Category: Cybersecurity

Google has revealed the various safety measures that are being incorporated into its generative artificial intelligence (AI) systems to mitigate emerging attack vectors like indirect prompt injections and improve the overall security posture for agentic AI systems.

“Unlike direct prompt injections, where an attacker directly inputs malicious commands into a prompt, indirect prompt injections involve hidden malicious instructions within external data sources,” Google’s GenAI security team said.

These external sources can take the form of email messages, documents, or even calendar invites that trick the AI systems into exfiltrating sensitive data or performing other malicious actions.

The tech giant said it has implemented what it described as a “layered” defense strategy that is designed to increase the difficulty, expense, and complexity required to pull off an attack against its systems.

These efforts span model hardening, introducing purpose-built machine learning (ML) models to flag malicious instructions and system-level safeguards. Furthermore, the model resilience capabilities are complemented by an array of additional guardrails that have been built into Gemini, the company’s flagship GenAI model.

These include –

• Prompt injection content classifiers, which are capable of filtering out malicious instructions to generate a safe response
• Security thought reinforcement, which inserts special markers into untrusted data (e.g., email) to ensure that the model steers away from adversarial instructions, if any, present in the content, a technique called spotlighting.
• Markdown sanitization and suspicious URL redaction, which uses Google Safe Browsing to remove potentially malicious URLs and employs a markdown sanitizer to prevent external image URLs from being rendered, thereby preventing flaws like EchoLeak
• User confirmation framework, which requires user confirmation to complete risky actions
• End-user security mitigation notifications, which involve alerting users about prompt injections

However, Google pointed out that malicious actors are increasingly using adaptive attacks that are specifically designed to evolve and adapt with automated red teaming (ART) to bypass the defenses being tested, rendering baseline mitigations ineffective.

“Indirect prompt injection presents a real cybersecurity challenge where AI models sometimes struggle to differentiate between genuine user instructions and manipulative commands embedded within the data they retrieve,” Google DeepMind noted last month.

“We believe robustness to indirect prompt injection, in general, will require defenses in depth – defenses imposed at each layer of an AI system stack, from how a model natively can understand when it is being attacked, through the application layer, down into hardware defenses on the serving infrastructure.”

The development comes as new research has continued to find various techniques to bypass a large language model’s (LLM) safety protections and generate undesirable content. These include character injections and methods that “perturb the model’s interpretation of prompt context, exploiting over-reliance on learned features in the model’s classification process.”

Another study published by a team of researchers from Anthropic, Google DeepMind, ETH Zurich, and Carnegie Mellon University last month also found that LLMs can “unlock new paths to monetizing exploits” in the “near future,” not only extracting passwords and credit cards with higher precision than traditional tools, but also to devise polymorphic malware and launch tailored attacks on a user-by-user basis.

The study noted that LLMs can open up new attack avenues for adversaries, allowing them to leverage a model’s multi-modal capabilities to extract personally identifiable information and analyze network devices within compromised environments to generate highly convincing, targeted fake web pages.

At the same time, one area where language models are lacking is their ability to find novel zero-day exploits in widely used software applications. That said, LLMs can be used to automate the process of identifying trivial vulnerabilities in programs that have never been audited, the research pointed out.

According to Dreadnode’s red teaming benchmark AIRTBench, frontier models from Anthropic, Google, and OpenAI outperformed their open-source counterparts when it comes to solving AI Capture the Flag (CTF) challenges, excelling at prompt injection attacks but struggled when dealing with system exploitation and model inversion tasks.

“AIRTBench results indicate that although models are effective at certain vulnerability types, notably prompt injection, they remain limited in others, including model inversion and system exploitation – pointing to uneven progress across security-relevant capabilities,” the researchers said.

“Furthermore, the remarkable efficiency advantage of AI agents over human operators – solving challenges in minutes versus hours while maintaining comparable success rates – indicates the transformative potential of these systems for security workflows.”

That’s not all. A new report from Anthropic last week revealed how a stress-test of 16 leading AI models found that they resorted to malicious insider behaviors like blackmailing and leaking sensitive information to competitors to avoid replacement or to achieve their goals.

“Models that would normally refuse harmful requests sometimes chose to blackmail, assist with corporate espionage, and even take some more extreme actions, when these behaviors were necessary to pursue their goals,” Anthropic said, calling the phenomenon agentic misalignment.

“The consistency across models from different providers suggests this is not a quirk of any particular company’s approach but a sign of a more fundamental risk from agentic large language models.”

These disturbing patterns demonstrate that LLMs, despite the various kinds of defenses built into them, are willing to evade those very safeguards in high-stakes scenarios, causing them to consistently choose “harm over failure.” However, it’s worth pointing out that there are no signs of such agentic misalignment in the real world.

“Models three years ago could accomplish none of the tasks laid out in this paper, and in three years models may have even more harmful capabilities if used for ill,” the researchers said. “We believe that better understanding the evolving threat landscape, developing stronger defenses, and applying language models towards defenses, are important areas of research.”

Not every risk looks like an attack. Some problems start as small glitches, strange logs, or quiet delays that don’t seem urgent—until they are. What if your environment is already being tested, just not in ways you expected?

Some of the most dangerous moves are hidden in plain sight. It’s worth asking: what patterns are we missing, and what signals are we ignoring because they don’t match old playbooks?

This week’s reports bring those quiet signals into focus—from attacks that bypassed MFA using trusted tools, to supply chain compromises hiding behind everyday interfaces. Here’s what stood out across the cybersecurity landscape:

⚡ Threat of the Week

Cloudflare Blocks Massive 7.3 Tbps DDoS Attack — Cloudflare said it autonomously blocked the largest distributed denial-of-service (DDoS) attack ever recorded, which hit a peak of 7.3 terabits per second (Tbps). The attack, the company said, targeted an unnamed hosting provider and delivered 37.4 terabytes in 45 seconds. It originated from over 122,145 source IP addresses spanning 5,433 Autonomous Systems (AS) across 161 countries. The top sources of attack traffic included Brazil, Vietnam, Taiwan, China, Indonesia, Ukraine, Ecuador, Thailand, the United States, and Saudi Arabia.

• Patched Google Chrome Flaw Exploited by TaxOff — A threat actor known as TaxOff exploited CVE-2025-2783, a now-patched security flaw in Google Chrome, as a zero-day in mid-March 2025 to target Russian organizations with a backdoor codenamed Trinper. The attacks share overlaps with another threat activity cluster dubbed Team46, which is believed to have been active since early 2024 and has leveraged another zero-day vulnerability in Yandex Browser for Windows in the past to deliver unspecified payloads.
• North Korea Employs Deepfakes in New Fake Zoom Scam — Threat actors with ties to North Korea targeted an unnamed employee of a cryptocurrency foundation with deceptive Zoom calls featuring deepfaked company executives to trick them into downloading malware. Cybersecurity company Huntress, which responded to the incident, said it discovered eight distinct malicious binaries on the victim host that are capable of running commands, dropping additional payloads, logging keystrokes, and stealing cryptocurrency-related files.
• Russian Threat Actors Use App Passwords to Bypass MFA — Russian threat actors tracked as UNC6293 have been found to bypass multi-factor authentication (MFA) and access Gmail accounts of targeted individuals by leveraging app-specific passwords in skilfully-crafted social engineering attacks that impersonate U.S. Department of State officials. The attacks, which started in at least April and continued through the beginning of June, are notable for their efforts to build trust with victims over weeks, instead of inducing a false sense of urgency and rushing them into taking unintended actions. The end goal of the attacks is to persuade the recipients to create and share app-specific passwords that would provide access to their Gmail accounts.
• Godfather Trojan Creates Sandbox on Infected Android Devices — A new version of the Godfather banking trojan has been found to create isolated virtual environments on Android devices to steal account data and transactions from legitimate banking apps. While the malware has been active since June 2021, the latest iteration takes its information-stealing capabilities to a whole new level through the deployment of a malicious app containing an embedded virtualization framework on infected devices, which is used to run copies of the targeted applications. Thus, when a user launches a banking app, they are redirected to the virtualized instance, from where sensitive data is stolen. The malware also displays a fake lock screen overlay to trick the victim into entering their PIN.
• Israel-Iran Conflict Sparks Surge in Cyber Warfare — The Israel-Iran conflict that started with Israeli attacks on Iranian nuclear and military targets on June 13 has triggered a wider cyber conflict in the region, with hacktivist groups and ideologically motivated actors targeting both nations. Notable among them, the pro-Israel threat group known as Predatory Sparrow breached Bank Sepah and Nobitex, claiming they have been used to circumvent international sanctions. Predatory Sparrow has been publicly linked to attacks targeting an Iranian steel production facility in 2022 and for causing outages at gas station payment systems across the country in 2021. Furthermore, Iran’s state-owned TV broadcaster was hacked to interrupt regular programming and air videos calling for street protests against the Iranian government. Nearly three dozen pro-Iranian groups are estimated to have launched coordinated attacks against Israeli infrastructure. These acts represent another escalation of the use of cyber attacks during (and as a precursor to) geopolitical conflicts, while also underscoring the growing importance of cyber-augmented warfare.

‎️‍🔥 Trending CVEs

Attackers love software vulnerabilities – they’re easy doors into your systems. Every week brings fresh flaws, and waiting too long to patch can turn a minor oversight into a major breach. Below are this week’s critical vulnerabilities you need to know about. Take a look, update your software promptly, and keep attackers locked out.

This week’s list includes — CVE-2025-34509, CVE-2025-34510, CVE-2025-34511 (Sitecore XP), CVE-2025-6018, CVE-2025-6019, CVE-2025-6020 (Linux), CVE-2025-23121 (Veeam Backup & Replication), CVE-2025-3600 (Progress Telerik UI for AJAX), CVE-2025-3464 (ASUS Armoury Crate), CVE-2025-5309 (BeyondTrust Remote Support and Privileged Remote Access), CVE-2025-5349, CVE-2025-5777 (Citrix ADC and Gateway), CVE-2025-5071 (AI Engine plugin), CVE-2025-4322 (Motors theme), CVE-2025-1087 (Insomnia API Client), CVE-2025-20260 (ClamAV), CVE-2025-32896 (Apache SeaTunnel), CVE-2025-50054 (OpenVPN), and CVE-2025-1907 (Instantel Micromate).

📰 Around the Cyber World

• Prometei Botnet Resurgence in March 2025 — The botnet known as Prometei has been observed in renewed attacks in March 2025, while also incorporating new features. “The latest Prometei versions feature a backdoor that enables a variety of malicious activities. Threat actors employ a domain generation algorithm (DGA) for their command-and-control (C2) infrastructure and integrate self-updating features for stealth and evasion,” Palo Alto Networks Unit 42 said. Prometei, first spotted in July 2020, is capable of striking both Windows and Linux systems for cryptocurrency mining, credential theft, and data exfiltration. It can also deploy additional malware payloads. In recent years, it has exploited Windows systems unpatched against ProxyLogon flaws. As of March 2023, it was estimated to have compromised more than 10,000 systems since November 2022. “This modular design makes Prometei highly adaptable, as individual components can be updated or replaced without affecting the overall botnet functionality,” Unit 42 said.
• BitoPro Hack Linked to Lazarus Group — Taiwanese cryptocurrency exchange BitoPro claimed the North Korean hacking group Lazarus is behind a cyber attack that led to the theft of $11,000,000 worth of cryptocurrency on May 9, 2025. “The attack methodology bears resemblance to patterns observed in multiple past international major incidents, including illicit transfers from global bank SWIFT systems and asset theft incidents from major international cryptocurrency exchanges. These attacks are attributed to the North Korean hacking organization ‘Lazarus Group,’” the company said. BitPro also revealed the attackers conducted a social engineering attack on a team member responsible for cloud operations to implant malware and remotely access their computer, while evading security monitoring. “They subsequently hijacked AWS Session Tokens to bypass Multi-Factor Authentication (MFA),” it added. “From the AWS environment, they delivered commands via a C2 server to discreetly transfer malicious scripts to the hot wallet host, awaiting an opportunity to launch the attack. After prolonged observation, the hackers specifically targeted the platform during its wallet system upgrade and asset transfer period, simulating normal operational behaviors to launch the attack.” On May 9, the malicious script was executed to transfer cryptocurrency from the hot wallet. BitPro said it shut down its hot wallet system, rotated all cryptographic keys, and isolated and rebuilt affected systems after discovering unusual wallet activity. The heist is the latest to be attributed to the notorious Lazarus Group, which was implicated in the record-breaking $1.5 billion theft from Bybit.
• Microsoft Plans to Clean Up Legacy Drivers — Microsoft said it’s launching a “strategic initiative” to periodically clean up legacy drivers published on Windows Update to reduce security and compatibility risks. “The rationale behind this initiative is to ensure that we have the optimal set of drivers on Windows Update that cater to a variety of hardware devices across the Windows ecosystem, while making sure that Microsoft Windows security posture is not compromised,” the company said. “This initiative involves periodic cleanup of drivers from Windows Update, thereby resulting in some drivers not being offered to any systems in the ecosystem.”
• Mocha Manakin Uses ClickFix to Deliver Node.js Backdoor — A previously undocumented threat actor known as Mocha Manakin has been linked to a new set of attacks that leverage the well-known ClickFix (aka Paste and run or fakeCAPTCHA) as an initial access technique to drop a bespoke Node.js backdoor codenamed NodeInitRAT. “NodeInitRAT allows the adversary to establish persistence and perform reconnaissance activities, such as enumerating principal names and gathering domain details,” Red Canary said. “NodeInitRAT communicates with adversary-controlled servers over HTTP, often through Cloudflare tunnels acting as intermediary infrastructure.” The backdoor comes with capabilities to execute arbitrary commands and deploy additional payloads on compromised systems. The threat actor was first observed by the cybersecurity company in January 2025. It’s assessed that the backdoor overlaps with a Node.js executable used in Interlock ransomware attacks.
• China Targets Russia to Seek War Secrets — State-sponsored hackers from China have repeatedly broken into Russian companies and government agencies to likely look for military secrets since the country’s invasion of Ukraine in 2022. According to The New York Times, intrusions accelerated in May 2022, with one group known as Sanyo impersonating the email addresses of a major Russian engineering firm to gather information on nuclear submarines. In a classified document prepared by the domestic security agency, Russia is said to have claimed that “China is seeking Russian defense expertise and technology and is trying to learn from Russia’s military experience in Ukraine,” calling China an “enemy.” Another threat actor of interest is Mustang Panda, which has expanded its scope to target governmental organizations in Russia and the European Union post the Russo-Ukrainian war.
• CoinMarketCap Website Hacked With Fake “Verify Wallet” Pop-up — CoinMarketCap (CMC), a popular platform for cryptocurrency tracking, disclosed that its website was hacked to serve a “malicious pop-up prompting users to ‘Verify Wallet’” with the goal of draining users digital assets. While it’s currently not clear how the attackers carried out the attack, the company said it has since identified and removed the malicious code from its site. According to Coinspect Security, the drainer was injected via CoinMarketCap’s rotating “Doodles” feature that’s served from the domain api.coinmarketcap[.]com. “CoinMarketCap’s backend API serves manipulated JSON data that injects malicious JavaScript through the rotating ‘doodles’ feature,” the company said. “Not all users see it, since the doodle shown varies per visit. The injected wallet drainer always loads if you visit /doodles/.” Specifically, this involves loading the drainer from the “CoinmarketCLAP” doodle’s JSON file, exploiting a code injection vulnerability that exploits Lottie animation JSON files to inject arbitrary JavaScript from an external site named static.cdnkit[.]io. “On June 20, 2025, our security team identified a vulnerability related to a doodle image displayed on our homepage,” CoinMarketCap said. “This doodle image contained a link that triggered malicious code through an API call, resulting in an unexpected pop-up for some users when visited (sic) our homepage.” CoinMarketCap did not reveal how many users encountered the pop-up or whether any wallets were compromised. However, according to screenshots shared by a threat actor named ReyXBF on X, about $43,266 was siphoned from 110 victims who interacted with the fake wallet verification pop-up. “This was a supply chain attack, meaning the breach didn’t target CMC’s own servers but a third-party tool or resource used by CMC,” c/side said.
• Malicious JavaScript Served via Corrupted Version of jQuery Migrate — In another supply chain threat, cybersecurity researchers discovered a malware infection chain that employed a malicious version of a version of the jQuery Migrate library that had been altered to remotely insert and execute arbitrary JavaScript into the victim’s browser. The first step in the attack was the compromise of a legitimate WordPress site (“tabukchamber[.]sa”), likely either via a vulnerable plugin or compromised credentials, to inject obfuscated logic related to Parrot TDS, which is designed to fingerprint the browser and selectively serve malware to qualifying users based on certain criteria. In this case, one of the tailored JavaScript responses included a dropper script disguised as jquery-migrate-3.4.1.min.js. The attack, per Trellix, unfolded when a senior executive from one of its enterprise clients accessed the WordPress website. “This method of infection shows a well-planned, covert operation focused on blending malware into normal website behavior, leveraging the weakest link – unverified third-party frontend pipelines,” the company said.
• Tesla Wall Connector Hacked to Carry Out Downgrade Attacks — Researchers demonstrated an attack technique that exploited the Tesla Wall Connector, a charger for electric vehicles, to install vulnerable firmware on the device and ultimately execute arbitrary code on the device. The attack takes advantage of the fact that Tesla vehicles can update the charging connector through a charging cable using a proprietary protocol. Synacktiv said it pulled off a successful exploit in approximately 18 minutes due to the “low bandwidth of the SWCAN [Single-Wire Controller Area Network] bus.” To achieve this, a Tesla car simulator was built to communicate with the charger in SWCAN communication mode, enabling them to run the downgrade logic, use Unified Diagnostic Services (UDS) to extract Wi-Fi credentials, and obtain a debug shell. Furthermore, a buffer overflow in the debug shell’s command parsing logic could be exploited to achieve code execution on the device. “Since the Wall Connector is typically connected to a home, hotel, or business network, gaining access to the device could provide a foothold into the private network, potentially allowing lateral movement to other devices,” the company said. Tesla has addressed the issue by implementing an anti-downgrade mechanism, preventing the firmware rollback used in the attack.
• ASRJam Devised to Block Automated Phone Scams — A group of academics from Ben Gurion University of the Negev and Amrita Vishwa Vidyapeetham has developed a new framework called ASRJam that injects adversarial perturbations into a victim’s audio to disrupt an attacker’s Automatic Speech Recognition (ASR) system. Powered by a jamming algorithm dubbed EchoGuard, it leverages natural distortions, such as reverberation and echo, to counter speech recognition systems that are used by attackers to conduct vishing attacks and elicit sensitive information from victims or trick them into performing a malicious action. ASRJam “targets the weakest link in the attacker’s pipeline, speech recognition, disrupting LLM-driven vishing attacks without affecting human intelligibility,” according to the study.
• AnonSecKh Targets Thai Entities After Border Flare-Up — A Cambodian hacktivist group has ramped up cyber attacks against Thai entities following a border skirmish between the two countries late last month that led to the death of a Cambodian soldier. The AnonsecKh group (aka ANON-KH or Bl4ckCyb3r) claimed at least 73 attacks on Thai organizations between May 28 and June 10, 2025. Targets included government websites, followed by entities in the military, manufacturing, and finance sectors. “Their attacks are tightly linked to political incidents and demonstrate a reactive pattern,” Radware said. “The group has shown the ability to launch rapid and intense attack waves.”
• DoJ Seizes Record $225 Million in Crypto Tied to Romance Baiting Scams — The U.S. Department of Justice (DoJ) said it has filed a civil forfeiture complaint seeking to recover over $225 million in cryptocurrency linked to cryptocurrency confidence (aka romance baiting) scams running out of Vietnam and the Philippines, the largest crypto seizure by the U.S. government to date. “The cryptocurrency addresses that held over $225.3 million in cryptocurrency were part of a sophisticated blockchain-based money laundering network that executed hundreds of thousands of transactions and was used to disperse proceeds of cryptocurrency investment fraud across many cryptocurrency addresses and accounts on the blockchain to conceal the source of the illegally obtained funds,” the DoJ said. More than 430 suspected victims are believed to have lost their funds after being duped into believing that they were making legitimate cryptocurrency investments. According to TRM Labs, the scheme involved directing victims to fake investment platforms that impersonated legitimate trading environments, luring them with the promise of high returns. While these services enabled smaller withdrawals, they blocked access or imposed fake tax or fee requirements when victims initiated larger withdrawal requests. As many as 144 accounts at the virtual currency exchange OKX were used for laundering the proceeds of the operation. “These accounts exhibited patterns of coordinated activity, including the use of Vietnamese KYC documents, overlapping IP addresses geolocated in the Philippines, and KYC photographs taken in the same physical setting,” the company said.
• Nigerian National Sent to U.S. Prison for Cyber Scams — Ridwan Adeleke Adepoju, a 33-year-old from Lagos, Nigeria, has been sentenced to three and a half years in federal prison for conducting a variety of cyber fraud schemes that targeted U.S. citizens and businesses, including phishing scams, romance scams, and submitting fraudulent tax returns. “The scams involved multiple spoofed email addresses, fictional social media personas, and unwitting money mules,” the DoJ said. Adepoju was arrested last year in the U.K. and later extradited to the U.S.
• Malicious Firefox Browser Add-ons Spotted — Cybersecurity researchers have uncovered several add-ons in the official extensions marketplace for Mozilla Firefox that is capable of leading users to tech support scam websites through pop-ups related to fake virus alerts and system errors (Shell Shockers io), redirecting Wikipedia traffic to an alternative domain that advertises a proxy service (wikipedia engelsiz giris), and manipulating user engagement metrics on platforms like Facebook by artificially inflating likes and views.
• Smartphones in North Korea Take Screenshots Every 5 Minutes — A smartphone smuggled out of North Korea in late 2024 had been programmed such that it takes a screenshot every five minutes and saves it in a folder, highlighting the extent to which the regime tries to exert its control over citizens, censor information, and indoctrinate people. BBC, which obtained the phone, said the device is engineered to automatically replace forbidden words with their North Korean equivalents, such as substituting the word “South Korea” with the term “Puppet state.”
• U.K. Fines 23andMe for 2023 Data Breach — The U.K. data protection watchdog, the Information Commissioner’s Office (ICO), said it’s fining embattled genomics company 23andMe $3.1 million over its 2023 breach and for failing to implement appropriate security measures to protect the personal information of U.K. users. The 2023 hack allowed unidentified threat actors to conduct a credential stuffing attack between April and September 2023 to gain unauthorized access to personal information belonging to 155,592 U.K. residents, likely revealing names, birth years, self-reported city or postcode-level location, profile images, race, ethnicity, family trees, and health reports in the process. The exact nature of the exposed information varied on a per-user basis. The ICO faulted 23andMe for not implementing appropriate authentication and verification measures and for not enforcing controls over access to raw genetic data. It also said the company did not have effective systems in place to “monitor, detect, or respond to cyber threats targeting its customers’ sensitive information.” The ICO further said 23andMe took until the end of 2024 to sufficiently address the security issues that underpinned the credential-stuffing attack.
• More than 46K Grafana Instances Vulnerable to CVE-2025-4123 — More than 46,000 internet-facing Grafana instances are susceptible to a recently disclosed security flaw (CVE-2025-4123 aka The Grafana Ghost) that could permit an attacker to run arbitrary code and take control the victims’ accounts by luring them into clicking URLs that lead to loading a rogue Grafana plugin from a site controlled by the threat actor without requiring any elevated permissions. “The vulnerability also affects Grafana instances running locally by crafting a payload that takes advantage of the locally used domain name and port for the local service,” OX Security said. The disclosure comes as Censys revealed that there are nearly 400 web-based human-machine interfaces (HMIs) exposed to the internet, out of which 40 were fully unauthenticated and controllable by anyone with a browser. A majority of these systems have since been secured. On top of that, almost 35,000 solar power systems from 42 vendors have been detected as publicly exposing their management interfaces over the internet.
• Viasat Hacked by Salt Typhoon — U.S. satellite communications company Viasat has acknowledged that it was targeted by China-linked Salt Typhoon hackers. According to Bloomberg, the breach was discovered earlier this year. Viasat confirmed that it had detected unauthorized access through a compromised device, but said it had found no evidence of impact to customers.
• FreeType Zero-Day Exploited in Paragon Spyware Attacks — A security flaw in FreeType (CVE-2025-27363) was exploited as a zero-day in connection with a Paragon Graphite spyware attack that leveraged WhatsApp as a delivery vector, according to a report from SecurityWeek. In March, WhatsApp revealed that it disrupted a campaign that involved the use of Graphite spyware to target around 90 journalists and civil society members. The vulnerability was addressed by Google last month in Android.
• VADER to Detect and Neutralize Dead Drops — Threat actors are known to leverage legitimate and trusted platforms like Dropbox, Google Drive, and Pastebin as dead drop resolvers (DDRs) to host information that points to the actual command-and-control (C2) servers in a likely effort to sidestep detection and blend in with regular activity within enterprise networks. This also makes the malicious infrastructure more resilient, since the attackers can dynamically change the list of C2 servers, in case the original one is taken down. Enter VADER, short for Vulnerability Analysis for Dead Drop Endpoint Resolution, which aims to improve web application security through proactive Dead Drop Resolver remediation. “Analyzing a dataset of 100,000 malware samples collected in the wild, VADER identified 8,906 DDR malware samples from 110 families that leverage 273 dead drops across seven web applications,” academics from the Georgia Institute of Technology said. “Additionally, it proactively uncovered 57.1% more dead drops spanning 11 web applications.”

🎥 Cybersecurity Webinars

• They’re Faking Your Brand — Stop AI Impersonation Before It Spreads — AI attackers are pretending to be your company, your execs—even your employees. From fake emails to deepfakes, it’s happening fast. In this webinar, Doppel will show how to detect and stop impersonation across the platforms that matter most—before customers or partners are fooled. Join to protect your brand in the age of AI threats.
• AI Agents Are Leaking Data — Learn How to Fix It Fast — AI tools like ChatGPT and Copilot are often linked to Google Drive or SharePoint—but without the right settings, they can leak private files. In this webinar, experts from Sentra break down real examples of how data exposure happens—and what you can do right now to stop it. If your team is using AI, this is a must-watch before something slips through.

🔧 Cybersecurity Tools

• glpwnme — It is a simple, powerful tool to find and exploit known vulnerabilities in GLPI, a widely used IT asset management platform. It helps security teams and pen-testers detect issues like RCEs, plugin flaws, and default credentials across multiple GLPI versions. Ideal for red teaming, bug bounty, or internal audits, glpwnme also supports safe cleanup and plugin enumeration—making it perfect for fast, focused GLPI security checks.
• Debloat — It is a simple tool that removes junk data from bloated executables—often 100–800MB added to evade sandboxing. With both GUI and CLI support, it cleans inflated binaries in seconds using automated detection of common packing tricks. Used by platforms like AssemblyLine and MWDB, it’s ideal for malware analysts and CERT teams who need fast, reliable cleanup before deeper analysis.

Disclaimer: These newly released tools are for educational use only and haven’t been fully audited. Use at your own risk—review the code, test safely, and apply proper safeguards.

🔒 Tip of the Week

SCCM Can Be a Silent Domain Takeover Tool — Here’s How to Secure It ➝ Microsoft’s System Center Configuration Manager (SCCM) is a powerful tool for managing software and devices across an organization. But because it touches so many systems, it’s also a big security risk if not set up carefully. Attackers who get access to just one user or machine can use SCCM’s Client Push feature to run code remotely on other systems. This often works because SCCM uses service accounts (like Distribution Point or Network Access accounts) that have admin rights on many machines. And if your environment still allows NTLM authentication or unsigned SMB traffic, attackers can quietly hijack these connections using tools like ntlmrelayx or PetitPotam—without triggering alerts.

Many IT teams miss the fact that SCCM setups often rely on shared local admin accounts, allow automatic client installs, and still support outdated security protocols. These common missteps make it easy for attackers to move through your network without being seen. What’s worse, the SCCM database and SMS Provider server, which are central to pushing software and storing credentials, are rarely locked down properly—leaving attackers a clear path to take control.

To protect your network, start by turning off NTLM fallback and turning on SMB signing through Group Policy. Then check which accounts SCCM uses to install clients—remove admin rights where not needed, and rotate those credentials regularly. Make sure the SCCM database uses dedicated service accounts, limits who can connect to it, and monitors logs like ClientPushInstallation.log for anything suspicious. Use tools like LAPS or gMSA to manage local passwords safely, and place SCCM servers in their own network group behind a firewall.

Finally, be careful where you run the SCCM admin console. Avoid using it on everyday laptops or general-use machines. Instead, use a secure, locked-down system just for admin work, and add protections like Credential Guard or use the RunAs /netonly command to keep admin credentials safe. When SCCM is secured properly, it blocks one of the easiest paths attackers use to spread through your network. But if it’s left wide open, it can give them quiet access to almost everything.

Conclusion

If the signals feel louder lately, it’s because they are. Attackers are refining their moves, not reinventing them—and they’re counting on defenders being too busy to notice. Don’t give them that edge. Sharpen your controls, simplify where you can, and keep moving faster than the threat.

Security isn’t just a solo effort—it’s a shared responsibility. If this recap helped you spot something worth a second look, chances are someone else in your network needs to see it too. Share it with your team, peers, or anyone responsible for keeping systems safe. A single overlooked detail in one environment can become the blueprint for risk in another.

Jun 21, 2025Ravie LakshmananCyber Attack / Critical Infrastructure

The April 2025 cyber attacks targeting U.K. retailers Marks & Spencer and Co-op have been classified as a “single combined cyber event.”

That’s according to an assessment from the Cyber Monitoring Centre (CMC), a U.K.-based independent, non-profit body set up by the insurance industry to categorize major cyber events.

“Given that one threat actor claimed responsibility for both M&S and Co-op, the close timing, and the similar tactics, techniques, and procedures (TTPs), CMC has assessed the incidents as a single combined cyber event,” the CMC said.

The organization has categorized the disruption of the retailers as a “Category 2 systemic event.” It’s estimated that the security breaches will have a total financial impact of £270 million ($363 million) to £440 million ($592 million).

However, the cyber attack on Harrods around the same time has not been included at this stage, citing a lack of adequate information about the cause and impact.

The initial access vector employed in the attacks targeting Marks & Spencer and Co-op revolved around the use of social engineering tactics, particularly targeting IT help desks.

The CMC further noted that its attribution efforts are still ongoing. That said, the notorious cybercrime group known as Scattered Spider (aka UNC3944) is believed to be behind the intrusions.

The group, an offshoot of the larger cybercrime community known as The Com, has a track record of leveraging its English-speaking members to carry out advanced social engineering attacks where they impersonate members of a company’s IT department to obtain unauthorized access.

“The impact from this event is ‘narrow and deep,’ having significant implications for two companies, and knock-on effects for suppliers, partners, and service providers,” the CMC said.

Earlier this week, Google Threat Intelligence Group (GTIG) revealed that Scattered Spider actors have begun to target major insurance companies in the United States.

“Given this actor’s history of focusing on a sector at a time, the insurance industry should be on high alert, especially for social engineering schemes which target their help desks and call centers,” John Hultquist, Chief Analyst at GTIG, said.

“The anticipated threat of Iranian cyber capability to U.S. organizations has been the focus of many discussions lately, but these actors are already targeting critical infrastructure. We expect more high-profile incidents in the near term as they move from sector to sector.”

The development comes as Indian consulting giant Tata Consultancy Services (TCS) disclosed that its systems or users were not compromised as part of the attack against Marks & Spencer. Last month, the Financial Times reported that TCS is internally probing whether its systems were used as a launchpad for the attack.

It also follows a new strategy from the Qilin ransomware operation that involves offering legal assistance to ramp up pressure during ransom negotiations. The threat actors also claim to have an in-house team of journalists who can work together with the legal department to craft blog posts and assist with victim negotiations.

The threat actors behind the Qilin ransomware-as-a-service (RaaS) scheme are now offering legal counsel for affiliates to put more pressure on victims to pay up, as the cybercrime group intensifies its activity and tries to fill the void left by its rivals.

The new feature takes the form of a “Call Lawyer” feature on the affiliate panel, per Israeli cybersecurity company Cybereason.

The development represents a newfound resurgence of the e-crime group as once-popular ransomware groups like LockBit, Black Cat, RansomHub, Everest, and BlackLock have suffered abrupt cessations, operational failures, and defacements. The group, also tracked as Gold Feather and Water Galura, has been active since October 2022.

Data compiled from the dark web leak sites run by ransomware groups shows that Qilin led with 72 victims in April 2025. In May, it is estimated to be behind 55 attacks, putting it behind Safepay (72) and Luna Moth (67). It’s also the third most active group after Cl0p and Akira since the start of the year, claiming a total of 304 victims.

“Qilin stands above the rest with its rapidly rising marketplace due to a mature ecosystem, extensive support options for clients, and robust solutions to ensure highly targeted, high-impact ransomware attacks designed to demand substantial payouts,” Qualys said in an analysis of the group this week.

There is evidence to suggest that affiliates working for RansomHub have migrated to Qilin, contributing to the spike in Qilin ransomware activity in recent months.

“With a growing presence across forums and ransomware activity trackers, Qilin operates a technically mature infrastructure: payloads built in Rust and C, loaders with advanced evasion features, and an affiliate panel offering Safe Mode execution, network spreading, log cleanup, and automated negotiation tools,” researchers Mark Tsipershtein and Evgeny Ananin said.

“Beyond the malware itself, Qilin offers spam services, PB-scale data storage, legal guidance, and a full set of operational features—positioning itself not just as a ransomware group, but as a full-service cybercrime platform.”

The development comes as Intrinsec assessed that at least one affiliate of Rhysida has started using an open-source utility named Eye Pyramid C2 likely as a post-compromise tool to maintain access to compromised endpoints and deliver additional payloads.

It’s worth noting that the Eye Pyramid C2 refers to the same Python-based backdoor that was deployed by threat actors linked to the RansomHub crew in Q4 2024.

It also follows a fresh analysis of the leaked Black Basta chat logs, which has shed light on a threat actor who went by the online alias “tinker.” Their real-world identity is presently unknown.

Tinker, per Intel 471, is said to be one of the trusted aides of tramp, the group’s leader, and joined the criminal enterprise as a “creative director” after having prior experience running call centers, including for the now-defunct Conti group, and as a negotiator for BlackSuit (aka Royal).

“The actor tinker played an important role in securing initial access to organizations,” the cybersecurity company said. “The leaked conversations reveal tinker would analyze the financial data and evaluate a victim’s situation before direct negotiations.”

The threat actor, besides conducting open-source research to obtain contact information for the company’s senior staff in order to extort them either via phone calls or messages, was tasked with writing phishing emails designed to breach organizations.

Tinker, notably, also came up with the Microsoft Teams-based phishing scenario, wherein the attackers would masquerade as an IT department employee, warning victims that they are at the receiving end of a spam attack and urging the employees to install remote desktop tools like AnyDesk and grant them access to purportedly secure their systems.

“After the RMM software was installed, the caller would contact one of Black Basta’s penetration testers, who would then move to secure persistent access to the system and domain,” Intel 471 said.

The leaked messages also reveal that tinker received no less than $105,000 in cryptocurrency for their efforts between December 18, 2023, and June 16, 2024. That said, it’s currently not clear what group they may be working for.

The findings coincide with the extradition of an unnamed 33-year-old foreign member of the Ryuk ransomware group to the United States for their alleged role as an initial access broker (IAB) and facilitating access to corporate networks. The suspect was arrested from Kyiv earlier this April at the request of U.S. law enforcement.

The member “was engaged in the search for vulnerabilities in the corporate networks of the victim enterprises,” the National Police of Ukraine said in a statement. “The data obtained by the hacker was used by his accomplices to plan and carry out cyber attacks.”

Authorities said they were able to trace the suspect following a forensic analysis of equipment seized in a previous raid that took place in November 2023 targeting members of the LockerGoga, MegaCortex, and Dharma ransomware families.

Elsewhere, police officials in Thailand have apprehended several Chinese nationals and other Southeast Asian suspects after raiding a hotel in Pattaya that was used as a gambling den and as an offices to conduct ransomware operations.

The ransomware scheme is said to have been run by six Chinese nationals, who sent malicious links to companies in order to infect them with ransomware. Local media reports say they were employees of a cybercrime gang, who were paid to distribute the booby-trapped links to Chinese firms.

Thailand’s Central Investigation Bureau (CIB), this week, also announced the arrest of more than a dozen foreigners as part of Operation Firestorm for allegedly running an online investment scam that defrauded several victims in Australia by calling them and deceiving them into investing their money in long-term bonds with a promise of high returns.

Cybersecurity researchers have exposed the inner workings of an Android malware called AntiDot that has compromised over 3,775 devices as part of 273 unique campaigns.

“Operated by the financially motivated threat actor LARVA-398, AntiDot is actively sold as a Malware-as-a-Service (MaaS) on underground forums and has been linked to a wide range of mobile campaigns,” PRODAFT said in a report shared with The Hacker News.

AntiDot is advertised as a “three-in-one” solution with capabilities to record the device screen by abusing Android’s accessibility services, intercept SMS messages, and extract sensitive data from third-party applications.

The Android botnet is suspected to be delivered via malicious advertising networks or through highly tailored phishing campaigns based on activity that indicates selective targeting of victims based on language and geographic location.

AntiDot was first publicly documented in May 2024 after it was spotted being distributed as Google Play updates to accomplish its information theft objectives.

Like other Android trojans, it features a wide range of capabilities to conduct overlay attacks, log keystrokes, and remotely control infected devices using Android’s MediaProjection API. It also establishes a WebSocket communication to facilitate real-time, bi-directional communication between the infected device and an external server.

In December 2024, Zimperium revealed details of a mobile phishing campaign that distributed an updated version of AntiDot dubbed AppLite Banker using job offer-themed decoys.

The latest findings from the Swiss cybersecurity company show that there are at least 11 active command-and-control (C2) servers in operation that are overseeing no less than 3,775 infected devices across 273 distinct campaigns.

A Java-based malware at its core, AntiDot is heavily obfuscated using a commercial packer to sidestep detection and analysis efforts. The malware, per PRODAFT, is delivered as part of a three-stage process that starts with an APK file.

“An inspection of the AndroidManifest file reveals that many class names do not appear in the original APK,” the company said. “These missing classes are dynamically loaded by the packer during installation, and include malicious code extracted from an encrypted file. The entire mechanism is intentionally crafted to avoid detection by antivirus tools.”

Once launched, it serves a bogus update bar and prompts the victim to grant it accessibility permissions, after which it unpacks and loads a DEX file incorporating the botnet functions.

A core feature of AntiDot is its ability to monitor for newly launched applications and serve and serve a bogus login screen from the C2 server when the victim opens a cryptocurrency- or payment-related app that the operators are interested in.

The malware also abuses accessibility services to gather extensive information about the contents of the active screens and sets itself as the default SMS app for capturing incoming and outgoing texts. Furthermore, it can monitor phone calls, block calls from specific numbers, or redirect them, effectively opening up more avenues for fraud.

Another important feature is that it can keep track of real-time notifications displayed in the device’s status bar and takes steps to either dismiss or snooze them in a bid to suppress alerts and avoid alerting the user of suspicious activity.

The development arrives as Zimperium zLabs said it uncovered a “sophisticated evolution” of the GodFather Android banking trojan that makes use of on-device virtualization to hijack legitimate mobile banking and cryptocurrency applications and carry out real-time fraud.

“The core of this novel technique is the malware’s ability to create a complete, isolated virtual environment on the victim’s device. Instead of simply mimicking a login screen, the malware installs a malicious ‘host’ application that contains a virtualization framework,” researchers Fernando Ortega and Vishnu Pratapagiri said.

“This host then downloads and runs a copy of the actual targeted banking or cryptocurrency app within its controlled sandbox.”

Should the victim launch the app, they are redirected to the virtual instance, from where their activities are monitored by the threat actors. In addition, the latest version of GodFather packs in features to bypass static analysis tools by making use of ZIP manipulation and filling the AndroidManifest file with irrelevant permissions.

Like in the case of AntiDot, GodFather relies on accessibility services to conduct its information gathering activities and control compromised devices. While Google has enforced security protections that prevent sideloaded apps from enabling accessibility services starting Android 13, a session-based installation approach can get around this safeguard.

The session-based method is used by Android app stores to handle app installation, as do texting apps, mail clients, and browsers when presented with APK files.

Central to the functioning of the malware is its virtualization feature. In the first stage, it collects information about the list of installed apps and checks if it includes any of the predetermined apps it’s configured to target.

If matches are found, it extracts relevant information from those apps and then proceeds to install a copy of those apps in a virtual environment inside the dropper app. Thus when the victim attempts to launch the actual banking application on their device, GodFather intercepts the action and opens the virtualized instance instead.

It’s worth pointing out that similar virtualization features were previously flagged in another Android malware codenamed FjordPhantom, which was documented by Promon in December 2023. The method represents a paradigm shift in mobile threat capabilities that go beyond the traditional overlay tactic to steal credentials and other sensitive data.

“While this GodFather campaign casts a wide net, targeting nearly 500 applications globally, our analysis reveals that this highly sophisticated virtualization attack is currently focused on a dozen Turkish financial institutions,” the company said.

“A particularly alarming capability uncovered in the GodFather malware is its capacity to steal device lock credentials, irrespective of whether the victim uses an unlock pattern, a PIN, or a password. This poses a significant threat to user privacy and device security.”

The mobile security company said the abuse of accessibility services is one of the many ways malicious apps can achieve privilege escalation on Android, allowing them to obtain permissions that exceed their functional requirements. These include misuse of Original Equipment Manufacturer (OEM) permissions and security vulnerabilities in pre-installed apps that cannot be removed by users.

“Preventing privilege escalation and securing Android ecosystems against malicious or over-privileged applications requires more than user awareness or reactive patching — it demands proactive, scalable, and intelligent defense mechanisms,” security researcher Ziv Zeira said.

SuperCard X Malware Comes to Russia

The findings also follow the first recorded attempts to target Russian users with SuperCard X, a newly emerged Android malware that can conduct near-field communication (NFC) relay attacks for conducting fraudulent transactions.

According to Russian cybersecurity company F6, SuperCard X is a malicious modification of a legitimate tool called NFCGate that can capture or modify NFC traffic. The end goal of the malware is to not only receive NFC traffic from the victim, but also bank card data read by sending commands to its EMV chip.

“This application allows attackers to steal bank card data by intercepting NFC traffic for subsequent theft of money from users’ bank accounts,” F6 researcher Alexander Koposov said in a report published this week.

Attacks leveraging SuperCard X were first spotted targeting Android users in Italy earlier this year, weaponizing NFC technology to relay data from victims’ physical cards to attacker-controlled devices, from where they were used to carry out fraudulent ATM withdrawals or authorize point-of-sale (PoS) payments.

The Chinese-speaking MaaS platform, advertised on Telegram as capable of targeting customers of major banks in the U.S., Australia and Europe, shares substantial code-level overlaps with NGate, an Android malware that has also been found weaponizing NFCGate for malicious purposes in the Czech Republic.

All these campaigns are united by the fact that they rely on smishing techniques to convince a potential victim of the need to install an APK file on the device under the guise of a useful program.

Malicious Apps Spotted on App Stores

While all of the aforementioned malware strains require victims to sideload the apps on their devices, new research has also unearthed malicious apps on the official Google Play Store and Apple’s App Store with capabilities to harvest personal information and steal mnemonic phrases associated with cryptocurrency wallets with the goal of draining their assets.

One of the apps in question, RapiPlata, is estimated to have been downloaded around 150,000 times on both Android and iOS devices, underscoring the severity of the threat. The app is a type of malware known as SpyLoan, which lures users by claiming to offer loans at low-interest rates, only to be subjected to extortion, blackmail, and data theft.

“RapiPlata primarily targets Colombian users by promising quick loans,” Check Point said. “Beyond its predatory lending practices, the app engages in extensive data theft. The app had extensive access to sensitive user data — including SMS messages, call logs, calendar events, and installed applications — even going so far as to upload this data to its servers.”

The cryptocurrency wallet phishing apps, on the other hand, have been distributed through compromised developer accounts and serve a phishing page via WebView to obtain the seed phrases.

Although these apps have since been removed from the respective app stores, the danger is that the Android apps could be available for download from third-party app marketplaces. Users are advised to exercise caution when downloading financial or loan-related applications.

Jun 20, 2025Ravie LakshmananCyber Warfare / Hacktivism

Iran’s state-owned TV broadcaster was hacked Wednesday night to interrupt regular programming and air videos calling for street protests against the Iranian government, according to multiple reports.

It’s currently not known who is behind the attack, although Iran pointed fingers at Israel, per Iran International.

“If you experience disruptions or irrelevant messages while watching various TV channels, it is due to enemy interference with satellite signals,” the broadcaster was quoted as saying.

The breach of state television is the latest in a string of cyber attacks inside Iran that have been attributed to Israel-linked actors. It also coincides with the hack of Bank Sepah and Nobitex, Iran’s largest cryptocurrency exchange.

The Nobitex hack led to the theft of more than $90 million, a brazen escalation in the cyber war that has simmered between Israel and Iran for more than a decade.

“Iranian entities have experimented with virtual assets as both a financial workaround and as a strategic asset to support broader geopolitical ambitions — including the proliferation of advanced weapons technology,” TRM Labs said. “This latest incident highlights how crypto exchanges, once peripheral to conflict, are increasingly becoming strategic targets for geopolitical actors.”

The latest development also follows the revelation from Israeli officials that Iran is hijacking private security cameras installed in Israel to gather real-time intelligence, mirroring a similar tactic used by Russia after its invasion of Ukraine in 2022.

“We know that in the past two or three days, the Iranians have been trying to connect to cameras to understand what happened and where their missiles hit to improve their precision,” Refael Franco, the former deputy director general of the Israel National Cyber Directorate, said.

Groups claiming DDoS attacks targeting Israel between June 13 and June 18, 2025 | Source: Radware

Cybersecurity firm Radware said nearly 40% of all hacktivist DDoS activity has been directed against Israel since the onset of the latest flare-up. On June 17, the hacktivist group DieNet warned it would launch cyber-attacks at the United States should it join the conflict against Iran.

The message has since been amplified by other groups like Arabian Ghosts, Sylhet Gang, and Team Fearless, suggesting that these entities are forming a potential collaboration in cyberspace as battle rages on the ground.

“Companies are urged to take maximum vigilance. The warning signs are clear. Critical infrastructure, supply chains, and even global businesses could become collateral targets if the cyber crossfire intensifies,” said Pascal Geenens, director of threat intelligence at Radware.

“The Israel-Iran conflict of 2025 is a stark illustration of modern hybrid warfare, where bytes and narratives are as much a part of the fight as bombs and missiles.”

In a two-part analysis, CloudSEK said more than 35 distinct pro-Iranian groups have launched coordinated attacks against Israeli infrastructure, as opposed to only less than half-a-dozen pro-Israeli groups engaging in hacktivist activity.

“The attacks predominantly consisted of DDoS assaults, website defacements, and claimed data breaches targeting government sites, military systems, and critical infrastructure,” security researcher Pagilla Manohar Reddy said.

“Most significantly, these recent attacks maintain the same pattern of exaggeration and disinformation that has characterized the broader hacktivist ecosystem, with groups continuing to take credit for unrelated service outages, recycle old data leaks, and inflate damage claims for media attention rather than achieving substantial operational impact.”

Cloudflare on Thursday said it autonomously blocked the largest ever distributed denial-of-service (DDoS) attack ever recorded, which hit a peak of 7.3 terabits per second (Tbps).

The attack, which was detected in mid-May 2025, targeted an unnamed hosting provider.

“Hosting providers and critical Internet infrastructure have increasingly become targets of DDoS attacks,” Cloudflare’s Omer Yoachimik said. “The 7.3 Tbps attack delivered 37.4 terabytes in 45 seconds.”

Earlier this January, the web infrastructure and security company said it had mitigated a 5.6 Tbps DDoS attack aimed at an unnamed internet service provider (ISP) from Eastern Asia. The attack originated from a Mirai-variant botnet in October 2024.

Then in April 2025, Cloudflare revealed it defended against a massive 6.5 Tbps flood that likely emanated from Eleven11bot, a botnet comprising roughly 30,000 webcams and video recorders. The hyper-volumetric attack lasted about 49 seconds.

The 7.3 Tbps DDoS attack, in comparison, carpet-bombed an average of 21,925 destination ports of a single IP address owned and used the hosting provider, hitting a crest of 34,517 destination ports per second.

The multi-vector attack originated from a similar distribution of source ports and has been identified as a combination of UDP flood, QOTD reflection attack, echo reflection attack, NTP reflection attack, Mirai UDP flood attack, portmap flood, and RIPv1 amplification attack. The UDP flood accounted for 99.996% of the attack traffic.

Cloudflare also pointed out that the attack came from over 122,145 source IP addresses spanning 5,433 Autonomous Systems (AS) across 161 countries. The top sources of attack traffic included Brazil, Vietnam, Taiwan, China, Indonesia, Ukraine, Ecuador, Thailand, the United States, and Saudi Arabia.

“The average number of unique source IP addresses per second was 26,855 with a peak of 45,097,” Yoachimik said.

“Telefonica Brazil (AS27699) accounted for the largest portion of the DDoS attack traffic, responsible for 10.5% of the total. Viettel Group (AS7552) follows closely with 9.8%, while China Unicom (AS4837) and Chunghwa Telecom (AS3462) contributed 3.9% and 2.9% respectively. China Telecom (AS4134) accounted for 2.8% of the traffic.”

The disclosure comes as the QiAnXin XLab team said the DDoS botnet tracked as RapperBot was behind an attack aimed at artificial intelligence (AI) company DeepSeek in February 2025, and that the latest samples of the malware attempting to extort victims to pay them “protection fees” to avoid being targeted by DDoS attacks in the future.

China, the United States, Israel, Mexico, the United Kingdom, Greece, Iran, Australia, Malaysia, and Thailand are the primary countries where devices infected by RapperBot are located. The botnet is known to be active since 2022.

RapperBot campaigns are known to target routers, network-attached storage devices, and video recorders with default weak passwords or firmware vulnerabilities to obtain initial access, and drop malware that can establish contact with a remote server over DNS TXT records to fetch DDoS attack commands.

The malware also makes use of custom encryption algorithms to encrypt the TXT records and command-and-control (C2) domain names used.

“Since March, its attack behavior has been significantly active, with an average of more than 100 attack targets per day and more than 50,000 bots observed,” the Chinese security vendor said.

“RapperBot’s attack targets are all over the fields of various industries, including public management, social security and social organizations, Internet platforms, manufacturing, financial services, etc.”

Hackers never sleep, so why should enterprise defenses? Threat actors prefer to target businesses during off-hours. That’s when they can count on fewer security personnel monitoring systems, delaying response and remediation.

When retail giant Marks & Spencer experienced a security event over Easter weekend, they were forced to shut down their online operations, which account for approximately a third of the retailer’s clothing and home sales.

As most staff are away during off-hours and holidays, it takes time to assemble an incident response team and initiate countermeasures. This gives attackers more time to move laterally within the network and wreak havoc before the security team reacts.

While not every organization may be ready to staff an in-house team around the clock, building a 24/7 SOC remains one of the most robust and proactive ways to protect against off-hours attacks. In the rest of this post, we’ll explore why 24/7 vigilance is so important, the challenges of achieving it, and six practical steps 24/7 SOC success.

Importance and challenges of a 24/7 SOC

A SOC is central to an organization’s cyber defense. It plays a key role in detecting, investigating, and responding to potential threats around the clock, providing real-time threat detection and resolution. Add in automation, and it only gets better, especially when everyone is away celebrating or concentrating on their weekend chores.

But running a 24/7 SOC isn’t straightforward. It requires a perfect balance of proven processes, advanced tools, and skilled professionals.

Proper planning and automation is key

Wherever security professionals can’t keep up with the demands of a changing attack surface, AI can make a difference. Together with the right people and processes in place, AI enables efficiency by automating threat detection, resulting in faster response times and enhancing your overall security posture. Let’s look at building the right processes and where AI fits in.

6 step approach for building a 24/7 SOC

Running a successful SOC comes down to the following six measures your organization will need to realize.

SOC teams are known to burn out quickly. Developing sustainable shift rotations with 8- or 12-hour shifts is important. For example, a SOC team can work on a 4-on, 4-off schedule to stay alert, while multinationals can spread shifts across time zones to reduce the risk of fatigue.

Hire more analysts than you think you’ll need—many are paid per shift, and having a bench ensures you can rotate effectively, cover unexpected absences, and reduce pressure on your core team. This approach gives you flexibility without overextending your staff.

Security professionals also need variety to keep things interesting and stay engaged. So, regularly rotate responsibilities like alert triage, playbook review, and threat hunting.

Note: Make sure to establish clear handoff protocols to encourage overlapping handover periods. This helps nurture an environment of context sharing between teams.

As fatigue often leads to a staffing exodus, automation can play a vital role in retaining top security talent. Use AI to reduce the team’s workload, automating repetitive tasks like log analysis or phishing triage.

Wellness programs can offer a big boost, too. Encouraging work/life balance and establishing anonymous feedback channels will improve retention. Also, schedule downtime and encourage actual breaks. Make sure to emphasize that there’s no reason to work through scheduled breaks unless there’s an active incident.

Lastly, rewarding team members and recognizing wins are important. These boost job satisfaction, helping you retain talent.

4. Choose the right tools

Thoroughly research and choose AI-driven security tools that fit your specific business needs and security requirements. It’s also imperative to consider different variables like cost and complexity before settling on a tool.

For example, SIEMs like Splunk are known to have scaling challenges and high log management costs. This can be unsustainable in multi-cloud environments. Elastic’s Attack Discovery is also known to have a lot of false positives, forcing analysts to manually validate outputs.

Although many AI-powered tools minimize manual effort, they still require significant setup, rule tuning, data onboarding, and dashboard customization. Some features may also require analysts to configure data sources and interpret results. Many SOC tools are static, with pre-trained models for just a handful of use cases.

Existing SOARs additionally require considerable configuration and maintenance, while their static playbooks can’t adaptively learn to deal with new threats.

Radiant is one alternative. Its adaptive AI SOC platform ingests, triages, and escalates when an alert is deemed a true positive. It will then respond fast to actual threats and various security use cases.

Aside from being cost-effective and requiring no maintenance, Radiant integrates back into customers’ environments for 1-click or fully automatic remediation (once the SOC team is confident with Radiant’s recommendations). Plus, it doesn’t require audits or retraining to stay on top of the latest malware.

5. Cultivate a culture of continuous learning

While security leadership should encourage post-mortems, they need to avoid assigning blame. Every security event has much to teach us, and organizations need to actively store this information in a knowledge base.

Continuous learning is your ticket to staying ahead of threats. So, make sure to offer seamless access to research and training, and sponsor certifications like GIAC Intrusion Analyst certification (GCIA) and Offensive Security Certified Professional (OSCP).

Create a team culture where members cross-pollinate knowledge and build trust. Hold regular threat briefings and security drills (e.g., red team vs. blue team simulations) to identify process gaps and improve escalation paths.

These drills will help each team member quickly act if the organization comes under attack. It’s also important to practice coordination with Legal, PR, and IT teams. Tabletop exercises for executives, i.e., testing the decision-making process under pressure, are also a great idea.

6. Governance, metrics, and reporting

Define success metrics, including MTTD/MTTR, AI accuracy, and false positive rate. Faster detection limits damage, and rapid response minimizes the impact of an incident. If the AI is highly accurate, it helps build trust in automation. At the same time, low false positives reduce analysts’ workload.

Equitable workload distribution and alert volume across SOC shifts ensure balance and lower the risk of burnout. Tracking incident statistics isn’t enough. You also have to continuously monitor employee well-being: A healthy SOC team means high morale and consistent performance.

For all the above, real-time dashboards and monthly reviews are a must. Provide visuals whenever possible and include deep dives for team leads. SOC managers and T3 analysts need comprehensive insights to optimize tools, better align compliance and business risk, and manage team health.

Conclusion

The synergy of skilled personnel, streamlined processes, advanced AI, and integrated tools is the underlying force that keeps your company name out of the headlines.

A 24/7 AI-powered SOC protects organizations from rapidly evolving, advanced, persistent threats. It will help you successfully address the limitations of SIEMs, SOARs, EDRs, and SOC co-pilots through the seamless integration of automation, people, processes, and tools.

Radiant’s unique adaptive AI SOC platform streamlines processes and empowers analysts, threat hunters, and security specialists. The platform’s no-retrain automation and >95% accuracy help SOC teams overcome a variety of hurdles: EDR’s limited scope, co-pilots’ analyst dependency, SIEM’s costly complexity, and SOAR’s manual playbooks, to name a few.

It’s also scalable and cost-effective with a wide range of integrations.

If you want to see Radiant in action, it’s just a click away. Book a demo today.

Cybersecurity researchers have uncovered a new campaign in which the threat actors have published more than 67 GitHub repositories that claim to offer Python-based hacking tools, but deliver trojanized payloads instead.

The activity, codenamed Banana Squad by ReversingLabs, is assessed to be a continuation of a rogue Python campaign that was identified in 2023 as targeting the Python Package Index (PyPI) repository with bogus packages that were downloaded over 75,000 times and came with information-stealing capabilities on Windows systems.

The findings build on a previous report from the SANS’s Internet Storm Center in November 2024 that detailed a supposed “steam-account-checker” tool hosted on GitHub, which incorporated stealthy features to download additional Python payloads that can inject malicious code into the Exodus cryptocurrency wallet app and harvest sensitive data to an external server (“dieserbenni[.]ru”).

Further analysis of the repository and the attacker-controlled infrastructure has led to the discovery of 67 trojanized GitHub repositories that impersonate benign repositories with the same name.

There is evidence to suggest that users searching for software such as account cleaning tools and game cheats such as Discord account cleaner, Fortnite External Cheat, TikTok username checker, and PayPal bulk account checker are the targets of the campaign. All the identified repositories have since been taken down by GitHub.

“Backdoors and trojanized code in publicly available source code repositories like GitHub are becoming more prevalent and represent a growing software supply chain attack vector,” ReversingLabs researcher Robert Simmons said.

“For developers relying on these open-source platforms, it’s essential to always double check that the repository you’re using actually contains what you expect.”

GitHub as a Malware Distribution Service

The development comes as GitHub is increasingly becoming the focus of several campaigns as a malware distribution vector. Earlier this week, Trend Micro said it uncovered 76 malicious GitHub repositories operated by a threat actor it calls Water Curse to deliver multi-stage malware.

Then Check Point shed light on another campaign that’s using a criminal service known as the Stargazers Ghost Network to target Minecraft users with Java-based malware. The Stargazers Ghost Network refers to a collection of GitHub accounts that propagate malware or malicious links via phishing repositories.

“The network consists of multiple accounts that distribute malicious links and malware and perform other actions such as starring, forking, and subscribing to malicious repositories to make them appear legitimate,” Check Point said.

The cybersecurity company has also assessed that such “GitHub ‘Ghost’ accounts are only one part of the grand picture, with other ‘Ghost’ accounts operating on different platforms as an integral part of an even larger Distribution-as-a-Service universe.”

Some aspects of the Stargazers Ghost Network were exposed by Checkmarx in April 2024, calling out the threat actor’s pattern of using fake stars and pushing out frequent updates to artificially inflate the popularity of the repositories and make sure they surfaced on top on GitHub search results.

These repositories are ingeniously disguised as legitimate projects, typically related to popular games, cheats, or tools like cryptocurrency price trackers and multiplier prediction for crash-betting games.

These campaigns also dovetail with another attack wave that has targeted novice cybercriminals on the lookout for readily available malware and attack tools on GitHub with backdoored repositories to infect them with information stealers.

In one instance highlighted by Sophos this month, the trojanized Sakura-RAT repository has been found to incorporate malicious code that compromised those who compiled the malware on their systems with information stealers and other remote access trojans (RATs).

The identified repositories act as a conduit for four different kinds of backdoors that are embedded within Visual Studio PreBuild events, Python scripts, screensaver files, and JavaScript to steal data, take screenshots, communicate via Telegram, as well as fetch more payloads, including AsyncRAT, Remcos RAT, and Lumma Stealer.

In all, the cybersecurity company said it detected no less than 133 backdoored repositories as part of the campaign, with 111 containing the PreBuild backdoor, and the others hosting Python, screensaver, and JavaScript backdoors.

Sophos further noted that these activities are likely linked to a distribution-as-a-service (DaaS) operation that has been operational since August 2022, and which has used thousands of GitHub accounts to distribute malware embedded within trojanized repositories themed around gaming cheats, exploits, and attack tools.

While the exact distribution method used in the campaign is unclear, it’s believed that the threat actors are also relying on Discord servers and YouTube channels to spread links to the trojanized repositories.

“It remains unclear if this campaign is directly linked to some or all of the previous campaigns reported on, but the approach does seem to be popular and effective, and is likely to continue in one form or another,” Sophos said. “In the future, it’s possible that the focus may change, and threat actors may target other groups besides inexperienced cybercriminals and gamers who use cheats.”

Cybersecurity researchers have uncovered a new campaign in which the threat actors have published more than 67 GitHub repositories that claim to offer Python-based hacking tools, but deliver trojanized payloads instead.

The activity, codenamed Banana Squad by ReversingLabs, is assessed to be a continuation of a rogue Python campaign that was identified in 2023 as targeting the Python Package Index (PyPI) repository with bogus packages that were downloaded over 75,000 times and came with information-stealing capabilities on Windows systems.

The findings build on a previous report from the SANS’s Internet Storm Center in November 2024 that detailed a supposed “steam-account-checker” tool hosted on GitHub, which incorporated stealthy features to download additional Python payloads that can inject malicious code into the Exodus cryptocurrency wallet app and harvest sensitive data to an external server (“dieserbenni[.]ru”).

Further analysis of the repository and the attacker-controlled infrastructure has led to the discovery of 67 trojanized GitHub repositories that impersonate benign repositories with the same name.

There is evidence to suggest that users searching for software such as account cleaning tools and game cheats such as Discord account cleaner, Fortnite External Cheat, TikTok username checker, and PayPal bulk account checker are the targets of the campaign. All the identified repositories have since been taken down by GitHub.

“Backdoors and trojanized code in publicly available source code repositories like GitHub are becoming more prevalent and represent a growing software supply chain attack vector,” ReversingLabs researcher Robert Simmons said.

“For developers relying on these open-source platforms, it’s essential to always double check that the repository you’re using actually contains what you expect.”

GitHub as a Malware Distribution Service

The development comes as GitHub is increasingly becoming the focus of several campaigns as a malware distribution vector. Earlier this week, Trend Micro said it uncovered 76 malicious GitHub repositories operated by a threat actor it calls Water Curse to deliver multi-stage malware.

Then Check Point shed light on another campaign that’s using a criminal service known as the Stargazers Ghost Network to target Minecraft users with Java-based malware. The Stargazers Ghost Network refers to a collection of GitHub accounts that propagate malware or malicious links via phishing repositories.

“The network consists of multiple accounts that distribute malicious links and malware and perform other actions such as starring, forking, and subscribing to malicious repositories to make them appear legitimate,” Check Point said.

The cybersecurity company has also assessed that such “GitHub ‘Ghost’ accounts are only one part of the grand picture, with other ‘Ghost’ accounts operating on different platforms as an integral part of an even larger Distribution-as-a-Service universe.”

Some aspects of the Stargazers Ghost Network were exposed by Checkmarx in April 2024, calling out the threat actor’s pattern of using fake stars and pushing out frequent updates to artificially inflate the popularity of the repositories and make sure they surfaced on top on GitHub search results.

These repositories are ingeniously disguised as legitimate projects, typically related to popular games, cheats, or tools like cryptocurrency price trackers and multiplier prediction for crash-betting games.

These campaigns also dovetail with another attack wave that has targeted novice cybercriminals on the lookout for readily available malware and attack tools on GitHub with backdoored repositories to infect them with information stealers.

In one instance highlighted by Sophos this month, the trojanized Sakura-RAT repository has been found to incorporate malicious code that compromised those who compiled the malware on their systems with information stealers and other remote access trojans (RATs).

The identified repositories act as a conduit for four different kinds of backdoors that are embedded within Visual Studio PreBuild events, Python scripts, screensaver files, and JavaScript to steal data, take screenshots, communicate via Telegram, as well as fetch more payloads, including AsyncRAT, Remcos RAT, and Lumma Stealer.

In all, the cybersecurity company said it detected no less than 133 backdoored repositories as part of the campaign, with 111 containing the PreBuild backdoor, and the others hosting Python, screensaver, and JavaScript backdoors.

Sophos further noted that these activities are likely linked to a distribution-as-a-service (DaaS) operation that has been operational since August 2022, and which has used thousands of GitHub accounts to distribute malware embedded within trojanized repositories themed around gaming cheats, exploits, and attack tools.

While the exact distribution method used in the campaign is unclear, it’s believed that the threat actors are also relying on Discord servers and YouTube channels to spread links to the trojanized repositories.

“It remains unclear if this campaign is directly linked to some or all of the previous campaigns reported on, but the approach does seem to be popular and effective, and is likely to continue in one form or another,” Sophos said. “In the future, it’s possible that the focus may change, and threat actors may target other groups besides inexperienced cybercriminals and gamers who use cheats.”