Category: Cybersecurity

Jun 30, 2025Ravie LakshmananCyber Attack / Critical Infrastructure

U.S. cybersecurity and intelligence agencies have issued a joint advisory warning of potential cyber-attacks from Iranian state-sponsored or affiliated threat actors.

“Over the past several months, there has been increasing activity from hacktivists and Iranian government-affiliated actors, which is expected to escalate due to recent events,” the agencies said.

“These cyber actors often exploit targets of opportunity based on the use of unpatched or outdated software with known Common Vulnerabilities and Exposures or the use of default or common passwords on internet-connected accounts and devices.”

There is currently no evidence of a coordinated campaign of malicious cyber activity in the U.S. that can be attributed to Iran, the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the Department of Defense Cyber Crime Center (DC3), and the National Security Agency (NSA) noted.

Emphasizing the need for “increased vigilance,” the agencies singled out Defense Industrial Base (DIB) companies, specifically those with ties to Israeli research and defense firms, as being at an elevated risk. U.S. and Israeli entities may also be exposed to distributed denial-of-service (DDoS) attacks and ransomware campaigns, they added.

Attackers often start with reconnaissance tools like Shodan to find vulnerable internet-facing devices, especially in industrial control system (ICS) environments. Once inside, they can exploit weak segmentation or misconfigured firewalls to move laterally across networks. Iranian groups have previously used remote access tools (RATs), keyloggers, and even legitimate admin utilities like PsExec or Mimikatz to escalate access—all while evading basic endpoint defenses.

Based on prior campaigns, attacks mounted by Iranian threat actors leverage techniques like automated password guessing, password hash cracking, and default manufacturer passwords to gain access to internet-exposed devices. They have also been found to employ system engineering and diagnostic tools to breach operational technology (OT) networks.

The development comes days after the Department of Homeland Security (DHS) released a bulletin, urging U.S. organizations to be on the lookout for possible “low-level cyber attacks” by pro-Iranian hacktivists amid the ongoing geopolitical tensions between Iran and Israel.

Last week, Check Point revealed that the Iranian nation-state hacking group tracked as APT35 targeted journalists, high-profile cyber security experts, and computer science professors in Israel as part of a spear-phishing campaign designed to capture their Google account credentials using bogus Gmail login pages or Google Meet invitations.

As mitigations, organizations are advised to follow the below steps –

• Identify and disconnect OT and ICS assets from the public internet
• Ensure devices and accounts are protected with strong, unique passwords, replace weak or default passwords, and enforce multi-factor authentication (MFA)
• Implement phishing-resistant MFA for accessing OT networks from any other network
• Ensure systems are running the latest software patches to protect against known security vulnerabilities
• Monitor user access logs for remote access to the OT network
• Establish OT processes that prevent unauthorized changes, loss of view, or loss of control
• Adopt full system and data backups to facilitate recovery

“Despite a declared ceasefire and ongoing negotiations towards a permanent solution, Iranian-affiliated cyber actors and hacktivist groups may still conduct malicious cyber activity,” the agencies said.

Europol on Monday announced the takedown of a cryptocurrency investment fraud ring that laundered €460 million ($540 million) from more than 5,000 victims across the world.

The operation, the agency said, was carried out by the Spanish Guardia Civil, along with support from law enforcement authorities from Estonia, France, and the United States. Europol said the investigation into the syndicate started in 2023.

In addition, the five alleged suspects behind the cryptocurrency scam were arrested on June 25, 2025. Three of the arrests took place in the Canary Islands, while two others were apprehended from Madrid.

“To carry out their fraudulent activities, the leaders of the criminal network allegedly used a net of associates spread around the world to raise funds through cash withdrawals, bank transfers, and crypto-transfers,” Europol said.

These types of scams often follow a pattern known as “pig butchering,” where scammers slowly build trust with victims over weeks or months—often through dating apps or friendly chats—before convincing them to invest in fake crypto platforms. Behind the scenes, fraudsters use social engineering tricks, like fake trading dashboards and scripted conversations, to keep the illusion going. Once money is deposited, it’s moved across multiple accounts in a process called layering, making it harder for authorities to trace.

The cybercriminals are believed to have set up a corporate and banking network based in Hong Kong, with the illicitly obtained funds routed through a maze of payment gateways and user accounts in the names of different people and in different exchanges.

The development comes shortly after the U.S. Department of Justice (DoJ) filed a civil forfeiture complaint seeking to recover over $225 million in cryptocurrency linked to cryptocurrency confidence (aka romance baiting) scams running out of Vietnam and the Philippines.

Europol described the “scale, variety, sophistication, and reach” of these online fraud schemes as “unprecedented,” and that they’re on track to surpass serious and organized crime, thanks to the increased adoption of artificial intelligence (AI) technologies.

“The integration of generative artificial intelligence by transnational criminal groups involved in cyber-enabled fraud is a complex and alarming trend observed in Southeast Asia, and one that represents a powerful force multiplier for criminal activities,” said UNODC Regional Analyst, John Wojcik, late last year.

According to a report from INTERPOL last week, cybercrime reports account for more than 30% of all reported crimes in Western and Eastern Africa. This included online scams, ransomware, business email compromise (BEC), and digital sextortion.

“Cybercrime continues to outpace the legal systems designed to stop it,” INTERPOL said, adding, “75% of countries surveyed said their legal frameworks and prosecution capacity needed improvement.”

Part of what makes this kind of fraud so hard to fight is how criminals exploit legal loopholes and fragmented international laws. Many scammers now use synthetic identities—fake personas built with stolen or AI-generated data—to register accounts or rent bank access. They also recruit financial mules to move money, often without them realizing they’re part of a crime.

To pull off such investment fraud schemes, unwitting people from Asia and Africa are lured into Southeast Asia with lucrative job opportunities, and forcefully detaining them inside “scam compounds” run by transnational organized crime groups originating from China.

As many as 53 scam compounds have been identified in Cambodia, per Amnesty International, where the non-profit said “human rights abuses have taken place or continue to occur, including human trafficking, torture and other ill-treatment, forced labour, child labour, deprivation of liberty and slavery.”

Many of the people forced into these scam compounds were originally promised tech or sales jobs abroad. Once they arrive, their passports are taken and they’re forced to scam others under threats of violence or debt.

Last year, the United States Institute of Peace revealed that the return on cyber scamming is estimated to exceed $12.5 billion annually in Cambodia, which amounts to half the country’s formal gross domestic product (GDP).

The findings highlight the enormity and scale of the problem, which typically involves building trust with prospective victims on social media and online dating apps before coaxing them to invest their funds in a bogus cryptocurrency platform.

The illegal operation has had such an impact that the Indian Embassy in Cambodia has a prominent warning on its website urging citizens to be vigilant against falling into the hands of human traffickers under the pretext of high-paying jobs, stating job seekers are coerced to undertake online financial scams and other illegal activities.

Adding more context to the criminal activity is a recent report from ProPublica that Chinese-language Telegram channels and groups are advertising to scammers the ability to rent U.S. bank accounts at Bank of America, Chase, Citibank, and PNC, who then use these accounts to launder the proceeds. Telegram has begun to take action on some of these channels.

Meta is said to have detected and taken down no less than seven million Facebook accounts associated with scam centers in Asia and the Middle East since the start of 2024, per a statement shared by the company to the investigative journalism organization.

Jun 30, 2025Ravie LakshmananCybercrime / Vulnerability

The threat actor known as Blind Eagle has been attributed with high confidence to the use of the Russian bulletproof hosting service Proton66.

Trustwave SpiderLabs, in a report published last week, said it was able to make this connection by pivoting from Proton66-linked digital assets, leading to the discovery of an active threat cluster that leverages Visual Basic Script (VBS) files as its initial attack vector and installs off-the-shelf remote access trojans (RATS).

Many threat actors rely on bulletproof hosting providers like Proton66 because these services intentionally ignore abuse reports and legal takedown requests. This makes it easier for attackers to run phishing sites, command-and-control servers, and malware delivery systems without interruption.

The cybersecurity company said it identified a set of domains with a similar naming pattern (e.g., gfast.duckdns[.]org, njfast.duckdns[.]org) beginning in August 2024, all of which resolved to the same IP address (“45.135.232[.]38”) that’s associated with Proton66.

