Collecting Cyber-News from over 60 sources

Tag: spear-phishing

Pakistani Cyber Actors Impersonating ‘NIC eEmail Services’ to Target Indian Government

Oct 21, 2025 1:26 PM

Tags: attack, credentials, cyber, email, government, group, india, infrastructure, phishing, service, spear-phishing, threat

Pakistan-based advanced persistent threat group APT36, also known as TransparentTribe, is actively targeting Indian government entities with a sophisticated spear-phishing campaign using email lures themed as “NIC eEmail Services.” This campaign leverages lookalike domains and weaponized infrastructure to steal credentials and enable long-term espionage. The attack begins with email messages that convincingly mimic official notifications…
Pakistani Cyber Actors Impersonating ‘NIC eEmail Services’ to Target Indian Government

Oct 21, 2025 1:26 PM

Tags: attack, credentials, cyber, email, government, group, india, infrastructure, phishing, service, spear-phishing, threat

Pakistan-based advanced persistent threat group APT36, also known as TransparentTribe, is actively targeting Indian government entities with a sophisticated spear-phishing campaign using email lures themed as “NIC eEmail Services.” This campaign leverages lookalike domains and weaponized infrastructure to steal credentials and enable long-term espionage. The attack begins with email messages that convincingly mimic official notifications…
Operation Silk Lure: Weaponizing Windows Scheduled Tasks for ValleyRAT Delivery

Oct 16, 2025 3:07 PM

Tags: china, crypto, cyber, email, espionage, exploit, fintech, intelligence, malware, phishing, spear-phishing, windows

A targeted cyber-espionage campaign exploiting Windows Scheduled Tasks and DLL side-loading to deploy the sophisticated ValleyRAT backdoor. The operation pivots on tailored spear-phishing emails, weaponized Windows shortcuts, and a persistent task scheduler mechanism, all delivering a multi-stage malware payload designed to harvest sensitive intelligence from Chinese FinTech and cryptocurrency firms. Adversaries behind Operation Silk Lure…
Operation Silk Lure: Weaponizing Windows Scheduled Tasks for ValleyRAT Delivery

Oct 16, 2025 3:07 PM

Tags: china, crypto, cyber, email, espionage, exploit, fintech, intelligence, malware, phishing, spear-phishing, windows

A targeted cyber-espionage campaign exploiting Windows Scheduled Tasks and DLL side-loading to deploy the sophisticated ValleyRAT backdoor. The operation pivots on tailored spear-phishing emails, weaponized Windows shortcuts, and a persistent task scheduler mechanism, all delivering a multi-stage malware payload designed to harvest sensitive intelligence from Chinese FinTech and cryptocurrency firms. Adversaries behind Operation Silk Lure…
From HealthKick to GOVERSHELL: The Evolution of UTA0388’s Espionage Malware

Oct 9, 2025 8:24 PM

Tags: china, espionage, malware, phishing, spear-phishing, threat, usa

A China-aligned threat actor codenamed UTA0388 has been attributed to a series of spear-phishing campaigns targeting North America, Asia, and Europe that are designed to deliver a Go-based implant known as GOVERSHELL.”The initially observed campaigns were tailored to the targets, and the messages purported to be sent by senior researchers and analysts from legitimate-sounding, completely…
APT Hackers Abuse ChatGPT to Develop Advanced Malware and Phishing Campaigns

Oct 9, 2025 9:23 AM

Tags: ai, apt, chatgpt, china, cyber, cyberattack, email, group, hacker, intelligence, malware, phishing, spear-phishing, threat

Security researchers at Volexity have uncovered compelling evidence that China-aligned threat actors are leveraging artificial intelligence platforms like ChatGPT to enhance their sophisticated cyberattack capabilities. The group, tracked as UTA0388, has been conducting sophisticated spear phishing campaigns since June 2025, using AI assistance to develop malware and craft multilingual phishing emails targeting organizations across North…
APT Meets GPT: China-Aligned UTA0388 Used ChatGPT for Automated, Multilingual Spear-Phishing

Oct 9, 2025 7:25 AM

Tags: apt, chatgpt, china, phishing, spear-phishing

The post APT Meets GPT: China-Aligned UTA0388 Used ChatGPT for Automated, Multilingual Spear-Phishing appeared first on Daily CyberSecurity. First seen on securityonline.info Jump to article: securityonline.info/apt-meets-gpt-china-aligned-uta0388-used-chatgpt-for-automated-multilingual-spear-phishing/
Purdue 2.0? : Rising to the Challenge to secure OT with Zero Trust Connectivity

