Tag: threat
-
Beware of Fake Chinese E-Commerce Sites Imitating Apple, Wrangler, and Exploiting Payment Services like MasterCard and PayPal
A sophisticated phishing campaign, initially spotlighted by Mexican journalist Ignacio Gómez Villaseñor, has evolved into a sprawling global threat, as revealed by Silent Push Threat Analysts. What began as a targeted attack on Spanish-language audiences during Mexico’s “Hot Sale 2025” an annual sales event akin to Black Friday has expanded into a massive fake marketplace…
-
New Hpingbot Exploits Pastebin for Payload Delivery and Uses Hping3 for DDoS Attacks
NSFOCUS Fuying Lab’s Global Threat Hunting System has discovered a new botnet family called >>hpingbot
-
Threat Actors Exploit .COM TLD to Host Widespread Credential Phishing Sites
Threat actors have dramatically increased their exploitation of the cybersecurity sector, which is a disturbing development. Spain’s country code TLD, ES, is used to plan credential phishing attacks. According to recent findings from Cofense Intelligence, the abuse of .ES TLD domains surged by an astonishing 19-fold from Q4 2024 to Q1 2025, propelling it to…
-
Massive Android Fraud Operations Uncovered: IconAds, Kaleidoscope, SMS Malware, NFC Scams
A mobile ad fraud operation dubbed IconAds that consisted of 352 Android apps has been disrupted, according to a new report from HUMAN.The identified apps were designed to load out-of-context ads on a user’s screen and hide their icons from the device home screen launcher, making it harder for victims to remove them, per the…
-
You can’t trust AI chatbots not to serve you phishing pages, malicious downloads, or bad code
Popular AI chatbots powered by large language models (LLMs) often fail to provide accurate information on any topic, but researchers expect threat actors to ramp up their … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/07/03/you-cant-trust-ai-chatbots-not-to-serve-you-phishing-pages-malicious-downloads-or-bad-code/
-
New ‘BUBBAS GATE’ Malware Advertised on Telegram Boasts SmartScreen and AV/EDR Bypass
A new malware loader dubbed”BUBBAS GATE”has surfaced on underground forums and Telegram channels, drawing attention for its bold claims of advanced evasion capabilities, including bypassing Microsoft’s SmartScreen and modern AV/EDR solutions. The loader was first advertised on June 22, 2025, with the threat actor touting a suite of features designed to evade detection and maximize…
-
Attackers Impersonate Top Brands in Callback Phishing
Microsoft, PayPal, Docusign, and others are among the trusted brands threat actors use in socially engineered scams that try to get victims to call adversary-controlled phone numbers. First seen on darkreading.com Jump to article: www.darkreading.com/endpoint-security/attackers-top-brands-callback-phishing
-
AI Tackles Binary Code Challenges to Fortify Supply Chain Security
Analyzing binary code helps vendors and organizations detect security threats and zero-day vulnerabilities in the software supply chain, but it doesn’t come without challenges. It looks like AI has come to the rescue. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/ai-tackles-binary-code-challenges-fortify-supply-chain-security
-
Ransomware Attacks on Organizations Surge 213% in Q1 of 2025
Ransomware assaults on businesses around the world have increased by 213% in the first quarter of 2025, with 2,314 victims reported over 74 distinct data breach sites, compared to just 1,086 in the first quarter of 2024. This is a startling increase in cyber dangers. According to Optiv’s Global Threat Intelligence Center (gTIC), this surge…
-
A third of organisations take more than 90 days to remediate threats
The recent Global Industrial Cybersecurity Benchmark 2025 by Takepoint Research, sponsored by Forescout, revealed an overconfidence in critical infrastructure security. Notably, the research found that 44% of industrial organisations claim to have strong real-time cyber visibility, but nearly 60% have low to no confidence in their Operational Technology (OT) and Internet of Things (IoT) threat…
-
Industrial security is on shaky ground and leaders need to pay attention
44% of industrial organizations claim to have strong real-time cyber visibility, but nearly 60% have low to no confidence in their OT and IoT threat detection capabilities, … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/07/03/ot-iot-threat-detection-confidence/
-
Chinese Hackers Exploited Ivanti Flaw in France
Hackers Targeted French Government Entities, ANSSI Said. A hacking campaign linked to Chinese threat actors chained zero-days in Ivanti server software to target French government, defense and media entities, the national cyber agency said. The hacker has similarities to a Chinese threat actor tracked as UNC5174. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/chinese-hackers-exploited-ivanti-flaw-in-france-a-28888
-
North Korean crypto thieves deploy custom Mac backdoor
North Korean threat actors are targeting companies from the Web3 and crypto industries with a backdoor designed for macOS written in niche programming language Nim. The attackers are also using AppleScript for early stage payloads, including a fake Zoom update.”North Korean-aligned threat actors have previously experimented with Go and Rust, similarly combining scripts and compiled…