The use of dynamic DNS services like DuckDNS also plays a key role in these operations. Instead of registering new domains each time, attackers rotate subdomains tied to a single IP address — making detection harder for defenders.

“The domains in question were used to host a variety of malicious content, including phishing pages and VBS scripts that serve as the initial stage of malware deployment,” security researcher Serhii Melnyk said. “These scripts act as loaders for second-stage tools, which, in this campaign, are limited to publicly available and often open-source RATs.”

While Visual Basic Script (VBS) might seem outdated, it’s still a go-to tool for initial access due to its compatibility with Windows systems and ability to run silently in the background. Attackers use it to download malware loaders, bypass antivirus tools, and blend into normal user activity. These lightweight scripts are often the first step in multi-stage attacks, which later deploy remote access trojans (RATs), data stealers, or keyloggers.

The phishing pages have been found to legitimate Colombian banks and financial institutions, including Bancolombia, BBVA, Banco Caja Social, and Davivienda. Blind Eagle, also known as AguilaCiega, APT-C-36, and APT-Q-98, is known for its targeting of entities in South America, particularly Colombia and Ecuador.

The deceptive sites are engineered to harvest user credentials and other sensitive information. The VBS payloads hosted on the infrastructure come fitted with capabilities to retrieve encrypted executable files from a remote server, essentially acting as a loader for commodity RATS like AsyncRAT or Remcos RAT.

Furthermore, an analysis of the VBS codes has revealed overlaps with Vbs-Crypter, a tool linked to a subscription-based crypter service called Crypters and Tools that’s used to obfuscate and pack VBS payloads with an aim to avoid detection.

Trustwave said it also discovered a botnet panel that allows users to “control infected machines, retrieve exfiltrated data, and interact with infected endpoints through a broad set of capabilities typically found in commodity RAT management suites.”

The disclosure comes as Darktrace revealed details of a Blind Eagle campaign that has been targeting Colombian organizations since November 2024 by exploiting a now-patched Windows flaw (CVE-2024-43451) to download and execute the next-stage payload, a behavior that was first documented by Check Point in March 2025.

“The persistence of Blind Eagle and ability to adapt its tactics, even after patches were released, and the speed at which the group were able to continue using pre-established TTPs highlights that timely vulnerability management and patch application, while essential, is not a standalone defense,” the company said.

Jun 30, 2025Ravie LakshmananCybersecurity / Hacking News

Ever wonder what happens when attackers don’t break the rules—they just follow them better than we do? When systems work exactly as they’re built to, but that “by design” behavior quietly opens the door to risk?

This week brings stories that make you stop and rethink what’s truly under control. It’s not always about a broken firewall or missed patch—it’s about the small choices, default settings, and shortcuts that feel harmless until they’re not.

The real surprise? Sometimes the threat doesn’t come from outside—it’s baked right into how things are set up. Dive in to see what’s quietly shaping today’s security challenges.

⚡ Threat of the Week

FBI Warns of Scattered Spider’s on Airlines — The U.S. Federal Bureau of Investigation (FBI) has warned of a new set of attacks mounted by the notorious cybercrime group Scattered Spider targeting the airline sector using sophisticated social engineering techniques to obtain initial access. Cybersecurity vendors Palo Alto Networks Unit 42 and Google Mandiant have also issued similar alerts, urging organizations to be on alert and apply necessary mitigations, including strong authentication, segregation of identities, and enforcing rigorous identity controls for password resets and multi-factor authentication (MFA) registration, to harden their environments to protect against tactics utilized by the threat actor.

• LapDogs ORB Network Compromised Over 1,000 SOHO Devices — A China-linked APT has built an operational relay box (ORB) network called LapDogs comprising over 1,000 backdoored routers for espionage purposes. The digital break-ins began no later than September 2023 and have expanded ever since. The campaign mostly targets end-of-life routers, IoT devices, internet-connected security cameras, virtual servers, and other small office/home office (SOHO) devices, with the goal of building an Operational Relay Box (ORB) network. Five geographic regions — the US (352 victims), Japan (256 victims), South Korea (226 victims), Taiwan (80 victims), and Hong Kong (37 victims) — make up about 90% of the entire ORB network. The attacks leverage known security flaws in Linux-based devices to drop a backdoor called ShortLeash. The purpose of the malware itself is not known, although it has been found to share similarities with another malware sample used by UAT-5918. It’s suspected that the devices are being gradually, but steadily, compromised as part of methodical and small-scale efforts across the world to gain long-term access to networks.
• Iranian Hacking Group Targets Israeli Cybersecurity Experts — APT35, an Iranian state-sponsored hacking group associated with the Islamic Revolutionary Guard Corps (IRGC) has been linked to a spear-phishing campaign targeting journalists, high-profile cyber security experts, and computer science professors in Israel that seeks to redirect them to bogus phishing pages that are capable of harvesting their Google account credentials. The attacks, which take place via emails and WhatsApp messages, leverage fake Gmail login pages or Google Meet invitations to harvest their credentials. The development comes amid geopolitical tensions between Iran and Israel, which has also led to a spike in hacktivist activity in the region. “There are about 170 hacker groups attacking Israel, with about 1,345 cyber attacks on Israel, including about 447 cyber attacks launched against Israel after the conflict broke out,” NSFOCUS said in a report published last week. “The number of hacker groups attacking Iran reached about 55, and the number of cyber attacks on Iran reached about 155, of which about 20 were launched against Iran after the conflict broke out.”
• Citrix Patches Actively Exploited 0-Day — Citrix has released security updates to address a critical flaw affecting NetScaler ADC that it said has been exploited in the wild. The vulnerability, tracked as CVE-2025-6543 (CVSS score: 9.2), is a memory overflow bug that could result in unintended control flow and denial-of-service. It’s currently not known how the vulnerability is being exploited in the wild. The exploitation of CVE-2025-6543 coincides with reports that another critical security vulnerability in NetScaler ADC (CVE-2025-5777, CVSS score: 9.3) is also being weaponized in real-world attacks post public-disclosure.
• U.S. House Bans WhatsApp Use in Government Devices — The U.S. House of Representatives has formally banned congressional staff members from using WhatsApp on government-issued devices, citing security concerns. According to the House Chief Administrative Officer (CAO), the decision was taken based on a lack of transparency in how WhatsApp protects user data, the absence of stored data encryption, and potential security risks. WhatsApp has rejected these concerns, stating messages are end-to-end encrypted by default, and that it offers a “higher level” of security than other apps.
• New Tool to Neutralize Cryptomining Botnets — Akamai has proposed a novel mechanism to defang cryptomining botnets using XMRogue, a proof-of-concept (PoC) tool that lets defenders stop miners’ proxy servers from using compromised endpoints for illicit mining purposes. In cases where a mining proxy is not used, the approach uses a script to send more than 1,000 simultaneous login requests using the attacker’s wallet, which will force the pool to temporarily ban the wallet. That said, it’s worth noting that these methods don’t necessarily remove the malicious code from the systems as it’s just a way to disable the mining infrastructure.

‎️‍🔥 Trending CVEs

Hackers are quick to jump on newly discovered software flaws—sometimes within hours. Whether it’s a missed update or a hidden bug, even one unpatched CVE can open the door to serious damage. Below are this week’s high-risk vulnerabilities making waves. Review the list, patch fast, and stay a step ahead.

This week’s list includes — CVE-2025-49825 (Teleport), CVE-2025-6218 (WinRAR), CVE-2025-49144 (Notepad++), CVE-2025-27387 (OPPO ColorOS), CVE-2025-2171, CVE-2025-2172 (Aviatrix Controller), CVE-2025-52562 (ConvoyPanel), CVE-2025-27915 (Zimbra Classic Web Client), CVE-2025-48703 (CentOS Web Panel), CVE-2025-23264, CVE-2025-23265 (NVIDIA Megatron LM), CVE-2025-36537 (TeamViewer), CVE-2025-4563 (Kubernetes), CVE-2025-2135 (Kibana), CVE-2025-3509 (GitHub), CVE-2025-36004 (IBM i), CVE-2025-49853 (ControlID iDSecure), CVE-2025-37101 (HPE OneView for VMware vCenter), CVE-2025-3699 (Mitsubishi Electric), CVE-2025-6709 (MongoDB), CVE-2025-1533, CVE-2025-3464 (ASUS Armoury Crate), and an unpatched flaw affecting Kerio Control.