Oct 8, 2025 3:58 PM

Tags: access, ai, attack, automation, breach, cloud, compliance, control, corporate, csf, cyber, cybercrime, cybersecurity, data, defense, detection, dns, email, endpoint, espionage, exploit, extortion, firewall, firmware, framework, incident response, infrastructure, intelligence, Internet, iot, malicious, malware, mitre, monitoring, network, nist, organized, phishing, ransomware, resilience, risk, service, siem, soc, software, spear-phishing, supply-chain, tactics, technology, theft, threat, tool, unauthorized, update, vpn, vulnerability, zero-trust

Our connected world is getting dangerously messy. Demands on the effective protection of OT environments has never been greater than it is today. This is only growing. Cybercrime is becoming more organized with RaaS and the internal threat is enhanced by huge payouts of initial access brokers. Additionally, Nation States are posturing for cyber war…
Purdue 2.0? : Rising to the Challenge to secure OT with Zero Trust Connectivity

Oct 8, 2025 3:58 PM

Tags: access, ai, attack, automation, breach, cloud, compliance, control, corporate, csf, cyber, cybercrime, cybersecurity, data, defense, detection, dns, email, endpoint, espionage, exploit, extortion, firewall, firmware, framework, incident response, infrastructure, intelligence, Internet, iot, malicious, malware, mitre, monitoring, network, nist, organized, phishing, ransomware, resilience, risk, service, siem, soc, software, spear-phishing, supply-chain, tactics, technology, theft, threat, tool, unauthorized, update, vpn, vulnerability, zero-trust

Our connected world is getting dangerously messy. Demands on the effective protection of OT environments has never been greater than it is today. This is only growing. Cybercrime is becoming more organized with RaaS and the internal threat is enhanced by huge payouts of initial access brokers. Additionally, Nation States are posturing for cyber war…
Neue SpearKampagne fokussiert auf Führungskräfte

Oct 8, 2025 10:50 AM

Tags: phishing, spear-phishing

First seen on datensicherheit.de Jump to article: www.datensicherheit.de/neu-spear-phishing-kampagne-fokus-fuehrungskraefte
Neue SpearKampagne fokussiert auf Führungskräfte

Oct 8, 2025 10:50 AM

Tags: phishing, spear-phishing

First seen on datensicherheit.de Jump to article: www.datensicherheit.de/neu-spear-phishing-kampagne-fokus-fuehrungskraefte
Neue SpearWelle trifft Managementebene

Oct 7, 2025 12:35 PM

Tags: phishing, spear-phishing

Die aktuelle Angriffswelle zeigt eindrucksvoll, wie geschickt Cyberkriminelle psychologische Taktiken und scheinbar vertrauliche Informationen nutzen, um Vertrauen zu erschleichen. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/neue-spear-phishing-welle-trifft-managementebene/a42266/
Phishing-Kampagne zielt auf Führungskräfte

Oct 6, 2025 3:35 PM

Tags: phishing, spear-phishing

Sicherheitsforscher warnen vor einer gezielten Welle von Spear-Phishing-Angriffen, die insbesondere Führungskräfte und leitende Angestellte in verschiedenen Branchen ins Visier nehmen. Die Angreifer tarnen ihre Nachrichten als Benachrichtigungen zur Freigabe von Onedrive-Dokumenten und versehen sie mit Betreffzeilen wie ‘Gehaltsänderung” oder ‘FIN_SALARY”. Ein Klick auf den enthaltenen Link führt die Empfänger auf eine täuschend echt gestaltete Anmeldeseite…
Neue Phishing-Variante greift Gmail-Nutzer an

Oct 2, 2025 5:41 PM

Tags: access, adobe, awareness, cio, ciso, cyberattack, hacker, intelligence, mail, malware, phishing, ransomware, risk, spear-phishing, threat, tool, zero-trust

Hacker haben gefälschte PDF-Dateien an Gmail-Nutzer verschickt, die täuschend echt wirken. Forscher des Sicherheitsunternehmens Varonis haben eine raffinierte Phishing-Methode entdeckt, die auf Gmail-Nutzer zielt. Dabei kommt eine Malware zum Einsatz, die sich nicht nur als PDF-Anhang tarnt, sondern die Opfer automatisch dazu auffordert, diesen zu öffnen.’Der Dateityp .PDF ist im privaten und geschäftlichen Bereich allgegenwärtig…
Confucius Hackers Hit Pakistan With New WooperStealer and Anondoor Malware

Oct 2, 2025 5:41 PM

Tags: defense, government, hacker, malicious, malware, military, phishing, spear-phishing, threat

The threat actor known as Confucius has been attributed to a new phishing campaign that has targeted Pakistan with malware families like WooperStealer and Anondoor.”Over the past decade, Confucius has repeatedly targeted government agencies, military organizations, defense contractors, and critical industries — especially in Pakistan using spear-phishing and malicious documents as initial First seen on…
Malicious ZIP Files Use Windows Shortcuts to Drop Malware