-
Initial Access Broker Self-Patches Zero Days as Turf Control
A likely China-nexus threat actor has been exploiting unpatched Ivanti vulnerabilities to gain initial access to victim networks and then patching the systems to block others from breaking in to the same network. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/initial-access-broker-self-patches-zero-days
-
Scattered Spider Tactics Include Data Theft, Extortion: CrowdStrike
Threat researchers from CrowdStrike are pointing to Scattered Spider’s focus on more than just traditional ransomware attacks, as experts have separately linked the threat group to a data theft attack against Australian airline Qantas. First seen on crn.com Jump to article: www.crn.com/news/security/2025/scattered-spider-tactics-include-data-theft-extortion-crowdstrike
-
DragonForce ransomware variant tied to emerging DEVMAN threat actor
First seen on scworld.com Jump to article: www.scworld.com/news/dragonforce-ransomware-variant-tied-to-emerging-devman-threat-actor
-
Hacktivists’ Claimed Breach of Nuclear Secrets Debunked
‘Bless Their Heart,’ Says Threat Intel Executive of Pro-Iranian Group. Security experts have dismissed pro-Iranian hacktivist group LulzSec Black’s claim to have breached Indian nuclear secrets in reprisal for the country’s support of Israel. Pro-Iran hacktivist groups’ SCADA-targeting, DDoS launching, data leaking and nuisance-level activities have surged. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/hacktivists-claimed-breach-nuclear-secrets-debunked-a-28881
-
US CISA agency extends Iran cyber alert, warns of CNI threat
The US Cybersecurity and Infrastructure Security Agency reiterates guidance for operators of critical national infrastructure as it eyes the possibility of cyber attacks from Iran First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366627095/US-CISA-agency-extends-Iran-cyber-alert-warns-of-CNI-threat
-
North Korean Hackers Target Web3 with Nim Malware and Use ClickFix in BabyShark Campaign
Tags: communications, crypto, hacker, injection, korea, macOS, malware, north-korea, programming, threatThreat actors with ties to North Korea have been observed targeting Web3 and cryptocurrency-related businesses with malware written in the Nim programming language, underscoring a constant evolution of their tactics.”Unusually for macOS malware, the threat actors employ a process injection technique and remote communications via wss, the TLS-encrypted version of the WebSocket protocol,” First seen…
-
Silent Push, NordVPN Uncover Thousands of Brand-Spoofing Websites
Researchers from NordVPN and Silent Push uncover separate brand-spoofing campaigns that involve tens of thousands of fake websites impersonating real plans that are used to lure victims to hand their data and money to threat actors. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/07/silent-push-nordvpn-uncover-thousands-of-brand-spoofing-websites/
-
Top FBI cyber official: Salt Typhoon ‘largely contained’ in telecom networks
Brett Leatherman told CyberScoop in an interview that while the group still poses a threat, the bureau is focused on resilience and victim support, and going on offense could be in the future. First seen on cyberscoop.com Jump to article: cyberscoop.com/top-fbi-cyber-official-salt-typhoon-largely-contained-in-telecom-networks/
-
A Group of Young Cybercriminals Poses the ‘Most Imminent Threat’ of Cyberattacks Right Now
The Scattered Spider hacking group has caused chaos among retailers, insurers, and airlines in recent months. Researchers warn that its flexible structure poses challenges for defense. First seen on wired.com Jump to article: www.wired.com/story/scattered-spider-most-imminent-threat/
-
Gamaredon Unleashes Six New Malware Tools for Stealth, Persistence, and Lateral Movement
Gamaredon, a Russia-aligned advanced persistent threat (APT) group attributed by Ukraine’s Security Service (SSU) to the FSB’s 18th Center of Information Security, has exclusively targeted Ukrainian governmental institutions throughout 2024, abandoning prior attempts to hit NATO countries. According to ESET Research Report, which has closely tracked the group’s activities, this refocus aligns with Gamaredon’s long-standing…
-
1 Year Later: Lessons Learned From the CrowdStrike Outage
The ever-growing volume of vulnerabilities and threats requires organizations to remain resilient and anti-fragile, that is, to be able to proactively respond to issues and continuously improve. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/1-year-later-lessons-crowdstrike-outage
-
Blumira Identifies 824 Iranian Cyber Incidents Over 21 Months
Security operations platform provider Blumira today released an intelligence assessment that tracked 824 security incidents attributed to Iranian threat actors over 21 months, providing insights into recent Iranian threat activity. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/07/blumira-identifies-824-iranian-cyber-incidents-over-21-months/