📰 Around the Cyber World

• Security Flaws Affect 100s of Printers and Scanners — Eight security vulnerabilities have been disclosed in multifunction printers (MFP) from Brother Industries, Ltd, that affect 742 models across 4 vendors, including FUJIFILM Business Innovation, Ricoh, Toshiba Tec Corporation, and Konica Minolta. “Some or all of these vulnerabilities have been identified as affecting 689 models across Brother’s range of printer, scanner, and label maker devices,” Rapid7 said. “Additionally, 46 printer models from FUJIFILM Business Innovation, 5 printer models from Ricoh, and 2 printer models from Toshiba Tec Corporation are affected by some or all of these vulnerabilities.” The most severe of the flaws is CVE-2024-51978 (CVSS score: 9.8), a critical bug that allows remote unauthenticated attackers to leak the target device’s serial number by chaining it with CVE-2024-51977 (CVSS score: 5.3), and generate the target device’s default administrator password. Having the admin password enables an attacker to reconfigure the device or abuse functionality intended for authenticated users.
• French Police Reportedly Arrest BreachForums Admins — French authorities have arrested five high-ranking members of BreachForums, a notorious online hub that specializes in selling stolen data and cybercriminal tools. This included forum users ShinyHunters, Hollow, Noct, and Depressed. A fifth suspect is said to have been apprehended by French police officials in February 2025. He went by the pseudonym IntelBroker (aka Kyle Northern), who has now been identified as a 25-year-old British man named Kai West. The latest iteration of BreachForums is currently offline. According to the U.S. Department of Justice (DoJ), West’s real-world identity was exposed after undercover Federal Bureau of Investigation (FBI) agents purchased a stolen API key that granted illicit access to one victim’s website, and traced the Bitcoin wallet’s address back to him. West has been charged with conspiracy to commit computer intrusions, conspiracy to commit wire fraud, accessing a protected computer to obtain information, and wire fraud. In total, he faces up to 50 years in prison. “Kai West, an alleged serial hacker, is charged for a nefarious, years-long scheme to steal victim’s [sic] data and sell it for millions in illicit funds, causing more than $25 million in damages worldwide,” said FBI Assistant Director in Charge Christopher G. Raia. The U.S. is seeking his extradition.
• Canada Orders Hikvision to Close its Canadian Operations — Canada’s government has ordered Chinese CCTV systems vendor Hikvision to cease all its operations in the country and shut down its Canadian business following a national security review. “The government has determined that Hikvision Canada Ic.’s continued operations in Canada would be injurious to Canada’s national security,” according to a statement released by Mélanie Joly, Canada’s Minister of Industry. “This determination is the result of a multi-step review that assessed information and evidence provided by Canada’s security and intelligence community.” In addition, the order prohibits the purchase or use of Hikvision products in government departments, agencies, and crown corporations. Hikvision called the allegations “unfounded” and that the decision “lacks a factual basis, procedural fairness, and transparency.”
• U.K. NCSC Details “Authentic Antics” Malware — The National Cyber Security Centre (NCSC) is calling attention to a new malware it calls Authentic Antics that runs within the Microsoft Outlook process, displaying periodic malicious login prompts to steal credentials and OAuth 2.0 tokens in an attempt to gain unauthorized access to victim email accounts. “The stolen credential and token data is then exfiltrated by authenticating to the victim’s Outlook on the web account via the Outlook web API, with the freshly stolen token, to send an email to an actor-controlled email address,” the NCSC said. “The emails will not show in the victim’s sent folder.”
• Microsoft Wants to Avoid Another CrowdStrike-like Outage — Microsoft said it’s planning to deliver a private preview of the Windows endpoint security platform to select endpoint security partners, including Bitdefender, CrowdStrike, ESET, SentinelOne, Trellix, Trend Micro, and WithSecure, that will allow them to build their anti-malware solutions to run outside the Windows kernel and in the user mode, just as other regular applications. “This means security products like anti-virus and endpoint protection solutions can run in user mode just as apps do,” Microsoft said. “This change will help security developers provide a high level of reliability and easier recovery resulting in less impact on Windows devices in the event of unexpected issues.” The change, first announced in November 2024, comes nearly a year after a faulty CrowdStrike update took down 8.5 million Windows-based machines around the world. In tandem, Microsoft said it’s also giving Blue Screen of Death (BSoD) a big visual makeover nearly 40 years after its debut in Windows, turning it black and listing the stop code and faulty system driver behind the crash in an attempt to give more clarity.
• Noyb Accuses Bumble of Violating E.U. GDPR — Bumble’s partnership with OpenAI for its Bumble for Friends feature violates Europe’s General Data Protection Regulation, according to a complaint from Austrian privacy non-profit noyb. “Powered by OpenAI’s ChatGPT, the feature is designed to help you start a conversation by providing an AI-generated message,” noyb said. “In order to do this, your personal profile information is fed into the AI system without Bumble ever obtaining your consent. Although the company repeatedly shows you a banner designed to nudge you into clicking ‘Okay,’ which suggests that it relies on user consent, it actually claims to have a so-called ‘legitimate interest’ to use data.” Noyb said the “Okay” option gives users a false sense of control over their data, when it claims to have a legitimate interest in sending user data to OpenAI.
• Jitter-Trap Turns Evasion into Detection — Cybersecurity researchers have designed a clever new technique called Jitter-Trap that aims to detect post-exploitation and command-and-control (C2) communication stemming from the use of red teaming frameworks like Cobalt Strike, Sliver, Empire, Mythic, and Havoc that are often adopted by threat actors in cyber attacks to maintain access, execute commands, move laterally, and exfiltrate data, while simultaneously evading detection. These tools are known to employ a parameter called “sleep” that defines how often the beacon communicates with its operator (i.e., the C2 server). One obfuscation method used to cloak this periodic beaconing activity action is “jitter,” which adds a little bit of randomness to the communication pattern to ensure that it remains undetected. “The jitter property for sleep-time between requests exists to create light randomness with the intent to look natural and like real traffic caused by users,” Varonis said. Jitter-Trap demonstrates how patterns of randomness can be leveraged by defenders to determine if such traffic exists in the first place, effectively turning attackers’ own tactics against them.
• REvil Members Released in Russia — Four members of the REvil ransomware group, Andrey Bessonov, Mikhail Golovachuk, Roman Muromsky, and Dmitry Korotayev, have been found guilty in Russia of financial fraud and cybercrimes, and were sentenced to five years in prison, but were ultimately released after a court determined that their sentence would amount to time already served while awaiting trial. This amounts to less than three years in detention. It’s worth noting that they were arrested in early 2022 on charges relating to trafficking stolen payment data and using malicious software to commit carding fraud. Other members of the crew, Daniil Puzyrevsky, Ruslan Khansvyarov, Aleksey Malozemov, and Artem Zayets, were jailed for four-and-a-half to six years in October 2024. Another REvil member, Yaroslav Vasinksyi, was arrested in 2021 at the Polish border and extradited to the US a year later. Last year, he was sentenced in May 2024 to almost 14 years in prison and ordered to return $16 million to his various victims. It is uncommon for Russia to prosecute its own hackers. In April 2022, Russia said the U.S. had unilaterally shut down communication channels with Russia on cybersecurity and withdrawn the negotiation process regarding the REvil gang.
• Malicious Python Package Shuts Down Windows Systems — A malicious Python package named psslib has been detected in the Python Package Index (PyPI) repository masquerading as a password security utility since November 2018, quietly attracting over 3,700 downloads to date. The package is a typosquat of the legitimate passlib library and is capable of immediately shutting down Windows systems when users enter a password that does not match the value set by the package’s developer. The library also incorporates the ability to invoke a system reboot without warning or consent. The discovery comes as two “protestware” packages with hidden functionality have been flagged in the npm registry. The packages (@link-loom/ui-sdk and @link-loom-react-sdk) specifically target Russian-language users visiting Russian or Belarusian domains (.ru, .su, and .by) in a web browser, blocking mouse-based interaction on the web page and indefinitely playing the Ukrainian anthem on a loop. That said, the attack ensures that only repeat visitors to the sites are targeted, meaning it’s triggered only when the target visits the websites more than once.
• Tudou Guarantee Takes Lead After HuiOne Shutdown — An illicit Telegram marketplace called Tudou Guarantee has emerged as the main winner following the closure of HuiOne Guarantee last month. The latest findings show that it’s business as usual for Chinese-language black markets in the wake of Telegram’s takedown of the two biggest of those bazaars, HuiOne Guarantee and Xinbi Guarantee. Both the services are estimated to have enabled a staggering $35 billion in transactions. Blockchain intelligence firm Elliptic said it’s tracking more than thirty highly-active guarantee markets. “Most notably, Tudou Guarantee has seen users more than double – and cryptocurrency inflows are now approximately equal to those seen for HuiOne Guarantee prior to its shutdown,” the company said. “Many of the merchants operating on Tudou are the same ones that previously sold through HuiOne Guarantee, offering stolen data, money laundering services and other products needed by scammers.” The shift is also significant in light of the fact that HuiOne Guarantee is a major shareholder in Tudou Guarantee. It acquired a 30% stake in December 2024. “These scammers have inflicted misery on millions of victims around the world, stealing billions of dollars. Unless these marketplaces are actively pursued, they will continue to flourish,” Elliptic’s Tom Robinson was quoted as saying to WIRED.