Oct 2, 2025 12:41 PM

Tags: cyber, cybersecurity, malicious, malware, phishing, spear-phishing, tactics, virus, windows

Cybersecurity firm Blackpoint Cyber reveals a new spear phishing campaign targeting executives. Learn how attackers use fraudulent document ZIPs containing malicious shortcut files, leveraging ‘living off the land’ tactics, and a unique Anti-Virus check to deliver a custom payload First seen on hackread.com Jump to article: hackread.com/malicious-zip-files-windows-shortcuts-malware/
That innocent PDF is now a Trojan Horse for Gmail attacks

Oct 2, 2025 5:41 AM

Tags: access, attack, awareness, cio, ciso, corporate, credentials, cybersecurity, defense, detection, email, endpoint, hacker, infrastructure, network, phishing, qr, ransomware, risk, social-engineering, spear-phishing, theft, threat, tool, training, zero-trust

Personal email use increases enterprise risk: Employees are increasingly accessing personal email accounts from corporate machines; it is commonplace in hybrid and remote work environments. But considering that hackers have access to easily-usable tools like MatrixPDF, experts advise enterprises to be more vigilant.CISOs and CIOs should consider opportunities to either restrict access to personal webmail…
New Spear-Phishing Attack Deploys DarkCloud Malware to Steal Keystrokes and Credentials

Sep 29, 2025 5:08 PM

Tags: attack, credentials, cyber, detection, intelligence, malware, phishing, soc, spear-phishing, threat

Adversaries don’t work 95 and neither do we. At eSentire, our 24/7 SOCs are staffed with elite threat hunters and cyber analysts who hunt, investigate, contain and respond to threats within minutes. Backed by threat intelligence, tactical threat response and advanced threat analytics from our Threat Response Unit (TRU), eSentire delivers rapid detection and disruption…
Nimbus Manticore Targets Defense and Telecom Industries with New Malware Attack

Sep 23, 2025 10:16 AM

Tags: attack, cyber, defense, iran, malware, phishing, spear-phishing, threat

Check Point Research has identified a long-running campaign by the Iranian-aligned threat actor Nimbus Manticore”, also known as UNC1549, Smoke Sandstorm, and the “Iranian Dream Job” operation”, targeting defense manufacturers, telecommunications, and aviation entities aligned with IRGC priorities. Recent activity demonstrates a sharpened focus on Western Europe, notably Denmark, Sweden, and Portugal, with spear-phishing lures…
Nimbus Manticore Targets Defense and Telecom Industries with New Malware Attack

Sep 23, 2025 10:16 AM

Tags: attack, cyber, defense, iran, malware, phishing, spear-phishing, threat

Check Point Research has identified a long-running campaign by the Iranian-aligned threat actor Nimbus Manticore”, also known as UNC1549, Smoke Sandstorm, and the “Iranian Dream Job” operation”, targeting defense manufacturers, telecommunications, and aviation entities aligned with IRGC priorities. Recent activity demonstrates a sharpened focus on Western Europe, notably Denmark, Sweden, and Portugal, with spear-phishing lures…
Breach Roundup: Microsoft, Cloudflare Dismantle RaccoonO365

Sep 18, 2025 11:15 PM

Tags: ai, breach, china, data, data-breach, hacker, microsoft, phishing, privacy, service, spear-phishing, technology

Also, Colt Services Outage Persists, Finland Charges Americans in Vastaamo Hack. This week, Microsoft hit RaccoonO365, Colt Technology Services, Finland charged a U.S. citizen in Vastaamo hack. RevengeHotels hackers used AI, Meta can’t overturn a privacy case verdict. Chinese hackers unleashed spear phishing emails. Prosper confirmed a data breach, as did Kering fashion houses. First…
Chinese TA415 Uses VS Code Remote Tunnels to Spy on U.S. Economic Policy Experts

Sep 17, 2025 4:15 PM

Tags: china, government, group, phishing, spear-phishing, spy, threat

A China-aligned threat actor known as TA415 has been attributed to spear-phishing campaigns targeting the U.S. government, think tanks, and academic organizations utilizing U.S.-China economic-themed lures.”In this activity, the group masqueraded as the current Chair of the Select Committee on Strategic Competition between the United States and the Chinese Communist Party (CCP), as well as…
Kimsuky Group Weaponizes AI Deepfakes in New Spear-Phishing Campaign

Sep 16, 2025 5:15 AM

Tags: ai, deep-fake, group, phishing, spear-phishing

The post Kimsuky Group Weaponizes AI Deepfakes in New Spear-Phishing Campaign appeared first on Daily CyberSecurity. First seen on securityonline.info Jump to article: securityonline.info/kimsuky-group-weaponizes-ai-deepfakes-in-new-spear-phishing-campaign/
AI-Forged Military IDs Used in North Korean Phishing Attack

