Tag: malware
-
CERT-UA reports PLUGGYAPE cyberattacks on defense forces
CERT-UA reported PLUGGYAPE malware attacks on Ukraine’s defense forces, linked with medium confidence to Russia’s Void Blizzard group. The Computer Emergency Response Team of Ukraine (CERT-UA) reported new cyberattacks against Ukraine’s defense forces using PLUGGYAPE malware. Government experts attributed the attack with medium confidence to the Russian-linked group Void Blizzard (aka Laundry Bear, UAC-0190), active…
-
New China Linked VoidLink Linux Malware Targets Major Cloud Providers
Researchers have discovered VoidLink, a sophisticated new Linux malware framework designed to infiltrate AWS, Google Cloud, and Azure. Learn how this Chinese-affiliated toolkit uses adaptive stealth to stay hidden. First seen on hackread.com Jump to article: hackread.com/china-voidlink-linux-malware-cloud-providers/
-
SpyCloud Launches Supply Chain Solution to Combat Rising Third-Party Identity Threats
Tags: access, ai, authentication, breach, business, communications, compliance, credentials, cybercrime, cybersecurity, dark-web, data, data-breach, defense, government, grc, group, identity, incident response, infosec, infrastructure, malware, monitoring, phishing, ransomware, risk, risk-management, service, supply-chain, technology, theft, threat, toolFor government agencies and critical infrastructure operators, supply chain threats present national security risks that demand heightened vigilance. Public sector organizations managing sensitive data and critical services increasingly rely on contractors and technology vendors whose compromised credentials could provide adversaries with pathways into classified systems or essential infrastructure. Last year alone, the top 98 Defense…
-
‘VoidLink’ Malware Poses Advanced Threat to Linux Systems
Researchers discovered a modular, cloud-first framework that is feature-rich and designed to maintain stealthy, long-term access to Linux environments. First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/voidlink-malware-advanced-threat-linux-systems
-
Hackers Exploit c-ares DLL Side-Loading to Bypass Security and Deploy Malware
Security experts have disclosed details of an active malware campaign that’s exploiting a DLL side-loading vulnerability in a legitimate binary associated with the open-source c-ares library to bypass security controls and deliver a wide range of commodity trojans and stealers.”Attackers achieve evasion by pairing a malicious libcares-2.dll with any signed version of the legitimate ahost.exe…
-
PLUGGYAPE Malware Uses Signal and WhatsApp to Target Ukrainian Defense Forces
The Computer Emergency Response Team of Ukraine (CERT-UA) has disclosed details of new cyber attacks targeting its defense forces with malware known as PLUGGYAPE between October and December 2025.The activity has been attributed with medium confidence to a Russian hacking group tracked as Void Blizzard (aka Laundry Bear or UAC-0190). The threat actor is believed…
-
Ukraine’s army targeted in new charity-themed malware campaign
Officials of Ukraine’s Defense Forces were targeted in a charity-themed campaign between October and December 2025 that delivered backdoor malware called PluggyApe. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/ukraines-army-targeted-in-new-charity-themed-malware-campaign/
-
Never-before-seen Linux malware is “far more advanced than typical”
VoidLink includes an unusually broad and advanced array of capabilities. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/01/never-before-seen-linux-malware-is-far-more-advanced-than-typical/
-
New VoidLink malware framework targets Linux cloud servers
A newly discovered advanced cloud-native Linux malware framework named VoidLink focuses on cloud environments, providing attackers with custom loaders, implants, rootkits, and plugins designed for modern infrastructures. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-voidlink-malware-framework-targets-linux-cloud-servers/
-
Analysis of VoidLink: A Cloud-Native Malware Threat Targeting Linux Systems
A sophisticated Linux malware framework, VoidLink, has been identified by Check Point Research, representing a significant escalation in threats targeting cloud-native environments. The advanced framework, developed by Chinese-affiliated developers, combines custom loaders, implants, rootkits, and over 30 modular plugins specifically engineered to maintain persistent access to Linux systems while evading detection through multiple layers of…
-
PowerShell-Driven Multi-Stage Windows Malware Using Text Payloads
Security researchers have identified a sophisticated multi-stage malware campaign dubbed SHADOW#REACTOR that chains together obfuscated Visual Basic Script (VBS) execution, resilient PowerShell stagers, text-only payload delivery mechanisms, and .NET Reactorprotected in-memory loaders to deploy Remcos RAT while evading detection and analysis reliably. Initial infection begins when users execute a malicious VBS script, typically delivered through…
-
Android Banking Malware deVixor Actively Targeting Users with Ransomware Capabilities.
A sophisticated Android banking trojan known as deVixor has emerged as a significant threat to mobile users, combining financial data theft, device surveillance, and ransomware capabilities into a single malicious platform. Active since October 2025, the malware represents a concerning evolution in Android-based financial threats, targeting victims through fake automotive websites and leveraging Telegram infrastructure…
-
AUTHOR QA: New techno-thriller ‘The Virus’ simulates an AI malware outbreak gone global
Eddy Willems has been a steady, pragmatic voice in cybersecurity for decades, known for breaking down complex threats in ways real people can understand. Related: AI fueling disinformaton With The Virus, he tries something new: a fast-paced techno-thriller… (more”¦) First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/01/author-qa-new-techno-thriller-the-virus-simulates-an-ai-malware-outbreak-gone-global/
-
SHADOW#REACTOR Campaign Uses Text-Only Staging to Deploy Remcos RAT
SHADOW#REACTOR is a multi-stage Windows malware campaign that stealthily deploys the Remcos RAT using complex infection techniques First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/shadowreactor-text-staging-remcos/
-
Dutch cops cuff alleged AVCheck malware kingpin in Amsterdam
Tags: malware33-year-old was under surveillance for some time before returning home from the UAE First seen on theregister.com Jump to article: www.theregister.com/2026/01/13/avcheck_arrest/
-
New Chinese-Made Malware Framework Targets Linux-Based Cloud Environments
Detected by Check Point researchers, VoidLink is a sophisticated malware framework that can be used to implant malware in the most common cloud environments First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/chinese-malware-framework-linux/
-
New Chinese-Made Malware Framework Targets Linux-Based Cloud Environments
Detected by Check Point researchers, VoidLink is a sophisticated malware framework that can be used to implant malware in the most common cloud environments First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/chinese-malware-framework-linux/
-
Court tosses appeal by hacker who opened port to coke smugglers with malware
Dutchman fails to convince judges his trial was unfair because cops read his encrypted chats First seen on theregister.com Jump to article: www.theregister.com/2026/01/13/dutch_port_hacker_appeal/
-
Court tosses appeal by hacker who opened port to coke smugglers with malware
Dutchman fails to convince judges his trial was unfair because cops read his encrypted chats First seen on theregister.com Jump to article: www.theregister.com/2026/01/13/dutch_port_hacker_appeal/
-
Q4 2025 Malware Trends: Telegram Backdoor, Banking Trojans Surge, Joker Returns to Google Play
Telegram mods spread a powerful Android backdoor as banking trojans surge and Joker malware resurfaces on Google Play in Q4 2025, says Doctor Web. First seen on hackread.com Jump to article: hackread.com/q4-2025-malware-telegram-backdoor-joker-google-play/
-
New Advanced Linux VoidLink Malware Targets Cloud and container Environments
Cybersecurity researchers have disclosed details of a previously undocumented and feature-rich malware framework codenamed VoidLink that’s specifically designed for long-term, stealthy access to Linux-based cloud environmentsAccording to a new report from Check Point Research, the cloud-native Linux malware framework comprises an array of custom loaders, implants, rootkits, and modular First seen on thehackernews.com Jump to…
-
New Malware Campaign Delivers Remcos RAT Through Multi-Stage Windows Attack
Cybersecurity researchers have disclosed details of a new campaign dubbed SHADOW#REACTOR that employs an evasive multi-stage attack chain to deliver a commercially available remote administration tool called Remcos RAT and establish persistent, covert remote access.”The infection chain follows a tightly orchestrated execution path: an obfuscated VBS launcher executed via wscript.exe invokes a First seen on…
-
Parrot OS shares its 2026 plans for security tools and platform support
Parrot OS is a Debian-based Linux distribution built for cybersecurity work. Security practitioners use it for penetration testing, digital forensics, malware analysis, and … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/01/13/parrot-os-2026-plans-security-platform-roadmap/
-
Parrot OS shares its 2026 plans for security tools and platform support
Parrot OS is a Debian-based Linux distribution built for cybersecurity work. Security practitioners use it for penetration testing, digital forensics, malware analysis, and … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/01/13/parrot-os-2026-plans-security-platform-roadmap/
-
<> Modulares Botnetz nutzt Standard-Zugangsdaten für Angriffe auf Webserver
Check Point Research (CPR), die Sicherheitsforschungsabteilung von Check Point Software Technologies, hat eine neue, hochaktive Malware-Kampagne analysiert: GoBruteforcer (auch ‘GoBrut” genannt). Dabei handelt es sich um ein in der Programmiersprache Go (Golang) entwickeltes, modulares Botnetz, das systematisch öffentlich erreichbare Web- und Datenbank-Services angreift darunter FTP, MySQL, PostgreSQL und phpMyAdmin auf Linux-Servern. Die Kampagne nutzt […]…
-
Botnet Threat Update July to December 2025
Botnet Command & Controller (C&C) activity increased 24% this period, with Remote Access Trojans (RATs) accounting for 42% of the Top 20 malware associated with botnets. Learn which Russia-based registrar saw a +9,608% surge in botnet C&C domains”, and which major cloud providers are taking action. Read the full report. First seen on securityboulevard.com Jump…
-
Fake Employee Reports Spread Guloader and Remcos RAT Malware
Scammers are using fake October 2025 performance reviews to trick staff into installing Guloader and Remcos RAT malware. Learn how to identify this threat and protect your personal data from remote hackers. First seen on hackread.com Jump to article: hackread.com/fake-employee-reports-guloader-remcos-rat-malware/
-
GoBruteforcer: Modulares Botnetz nutzt Standard-Zugangsdaten für Angriffe
Eine aktuelle Analyse von Check Point Research zeigt, wie anfällig öffentlich erreichbare Server nach wie vor sind. Im Mittelpunkt steht eine neue Malware Kampagne mit dem Namen GoBruteforcer. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/gobruteforcer-botnetz