• South Korea Targeted by MeshAgent and SuperShell — Windows and Linux servers in South Korea are being targeted by Chinese-speaking threat actors to drop web shells like SuperShell and remote desktop software such as MeshAgent to establish persistent access and install additional payloads. The IP address used to stage the payloads has also been found to include WogRAT (short for “WingsOfGod”), a backdoor that can collect system information and execute arbitrary commands issued by a remote server. The exact initial access vector used in the attacks is unknown, according to AhnLab. “The attacker seems to target not only Windows but also Linux, attempting to take control of the network where the infected system belongs by moving from the initial penetration phase to the lateral movement phase,” the cybersecurity company said. “While the ultimate goal is unknown, the attacker may steal sensitive information or infect the network with ransomware if they successfully take control of the organization’s network.”
• AndroxGh0st Malware Evolves to Add New Flaws — The threat actors behind the AndroxGh0st malware have been found leveraging compromised websites associated with the University of California, San Diego, and an unnamed Jamaican events aggregator platform for C2 purposes. Attacks mounted by the Python-based cloud attack tool are known to leverage a wide range of known security flaws, including those affecting Apache Struts, Apache Shiro, FasterXML, Lantronix PremierWave, Popup Maker WordPress plugin, and Spring Framework, to obtain initial access and drop the malware. “The botnet exploits popular platforms (e.g., Apache Shiro, Spring framework, WordPress) and IoT devices (Lantronix), enabling remote code execution, sensitive data theft, and cryptomining,” CloudSEK said.
• Phishing Campaign Leverages CapCut Lures — A new phasing campaign is employing fake CapCut invoice lures to trick recipients into clicking on bogus links that mimic Apple account login pages and prompt them to enter their financial information to receive a refund. However, the attack is designed to stealthily hoover their credentials and credit card details to an external server. “As CapCut continues to dominate the short-form video editing scene, cybercriminals are seizing the opportunity to exploit its popularity,” Cofense said.
• Dutch Police Contact 126 Individuals in Connection with Cracked.io — Dutch police have identified and contacted 126 individuals who held accounts on the Cracked.io hacking forum. Authorities filed criminal cases against eight suspects and warned the remaining individuals against engaging in further criminal activity. The youngest person contacted by authorities was 11 years old. Law enforcement agencies from the U.S. and Europe seized Cracked and Nulled earlier this January. Prior to the takedown, the forum had more than 4.7 million users and was known for selling hacking services, stolen data, and malware.
• Vulnerabilities in Airoha SoCs — Cybersecurity researchers have discovered three flaws in devices that incorporate Airoha Systems on a Chip (SoCs) that could be weaponized to take over susceptible products without requiring any authentication or pairing, and on certain phones, even eavesdrop on conversations and extract call history and stored contacts. “Any vulnerable device can be compromised if the attacker is in Bluetooth range,” the researchers said. The vulnerabilities, assigned the CVE identifiers CVE-2025-20700, CVE-2025-20701, and CVE-2025-20702, relate to missing authentication for GATT Services, missing authentication for Bluetooth BR/EDR, and an unspecified vulnerability in a custom protocol that allows for manipulating the device. The Bluetooth chipset, according to cybersecurity company ERNW, is used in headsets, earbuds, dongles, speakers, and wireless microphones. “Some vendors are not even aware that they are using an Airoha SoC,” ERNW noted. “They have outsourced parts of the development of their device, such as the Bluetooth module.”
• Operation Overload Uses API to Amplify Pro-Russian Propaganda — A Russian disinformation operation known as Operation Overload has adopted artificial intelligence (AI) to generate Russian propaganda and spread it across Telegram, X, BlueSky, and TikTok. The activity involves AI-generated or deceptively edited content, often impersonating journalists, public figures, and respected institutions, to interfere with the political discourse in Ukraine, France, Germany, Poland, Moldova, and the United States. “While anti-Ukrainian narratives continue to dominate, election interference stands out as a prominent theme,” CheckFirst said.
• Crypto Drainer Scam Impersonates Tax Authorities — A new phishing campaign dubbed Declaration Trap has been observed targeting cryptocurrency users by impersonating European tax authorities, specifically Dutch agencies Belastingdienst and MijnOverheid. In these attacks, prospective victims are lured via email messages to phishing sites that harvest personal information and run crypto drainer phishing kits to siphon seed phrases, and perform unauthorized withdrawals by sending malicious transaction signing requests. “The victim’s journey begins with an email that appears to come from Belastingdienst or MijnOverheid and tells the recipient they need to complete a special declaration form for their crypto assets due to new tax regulations introduced in 2025,” Group-IB said. “Scammers use pressure tactics: they set short deadlines for completing the form and threaten victims with fines if they don’t comply.” The disclosure comes as IBM X-Force detailed a phishing campaign that’s targeting financial institutions across the world with weaponized Scalable Vector Graphics (SVG) files embedded with JavaScript to steal credentials and drop remote access trojans (RATs). “When executed, the SVG-embedded JavaScript drops a ZIP archive containing a JavaScript file that is used to download a Java-based loader,” IBM said. “If Java is present, it deploys modular malware including Blue Banana RAT, SambaSpy, and SessionBot.”
• Hive0131 Campaign Delivers DCRat in Colombia — In a new phishing campaign detected in early May 2025, the threat actor tracked as Hive0131 targeted users in Colombia with bogus notifications about criminal proceedings to initiate an attack chain that ultimately delivered the modular DCRat malware to harvest files, keystrokes, and audio and video recordings. “Hive0131 is a financially motivated group likely originating from South America that routinely conducts campaigns largely in Latin America (LATAM) to deliver a wide array of commodity payloads,” IBM X-Force said. “The current campaigns imitate official correspondence and contain either an embedded link or a PDF lure with an embedded link. Clicking on the embedded link will initiate the infection chain to execute the banking trojan ‘DCRat’ in memory.” The attacks, which have also been found to either contain a PDF lure with a link to a TinyURL or an embedded link to a Google Docs location, are characterized by the use of an obfuscated .NET loader dubbed VMDetectLoader that’s used to download and execute DCRat.

