past six months ramping up espionage, sabotage, and cybercrime campaigns across multiple regions, according to ESET’s APT Activity … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/11/06/global-apt-activity-report-2025/
-
Google Forecasts Rise of Cyber-Physical Attacks Targeting Europe in 2026
Europe will likely face a combination of heightened cyber-physical attacks and information operations coming from nation-state groups in 2026 First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/google-cyberphysical-attacks/
-
Marks And Spencer Reports Steep Profit Drop Amid Cyberattack Fallout, Despite Strong Sales Growth
Marks And Spencer Group Plc (M&S) has reported a dramatic decline in its first-half profit, largely from the financial impact arising from a rec First seen on thecyberexpress.com Jump to article: thecyberexpress.com/marks-and-spencer-profit-falls/
-
Google Forecasts Rise of Cyber-Physical Attacks Targeting Europe in 2026
Europe will likely face a combination of heightened cyber-physical attacks and information operations coming from nation-state groups in 2026 First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/google-cyberphysical-attacks/
-
Marks And Spencer Reports Steep Profit Drop Amid Cyberattack Fallout, Despite Strong Sales Growth
Marks And Spencer Group Plc (M&S) has reported a dramatic decline in its first-half profit, largely from the financial impact arising from a rec First seen on thecyberexpress.com Jump to article: thecyberexpress.com/marks-and-spencer-profit-falls/
-
Google Warns of PROMPTFLUX Malware That Uses Gemini API for Self-Rewriting Attacks
Cybersecurity researchers at Google Threat Intelligence Group (GTIG) have identified a significant shift in how threat actors are leveraging artificial intelligence in their operations. The discovery of experimental malware called PROMPTFLUX marks a watershed moment in cyber threats, demonstrating that attackers are no longer using AI merely to boost productivity they are now deploying AI-enabled…