Sep 15, 2025 3:16 PM

Tags: ai, attack, chatgpt, defense, group, military, north-korea, phishing, spear-phishing

Genians observed the Kimsuky group impersonate a defense institution in a spear-phishing attack, leveraging ChatGPT to create fake military ID cards First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/ai-military-ids-north-korea/
APT37 Targets Windows with Rust Backdoor and Python Loader

Sep 8, 2025 5:08 PM

Tags: api, attack, backdoor, cctv, cloud, computer, control, data, detection, exploit, government, group, infection, injection, jobs, korea, malicious, malware, microsoft, monitoring, north-korea, organized, password, phishing, powershell, programming, rust, service, social-engineering, spear-phishing, startup, tactics, theft, threat, tool, update, vulnerability, windows

IntroductionAPT37 (also known as ScarCruft, Ruby Sleet, and Velvet Chollima) is a North Korean-aligned threat actor active since at least 2012. APT37 primarily targets South Korean individuals connected to the North Korean regime or involved in human rights activism, leveraging custom malware and adopting emerging technologies.In recent campaigns, APT37 utilizes a single command-and-control (C2) server…
APT37 Targets Windows with Rust Backdoor and Python Loader

Sep 8, 2025 5:08 PM

Tags: api, attack, backdoor, cctv, cloud, computer, control, data, detection, exploit, government, group, infection, injection, jobs, korea, malicious, malware, microsoft, monitoring, north-korea, organized, password, phishing, powershell, programming, rust, service, social-engineering, spear-phishing, startup, tactics, theft, threat, tool, update, vulnerability, windows

IntroductionAPT37 (also known as ScarCruft, Ruby Sleet, and Velvet Chollima) is a North Korean-aligned threat actor active since at least 2012. APT37 primarily targets South Korean individuals connected to the North Korean regime or involved in human rights activism, leveraging custom malware and adopting emerging technologies.In recent campaigns, APT37 utilizes a single command-and-control (C2) server…
APT37 Targets Windows with Rust Backdoor and Python Loader

Sep 8, 2025 5:08 PM

Tags: api, attack, backdoor, cctv, cloud, computer, control, data, detection, exploit, government, group, infection, injection, jobs, korea, malicious, malware, microsoft, monitoring, north-korea, organized, password, phishing, powershell, programming, rust, service, social-engineering, spear-phishing, startup, tactics, theft, threat, tool, update, vulnerability, windows

IntroductionAPT37 (also known as ScarCruft, Ruby Sleet, and Velvet Chollima) is a North Korean-aligned threat actor active since at least 2012. APT37 primarily targets South Korean individuals connected to the North Korean regime or involved in human rights activism, leveraging custom malware and adopting emerging technologies.In recent campaigns, APT37 utilizes a single command-and-control (C2) server…
Iran-Nexus Hackers Impersonate Omani MFA to Target Governments Entities

Sep 4, 2025 7:21 PM

Tags: breach, communications, cyber, cybersecurity, exploit, government, group, hacker, intelligence, iran, malicious, mfa, phishing, spear-phishing

Cybersecurity researchers uncovered a sophisticated, Iran-linked spear-phishing operation that exploited a compromised Ministry of Foreign Affairs (MFA) mailbox in Oman to deliver malicious payloads to government entities worldwide. Analysts attribute the operation to the “Homeland Justice” group, believed to be aligned with Iran’s Ministry of Intelligence and Security (MOIS). Leveraging stolen diplomatic communications, encoded macros,…
Iranian Hackers Exploit 100+ Embassy Email Accounts in Global Phishing Targeting Diplomats

Sep 3, 2025 1:19 PM

Tags: cyber, cybersecurity, email, exploit, group, hacker, iran, phishing, spear-phishing

An Iran-nexus group has been linked to a “coordinated” and “multi-wave” spear-phishing campaign targeting the embassies and consulates in Europe and other regions across the world.The activity has been attributed by Israeli cybersecurity company Dream to Iranian-aligned operators connected to broader offensive cyber activity undertaken by a group known as Homeland Justice.”Emails were sent to…
Iran-Nexus Hackers Exploit Omani Mailbox to Target Governments

Sep 2, 2025 2:19 PM

Tags: authentication, communications, cyber, exploit, government, group, hacker, intelligence, iran, mfa, phishing, spear-phishing

A sophisticated spear-phishing campaign that exploited a compromised mailbox belonging to the Ministry of Foreign Affairs of Oman. The operation, attributed to an Iranian-aligned group known as Homeland Justice and linked to Iran’s Ministry of Intelligence and Security (MOIS), masqueraded as legitimate multi-factor authentication (MFA) communications to infiltrate governments and diplomatic missions around the world.…