• CISA and NSA Call for Adoption of Memory-Safe Languages — The U.S. Cybersecurity and Infrastructure Security Agency, along with the National Security Agency (NSA), issued guidance on adopting memory-safe languages (MSLs) such as Rust to mitigate memory-related vulnerabilities in software. MSLs offer built-in mechanisms such as bounds checking, memory management, data race prevention, and runtime safety checks to protect against memory bugs. “Achieving better memory safety demands language-level protections, library support, robust tooling, and developer training,” the agencies said. “MSLs offer built-in safeguards that shift safety burdens from developers to the language and the development environment. By integrating safety mechanisms directly at the language level, MSLs enhance security outcomes and reduce reliance on after-the-fact analysis tools.” However, the report also points out the challenges with adopting MSLs due to legacy systems and tightly coupled code, performance overhead, and the availability (or lack thereof) of tools and libraries available for an MSL.
• New SmartAttack Technique Uses Smartwatches to Steal Air-Gapped Data — A new side-channel attack dubbed SmartAttack has demonstrated the use of smartwatches as receivers for ultrasonic covert communication in air-gapped environments. The approach, according to Dr. Mordechai Guri, the head of the Offensive Cyber Research Lab in the Department of Software and Information Systems Engineering at the Ben Gurion University of the Negev in Israel, utilizes the built-in microphones of smartwatches to capture covert signals in real-time within the ultrasonic frequency range of 18-22 kHz. As with other attacks of this kind, the threat model presupposes that the attacker has already infiltrated the air-gapped system and implanted malware that operates stealthily, transmitting information using the infected machine’s speakers in a frequency range that’s inaudible to humans. On the other end, the attack also requires the threat actor to compromise the smartwatch of an individual with access to the secured environment, and deploy malware capable of receiving the covert ultrasonic communication, decoding it, reconstructing it, and forwarding it to the attacker’s infrastructure. In an experimental setup, SmartAttack can be used to transmit data through ultrasonic signals over distances of more than 6 meters, with data rates of up to 50 bits per second. Dr. Guri, who disclosed RAMBO and PIXHELL attacks last year to exfiltrate data from air-gapped systems, said the findings highlight the “security risks posed by smartwatches in high-security environments.” Possible mitigations include prohibiting smartwatches and similar audio-capable wearables when entering secure environments, deploying ultrasonic monitoring systems to identify unauthorized transmissions, deploying ultrasonic jammers, and physically removing or disabling audio hardware components.
• Google Adds New Security Feature to Tackle XSS Attacks — Google has added a new security feature to the Chrome browser that automatically escapes “<” and “>” characters inside HTML attributes. The new feature is designed to prevent cross-site scripting attacks that rely on slipping in malicious code inside HTML code. The feature shipped with the stable version of Chrome 138 released on June 24, 2025. “It’s possible that a sanitizer may have a DOM tree it considers safe; however, after re-parsing, this DOM tree will be materially different, resulting in an XSS,” Google’s Michał Bentkowski said. This type of XSS attack is called mutation XSS (mXSS).

🎥 Cybersecurity Webinars

• Designing Identity for Trust at Scale—With Privacy, AI, and Seamless Logins in Mind ➝ In today’s AI-powered world, customer identity is all about trust. This webinar unpacks insights from the Auth0 2025 Trends Report—covering how users react to AI, rising privacy expectations, and the latest identity threats. Whether you’re building login flows or trust strategies, you’ll get clear, practical advice to stay ahead.
• Stop Pip Installing and Praying: Secure Your Python Supply Chain in 2025 ➝ The Python ecosystem in 2025 is under attack—from repo jacking and typosquatting to hidden flaws in common container images. If you’re still “pip installing and hoping,” it’s time to rethink. Join security experts as they unpack real threats, explain tools like CVE, Sigstore, and SLSA, and share how PyPI is responding. Whether you’re using YOLO models or managing production apps, you’ll get clear, practical steps to secure your Python supply chain today.

🔧 Cybersecurity Tools

• RIFT ➝ Microsoft has open-sourced RIFT, a tool that helps analysts spot attacker-written code in complex Rust malware. As Rust becomes more popular among threat actors, malware is getting harder to analyze. RIFT cuts through the noise by using automated signature matching and binary diffing to highlight only the custom code—saving time and improving detection.

Disclaimer: These newly released tools are for educational use only and haven’t been fully audited. Use at your own risk—review the code, test safely, and apply proper safeguards.

🔒 Tip of the Week

Beyond Defaults: Mastering Windows Hardening ➝ Default Windows settings are built for ease, not security. That’s fine for casual use—but if you care about protecting your data, business, or even just your privacy, it’s time to go beyond the basics.

The good news? You don’t need to be a sysadmin to lock down your system. Tools like HardeningKitty, CIS-CAT Lite, and Microsoft’s Security Compliance Toolkit do the heavy lifting for you. They scan your system and tell you exactly what to fix—like disabling outdated protocols (SMBv1, NetBIOS), hardening Office macros, or turning off risky Windows features you don’t even use.

If that sounds a bit much, don’t worry—there are one-click apps too. ConfigureDefender lets you max out Microsoft Defender’s protection (including turning on hidden advanced rules). WPD and O&O ShutUp10++ help you cut Windows tracking, bloatware, and junk settings in minutes. Think of them as the “Privacy + Security” switches Microsoft should’ve given you by default.

Want to get serious? Start with CIS-CAT Lite to see where your system stands, then run HardeningKitty to close the gaps. These aren’t just checkboxes—you’re cutting off real-world attack paths like phishing payloads, document-based malware, and lateral movement across networks.

Bottom line: You don’t have to “just use Windows as it is.” You can make it work for you, not against you—without breaking anything. Small changes, big impact.

Conclusion

It’s easy to get caught up in the technical details, but at the end of the day, it’s about making smart decisions with the tools and time we have. No one can fix everything at once—but knowing where the cracks are is half the battle. Whether it’s a quick configuration check or a deeper policy rethink, small steps add up.

Take a few minutes to scan the highlights and see where your team might need a second look.

Identity-based attacks are on the rise. Attacks in which malicious actors assume the identity of an entity to easily gain access to resources and sensitive data have been increasing in number and frequency over the last few years. Some recent reports estimate that 83% of attacks involve compromised secrets. According to reports such as the Verizon DBIR, attackers are more commonly using stolen credentials to gain their initial foothold, rather than exploiting a vulnerability or misconfiguration.

Attackers are not just after human identities that they can assume, though. More commonly, they are after Non-Human Identities (NHIs), which outnumber human identities in the enterprise by at least 50 to one. Unlike humans, machines have no good way to achieve multi-factor authentication, and we, for the most part, have been relying on credentials alone, in the form of API keys, bearer tokens, and JWTs.

Traditionally, identity and access management (IAM) has been built on the idea of persistent human traits over time. It is rare for a person to change their name, fingerprints, or DNA. We can assume that if you went through an identity verification process, you are confirmed to be the human you claim to be. Based on this, you can obtain certain permissions dependent on your role within the organization and your level of trust.

Securing machine identities means getting a handle on the unique trait that bad actors actually care about, namely, their access keys. If we treat these highly valued secrets as the way to uniquely identify the identities we are protecting, then we can leverage that into true observability around how access is granted and used throughout your enterprise.

Accounting For NHIs Through A Fractured Lens

Before we take a deeper look at secrets as unique identifiers, let’s first consider how we currently talk about NHIs in the enterprise.

Most teams struggle with defining NHIs. The canonical definition is simply “anything that is not a human,” which is necessarily a wide set of concerns. NHIs manifest differently across cloud providers, container orchestrators, legacy systems, and edge deployments. A Kubernetes service account tied to a pod has distinct characteristics compared to an Azure managed identity or a Windows service account. Every team has historically managed these as separate concerns. This patchwork approach makes it nearly impossible to create a consistent policy, let alone automate governance across environments.

The exponential growth of NHIs has left a gap in traditional asset inventory tools, and access reviewers can’t keep pace. Enforcement of consistent permissions or security controls across such a wildly varied set of identities seems near impossible. This is on top of aging legacy systems that have not had their passwords rotated or audited in years.

Compounding this issue is the lack of metadata and ownership around NHIs. Questions like “What is this identity for?” or “Who owns this token?” frequently go unanswered, as the person who created and released that identity into the system has moved on. This vacuum of accountability makes it difficult to apply basic lifecycle practices such as rotation or decommissioning. NHIs that were created for testing purposes often persist long after the systems they were tied to are discontinued, accumulating risk silently.

The UUIDs Of Your Zero Trust Protect Surface

No matter what form or shape an NHI takes, in order to do work as part of an application or system, it needs to authenticate to access data and resources and do its work.

Most commonly, this takes the form of secrets, which look like API keys, certificates, or tokens. These are all inherently unique and can act as cryptographic fingerprints across distributed systems. When used in this way, secrets used for authentication become traceable artifacts tied directly to the systems that generated them. This allows for a level of attribution and auditing that’s difficult to achieve with traditional service accounts. For example, a short-lived token can be directly linked to a specific CI job, Git commit, or workload, allowing teams to answer not just what is acting, but why, where, and on whose behalf.

This access-as-the-identifier model can bring clarity to your inventory, offering a unified view of all your machines, workloads, task runners, and even agent-based AI systems. Secrets offer a consistent and machine-verifiable method of indexing NHIs, letting teams centralize visibility into what exists, who owns it, and what it can access, regardless of whether it’s running on Kubernetes, GitHub Actions, or a public cloud.

Critically, this model also supports lifecycle management and Zero Trust principles more naturally than legacy identity frameworks. A secret is only valid when it can be used, which is a provable state, which means unused or expired secrets can be automatically flagged for cleanup. This can stop identity sprawl and ghost accounts, which are endemic in NHI-heavy environments.

The Security Ramifications Of Secrets At NHI Identifiers

If we are going to talk about secrets as the unique identifier for machines and workloads, we do need to address the fact that they have a nasty tendency to leak. According to our State of Secrets Sprawl 2025 research, almost 23.8 million secrets were leaked on public GitHub repositories in 2024, a 25% year-over-year increase. Worse yet, a full 35% of the private repositories we researched contained secrets, 8 times as many as we found in public repositories.

Breaches over the past several years, from Uber to the U.S. Department of the Treasury, have shown that when secrets are scattered across pipelines, codebases, containers, and cloud configs without consistent management, they become a silent invitation to attackers. These leaked or stolen credentials offer attackers a low-friction path to compromise.

A leaked API key or NHI token allows anyone who attempts to use it to establish a valid session, with no mechanism in place to verify its legitimacy or the context of its use. If the secret is tied to a long-lived, over-permissioned bot or service account, the attacker instantly inherits all that trust.

The problem is amplified further when secrets outlive their purpose. Orphaned secrets, credentials forgotten about and never decommissioned, abandoned CI/CD jobs, or one-off projects, linger quietly, often with dangerous levels of access and zero visibility. Without ownership, expiration, or revocation processes, they become ideal entry points for attackers looking for stealth and persistence.

GitGuardian Can Inventory All Your Secrets, Not Just The Leaked Ones

Secrets can only live in two possible places: where they belong, safely stored in a secrets management vault, or leaked elsewhere. We have been helping people find the secrets leaked where they are not supposed to be for years now, with our internally focused Secrets Detection offering and our Public Monitoring platform.

Now, GitGuardian can act as your cross-environment NHI inventory platform, helping you gain visibility into what secrets are in your vaults, along with metadata around how they are used. GitGuardian builds a unified, contextualized inventory of every secret, regardless of origin or format. Whether it’s injected via Kubernetes, embedded in an Ansible playbook, or retrieved from a vault like HashiCorp, each secret is fingerprinted and monitored.

This cross-environment awareness allows teams to quickly see

• Which NHIs have keys leaked publicly.
• If any internal leaks happened for those same secrets.
• Any secrets redundantly stored in multiple vaults
• If the secret is long lived and needs rotation

The GitGuardian NHI Governance Inventory dashboard showing policy violations and risk scores.

Crucially, GitGuardian also detects “zombie” credentials, secrets that persist without authorization or oversight. Rich metadata, like creator attribution, secret lifespan, permissions scope, and context, empower governance over these non-human actors, enabling real-time inventory alignment and accountability.

This visibility isn’t just operational, it’s strategic. GitGuardian enables centralized policy enforcement across all secret sources, transforming reactive secrets detection into proactive identity governance. By mapping secrets to NHIs and enforcing lifecycle policies like expiration, rotation, and revocation, GitGuardian closes the loop between discovery, vaulting, and enforcement

Beyond Inventory And Towards NHI Governance

The rise of non-human identities has reshaped the identity landscape, and with it, the attack surface. Credentials aren’t just access keys. Secrets are the mechanism that allows an attacker to assume an identity that already has persistent access to your data and resources. Without visibility into where those credentials live, how they’re used, and whether they’re still valid, organizations are left vulnerable to silent compromise.

GitGuardian’s Secrets Security + NHI Governance = Non-Human Identity Security

Treating secrets as the UUIDs of modern workloads is the clearest path to scalable, cross-platform NHI governance. But that approach only works if you can see the full picture: vaults, pipelines, ephemeral infrastructure, and everything in between.

GitGuardian delivers that visibility. We are turning fragmented credential sprawl into a unified, actionable inventory. By anchoring NHI identity to its authenticating secret, and layering in rich metadata and lifecycle controls, GitGuardian enables security teams to detect issues early, identify over-permissioned and orphaned credentials, and enforce revocation before a breach occurs.

We are helping complex modern enterprises reduce the likelihood of successful identity-based attacks. When credentials are monitored, scoped, and managed in real time, they’re no longer low-hanging fruit for attackers.

We would love to give you a full demo of the capabilities of the GitGuardian NHI Security platform and help you get unparalleled insight into your NHIs and secrets security. And if you’d rather explore on your own, take a guided tour of GitGuardian with our interactive demo!

The U.S. Federal Bureau of Investigation (FBI) has revealed that it has observed the notorious cybercrime group Scattered Spider broadening its targeting footprint to strike the airline sector.

To that end, the agency said it’s actively working with aviation and industry partners to combat the activity and help victims.

“These actors rely on social engineering techniques, often impersonating employees or contractors to deceive IT help desks into granting access,” the FBI said in a post on X. “These techniques frequently involve methods to bypass multi-factor authentication (MFA), such as convincing help desk services to add unauthorized MFA devices to compromised accounts.”

Scattered Spider attacks are also known to target third-party IT providers to obtain access to large organizations, putting trusted vendors and contractors at risk of potential attacks. The attacks typically pave the way for data theft, extortion, and ransomware.

In a statement shared on LinkedIn, Palo Alto Networks Unit 42’s Sam Rubin confirmed the threat actor’s attacks against the aviation industry, urging organizations to be on “high alert” for advanced social engineering attempts and suspicious multi-factor authentication (MFA) reset requests

Google-owned Mandiant, which recently warned of Scattered Spider’s targeting of the U.S. insurance sector, also echoed the warning, stating it’s aware of multiple incidents in the airline and transportation verticals that resemble the modus operandi of the hacking crew.

“We recommend that the industry immediately take steps to tighten up their help desk identity verification processes prior to adding new phone numbers to employee/contractor accounts (which can be used by the threat actor to perform self-service password resets), reset passwords, add devices to MFA solutions, or provide employee information (e.g. employee IDs) that could be used for a subsequent social engineering attacks,” Mandiant’s Charles Carmakal said.

One reason Scattered Spider continues to succeed is how well it understands human workflows. Even when technical defenses like MFA are in place, the group focuses on the people behind the systems—knowing that help desk staff, like anyone else, can be caught off guard by a convincing story.

This isn’t about brute-force hacking; it’s about building trust just long enough to sneak in. And when time is short or pressure is high, it’s easy to see how a fake employee request could slip through. That’s why organizations should look beyond traditional endpoint security and rethink how identity verification happens in real time.

The activity tracked as Scattered Spider overlaps with threat clusters such as Muddled Libra, Octo Tempest, Oktapus, Scatter Swine, Star Fraud, and UNC3944. The group, originally known for its SIM swapping attacks, counts social engineering, helpdesk phishing, and insider access among its roster of initial access techniques to penetrate hybrid environments.

“Scattered Spider represents a major evolution in ransomware risk, combining deep social engineering, layered technical sophistication, and rapid double‑extortion capabilities,” Halcyon said. “In a matter of hours, the group can breach, establish persistent access, harvest sensitive data, disable recovery mechanisms, and detonate ransomware across both on‑premises and cloud environments.”

What makes this group especially dangerous is its mix of patient planning and sudden escalation. Scattered Spider doesn’t just rely on stolen credentials—it spends time gathering intel on its targets, often combining social media research with public breach data to impersonate people with scary accuracy. This kind of hybrid threat, blending business email compromise (BEC) techniques with cloud infrastructure sabotage, can fly under the radar until it’s too late.

Scattered Spider is part of an amorphous collective called the Com (aka Comm), which also counts other groups like LAPSUS$. It’s assessed to be active at least since 2021.

“This group evolved in the Discord and Telegram communication platforms, drawing in members from diverse backgrounds and interests,” Unit 42 said. “The loose-knit and fluid nature of this group makes it inherently difficult to disrupt.”

In a report published Friday, ReliaQuest detailed how Scattered Spider actors breached an unnamed organization late last month by targeting its chief financial officer (CFO), and abused their elevated access to conduct an extremely precise and calculated attack.

