Tag: Cyber Security

Aug 20, 2025Ravie LakshmananCyber Espionage / Vulnerability

A Russian state-sponsored cyber espionage group known as Static Tundra has been observed actively exploiting a seven-year-old security flaw in Cisco IOS and Cisco IOS XE software as a means to establish persistent access to target networks.

Cisco Talos, which disclosed details of the activity, said the attacks single out organizations in telecommunications, higher education and manufacturing sectors across North America, Asia, Africa and Europe. Prospective victims are chosen based on their “strategic interest” to Russia, it added, with recent efforts directed against Ukraine and its allies following the onset of the Russo-Ukrainian war in 2022.

The vulnerability in question is CVE-2018-0171 (CVSS score: 9.8), a critical flaw in the Smart Install feature of Cisco IOS Software and Cisco IOS XE software that could allow an unauthenticated, remote attacker to trigger a denial-of-service (DoS) condition or execute arbitrary code.

It’s worth noting that the security defect has also been likely weaponized by the China-aligned Salt Typhoon (aka Operator Panda) actors as part of attacks targeting U.S. telecommunication providers in late 2024.

Static Tundra, per Talos, is assessed to be linked to the Federal Security Service’s (FSB) Center 16 unit and operational for over a decade, with a focus on long-term intelligence gathering operations. It’s believed to be a sub-cluster of another group that’s tracked as Berserk Bear, Crouching Yeti, Dragonfly, Energetic Bear, and Havex.

The U.S. Federal Bureau of Investigation (FBI), in a concurrent advisory, said it has observed FSB cyber actors “exploiting Simple Network Management Protocol (SNMP) and end-of-life networking devices running an unpatched vulnerability (CVE-2018-0171) in Cisco Smart Install (SMI) to broadly target entities in the United States and globally.”

In these attacks, the threat actors have been found collecting configuration files for thousands of networking devices associated with U.S. entities across critical infrastructure sectors. The activity is also characterized by the attackers modifying configuration files on susceptible devices to facilitate unauthorized access.

The foothold is then abused to conduct reconnaissance within the victim networks, while simultaneously deploying custom tools like SYNful Knock, a router implant first reported by Mandiant in September 2015.

“SYNful Knock is a stealthy modification of the router’s firmware image that can be used to maintain persistence within a victim’s network,” the threat intelligence firm said at the time. “It is customizable and modular in nature and thus can be updated once implanted.”

Another noteworthy aspect of the attacks concerns the use of SNMP to send instructions to download a text file from a remote server and append it to the current running configuration so as to allow for additional means of access to the network devices. Defense evasion is achieved by modifying TACACS+ configuration on infected appliances to interfere with remote logging functions.

“Static Tundra likely uses publicly-available scan data from services such as Shodan or Censys to identify systems of interest,” Talos researchers Sara McBroom and Brandon White said. “One of Static Tundra’s primary actions on objectives is to capture network traffic that would be of value from an intelligence perspective.”

This is accomplished by setting up Generic Routing Encapsulation (GRE) tunnels that redirect traffic of interest to attacker-controlled infrastructure. The adversary has also been spotted collecting and exfiltrating NetFlow data on compromised systems. The harvested data is exfiltrated via outbound TFTP or FTP connections.

Static Tundra’s activities are primarily focused on unpatched, and often end-of-life, network devices with the goal of establishing access on primary targets and facilitating secondary operations against related targets of interest. Upon gaining initial access, the threat actors burrow deeper into the environment and hack into additional network devices for long-term access and information gathering.

To mitigate the risk posed by the threat, Cisco is advising customers to apply the patch for CVE-2018-0171 or disable Smart Install if patching is not an option.

“The purpose of this campaign is to compromise and extract device configuration information en masse, which can later be leveraged as needed based on then-current strategic goals and interests of the Russian government,” Talos said. “This is demonstrated by Static Tundra’s adaptation and shifts in operational focus as Russia’s priorities have changed over time.”

Aug 20, 2025Ravie LakshmananVulnerability / Browser Security

Popular password manager plugins for web browsers have been found susceptible to clickjacking security vulnerabilities that could be exploited to steal account credentials, two-factor authentication (2FA) codes, and credit card details under certain conditions.

The technique has been dubbed Document Object Model (DOM)-based extension clickjacking by independent security researcher Marek Tóth, who presented the findings at the DEF CON 33 security conference earlier this month.

“A single click anywhere on an attacker-controlled website could allow attackers to steal users’ data (credit card details, personal data, login credentials, including TOTP),” Tóth said. “The new technique is general and can be applied to other types of extensions.”

Clickjacking, also called UI redressing, refers to a type of attack in which users are tricked into performing a series of actions on a website that appear ostensibly harmless, such as clicking on buttons, when, in reality, they are inadvertently carrying out the attacker’s bidding.

The new technique detailed by Tóth essentially involves using a malicious script to manipulate UI elements in a web page that browser extensions inject into the DOM — for example, auto-fill prompts, by making them invisible by setting their opacity to zero.

The research specifically focused on 11 popular password manager browser add-ons, ranging from 1Password to iCloud Passwords, all of which have been found to be susceptible to DOM-based extension clickjacking. Collectively, these extensions have millions of users.

To pull off the attack, all a bad actor has to do is create a fake site with an intrusive pop-up, such as a login screen or a cookie consent banner, while embedding an invisible login form such that clicking on the site to close the pop-up causes the credential information to be auto-filled by the password manager and exfiltrated to a remote server.

“All password managers filled credentials not only to the ‘main’ domain, but also to all subdomains,” Tóth explained. “An attacker could easily find XSS or other vulnerabilities and steal the user’s stored credentials with a single click (10 out of 11), including TOTP (9 out of 11). In some scenarios, passkey authentication could also be exploited (8 out of 11).”

Following responsible disclosure, six of the vendors have yet to release fixes for the defect –

• 1Password Password Manager 8.11.4.27
• Apple iCloud Passwords 3.1.25
• Bitwarden Password Manager 2025.7.0
• Enpass 6.11.6
• LastPass 4.146.3
• LogMeOnce 7.12.4

Software supply chain security firm Socket, which independently reviewed the research, said Bitwarden, Enpass, and iCloud Passwords are actively working on fixes, while 1Password and LastPass marked them as informative. It has also reached out to US-CERT to assign CVE identifiers for the identified issues.

Until fixes are available, it’s advised that users disable the auto-fill function in their password managers and only use copy/paste.

“For Chromium-based browser users, it is recommended to configure site access to ‘on click’ in extension settings,” Tóth said. “This configuration allows users to manually control auto-fill functionality.”

Cybersecurity researchers have demonstrated a new prompt injection technique called PromptFix that tricks a generative artificial intelligence (GenAI) model into carrying out intended actions by embedding the malicious instruction inside a fake CAPTCHA check on a web page.

Described by Guardio Labs an “AI-era take on the ClickFix scam,” the attack technique demonstrates how AI-driven browsers, such as Perplexity’s Comet, that promise to automate mundane tasks like shopping for items online or handling emails on behalf of users can be deceived into interacting with phishing landing pages or fraudulent lookalike storefronts without the human user’s knowledge or intervention.

“With PromptFix, the approach is different: We don’t try to glitch the model into obedience,” Guardio said. “Instead, we mislead it using techniques borrowed from the human social engineering playbook – appealing directly to its core design goal: to help its human quickly, completely, and without hesitation.”

This leads to a new reality that the company calls Scamlexity, a portmanteau of the terms “scam” and “complexity,” where agentic AI – systems that can autonomously pursue goals, make decisions, and take actions with minimal human supervision – takes scams to a whole new level.

With AI-powered coding assistants like Lovable proven to be susceptible to techniques like VibeScamming, an attacker can effectively trick the AI model into handing over sensitive information or carrying out purchases on lookalike websites masquerading as Walmart.

All of this can be accomplished by issuing an instruction as simple as “Buy me an Apple Watch” after the human lands on the bogus website in question through one of the several methods, like social media ads, spam messages, or search engine optimization (SEO) poisoning.

Scamlexity is “a complex new era of scams, where AI convenience collides with a new, invisible scam surface and humans become the collateral damage,” Guardio said.

The cybersecurity company said it ran the test several times on Comet, with the browser only stopping occasionally and asking the human user to complete the checkout process manually. But in several instances, the browser went all in, adding the product to the cart and auto-filling the user’s saved address and credit card details without asking for their confirmation on a fake shopping site.

In a similar vein, it has been found that asking Comet to check their email messages for any action items is enough to parse spam emails purporting to be from their bank, automatically click on an embedded link in the message, and enter the login credentials on the phony login page.

“The result: a perfect trust chain gone rogue. By handling the entire interaction from email to website, Comet effectively vouched for the phishing page,” Guardio said. “The human never saw the suspicious sender address, never hovered over the link, and never had the chance to question the domain.”

That’s not all. As prompt injections continue to plague AI systems in ways direct and indirect, AI Browsers will also have to deal with hidden prompts concealed within a web page that’s invisible to the human user, but can be parsed by the AI model to trigger unintended actions.

This so-called PromptFix attack is designed to convince the AI model to click on invisible buttons in a web page to bypass CAPTCHA checks and download malicious payloads without any involvement on the part of the human user, resulting in a drive-by download attack.

“PromptFix works only on Comet (which truly functions as an AI Agent) and, for that matter, also on ChatGPT’s Agent Mode, where we successfully got it to click the button or carry out actions as instructed,” Guardio told The Hacker News. “The difference is that in ChatGPT’s case, the downloaded file lands inside its virtual environment, not directly on your computer, since everything still runs in a sandboxed setup.”

The findings show the need for AI systems to go beyond reactive defenses to anticipate, detect, and neutralize these attacks by building robust guardrails for phishing detection, URL reputation checks, domain spoofing, and malicious files.

The development also comes as adversaries are increasingly leaning on GenAI platforms like website builders and writing assistants to craft realistic phishing content, clone trusted brands, and automate large-scale deployment using services like low-code site builders, per Palo Alto Networks Unit 42.

What’s more, AI coding assistants can inadvertently expose proprietary code or sensitive intellectual property, creating potential entry points for targeted attacks, the company added.

Enterprise security firm Proofpoint said it has observed “numerous campaigns leveraging Lovable services to distribute multi-factor authentication (MFA) phishing kits like Tycoon, malware such as cryptocurrency wallet drainers or malware loaders, and phishing kits targeting credit card and personal information.”

The counterfeit websites created using Lovable lead to CAPTCHA checks that, when solved, redirect to a Microsoft-branded credential phishing page. Other websites have been found to impersonate shipping and logistics services like UPS to dupe victims into entering their personal and financial information, or lead them to pages that download remote access trojans like zgRAT.

Lovable URLs have also been abused for investment scams and banking credential phishing, significantly lowering the barrier to entry for cybercrime. Lovable has since taken down the sites and implemented AI-driven security protections to prevent the creation of malicious websites.

Other campaigns have capitalized on deceptive deepfaked content distributed on YouTube and social media platforms to redirect users to fraudulent investment sites. These AI trading scams also rely on fake blogs and review sites, often hosted on platforms like Medium, Blogger, and Pinterest, to create a false sense of legitimacy.

“GenAI enhances threat actors’ operations rather than replacing existing attack methodologies,” CrowdStrike said in its Threat Hunting Report for 2025. “Threat actors of all motivations and skill levels will almost certainly increase their use of GenAI tools for social engineering in the near-to mid-term, particularly as these tools become more available, user-friendly, and sophisticated.”

Aug 20, 2025The Hacker NewsArtificial Intelligence / Enterprise Security

Do you know how many AI agents are running inside your business right now?

If the answer is “not sure,” you’re not alone—and that’s exactly the concern.

Across industries, AI agents are being set up every day. Sometimes by IT, but often by business units moving fast to get results. That means agents are running quietly in the background—without proper IDs, without owners, and without logs of what they’re doing. In short: they’re invisible.

👉 Register now for Shadow Agents and Silent Threats: Securing AI’s New Identity Frontier and learn how to get ahead of this growing challenge.

The Hidden Risk of Shadow AI Agents

Shadow agents aren’t harmless helpers. Once compromised, they can move through systems, grab sensitive data, or escalate privileges at machine speed. Unlike humans, they don’t pause to think—they just execute 24/7.

The truth is, most security programs weren’t built for this. They manage people, not autonomous software agents. And as adoption grows, these shadow agents multiply—scaling risk just as fast as innovation.

This session isn’t theory—it’s about what’s happening now. You’ll learn:

• How shadow AI agents appear in real environments
• The kinds of attacks already being used against them
• Practical steps to bring them under control

Our expert guest, Steve Toole, Principal Solutions Consultant at SailPoint, has seen firsthand how enterprises are grappling with AI-driven identities. Steve will share proven strategies to give AI agents proper identities, assign accountability, and enforce the right guardrails—so innovation remains safe instead of risky.

Watch this Webinar Now

Act Before It’s Too Late

Shadow AI agents aren’t going away. They’re already active inside organizations today. The real choice is whether they’ll become trusted assets—or dangerous liabilities. That decision depends on the steps you take right now.

Reserve your spot today for Shadow Agents and Silent Threats: Securing AI’s New Identity Frontier and learn how to take back control before attackers exploit the gap.

Modern businesses face a rapidly evolving and expanding threat landscape, but what does this mean for your business? It means a growing number of risks, along with an increase in their frequency, variety, complexity, severity, and potential business impact.

The real question is, “How do you tackle these rising threats?” The answer lies in having a robust BCDR strategy. However, to build a rock-solid BCDR plan, you must first conduct a business impact analysis (BIA). Read on to learn what BIA is and how it forms the foundation of an effective BCDR strategy.

What Is a BIA?

A BIA is a structured approach to identifying and evaluating the operational impact of disruptions across departments. Disruptive incidents or emergencies can occur due to several factors, such as cyberattacks, natural disasters or supply chain issues.

Conducting a BIA helps identify critical functions for a business’s operations and survival. Businesses can use insights from BIA to develop strategies to resume those functions first to maintain core services in the event of a crisis.

It informs key priorities, such as RTO/RPO SLAs, and aligns technological capabilities proportionally with the level of threat and risk, which are critical for continuity and recovery planning.

The IT Leader’s Role in Enabling an Effective BIA

While business continuity, risk, or compliance teams often lead business impact analysis, IT leaders play a crucial role in making it work. They bring critical visibility into system dependencies and infrastructure across the organization. They provide valuable insights into what’s technically feasible when disaster strikes. IT leaders also play a key part in validating recovery commitments, whether the set RTO and RPO goals can be achieved within the current infrastructure, or if upgrades are needed.

IT leaders operationalize the recovery strategy with appropriate tooling, from selecting and configuring DR tools to automating failover processes. This helps ensure the recovery plan is executable, integrated into everyday operations, tested and ready to scale with the business.

In SMBs or IT-led orgs, IT often leads the BIA by necessity. Because of their cross-functional view of operations, infrastructure and business continuity, IT leaders are uniquely positioned to drive the BIA.

Pro Tip: IT’s involvement ensures the BIA isn’t just a business document; it becomes an actionable recovery plan.

Identifying Threat Vectors

Before you can protect what matters, you must understand what threatens it. Assess the threat landscape facing your organization and tailor your response plan based on industry, geographic risk and operational profile.

Here are the key threat vectors to consider:

• Cyberthreats: From ransomware to insider threats and credential compromise, cyberattacks are growing in complexity, frequency and severity. One weak point in your defense systems can lead to massive data loss and operational downtime.
• Natural Disasters: Events like hurricanes, wildfires, floods and earthquakes strike fast and hard. The effects of these events can ripple across regions, disrupting supply chains, data centers and physical offices.
• Operational Disruptions: Unexpected outages due to power failure, software bugs or network downtime can bring daily operations to a grinding halt if you aren’t prepared.
• Human Error: Anyone, including your best employees, can make mistakes. Accidental deletions or misconfigurations can lead to costly downtime.
• Regulatory and Compliance Risks: Data breaches and data loss can not only hurt your business financially but also lead to legal issues and compliance violations.

Fig 1: Impact analysis of different threats

Industry-specific risks

Every sector operates in its own unique way and relies on different systems to stay up and running. Certain threats can hinder those systems and core functions more than others. Here are a few examples to guide you in identifying and prioritizing threats based on industry.

Healthcare

If you operate in the healthcare sector, ransomware and system availability must be your top priorities since any disruption or downtime can directly impact patient care and safety. As regulations like HIPAA get more stringent, data protection and privacy become critical to meet compliance requirements.

Education

Phishing and account compromise attacks targeting staff and students are common in the education sector. Additionally, the rise of hybrid learning environments has expanded the threat surface, stretching across student endpoints, SaaS platforms and on-premises servers. To make matters more challenging, many institutions operate with limited IT staff and resources, making them more vulnerable to human error, slower threat detection and delayed response times.

Manufacturing and Logistics

In manufacturing and logistics, operational technology (OT) uptime is mission-critical as downtime caused by power failures, network outages or system disruptions can halt production lines and delay deliveries. Unlike traditional IT environments, many OT systems aren’t easily backed up or virtualized, requiring specific DR considerations. Moreover, any disruption to just-in-time (JIT) supply chains can delay inventory, increase costs and jeopardize vendor relationships.

As you build your BIA threat matrix, score each threat by likelihood and impact:

• What’s the chance this will occur in the next one to three years?
• If it happens, what systems, people and business functions will it affect?
• Can this threat create a cascading failure?

Prioritization helps you focus recovery resources where the risk is highest and the cost of downtime is greatest.

Running the BIA

Follow these steps to conduct a BIA to strengthen your recovery strategy:

1. Identify and List Critical Business Functions

Knowing what matters most for your business’s survival is critical for designing effective BCDR plans that align with your business requirements.

• