Category: Cybersecurity

Sep 23, 2025Ravie LakshmananFinancial Crime / Cryptocurrency

Law enforcement authorities in Europe have arrested five suspects in connection with an “elaborate” online investment fraud scheme that stole more than €100 million ($118 million) from over 100 victims in France, Germany, Italy, and Spain.

According to Eurojust, the coordinated action saw searches in five places across Spain and Portugal, as well as in Italy, Romania and Bulgaria. Bank accounts and other financial assets associated with the cybercrime ring were frozen.

The main perpetrator behind the operation has been accused of large-scale fraud and money laundering by running an online investment platform for several years, tricking unsuspecting individuals into parting with their funds by promising them high returns on investments in various cryptocurrencies.

Once the deposits were made, the funds were transferred to bank accounts in Lithuania to launder them. Victims who attempted to withdraw their assets from the platform were asked to pay additional fees, after which the website used to conduct the scam vanished.

A number of judicial and law enforcement agencies from Bulgaria, Italy, Lithuania, Portugal, Romania, and Spain participated in the fraud scheme investigation.

“This fraud had been running since at least 2018, and covered 23 different countries, for instance, either as areas used to divert proceeds of the scam or as locations where victims were based,” Eurojust, which coordinated the effort along with support from Europol, said.

According to the U.S. Federal Trade Commission (FTC), Americans lost a record $12.5 billion to fraud in 2024, a 25% increase from the previous year, with investment scams resulting in the highest losses, touching $5.7 billion, up from $4.6 billion in 2023 and $3.8 billion in 2022.

“A majority (79%) of people who reported an investment-related scam lost money, with a median loss of over $9,000,” the FTC said. “People lost over $3 billion to scams that started online, compared to approximately $1.9 billion lost to more ‘traditional’ contact methods like calls, texts, or emails.”

The disclosure comes as Chainalysis revealed how a Venus Protocol user was targeted on September 2, 2025, in a social engineering attack, and how early detection and swift action enabled the recovery of stolen funds worth approximately $13 million.

“The attack was rooted in social engineering: malicious actors used a compromised Zoom client to gain system access,” Chainalysis said.

Image Source: Chainalysis

“After infiltrating the victim’s machine, the attackers manipulated the user into submitting a blockchain transaction, which granted them delegate status over the account. This gave them direct control to borrow and redeem assets on behalf of the victim, effectively draining funds.”

The blockchain analytics company said Venus paused its protocol within 20 minutes of the malicious transaction taking place, effectively preventing the attacker from moving the funds further. Over the next 12 hours, Venus force-liquidated the attacker’s wallet, recovered the stolen funds, and resumed full service.

“Venus passed a governance proposal to freeze $3 million in assets still controlled by the attacker,” Chainalysis noted. “Not only did the attacker fail to profit; they actually lost $3 million as a result of the community’s decisive action.”

The Eurojust crackdown also coincides with a similar effort undertaken by the Seoul Metropolitan Police Agency (SMPA) earlier this month that disrupted a cybercrime operation, which is estimated to have stolen about $30 million from 258 high-profile victims, including corporate executives.

“The operation was sophisticated: after successfully hacking victims’ personal information and stealing funds, the criminals would impersonate agency employees and approach victims’ family members to gather even more personal data, preparing for additional thefts,” Chainalysis noted.

Sep 23, 2025Ravie LakshmananNational Security / Threat Intelligence

The U.S. Secret Service on Tuesday said it took down a network of electronic devices located across the New York tri-state area that were used to threaten U.S. government officials and posed an imminent threat to national security.

“This protective intelligence investigation led to the discovery of more than 300 co-located SIM servers and 100,000 SIM cards across multiple sites,” the Secret Service said.

The devices were concentrated within a 35-mile (56 km) radius of the global meeting of the United Nations General Assembly in New York City. An investigation into the incident has been launched by the Secret Service’s Advanced Threat Interdiction Unit.

Aside from issuing anonymous telephonic threats, the sophisticated devices could be weaponized to conduct various attacks on the telecommunications infrastructure, including disabling cell phone towers, triggering a denial-of-service, and facilitating encrypted communication between potential threat actors and criminal enterprises.

The Secret Service also said early evidence points to cellular communications between nation-state threat actors and individuals that are known to federal law enforcement. It did not elaborate on who these actors are. The agency also did not identify the officials who were threatened, the nature of the threat, or the nations that may have been involved.

CNN and NBC News reported that the network anonymously conveyed assassination threats against senior U.S. officials and that the probe uncovered empty electronic safehouses rented around the area, including Armonk, New York; Greenwich, Connecticut; Queens, New York; and across the river in New Jersey.

“The potential for disruption to our country’s telecommunications posed by this network of devices cannot be overstated,” said U.S. Secret Service Director Sean Curran.

“The U.S. Secret Service’s protective mission is all about prevention, and this investigation makes it clear to potential bad actors that imminent threats to our protectees will be immediately investigated, tracked down, and dismantled.”

Sep 23, 2025Ravie LakshmananVulnerability / Data Security

SolarWinds has released hot fixes to address a critical security flaw impacting its Web Help Desk software that, if successfully exploited, could allow attackers to execute arbitrary commands on susceptible systems.

The vulnerability, tracked as CVE-2025-26399 (CVSS score: 9.8), has been described as an instance of deserialization of untrusted data that could result in code execution. It affects SolarWinds Web Help Desk 12.8.7 and all previous versions.

“SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine,” SolarWinds said in an advisory released on September 17, 2025.

An anonymous researcher working with the Trend Micro Zero Day Initiative (ZDI) has been credited with discovering and reporting the flaw.

SolarWinds said CVE-2025-26399 is a patch bypass for CVE-2024-28988 (CVSS score: 9.8), which, in turn, is a bypass for CVE-2024-28986 (CVSS score: 9.8) that was originally addressed by the company back in August 2024.

“This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Web Help Desk. Authentication is not required to exploit this vulnerability,” according to a ZDI advisory for CVE-2024-28988.

“The specific flaw exists within the AjaxProxy. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.”

While there is no evidence of the vulnerability being exploited in the wild, users are advised to update their instances to SolarWinds Web Help Desk 12.8.7 HF1 for optimal protection.

That said, it’s worth emphasizing that the original bug CVE-2024-28986 was added to the Known Exploited Vulnerabilities (KEV) catalog by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) shortly after public disclosure. There is currently no information publicly available on the nature of the attacks weaponizing the bug.

“SolarWinds is a name that needs no introduction in IT and cybersecurity circles. The infamous 2020 supply chain attack, attributed to Russia’s Foreign Intelligence Service (SVR), allowed months-long access into multiple Western government agencies and left a lasting mark on the industry,” Ryan Dewhurst, head of proactive threat intelligence at watchTowr, said in a statement.

“Fast forward to 2024: an unauthenticated remote deserialization vulnerability (CVE-2024-28986) was patched… then patched again (CVE-2024-28988). And now, here we are with yet another patch (CVE-2025-26399) addressing the very same flaw.

“Third time’s the charm? The original bug was actively exploited in the wild, and while we’re not yet aware of active exploitation of this latest patch bypass, history suggests it’s only a matter of time.”

Big companies are getting smaller, and their CEOs want everyone to know it. Wells Fargo has cut its workforce by 23% over five years, Bank of America has shed 88,000 employees since 2010, and Verizon’s CEO recently boasted that headcount is “going down all the time.” What was once a sign of corporate distress has become a badge of honor, with executives celebrating lean operations and AI-driven efficiency.

But while C-suite leaders tout “doing more with less,” CISOs are left with fewer resources, while every preventable security incident becomes exponentially costlier. With security teams already stretched thin and developer-to-security ratios reaching unsustainable levels, these workforce reductions push already distressed teams past their breaking point. Against this backdrop of workforce optimization, hardcoded secrets represent a particularly dangerous blind spot that can no longer be managed through manual processes and reactive firefighting.

The Numbers Don’t Lie

The credential crisis is already here. According to IBM’s latest research, 86% of breaches involve stolen or compromised credentials, with the average time to identify and contain these incidents stretching to a staggering 292 days.

The financial stakes have never been higher. In the United States, breach costs surged to an all-time high of $10.22 million, driven by higher regulatory fines and detection costs. For credential-based incidents specifically, HashiCorp’s research shows these breaches carry a $750,000 premium, meaning US organizations face potential costs exceeding $11 million when hardcoded secrets are involved.

But the hidden costs may be even more devastating. Organizations waste nearly $1.4 million annually on managing secrets manually. This includes developer time spent on credential rotation and exposure investigation ($936,000) and security analysts triaging false positives and chasing down leaked credentials (>$500,000).

The real-world impact is already visible. Canva experienced days of downtime across multiple teams due to a single leaked secret, consuming engineering resources that should have been focused on product development.

Why Lean Teams Amplify the Risk

Workforce reductions mean longer mean-time-to-remediate incidents, and the 292-day average containment window becomes even more dangerous. Each security incident pulls already-stretched teams away from core business functions, creating costly context-switching overhead that lean organizations can’t afford.

The scope of the problem continues expanding even as teams shrink. Large organizations harbor thousands of unmanaged secrets scattered across code repositories, CI/CD pipelines, Slack channels, Jira tickets, and collaboration platforms.

HashiCorp’s research indicates that up to 40% of these secrets fall into high-risk categories, often providing direct production access.

This creates a multiplication effect: one hardcoded API key can enable lateral movement, supply chain compromise, and large-scale ransomware deployment. The recent s1ngularity attack demonstrates this perfectly: what began as a GitHub Action token-stealing pull request compromised Nx packages, stealing 2,349 credentials, and cascaded into attackers exposing 82,901 additional secrets by making over 10,000 private repositories public.

The Strategic Response: Precision Over Volume

GitGuardian’s approach to secrets security recognizes a fundamental truth: detection alone isn’t enough. Without effective remediation, alerts become expensive noise that overwhelms already-stretched teams. For CISOs managing learner security operations, this distinction is critical.

Secrets present a fundamentally different challenge than traditional vulnerabilities. While a developer can typically patch a code vulnerability independently, remediating exposed secrets requires understanding the broader infrastructure context—where the secret is used across multiple services, which systems depend on it, and who has the authority to rotate it. This often demands coordination between development, platform, and DevOps teams, each with its own priorities and workflows. Gathering this context manually becomes prohibitively expensive when security teams are already operating at capacity, turning what should be quick fixes into complex, multi-team investigations that can stretch for weeks.

Advanced platforms now shift focus from “What is exposed?” to “What is the magnitude of exposure?” by providing contextual information, including roles, permissions, ownership, and threat scope. This holistic approach directly addresses the false positive burden that costs organizations over $500,000 annually in wasted analyst time.

Cutting Remediation Time from Weeks to Hours

Effective remediation frameworks align perfectly with lean team constraints:

Proactive Detection: Platforms that implement both preventive scanning during commits and reactive scanning for existing leaks catch issues before they reach the 292-day average containment window.

Clear Ownership: Instead of broadcasting vague alerts, modern tools assign ownership for every secret, ensuring responsible developers receive notifications with full context. This eliminates time waste hunting down secret owners.

Informed Decision Making: Teams receive precise location data, understand what each secret unlocks, and know whether it’s still active. According to the Hashicorp research mentioned above, this targeted approach prevents the $936,000 annual productivity drain from manual investigation tasks.

Workflow Integration: Developers get clear remediation guidance directly within their existing tools, reducing the context switching costs that plague smaller teams. Advanced platforms now offer automated secret revocation capabilities and can generate code-fixing pull requests directly within version control systems, meeting developers exactly where they work rather than forcing them into separate security tools.

The ROI of Smart Remediation

By pinpointing specific files and lines of code where secrets are hardcoded, GitGuardian’s approach transforms the economics of incident response. Instead of developers spending hours searching codebases, they focus their efforts exactly where needed. Real-time remediation tracking provides security teams with visibility without manual oversight.

This precision approach directly tackles the core challenge facing downsized security teams: doing more with less while maintaining security posture.

Cybersecurity researchers have disclosed details of a new botnet that customers can rent access to conduct distributed denial-of-service (DDoS) attacks against targets of interest.

The ShadowV2 botnet, according to Darktrace, predominantly targets misconfigured Docker containers on Amazon Web Services (AWS) cloud servers to deploy a Go-based malware that turns infected systems into attack nodes and co-opt them into a larger DDoS botnet. The cybersecurity company said it detected the malware targeting its honeypots on June 24, 2025.

“At the center of this campaign is a Python-based command-and-control (C2) framework hosted on GitHub Codespaces,” security researcher Nathaniel Bill said in a report shared with The Hacker News.

“What sets this campaign apart is the sophistication of its attack toolkit. The threat actors employ advanced methods such as HTTP/2 Rapid Reset, a Cloudflare under attack mode (UAM) bypass, and large-scale HTTP floods, demonstrating a capability to combine distributed denial-of-service (DDoS) techniques with targeted exploitation.”

The activity is notable for incorporating a Python-based spreader module to breach Docker daemons, mainly those running on AWS EC2, while the Go-based remote access trojan (RAT) enables command execution and communication with its operators using the HTTP protocol. ShadowV2 has been described by the authors as an “advanced attack platform.”

Campaigns targeting exposed Docker instances are known to typically leverage the access to either drop a custom image or leverage an existing image on Docker Hub to deploy the necessary payloads. However, ShadowV2 takes a slightly different approach by first spawning a generic setup container from an Ubuntu image and installing various tools in it.

An image of the created container is then built and deployed as a live container. It’s currently not known why this method was chosen by the attackers, although Darktrace said it’s possible that they are trying to avoid leaving any forensic artifacts by carrying it out directly on the victim machine.

It also incorporates features to conduct HTTP/2 Rapid Reset attacks as opposed to a traditional HTTP flood and sidestep Cloudflare’s Under Attack mode by using the ChromeDP tool to solve the JavaScript challenge presented to users and obtain the clearance cookie for use in subsequent requests. That said, the bypass is unlikely to work given that these challenges are explicitly designed to block headless browser traffic.

Further analysis of C2 infrastructure has found that the server is hosted behind Cloudflare to conceal its true origins. It also makes use of FastAPI and Pydantic, and supports a login panel and operator interface, indicating that the tool is being developed with the idea of offering a “DDoS-for-Hire” service.

The API endpoints allow operators to add, update, or delete users, configure the type of attacks those users can execute, provide a list of endpoints from which the attack has to be launched, and exclude a list of sites from being targeted.

“By leveraging containerization, an extensive API, and with a full user interface, this campaign shows the continued development of cybercrime-as-a-service,” Bill said. “The ability to deliver modular functionality through a Go-based RAT and expose a structured API for operator interaction highlights how sophisticated some threat actors are.”

The disclosure comes as F5 Labs said it detected a web scanning botnet that uses Mozilla-related browser user agents to target internet-exposed systems for known security flaws. So far, the botnet is said to have used 11,690 different Mozilla User-Agent strings for its scans.

It also comes as Cloudflare said it autonomously blocked hyper-volumetric DDoS attacks that peaked at 22.2 terabits per second (Tbps) and 10.6 billion packets per second (Bpps), respectively, according to a post shared on X today. The DDoS attack, the largest ever recorded to date, lasted only 40 seconds.

Earlier this month, the web infrastructure company revealed it had mitigated a record-setting volumetric distributed denial-of-service (DDoS) attack that peaked at 11.5 terabits per second (Tbps) and lasted only about 35 seconds.

Chinese security firm QiAnXin XLab, in a technical report last week, said the botnet known as AISURU is responsible for the attack. A variant of AIRASHI, it has infected nearly 300,000 devices, most of which are routers and security cameras. The botnet, per the company, is managed by three individuals – Snow, Tom, and Forky – who take care of development, vulnerability integration, and sales, respectively.

Recent iterations of the malware include a modified RC4 algorithm to decrypt source code strings, conduct speed tests to find the lowest-latency server, and steps to check compromised devices to determine the presence of network utilities like tcpdump, Wireshark, as well as virtualization frameworks like VMware, QEMU, VirtualBox, and KVM.

“The AISURU botnet has launched attacks worldwide, spanning multiple industries,” XLab noted. “Its primary targets have been located in regions such as China, the United States, Germany, the United Kingdom, and Hong Kong. The new samples support not only DDoS attacks but also Proxy functionality. As global law enforcement increases pressure on cybercrime, demand for anonymization services is rising.”

Sep 23, 2025Ravie LakshmananSupply Chain Attack / Malware

GitHub on Monday announced that it will be changing its authentication and publishing options “in the near future” in response to a recent wave of supply chain attacks targeting the npm ecosystem, including the Shai-Hulud attack.

This includes steps to address threats posed by token abuse and self-replicating malware by allowing local publishing with required two-factor authentication (2FA), granular tokens that will have a limited lifetime of seven days, and trusted publishing, which enables the ability to securely publish npm packages directly from CI/CD workflows using OpenID Connect (OIDC).

Trusted publishing, besides eliminating the need for npm tokens, establishes cryptographic trust by authenticating each publish using short-lived, workflow-specific credentials that cannot be exfiltrated or reused. Even more significantly, the npm CLI automatically generates and publishes provenance attestations for the package.

“Every package published via trusted publishing includes cryptographic proof of its source and build environment,” GitHub noted back in late July 2025. “Your users can verify where and how your package was built, increasing trust in your supply chain.”

To support these changes, the Microsoft-owned company said it will be enacting the following steps –

• Deprecate legacy classic tokens.
• Deprecate time-based one-time password (TOTP) 2FA, migrating users to FIDO-based 2FA.
• Limit granular tokens with publishing permissions to a shorter expiration.
• Set publishing access to disallow tokens by default, encouraging usage of trusted publishers or 2FA-enforced local publishing.
• Remove the option to bypass 2FA for local package publishing.
• Expand eligible providers for trusted publishing.

The development comes a week after a supply chain attack codenamed Shai-Hulud injected a self-replicating worm into hundreds of npm packages that scanned developer machines for sensitive secrets and transmitted them to an attacker-controlled server.

“By combining self-replication with the capability to steal multiple types of secrets (and not just npm tokens), this worm could have enabled an endless stream of attacks had it not been for timely action from GitHub and open source maintainers,” GitHub’s Xavier René-Corail said.

Npm Package Includes QR Code-Based

The disclosure comes as software supply chain security company Socket said it identified a malicious npm package named fezbox that’s capable of harvesting browser passwords using a novel steganographic technique. The package is no longer available for download from npm. It attracted a total of 476 downloads since it was first published on August 21, 2025.

“In this package, the threat actor (npm alias janedu; registration email janedu0216@gmail[.]com) executes a payload within a QR code to steal username and password credentials from web cookies, within the browser,” security researcher Olivia Brown said.

Fezbox claims to be a JavaScript utility consisting of common helper functions. But, in reality, it harbors stealthy code to fetch a QR code from a remote URL, parse the QR code, and execute the JavaScript payload contained within that URL.

The payload, for its part, attempts to read document.cookie, extracts username and password information from the cookie, and transmits the information to an external server (“my-nest-app-production>.up.railway[.]app”) via an HTTPS POST request.

“Most applications no longer store literal passwords in cookies, so it’s difficult to say how successful this malware would be at its goal,” Brown noted. “However, the use of a QR code for further obfuscation is a creative twist by the threat actor. This technique demonstrates how threat actors continue to improve their obfuscation techniques and why having a dedicated tool to check your dependencies is more important than ever.”

Sep 23, 2025Ravie LakshmananSEO Poisoning / Malware

Cybersecurity researchers are calling attention to a search engine optimization (SEO) poisoning campaign likely undertaken by a Chinese-speaking threat actor using a malware called BadIIS in attacks targeting East and Southeast Asia, particularly with a focus on Vietnam.

The activity, dubbed Operation Rewrite, is being tracked by Palo Alto Networks Unit 42 under the moniker CL-UNK-1037, where “CL” stands for cluster and “UNK” refers to unknown motivation. The threat actor has been found to share infrastructure and architectural overlaps with an entity referred to as Group 9 by ESET and DragonRank.

“To perform SEO poisoning, attackers manipulate search engine results to trick people into visiting unexpected or unwanted websites (e.g., gambling and porn websites) for financial gain,” security researcher Yoav Zemah said. “This attack used a malicious native Internet Information Services (IIS) module called BadIIS.”

BadIIS is designed to intercept and modify incoming HTTP web traffic with the end goal of serving malicious content to site visitors using legitimate compromised servers. In other words, the idea is to manipulate search engine results to direct traffic to a destination of their choosing by injecting keywords and phrases into legitimate websites carrying a good domain reputation.

The IIS module is equipped to flag visitors originating from search engine crawlers by inspecting the User-Agent header in the HTTP request, allowing it to contact an external server to fetch the poisoned content to alter the SEO and cause the search engine to index the victim site as a relevant result for the terms found in the command-and-control (C2) server response.

Once the sites have been poisoned in this manner, all it takes to complete the scheme is ensnaring victims who search for those terms in a search engine and end up clicking on the legitimate-but-compromised site, ultimately redirecting them to a scam site instead.

In at least one incident investigated by Unit 42, the attackers are said to have leveraged their access to a search engine crawler to pivot to other systems, create new local user accounts, and drop web shells for establishing persistent remote access, exfiltrating source code, and uploading BadIIS implants.

“The mechanism first builds a lure and then springs the trap,” Unit 42 said. “The lure is built by attackers feeding manipulated content to search engine crawlers. This makes the compromised website rank for additional terms to which it would otherwise have no connection. The compromised web server then acts as a reverse proxy — an intermediary server getting content from other servers and presenting it as its own.”

Some of the other tools deployed by the threat actors in their attacks include three different variants of BadIIS modules –

• A lightweight ASP.NET page handler that achieves the same goal of SEO poisoning by proxying malicious content from a remote C2 server
• A managed .NET IIS module that can inspect and modify every request that passes through the application to inject spam links and keywords from a different C2 server, and
• An all-in-one PHP script that combines user redirection and dynamic SEO poisoning

“The threat actor tailored all the implants to the goal of manipulating search engine results and controlling the flow of traffic,” Unit 42 said. “We assess with high confidence that a Chinese-speaking actor is operating this activity, based on direct linguistic evidence, as well as infrastructure and architecture links between this actor and the Group 9 cluster.”

The disclosure comes weeks after ESET detailed a previously undocumented threat cluster dubbed GhostRedirector that has managed to compromise at least 65 Windows servers primarily located in Brazil, Thailand, and Vietnam with a malicious IIS module codenamed Gamshen to facilitate SEO fraud.

Organizations in Belarus, Kazakhstan, and Russia have emerged as the target of a phishing campaign undertaken by a previously undocumented hacking group called ComicForm since at least April 2025.

The activity primarily targeted industrial, financial, tourism, biotechnology, research, and trade sectors, cybersecurity company F6 said in an analysis published last week.

The attack chain involves sending emails bearing subject lines like “Waiting for the signed document,” “INvoice for Payment,” or “Reconciliation Act for Signature,” urging recipients to open an RR archive, within which there exists a Windows executable that masquerades as a PDF document (e.g., “Акт_сверки pdf 010.exe”). The messages, written in Russian or English, are sent from email addresses registered in the .ru, .by, and .kz top-level domains.

The executable is an obfuscated .NET loader designed to launch a malicious DLL (“MechMatrix Pro.dll”), which subsequently runs a third-stage payload, another DLL named “Montero.dll” that serves as a dropper for the Formbook malware, but not before creating a scheduled task and configuring Microsoft Defender exclusions to evade detection.

Interestingly, the binary has also been found to contain Tumblr links pointing to completely harmless GIFs of comic superheroes like Batman, giving the threat actor its name. “These images were not used in any attack, but were merely part of the malware code,” F6 researcher Vladislav Kugan said.

Analysis of ComicForm’s infrastructure has revealed signs that phishing emails have also been directed against an unspecified company operating in Kazakhstan in June 2025 and a Belarusian bank in April 2025.

F6 also said it detected and blocked phishing emails sent to Russian manufacturing companies from the email address of a Kazakhstan-based industrial company as recently as July 25, 2025. These digital missives prompt prospective targets to click on an embedded link to confirm their account and avoid a potential block.

Users who click on the link are redirected to a bogus landing page mimicking the login page of a domestic document management service to facilitate credential theft by transmitting the entered information to an attacker-controlled domain in the form of an HTTP POST request.

“Additionally, JavaScript code was found in the page body that extracts the email address from URL parameters, populates the input field with id=”email” , extracts the domain from the email address, and sets a screenshot of that domain’s website (via the screenshotapi[.]net API) as the background of the phishing page,” Kugan explained.

The attack aimed at the Belarusian bank involved sending a phishing email with an invoice-themed lure to trick users into entering their email addresses and phone numbers in a form, which are then captured and sent to an external domain.

“The group attacks Russian, Belarusian, and Kazakh companies from various sectors, and the use of English-language emails suggests that the attackers are also targeting organizations in other countries,” F6 said. “The attackers employ both phishing emails distributing FormBook malware and phishing resources disguised as web services to harvest access credentials.”

Pro-Russian Group Targets South Korea with Formbook

The disclosure comes as the NSHC ThreatRecon Team disclosed details of a pro-Russian cybercrime group that has targeted manufacturing, energy, and semiconductor sectors in South Korea. The activity has been attributed to a cluster called SectorJ149 (aka UAC-0050).

The attacks, observed in November 2024, commenced with spear-phishing emails targeting executives and employees using lures related to production facility purchases or quotation requests, leading to the execution of commodity malware families like Lumma Stealer, Formbook, and Remcos RAT by means of a Visual Basic Script distributed as a Microsoft cabinet (CAB) archive.

The Visual Basic Script is engineered to run a PowerShell command that reaches out to a Bitbucket or GitHub repository to fetch a JPG image file, which conceals a loader executable responsible for launching the final stealer and RAT payloads.

“The PE Malware executed directly in the memory area is a loader-type Malware that downloads additional malicious data disguised as a text file (.txt) through a URL included in the provided parameter values, decrypts it, and then generates and executes the PE Malware,” the Singaporean cybersecurity company said.

“In the past, the SectorJ149 group primarily operated for financial gain, but the recent hacking activities targeting Korean companies are believed to have a strong hacktivist nature, using hacking techniques to convey political, social, or ideological messages.”

Sep 22, 2025Ravie Lakshmanan

The security landscape now moves at a pace no patch cycle can match. Attackers aren’t waiting for quarterly updates or monthly fixes—they adapt within hours, blending fresh techniques with old, forgotten flaws to create new openings. A vulnerability closed yesterday can become the blueprint for tomorrow’s breach.

This week’s recap explores the trends driving that constant churn: how threat actors reuse proven tactics in unexpected ways, how emerging technologies widen the attack surface, and what defenders can learn before the next pivot.

Read on to see not just what happened, but what it means—so you can stay ahead instead of scrambling to catch up.

⚡ Threat of the Week

Google Patches Actively Exploited Chrome 0-Day — Google released security updates for the Chrome web browser to address four vulnerabilities, including one that it said has been exploited in the wild. The zero-day vulnerability, CVE-2025-10585, has been described as a type confusion issue in the V8 JavaScript and WebAssembly engine. The company did not share any additional specifics about how the vulnerability is being abused in real-world attacks, by whom, or the scale of such efforts. “Google is aware that an exploit for CVE-2025-10585 exists in the wild,” it acknowledged. CVE-2025-10585 is the sixth zero-day vulnerability in Chrome that has been either actively exploited or demonstrated as a proof-of-concept (PoC) since the start of the year.

• AI-Powered Villager Pen Testing Tool Hits 11,000 PyPI Downloads — A new artificial intelligence (AI)-native penetration testing tool called Villager has reached nearly 11,000 downloads on the Python Package Index (PyPI) just two months after release. The rapid adoption of what appears to be a legitimate tool echoes the trajectory of Cobalt Strike, Sliver, and Brute Ratel C4 (BRc4), which were created for legitimate use but have since become some of the favorite tools among cybercriminals. The release of Villager has also raised concerns over dual-use abuse, with threat actors potentially misusing it to run advanced intrusions with speed and efficiency.
• RowHammer Attack Against DDR5 RAM From SK Hynix — Researchers have devised a new technique to trigger RowHammer bit flips inside the memory cells of DDR5 RAM modules, which were believed to be protected against such attacks. The attack allows controlled memory modification, leading to privilege escalation exploits or the leaking of sensitive data stored in restricted memory regions. “Our reverse-engineering efforts show that significantly longer RowHammer patterns are nowadays necessary to bypass these new protections,” the researchers said. “To trigger RowHammer bit flips, such patterns need to remain in-sync with thousands of refresh commands, which is challenging. Our new RowHammer attack, called Phoenix, resynchronizes these long patterns as necessary to trigger the first DDR5 bit flips in devices with such advanced TRR protections.”
• Scattered Spider Members Arrested — Law enforcement authorities in the U.K. arrested two teen members of the Scattered Spider hacking group in connection with their alleged participation in an August 2024 cyber attack targeting Transport for London (TfL), the city’s public transportation agency. Thalha Jubair (aka EarthtoStar, Brad, Austin, and @autistic), 19, from East London, and Owen Flowers, 18, from Walsall, West Midlands were arrested at their home addresses. In parallel, the U.S. Department of Justice (DoJ) unsealed a complaint charging Jubair with conspiracies to commit computer fraud, wire fraud, and money laundering in relation to at least 120 computer network intrusions and extorting 47 U.S. entities from May 2022 to September 2025. Victims of the ransomware attacks paid at least $115,000,000 in payments. In a related but separate announcement, the Los Angeles Metropolitan Police Department said a teenage male surrendered by himself on September 17, 2025, for allegedly attacking multiple Las Vegas casino properties between August and October 2023. The juvenile suspect has been charged with three counts of Obtaining and Using Personal Identifying Information of Another Person to Harm or Impersonate Person, one count of extortion, one count of Conspiracy to Commit Extortion, and one count of Unlawful Acts Regarding Computers. The arrests came as 15 well-known e-crime groups, including Scattered Spider, ShinyHunters, and LAPSUS$, announced that they are shutting down their operations. The collective announcement was posted on BreachForums, where the groups claimed they had achieved their goals of exposing weaknesses in digital infrastructure rather than profiting through extortion. While it’s very much possible that some of the members may have decided to step back and enjoy their earnings, it does not stop copycat groups from rising up and taking their spots, or even for the threat actors to resurface under a different brand.
• Gameredon and Turla Join Hands to Strike Ukraine — The Russian hacker group known as Turla has carried out some of the most innovative hacking feats in the history of cyber espionage, including hijacking other hackers’ operations to cloak their own data extraction. Even when they’re operating on their home turf, they have adopted equally remarkable methods, such as using their control of Russia’s internet service providers to directly plant spyware on the computers of their targets in Moscow. The latest approach involves leveraging the access obtained by fellow FSB group Gamaredon to selectively target high-value targets with a backdoor known as Kazuar. The development marks the first known cases of collaboration between Gamaredon and Turla.
• Microsoft and Cloudflare Dismantle RaccoonO365 PhaaS — Microsoft’s Digital Crimes Unit said it teamed up with Cloudflare to coordinate the seizure of 338 domains used by RaccoonO365, a financially motivated threat group that was behind a phishing-as-a-service (PhaaS) toolkit used to steal more than 5,000 Microsoft 365 credentials from 94 countries since July 2024. RaccoonO365 is marketed to other cybercriminals under a subscription model, allowing them to mount phishing and credential harvesting attacks at scale with little to no technical expertise. A 30-day plan costs $355, and a 90-day plan is priced at $999. Cloudflare said it banned all identified domains, placed interstitial “phish warning” pages in front of them, terminated the associated Workers scripts, and suspended the user accounts.
• Self-Replicating Worm Hits npm Registry — Another software supply chain attack hit the npm registry, this time infecting several packages with a self-replicating worm that searches developer machines for secrets using TruffleHog’s credential scanner and transmits them to an external server under the attacker’s control. The attack is capable of targeting both Windows and Linux systems. The incident is estimated to have affected over 500 packages.

‎️‍🔥 Trending CVEs

Hackers don’t wait. They exploit newly disclosed vulnerabilities within hours, transforming a missed patch or a hidden bug into a critical point of failure. One unpatched CVE is all it takes to open the door to a full-scale compromise. Below are this week’s most critical vulnerabilities, making waves across the industry. Review the list, prioritize patching, and close the window of opportunity before attackers do.

This week’s list includes — CVE-2025-10585 (Google Chrome), CVE-2025-55241 (Microsoft Azure Entra), CVE-2025-10035 (Fortra GoAnywhere Managed File Transfer), CVE-2025-58434 (Flowise), CVE-2025-58364, CVE-2025-58060 (Linux CUPS), CVE-2025-8699 (KioSoft), CVE-2025-5821 (Case Theme User), CVE-2025-41248, CVE-2025-41249 (Spring Framework), CVE-2025-38501 (Linux Kernel KSMBD), CVE-2025-9242 (WatchGuard Firebox), CVE-2025-9961 (TP-Link), CVE-2025-5115, CVE-2025-59474 (Jenkins), CVE-2025-59340 (HubSpot Jinjava), CVE-2025-58321 (Delta Electronics DIALink), CVE-2023-49564 (Nokia CloudBand Infrastructure Software and Container Service), and path traversal (LVE-2025-0257) and authentication bypass or local privilege escalation (LVE-2025-0264) flaws in LG’s webOS for smart TVs.

📰 Around the Cyber World

• China’s Great Firewall Leak — The Great Firewall of China (GFW) suffered its largest-ever internal data breach after unknown actors published a 600 GB trove of sensitive material – including source code, work logs, configuration files, and internal communications. The data appears to have come from the servers of Geedge Networks and the Massive and Effective Stream Analysis (MESA) Lab at the Institute of Information Engineering, Chinese Academy of Sciences. The leaked data detail efforts to conduct deep packet inspection, real-time mobile internet monitoring, instructions on how to carry out granular control over data traffic, and censorship rules tailored to different regions. InterSecLab also argues the data indicates Chinese authorities can locate netizens, adding Geedge’s contributions to the Great Firewall may be copies of security appliances made by vendors Greynoise and Fortinet. The development came as Geedge Networks has been flagged for exporting technology to build national censorship firewalls. The governments of Kazakhstan, Ethiopia, Pakistan, and Myanmar have purchased and installed equipment from the company. “The company not only provides services to local governments in Xinjiang, Jiangsu, and Fujian, but also exports censorship and surveillance technology to countries such as Myanmar, Pakistan, Ethiopia, and Kazakhstan under the ‘Belt and Road’ framework,” the Great Firewall Report said.
• Cyber Scam Centers Likely Shift to Vulnerable Jurisdictions — Transnational criminal groups appear to be moving cyber scam centers to vulnerable countries through criminal foreign direct investment (FDI). The United Nations Office on Drugs and Crime (UNDOC) warned it had found “indications of scam center activity, including SIM cards and satellite internet devices” at a hotel in the Special Administrative Region of Oecusse-Ambeno (RAEOA). “With growing awareness and understanding of scam centers and related criminal activity, law enforcement pressure has intensified across Southeast Asia, making it more difficult for organized crime groups to operate in traditional hotspot areas,” UNDOC advised. “As a result, syndicates actively create avenues for expanding operations to new jurisdictions with limited experience in scam center responses, including Timor-Leste.”
• Phishing Campaigns Drop RMM Tools — Phishing campaigns have been observed dropping remote monitoring and management (RMM) tools ITarian (aka Comodo), PDQ, SimpleHelp, and Atera, using a variety of social engineering lures, such as fake browser updates, meeting invitations, party invitations, and fake government forms. “Adversaries often use RMM tools in a stealthy and effective way to retain control over compromised systems without raising immediate alarms,” Zscaler-owned Red Canary said. “Hands-on-keyboard actions allow the adversary to modify their behaviors so they blend in with day-to-day administrator activity, complicating detection opportunities.” Attacks that deploy ITarian have even been found to leverage the access to deliver Hijack Loader and DeerStealer malware.
• SVG Attachments in Phishing Emails Deliver RATs — Threat actors are continuing to leverage SVG file attachments in phishing emails to filelessly deliver XWorm and Remcos via Windows batch scripts. “These campaigns often begin with a ZIP archive, typically hosted on trusted-looking platforms such as ImgKit, and are designed to appear as legitimate content to entice user interaction,” Seqrite Labs said. Upon extraction, the ZIP file contains a highly obfuscated BAT script that serves as the initial stage of the infection chain. These BAT files use advanced techniques to evade static detection and are responsible for executing PowerShell-based loaders that inject the RAT payload directly into memory.”
• Buterat Backdoor Detailed — A Windows backdoor known as Buterat has been identified as being distributed via phishing campaigns, malicious attachments, or trojanized software downloads to seize control of infected endpoints remotely, deploy additional payloads, and exfiltrate sensitive information. “Once executed, it disguises its processes under legitimate system tasks, modifies registry keys for persistence, and uses encrypted or obfuscated communication channels to avoid network-based detection,” Point Wild said.
• Mac.c Stealer Rebrands to MacSync — The macOS-focused information stealer known as Mac.c Stealer has been rebranded to MacSync, but follows the same malware-as-a-service (MaaS) model. “The old project risked dying from lack of time and funding, so it was purchased and will be developed further without dwelling on past difficulties,” the threat actors said in an interview with security researcher g0njxa. “MacSync Stealer is a reliable stealer with broad functionality that emphasizes simplicity and effectiveness. Literally, you can start using it immediately after purchase.” According to MacPaw Moonlock Lab, MacSync includes a fully-featured Go-based agent acting as a backdoor, expanding its functionality far beyond basic data exfiltration. “This makes MacSync one of the first known cases of a macOS stealer with modular, remote command-and-control capabilities,” the company said. AMOS, which was also updated in July 2025 with its own backdoor, relies on C-based components and curl for C2 communication. In contrast, MacSync’s approach is stealthier as it utilizes the native net/http library for HTTPS requests. MacSync infections have been detected in Europe and North America, with the most activity originating from Ukraine, the U.S., Germany, and the U.K.
• Google Releases VaultGemma — Google has released VaultGemma, a large language model (LLM) designed to keep sensitive data private during training. The model uses differential privacy techniques to prevent individual data points from being exposed by adding calibrated noise, which makes it safer for handling confidential information in healthcare, finance, and government sectors. “VaultGemma represents a significant step forward in the journey toward building AI that is both powerful and private by design,” Google said. “While a utility gap still exists between DP-trained and non-DP–trained models, we believe this gap can be systematically narrowed with more research on mechanism design for DP training.” Last month, the tech giant released a new active learning method for curating high-quality data that reduces training data requirements for fine-tuning LLMs by orders of magnitude. “The process can be applied to datasets of hundreds of billions of examples to iteratively identify the examples for which annotation would be most valuable and then use the resulting expert labels for fine-tuning,” it noted. “The ability to retrain models with just a handful of examples is especially valuable for handling the rapidly changing landscapes of domains like ads safety.”
• Indonesia Targeted by Mobile Malware Campaign — A Chinese-speaking threat group has been exploiting Indonesia’s state pension fund, TASPEN, to launch a sophisticated mobile malware campaign targeting senior citizens and enabling full-spectrum data theft and financial fraud. The attack uses a phishing site mimicking TASPEN to trick users into downloading the malicious APK file. Users are directed to these links via SEO poisoning campaigns. “Disguised as an official app, the spyware steals banking credentials, OTPs, and even biometric data, enabling large-scale fraud,” CloudSEK said. “Beyond financial loss, the attack erodes public trust, threatens Indonesia’s digital transformation, and sets a dangerous precedent for pension fund attacks across Southeast Asia.” Technical artifacts found within the malware’s distribution network and communication channels, including error messages and developer comments written in Simplified Chinese, strongly suggest the involvement of a well-organized, Chinese-speaking threat actor group.
• Luno Botnet Combines Crypto Mining and DDoS Features — A new Linux botnet campaign dubbed Luno has combined cryptocurrency mining, remote command execution, and modular DDoS attack capabilities targeting gaming platforms, suggesting long-term monetization and operational flexibility. It’s advertised via the domain main.botnet[.]world. The malware launches watchdog threads that continuously monitor the parent process and respawn it under a disguised name if it terminates. It’s also designed to ignore termination signals (SIGSEGV, SIGTERM, SIGINT, SIGHUP, and SIGPIPE) to protect itself from easy termination while disguising itself as bash.” “Unlike conventional crypto miners or DDoS botnets, LunoC2 exhibits process masquerading, binary replacement, and a self-update system, suggesting the malware is designed as a long-term criminal infrastructure tool,” Cyble said.
• Apple macOS Users Targeted by Odyssey Stealer — Threat actors are exploiting a fake Microsoft Teams download site to deliver the Odyssey macOS stealer via the ClickFix social engineering tactic. “Once executed, the malware harvests credentials, cookies, Apple Notes, and crypto wallets, exfiltrating data to a C2 server before ensuring persistence through LaunchDaemons and even replacing Ledger Live with a trojanized version,” CloudSEK said.
• FIDO Authentication Downgrade Demonstrated — A new FIDO downgrade attack against Microsoft Entra ID can trick users into authenticating with weaker login methods, making them susceptible to phishing and session hijacking. The weaker authentication methods are vulnerable to adversary-in-the-middle (AitM) phishing attacks that employ tools like Evilginx, allowing attackers to capture valid session cookies and hijack the accounts. The attack, devised by Proofpoint, employs a custom phishlet within the Evilginx AitM framework to spoof a browser user agent that lacks FIDO support. Specifically, this involves spoofing Safari on Windows, which is not compatible with FIDO-based authentication in Microsoft Entra ID. “This seemingly insignificant gap in functionality can be leveraged by attackers,” the company said. “A threat actor can adjust the AiTM to spoof an unsupported user agent, which is not recognized by a FIDO implementation. Subsequently, the user would be forced to authenticate through a less secure method. This behavior, observed on Microsoft platforms, is a missing security measure.” This causes the authentication system to fallback to a less secure verification method, such as OTPs, enabling the AitM proxy to intercept a user’s credentials and tokens. To prevent this type of attack, customers are recommended to deploy phishing-resistant authentication methods, along with Conditional Access enforcement.
• Canada Shuts Down TradeOgre — The Royal Canadian Mounted Police (RCMP) shut down the TradeOgre cryptocurrency exchange and seized more than $40 million believed to originate from criminal activities, marking the first time a cryptocurrency exchange platform has been dismantled by Canadian law enforcement. The RCMP said the platform violated Canadian laws by failing to register with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) as a money services business and that it has “reason to believe that the majority of funds transacted on TradeOgre came from criminal sources.” The service had gone offline towards the end of July 2025.
• Windows SCM for Lateral Movement — Cybersecurity researchers have demonstrated a stealthy lateral movement technique that uses Windows Service Control Manager (SCM) to execute commands on remote PCs discreetly. “Attackers can execute malicious payloads without ever dropping a file on disk by remotely modifying service configurations via built-in APIs such as ChangeServiceConfigA,” Trellix said. “This type of fileless lateral movement is extremely difficult to detect with traditional security solutions that only monitor endpoints or files. Attackers may use legitimate credentials, avoid writing to disk, and blend into normal administrative behavior, making their actions appear benign.”

• Security Flaws in Novakon ICS Devices — Half a dozen security flaws (from CVE-2025-9962 through CVE-2025-9966) have been discovered in industrial control system (ICS) products made by Taiwan-based Novakon that could allow remote code execution with root privileges, retrieve and manipulate system files, and abuse weakly protected services and processes. Given that no patches have been released by the company, users are advised to restrict network access to the device and disable Ethernet configuration if serial ports are used for PLC communication.
• U.S. Sounds Alarm on Hidden Radios in Solar-Powered Devices — The U.S. Department of Transportation’s Federal Highway Department alerted highway agencies and infrastructure firms that “solar-powered highway infrastructure including chargers, roadside weather stations, and traffic cameras should be scanned for the presence of rogue devices — such as hidden radios — secreted inside batteries and inverters,” according to a report from Reuters, raising fresh supply chain concerns. The note did not specify where the products containing undocumented equipment had been imported from. The risk underscores the need for suppliers to provide something akin to a Software Bill of Materials (SBOM) to inventory the hardware components in their equipment for improved visibility.
• New Zealand Sanctions Russian Hackers — New Zealand has imposed sanctions on Russian military intelligence hackers accused of cyberattacks on Ukraine, including members of a notorious hacking unit previously tied to destructive malware campaigns. The sanctions target Unit 29155 of Russia’s GRU intelligence agency, which is also tracked as Cadet Blizzard and Ember Bear.
• DarkCloud Stealer Targets Financial Orgs — Financial enterprises are the target of a malware campaign distributing DarkCloud Stealer since August 2025 through phishing emails with malicious RAR attachments. “The observed samples were programmed to target Windows users and programmed to steal login credentials from email clients, FTP clients, and data from browsers,” CyberProof said. “DarkCloud operators are also seen using the DarkCloud loader embedded into a JPG file, which is downloaded using PowerShell in the attack chain.” Contained within the archive is a VBE file that, when executed, downloads the JPG image, which is then unpacked to launch the DarkCloud loader .NET DLL.
• Model Namespace Reuse Aims for AI Supply Chains — Cybersecurity researchers demonstrated a technique called Model Namespace Reuse that exploits a fundamental flaw in the AI supply chain to gain Remote Code Execution (RCE) and additional capabilities on major platforms like Microsoft’s Azure AI Foundry, Google’s Vertex AI, and Hugging Face. “Model Namespace Reuse occurs when cloud provider model catalogs or code retrieve a deleted or transferred model by name,” Palo Alto Networks Unit 42 said. “By re-registering an abandoned namespace and recreating its original path, malicious actors can target pipelines that deploy models based solely on their name. This potentially allows attackers to deploy malicious models and gain code execution capabilities, among other impacts.” A severe consequence of this threat is that developers who rely on the trusted model catalogs of major cloud AI services could unknowingly deploy malicious models originally hosted on Hugging Face without ever interacting with Hugging Face directly. To mitigate the risks associated with Model Namespace Reuse, it’s advised to pin the used model to a specific commit, clone the model and store it in a trusted location, and treat model references like any other dependency subject to policy and review.

• New VoidProxy PhaaS Detailed — A new Phishing-as-a-Service (PhaaS) named VoidProxy has been spotted in the wild using Adversary-in-the-Middle (AitM) techniques to intercept authentication flows in real-time, capturing credentials, MFA codes and any session tokens established during the sign-in event. “VoidProxy is a novel and highly evasive service used by attackers to target Microsoft and Google accounts,” Okta said. “The service is also capable of redirecting accounts protected by third-party single sign-on (SSO) providers like Okta to second-stage phishing pages.” Campaigns relying on the phishing kit have leveraged compromised accounts of legitimate Email Service Providers (ESPs) such as Constant Contact, Active Campaign (Postmarkapp), and NotifyVisitors, to bypass spam filters and send email messages that trick users into providing their credentials by clicking on links that are shortened using URL shorteners like TinyURL. Before any of the phishing landing sites load, the user is presented with a Cloudflare Captcha challenge to determine if the request is from an interactive user or a bot. The malicious sites are hosted on disposable low-cost domains on .icu, .sbs, .cfd, .xyz, .top, and .home, which are protected by Cloudflare to hide their real IP addresses.
• SideWinder Strikes Nepal with Android Malware — The advanced persistent threat actor SideWinder capitalized on the recent Gen-Z protests in Nepal to phish government entities and infect them with Android and Windows malware masquerading as legitimate emergency services. The malware, designed to siphon sensitive data, is distributed via phishing websites spoofing the Nepalese Emergency Service or an Emergency Helpline portal. In a related development, the threat actor known as Rattlesnake (aka APT-C-24) has been observed using Windows shortcut (LNK) files as payloads to execute malicious scripts in remote URLs. “These scripts are multi-layered and complex obfuscation, which eventually loads the execution attack components in memory to achieve remote control of the target host.” Another campaign, attributed to Patchwork, has leveraged spear-phishing lures to distribute Quasar RAT, AsyncRAT, and the Mythic post-exploitation framework in attacks aimed at Pakistan.
• WordPress Plugin Flaw Under Active Attack — Threat actors are exploiting a vulnerability (CVE-2025-5821, CVSS score: 9.8) in Case Theme User, a WordPress plugin bundled with various commercial WordPress themes. “This vulnerability makes it possible for an unauthenticated attacker to gain access to any account on a site, including accounts used to administer the site, if the attacker knows, or can find, the associated email address,” Wordfence said. The plugin is installed on more than 12,000 websites. A patch for the flaw was released on August 13, 2025, with exploitation activity beginning on August 22.
• Google Releases CSE for Sheets — Google has made available a conversion tool to convert decrypted Google Sheets files encrypted using client-side encryption into a Microsoft Excel file. Currently, client-side encryption is available in Google Drive, Docs, Gmail, Calendar, and Meet.
• Israel Defense Ministry Orders Seizure of IRGC Crypto Wallets — Israel’s Ministry of Defense announced that it was ordering the seizure of 187 cryptocurrency wallets that allegedly belong to Iran’s Islamic Revolutionary Guard Corps (IRGC), alleging that they are “used for the perpetration of a severe terror crime.” These addresses have collectively received $1.5 billion in Tether’s USDT stablecoin, although it’s currently not known if all the transactions are directly linked to the IRGC, as blockchain analytics firm Elliptic said that “some of the addresses may be controlled by cryptocurrency services and could be part of wallet infrastructure used to facilitate transactions for many customers.”
• Europol Adds Spanish University Professor to Most Wanted List — Europol placed Enrique Arias Gil (aka Desinformador Ruso), 37, a former Spanish university professor, on its most wanted list over accusations of helping the pro-Russian hacker group NoName057(16), according to Spain’s National Police. In a message on his Telegram channel, Arias Gil demanded that Spanish law enforcement drop the case within 10 hours or risk the release of alleged kompromat on senior officials. Noname057(16) has called the move a witch hunt.
• Pro-Kremlin Op CopyCopy Sets Up New Sites — The Russian covert influence operation known as CopyCop, or Storm-1516, has been linked to new infrastructure since March 2025. This includes “200 new fictional media websites targeting the United States, France, and Canada, in addition to websites impersonating media brands and political parties and movements in France, Canada, and Armenia.” The network is also said to have established a regionalized network of websites posing as a fictional fact-checking organization publishing content in Turkish, Ukrainian, and Swahili languages, Recorded Future said. In all, the group has established over 300 websites since the start of the year. These websites are likely operated by John Mark Dougan with support from the Moscow-based Center for Geopolitical Expertise (CGE) and the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU). “CopyCop’s core influence objectives remain eroding public support for Ukraine and undermining democratic processes and political leaders in Western countries supporting Ukraine,” the company said.
• Decade-Old Pixie Dust Wi-Fi Hack Still Affects Many Devices — Many current router models are still susceptible to a 10-year-old Wi-Fi attack named Pixie Dust, which was first disclosed in 2014. The attack allows threat actors to recover a router’s Wi-Fi Protected Setup (WPS) PIN and access its Wi-Fi network by exploiting weaknesses in the key generation mechanism in the WPS protocol. According to a study by NetRise, 24 devices, including routers, range extenders, access points, and hybrid Wi-Fi/powerline products, spanning six vendors, have been found to be vulnerable to the exploit. “As of this writing, 13 devices remain actively supported but unpatched,” the company said. “Another seven reached their end of life without ever receiving fixes.”
• TikTok Takes Down Influence Operation From Thailand — TikTok said it took down several influence operation networks in July 2025 that targeted the political discourse in Thailand, Ukraine, Azerbaijan, and Israel and Palestine, as well as the war between Russia and Ukraine. The largest network, comprising 398 accounts, operated from Thailand and targeted Chinese-speaking audiences. “The individuals behind this network created inauthentic accounts in order to amplify narratives of Chinese dominance and Western inefficiencies,” TikTok said. “The network was found to use AI-generated content, which often incorporated various animal characters, as commentary on global events.”
• GitHub Announces Post-Quantum SSH Key Exchange Support — GitHub announced it’s adding a new post-quantum secure SSH key exchange algorithm, known alternately as sntrup761x25519-sha512 and sntrup761x25519-sha512@openssh.com, to its SSH endpoints for accessing Git data. This is part of efforts to counter the threat of future decryption attacks once quantum computers become broadly available. “This only affects SSH access and doesn’t impact HTTPS access at all,” GitHub said. “It also does not affect GitHub Enterprise Cloud with data residency in the United States region.” The new algorithm was enabled on September 17, 2025, for GitHub.com and GitHub Enterprise Cloud with data residency. It is also expected to be included in GitHub Enterprise Server 3.19.
• Consumer Reports Urges Microsoft to Extend October 2025 Deadline — Consumer Reports called on Microsoft to extend the October 14, 2025, deadline that will cut off free security updates for Windows 10 computers, stating the move “risks harming the consumer as well as co-opting the machine to perpetuate attacks against other entities, risking national security.” Around 46.2 percent of people around the world still use Windows 10 as of August 2025.
• China Announces Stricter Data Breach Requirements — The Chinese government will require critical infrastructure operators to report security breaches within an hour of detection. The new deadline requires that all serious incidents be reported to the relevant authorities within 60 minutes – or in the case of “particularly major” events, 30 minutes. Companies that fail to report such incidents risk facing penalties. The new reporting rules will take effect starting November 1, 2025, according to the Cyberspace Administration of China (CAC). “If the network operator reports late, omitted, falsely reported or concealed network security incidents, causing major harmful consequences, the network operator and the relevant responsible persons shall be punished more severely according to law,” Beijing warned.
• Possible Ties Between Belsen Group and ZeroSevenGroup? — Cybersecurity company KELA suggested a possible connection between the Belsen Group and ZeroSevenGroup, two cybercriminal entities with ties to Yemen that emerged in January 2025 and July 2024, respectively. Both groups are known for leaking and monetizing stolen data, as well as sharing similarities in writing style and post formatting. “While these overlaps are not conclusive, they suggest a possible connection,” it said.
• SmokeLoader Returns with New Changes — SmokeLoader, which was disrupted as part of Operation Endgame in May 2024, has resurfaced with a new version in July 2025 with a modified network protocol that breaks compatibility with prior versions. The new variant is being tracked by Zscaler ThreatLabz as version 2025. Also detected earlier this February is a variant named version 2025 alpha that included bug fixes that caused performance degradation. “SmokeLoader consists of two main components: a stager and a main module,” Zscaler said. “The stager has two main purposes: hinder analysis, detect virtual environments (and terminate if present), and inject the SmokeLoader main module into explorer.exe. The main module performs the bulk of the malicious functionality, including establishing persistence, beaconing to the C2 server, and executing tasks and plugins.” The main function of the loader is to download and execute second-stage malware. It may also use optional plugins to perform tasks such as stealing data, launching distributed denial of service attacks, and mining cryptocurrency.
• E.U. Spyware Vendors Pocket Startup Subsidies — A new report from Follow The Money found cases of spyware and surveillance companies using E.U. startup subsidies to create hacking tools that are then used against E.U. citizens. “The beneficiaries include some big names in the market such as the Intellexa Alliance, Cy4Gate, Verint Systems, and Cognyte, along with smaller European firms,” the report said.
• PyPI Invalidates Tokens Stolen in GhostAction Attack — The maintainers of the Python Package Index (PyPI) said they invalidated all PyPI tokens stolen from GitHub repos by a malicious action on September 5 in a supply chain attack known as GhostAction. None of the tokens were abused to upload malware to the registry, and impacted project maintainers have been notified. Users who rely on GitHub Actions to publish to PyPI are advised to replace long-lived tokens with Trusted Publishers and review account history for any suspicious activity.
• U.K. MI6 Launches Silent Courier — The UK’s foreign intelligence service, MI6, launched Silent Courier, an online portal (“mi6govukbfxe5pzxqw3otzd2t4nhi7v6x4dljwba3jmsczozcolx2vqd.onion”) hosted on the dark web designed to let potential spies from Russia and elsewhere communicate with U.K. intelligence. The idea is to recruit spies “anywhere in the world with access to sensitive information relating to terrorism or hostile intelligence activity.”
• New Information Stealers Detected — Cyble, CYFIRMA, and Point Wild shared details on three new information stealer families called Maranhão Stealer, XillenStealer, and Raven, respectively.
• New and Emerging Ransomware Strains Detected — Some of the nascent ransomware operations that have been documented in recent weeks include BlackLock, BlackNevas, BQTLOCK, Crypto24, CyberVolk, EXTEN, GAGAKICK, Gentleman, Jackpot, KillSec, LockBeast, NEZHA, Obscura, and Yurei. In particular, the Crypto24 ransomware group has been observed using a custom version of the open-source RealBlindingEDR tool to disable security software running on infected hosts prior to deploying the locker. “The threat actor’s customized version employs advanced evasion, likely via unknown vulnerable drivers, showcasing deep technical expertise and ongoing tool refinement,” Trend Micro said. “The group’s ability to maintain persistence before encryption reflects patience and strategic planning uncommon in commodity ransomware.”

🎥 Cybersecurity Webinars

• AI + Human Workflows: Your Simple Blueprint for Secure Automation: AI can speed up your work—but only if you use it wisely. In this webinar, Thomas Kinsella, Co-founder and Chief Customer Officer at Tines, will show how top teams mix human skills, rules-based steps, and AI tools to build workflows that are clear, secure, and easy to audit. You’ll walk away knowing where AI fits best and how to avoid the common traps of over-engineering.
• Banish Costly Breaches: A Practical Blueprint for Stronger Password Security: Passwords are still the easiest way for attackers to break in—and the hardest headache for IT teams. This Halloween, join The Hacker News and Specops Software to uncover real password breach stories, see why old password rules fail, and watch a live demo of tools that block stolen credentials in real time. You’ll leave with a clear, simple plan to protect your company, meet compliance needs, and end password problems for good—without making life harder for users.
• See Every Risk from Code to Cloud—Before Hackers Spot the Gap: Modern apps move fast—from code changes to cloud deployment—but hidden gaps in visibility give attackers room to strike. Join us to see how code-to-cloud mapping unites developers, DevOps, and security teams on one clear view of risk. You’ll learn how to spot vulnerabilities, secrets, and misconfigurations early, link them to real runtime exposure, and cut noise so teams can fix issues faster and with confidence.
• Seal Every Gap: Practical Steps to Lock Down Python Packages and Containers: Python projects face bigger security risks than ever in 2025—malicious packages, repo hijacks, and vulnerable base images can all open the door to attackers. Join us to learn simple, proven ways to protect your Python supply chain. We’ll show real examples of recent attacks, demo the latest scanning and signing tools, and share steps you can take now to lock down your code, containers, and dependencies with confidence.

🔧 Cybersecurity Tools

• NPM Malware Scanner: It is a command-line tool that helps you spot dangerous or suspicious npm packages before they reach production. It scans GitHub repositories or local projects, checks every package.json file, and flags known malware or risky dependencies using a built-in database. Designed for speed and clear results, it gives developers and security teams an easy way to keep their JavaScript projects safe without extra setup.
• VMDragonSlayer: It is a research framework built to uncover and analyze binaries protected by virtual machine–based obfuscation. It combines techniques like dynamic taint tracking, symbolic execution, pattern matching, and machine learning to speed up reverse engineering that normally takes weeks or months. With integrations for tools such as Ghidra, IDA Pro, and Binary Ninja, it helps researchers detect VM-based protectors and understand complex, custom malware environments through structured, automated analysis.

Disclaimer: The tools featured here are provided strictly for educational and research purposes. They have not undergone full security audits, and their behavior may introduce risks if misused. Before experimenting, carefully review the source code, test only in controlled environments, and apply appropriate safeguards. Always ensure your usage aligns with ethical guidelines, legal requirements, and organizational policies.

🔒 Tip of the Week

Catch Fake Cell Towers Before They Catch You — Cell-site simulators—also known as IMSI catchers or “stingrays”—mimic real cell towers to intercept calls or track devices. They’re showing up in more places and can silently scoop up data from nearby phones.

Use open-source detection tools to monitor your environment. Rayhunter, created by the Electronic Frontier Foundation, runs on inexpensive mobile hotspots and watches the control traffic between your device and the cell network. It flags suspicious behavior—like forced 2G downgrades or fake tower identifiers—without snooping on your personal data.

Other Options to Explore:

• SnoopSnitch (Android) – Uses your phone’s radio diagnostics to warn of fake towers.
• Cell Spy Catcher – Detects IMSI catchers by monitoring unusual network changes.
• Stingray Detector apps & SDR projects – For advanced users with software-defined radios.

Quick Win: Set up one of these tools during events, protests, or when traveling in high-risk areas. Even if you’re not a security pro, these tools give you a visible early warning when someone tries to spy on mobile traffic.

Pro move: Combine mobile-network monitoring with strong basics—use end-to-end encrypted messaging (like Signal) and keep your phone’s OS updated. This layered defense makes it far harder for attackers to gather useful data, even if they’re nearby.

Conclusion

The threat landscape won’t slow down, but that doesn’t mean you’re powerless. Awareness is leverage: it lets you patch faster, question assumptions, and spot weak spots before they become incidents. Keep these takeaways in mind, share them with your team, and turn today’s lessons into tomorrow’s advantage.

The threat landscape won’t slow down, but that doesn’t mean you’re powerless. Awareness is leverage: it lets you patch faster, question assumptions, and spot weak spots before they become incidents. Keep these takeaways in mind, share them with your team, and turn today’s lessons into tomorrow’s advantage.

We hear this a lot:

“We’ve got hundreds of service accounts and AI agents running in the background. We didn’t create most of them. We don’t know who owns them. How are we supposed to secure them?”

Every enterprise today runs on more than users. Behind the scenes, thousands of non-human identities, from service accounts to API tokens to AI agents, access systems, move data, and execute tasks around the clock.

They’re not new. But they’re multiplying fast. And most weren’t built with security in mind.

Traditional identity tools assume intent, context, and ownership. Non-human identities have none of those. They don’t log in and out. They don’t get offboarded. And with the rise of autonomous agents, they’re beginning to make their own decisions, often with broad permissions and little oversight.

It’s already creating new blind spots. But we’re only at the beginning.

In this post, we’ll look at how non-human identity risk is evolving, where most organizations are still exposed, and how an identity security fabric helps security teams get ahead before the scale becomes unmanageable.

The rise (and risk) of non-human identities

Cloud-first architectures increased infrastructure complexity and triggered a surge in background identities. As these environments grow, the number of background identities grows with them, many of which get created automatically, without clear ownership or oversight. In many cases, these identities outnumber human users by more than 80 to 1.

What makes that especially risky is how little most teams know about them. NHIs often get created automatically during deployment or provisioning, then disappear from the radar, untracked, unowned, and often over-permissioned.

Service accounts, in particular, are everywhere. They move data between systems, run scheduled jobs, and authenticate headless services. But their sprawl is rarely visible, and their permissions are rarely reviewed. Over time, they become perfect vehicles for lateral movement and privilege escalation.

But service accounts are only part of the picture. As AI adoption grows, a new category of non-human identity introduces even more unpredictable risk.

Why AI agents behave differently and why that matters

Unlike most machine identities, AI agents initiate actions on their own; interacting with APIs, querying data, and making decisions autonomously.

That autonomy comes at a cost. AI agents often need access to sensitive data and APIs, but few organizations have guardrails for what they can do or how to revoke that access.

Worse, most AI agents lack clear ownership, follow no standard lifecycle, and offer little visibility into their real-world behavior. They can be deployed by developers, embedded in tools, or called via external APIs. Once live, they can run indefinitely, often with persistent credentials and elevated permissions.

And because they’re not tied to a user or session, AI agents are difficult to monitor using traditional identity signals like IP, location, or device context.

The cost of invisible access

Secrets get hardcoded. Tokens get reused. Orphaned identities remain active for months, sometimes years.

These risks are not new, but static credentials and wide-open access may have been manageable when you had a few dozen service accounts. But with thousands, or tens of thousands, of NHIs operating independently across cloud services, manual tracking simply doesn’t scale.

That’s why many security teams are revisiting how they define identity in the first place. Because if an AI agent can authenticate, access data, and make decisions, it is an identity. And if that identity isn’t governed, it’s a liability.

Common NHI security challenges

Understanding that non-human identities represent a growing risk is one thing; managing that risk is another. The core problem is that the tools and processes built for human identity management don’t translate to the world of APIs, service accounts, and AI agents. This disconnect creates several distinct and dangerous security challenges that many organizations are only beginning to confront.

See how Okta and AWS help organizations bring order to NHI sprawl. [Download the guide] to get started.