The threat actors have been found to carry out extensive reconnaissance to single out high-value individuals, especially impersonating the CFO in a call to the company’s IT help desk and persuading them to reset the MFA device and credentials tied to their account.

The attackers also leveraged the information obtained during reconnaissance to enter the CFO’s date of birth and the last four digits of their Social Security Number (SSN) into the company’s public login portal as part of their login flow, ultimately confirming their employee ID and validating the gathered information.

“Scattered Spider favors C-Suite accounts for two key reasons: They’re often over-privileged, and IT help-desk requests tied to these accounts are typically treated with urgency, increasing the likelihood of successful social engineering,” the company said. “Access to these accounts gives Scattered Spider a pathway into critical systems, making reconnaissance a cornerstone of its tailored attack plans.”

Armed with access to the CFO’s account, Scattered Spider actors performed a series of actions on the target environment that demonstrated its ability to adapt and rapidly escalate their attack –

• Conduct Entra ID enumeration on privileged accounts, privileged groups, and service principals for privilege escalation and persistence
• Perform SharePoint discovery to locate sensitive files and collaborative resources, and gain deeper insights about the organization’s workflows and IT and cloud architectures so as to tailor their attack
• Infiltrate the Horizon Virtual Desktop Infrastructure (VDI) platform using the CFO’s stolen credentials and compromising two additional accounts via social engineering, extract sensitive information, and establish a foothold in the virtual environment
• Breach the organization’s VPN infrastructure to secure uninterrupted remote access to internal resources
• Reinstate previously decommissioned virtual machines (VMs) and create new ones to access the VMware vCenter infrastructure, shut down a virtualized production domain controller, and extract the contents of the NTDS.dit database file
• Use their elevated access to crack open CyberArk password vault and obtain more than 1,400 secrets
• Advance the intrusion further using the privileged accounts, including assigning administrator roles to compromised user accounts
• Use legitimate tools like ngrok to set up persistence to VMs under their control
• Resort to a “scorched-earth” strategy after its presence was detected by the organization’s security team, prioritizing “speed over stealth” to deliberately delete Azure Firewall policy rule collection groups, hampering regular business operations

ReliaQuest also described what was essentially a tug-of-war between the incident response team and the threat actors for the control of the Global Administrator role within the Entra ID tenant, a battle that only ended after Microsoft itself stepped in to restore control over the tenant.

The bigger picture here is that social engineering attacks are no longer just phishing emails—they’ve evolved into full-blown identity threat campaigns, where attackers follow detailed playbooks to bypass every layer of defense. From SIM swapping to vishing and privilege escalation, Scattered Spider shows how quickly attackers can move when the path is clear.

For most companies, the first step isn’t buying new tools—it’s tightening internal processes, especially for things like help desk approvals and account recovery. The more you rely on people for identity decisions, the more important it becomes to train them with real-world examples.

“Scattered Spider’s initial access methods expose a critical weakness in many organizations: Reliance on human-centric workflows for identity verification,” security researchers Alexa Feminella and James Xiang said.

“By weaponizing trust, the group bypassed strong technical defenses and demonstrated how easily attackers can manipulate established processes to achieve their goals. This vulnerability highlights the urgent need for businesses to reevaluate and strengthen ID verification protocols, reducing the risk of human error as a gateway for adversaries.”

Jun 28, 2025Ravie LakshmananMalware / Cyber Warfare

The threat actor behind the GIFTEDCROOK malware has made significant updates to turn the malicious program from a basic browser data stealer to a potent intelligence-gathering tool.

“Recent campaigns in June 2025 demonstrate GIFTEDCROOK’s enhanced ability to exfiltrate a broad range of sensitive documents from the devices of targeted individuals, including potentially proprietary files and browser secrets,” Arctic Wolf Labs said in a report published this week.

“This shift in functionality, combined with the content of its phishing lures, […] suggests a strategic focus on intelligence gathering from Ukrainian governmental and military entities.”

GIFTEDCROOK was first documented by the Computer Emergency Response Team of Ukraine (CERT-UA) in early April 2025 in connection with a campaign targeting military entities, law enforcement agencies, and local self-government bodies.

The activity, attributed to a hacking group it tracks as UAC-0226, involves the use of phishing emails containing macro-laced Microsoft Excel documents that act as a conduit to deploy GIFTEDCROOK.

An information stealer at its core, the malware is designed to steal cookies, browsing history, and authentication data from popular web browsers such as Google Chrome, Microsoft Edge, and Mozilla Firefox.

Arctic Wolf’s analysis of the artifacts has revealed that the stealer started off as a demo in February 2025, before gaining new features with versions 1.2 and 1.3.

These new iterations include the ability to harvest documents and files below 7 MB in size, specifically looking for files created or modified within the last 45 days. The malware specifically searches for the following extensions: .doc, .docx, .rtf, .pptx, .ppt, .csv, .xls, .xlsx, .jpeg, .jpg, .png, .pdf, .odt, .ods, .rar, .zip, .eml, .txt, .sqlite, and .ovpn.

The email campaigns leverage military-themed PDF lures to entice users into clicking on a Mega cloud storage link that hosts a macro-enabled Excel workbook (“Список оповіщених військовозобов’язаних організації 609528.xlsm”), causing GIFTEDCROOK to be downloaded when the recipient turns on macros. Many users don’t realize how common macro-enabled Excel files are in phishing attacks. They slip past defenses because people often expect spreadsheets in work emails—especially ones that look official or government-related.

The captured information is bundled into a ZIP archive and exfiltrated to an attacker-controlled Telegram channel. If the total archive size exceeds 20 MB, it is broken down into multiple parts. By sending stolen ZIP archives in small chunks, GIFTEDCROOK avoids detection and skips around traditional network filters. In the final stage, a batch script is executed to erase traces of the stealer from the compromised host.

This isn’t just about stealing passwords or tracking online behavior—it’s targeted cyber espionage. The malware’s new ability to sift through recent files and grab documents like PDFs, spreadsheets, and even VPN configs points to a bigger goal: collecting intelligence. For anyone working in public sector roles or handling sensitive internal reports, this kind of document stealer poses a real risk—not just to the individual, but to the entire network they’re connected to.

“The timing of the campaigns discussed in this report demonstrates clear alignment with geopolitical events, particularly the recent negotiations between Ukraine and Russia in Istanbul,” Arctic Wolf said.

“The progression from simple credential theft in GIFTEDCROOK version 1, to comprehensive document and data exfiltration in versions 1.2 and 1.3, reflects coordinated development efforts where malware capabilities followed geopolitical objectives to enhance data collection from compromised systems in Ukraine.”

Jun 28, 2025Ravie LakshmananPrivacy / Data Protection

Facebook, the social network platform owned by Meta, is asking for users to upload pictures from their phones to suggest collages, recaps, and other ideas using artificial intelligence (AI), including those that have not been directly uploaded to the service.

According to TechCrunch, which first reported the feature, users are being served a new pop-up message asking for permission to “allow cloud processing” when they are attempting to create a new Story on Facebook.

“To create ideas for you, we’ll select media from your camera roll and upload it to our cloud on an ongoing basis, based on info like time, location or themes,” the company notes in the pop-up. “Only you can see suggestions. Your media won’t be used for ads targeting. We’ll check it for safety and integrity purposes.”

Should users consent to their photos being processed on the cloud, Meta also states that they are agreeing to its AI terms, which allow it to analyze their media and facial features.

On a help page, Meta says “this feature isn’t yet available for everyone,” and that it’s limited to users in the United States and Canada. It also pointed out to TechCrunch that these AI suggestions are opt-in and can be disabled at any time.

The development is yet another example of how companies are racing to integrate AI features into their products, oftentimes at the cost of user privacy.

Meta says its new AI feature won’t be used for targeted ads, but experts still have concerns. When people upload personal photos or videos—even if they agree to it—it’s unclear how long that data is kept or who can see it. Since the processing happens in the cloud, there are risks, especially with things like facial recognition and hidden details such as time or location.

Even if it’s not used for ads, this kind of data could still end up in training datasets or be used to build user profiles. It’s a bit like handing your photo album to an algorithm that quietly learns your habits, preferences, and patterns over time.

Last month, Meta began to train its AI models using public data shared by adults across its platforms in the European Union after it received approval from the Irish Data Protection Commission (DPC). The company suspended the use of generative AI tools in Brazil in July 2024 in response to privacy concerns raised by the government.

The social media giant has also added AI features to WhatsApp, the most recent being the ability to summarize unread messages in chats using a privacy-focused approach it calls Private Processing.

This change is part of a bigger trend in generative AI, where tech companies mix convenience with tracking. Features like auto-made collages or smart story suggestions may seem helpful, but they rely on AI that watches how you use your devices—not just the app. That’s why privacy settings, clear consent, and limiting data collection are more important than ever.

Facebook’s AI feature also comes as one of Germany’s data protection watchdogs called on Apple and Google to remove DeepSeek’s apps from their respective app stores due to unlawful user data transfers to China, following similar concerns raised by several countries at the start of the year.

“The service processes extensive personal data of the users, including all text entries, chat histories and uploaded files as well as information about the location, the devices used and networks,” according to a statement released by the Berlin Commissioner for Data Protection and Freedom of Information. “The service transmits the collected personal data of the users to Chinese processors and stores it on servers in China.”

These transfers violate the General Data Protection Regulation (GDPR) of the European Union, given the lack of guarantees that the data of German users in China are protected at a level equivalent to the bloc.

Earlier this week, Reuters reported that the Chinese AI company is assisting the country’s military and intelligence operations, and that it’s sharing user information with Beijing, citing an anonymous U.S. Department of State official.

A couple of weeks ago, OpenAI also landed a $200 million with the U.S. Department of Defense (DoD) to “develop prototype frontier AI capabilities to address critical national security challenges in both warfighting and enterprise domains.”

The company said it will help the Pentagon “identify and prototype how frontier AI can transform its administrative operations, from improving how service members and their families get health care, to streamlining how they look at program and acquisition data, to supporting proactive cyber defense.”

Jun 27, 2025Ravie LakshmananThreat Hunting / Vulnerability

Threat hunters have discovered a network of more than 1,000 compromised small office and home office (SOHO) devices that have been used to facilitate a prolonged cyber espionage infrastructure campaign for China-nexus hacking groups.

The Operational Relay Box (ORB) network has been codenamed LapDogs by SecurityScorecard’s STRIKE team.

“The LapDogs network has a high concentration of victims across the United States and Southeast Asia, and is slowly but steadily growing in size,” the cybersecurity company said in a technical report published this week.

Other regions where the infections are prevalent include Japan, South Korea, Hong Kong, and Taiwan, with victims spanning IT, networking, real estate, and media sectors. Active infections span devices and services from Ruckus Wireless, ASUS, Buffalo Technology, Cisco-Linksys, Cross DVR, D-Link, Microsoft, Panasonic, and Synology.

LapDogs’ beating heart is a custom backdoor called ShortLeash that’s engineered to enlist infected devices in the network. Once installed, it sets up a fake Nginx web server and generates a unique, self-signed TLS certificate with the issuer name “LAPD” in an attempt to impersonate the Los Angeles Police Department. It’s this reference that has given the ORB network its name.

ShortLeash is assessed to be delivered by means of a shell script to primarily penetrate Linux-based SOHO devices, although artifacts serving a Windows version of the backdoor have also been found. The attacks themselves weaponize N-day security vulnerabilities (e.g., CVE-2015-1548 and CVE-2017-17663) to obtain initial access.

First signs of activity related to LapDogs have been detected as far back as September 6, 2023, in Taiwan, with the second attack recorded four months later, on January 19, 2024. There is evidence to suggest that the campaigns are launched in batches, each of which infects no more than 60 devices. A total of 162 distinct intrusion sets have been identified to date.

The ORB has been found to share some similarities with another cluster referred to as PolarEdge, which was documented by Sekoia earlier this February as exploiting known security flaws in routers and other IoT devices to corral them into a network since late 2023 for an as-yet-undetermined purpose.

The overlaps aside, LapDogs and PolarEdge are assessed as two separate entities, given the differences in the infection process, the persistence methods used, and the former’s ability to also target virtual private servers (VPSs) and Windows systems.

“While PolarEdge backdoor replaces the CGI script of the devices with the operator’s designated webshell, ShortLeash merely inserts itself into the system directory as a .service file, ensuring the persistence of the service upon reboot, with root-level privileges,” SecurityScorecard noted.

What’s more, it has been gauged with medium confidence that the China-linked hacking crew tracked as UAT-5918 used LapDogs in at least one of its operations aimed at Taiwan. It’s currently not known if UAT-5918 is behind the network or is just a client.

Chinese threat actors’ use of ORB networks as a means of obfuscation has been previously documented by Google Mandiant, Sygnia and SentinelOne, indicating that they are being increasingly adopted into their playbooks for highly targeted operations.

“While both ORBs and botnets commonly consist of a large set of compromised, legitimate internet-facing devices or virtual services, ORB networks are more like Swiss Army knives, and can contribute to any stage of the intrusion lifecycle, from reconnaissance, anonymized actor browsing, and netflow collection to port and vulnerability scanning, initiating intrusion cycles by reconfiguring nodes into staging or even C2 servers, and relaying exfiltrated data up the stream,” SecurityScorecard said.

Jun 27, 2025Ravie LakshmananVulnerability / Cyber Espionage

A China-linked threat actor known as Mustang Panda has been attributed to a new cyber espionage campaign directed against the Tibetan community.

The spear-phishing attacks leveraged topics related to Tibet, such as the 9th World Parliamentarians’ Convention on Tibet (WPCT), China’s education policy in the Tibet Autonomous Region (TAR), and a recently published book by the 14th Dalai Lama, according to IBM X-Force.

The cybersecurity division of the technology company said it observed the campaign earlier this month, with the attacks leading to the deployment of a known Mustang Panda malware called PUBLOAD. It’s tracking the threat actor under the name Hive0154.

The attack chains employ Tibet-themed lures to distribute a malicious archive containing a benign Microsoft Word file, along with articles reproduced by Tibetan websites and photos from WPCT, into opening an executable that’s disguised as a document.

The executable, as observed in prior Mustang Panda attacks, leverages DLL side-loading to launch a malicious DLL dubbed Claimloader that’s then used to deploy PUBLOAD, a downloader malware that’s responsible for contacting a remote server and fetching a next-stage payload dubbed Pubshell.

Pubshell is a “light-weight backdoor facilitating immediate access to the machine via a reverse shell,” security researchers Golo Mühr and Joshua Chung said in an analysis published this week.

At this stage, it’s worth mentioning some of the nomenclature differences: IBM has given the name Claimloader to the custom stager first documented by Cisco Talos in May 2022 and PUBLOAD to the first-stage shellcode downloader, whereas Trend Micro identifies both the stager and the downloader as PUBLOAD. Team T5, similarly, tracks the two components collectively as NoFive.

The development comes weeks after IBM’s activity which it said is the work of a Hive0154 sub-cluster targeting the United States, Philippines, Pakistan, and Taiwan from late 2024 to early 2025.

This activity, like in the case of those targeting Tibet, utilizes weaponized archives originating from spear-phishing emails to target government, military, and diplomatic entities.

The digital missives contain links to Google Drive URLs that download the booby-trapped ZIP or RAR archives upon clicking, ultimately resulting in the deployment of TONESHELL in 2024 and PUBLOAD starting this year via Claimloader.

TONESHELL, another oft-used Mustang Panda malware, functions similarly to Pubshell in that it’s also used to create a reverse shell and execute commands on the compromised host.

“The Pubshell implementation of the reverse shell via anonymous pipes is almost identical to TONESHELL,” the researchers said. “However, instead of running a new thread to immediately return any results, Pubshell requires an additional command to return command results. It also only supports running ‘cmd.exe’ as a shell.”

“In several ways, Pubload and Pubshell appear to be an independently developed ‘lite version’ of TONESHELL, with less sophistication and clear code overlaps.”

The attacks targeted Taiwan have been characterized by the use of a USB worm called HIUPAN (aka MISTCLOAK or U2DiskWatch), which is then leveraged to spread Claimloader and PUBLOAD through USB devices.

“Hive0154 remains a highly capable threat actor with multiple active sub-clusters and frequent development cycles,” the researchers said.

“China-aligned groups like Hive0154 will continue to refine their large malware arsenal and retain a focus on East Asia-based organizations in the private and public sectors. Their wide array of tooling, frequent development cycles, and USB worm-based malware distribution highlights them as a sophisticated threat actor.”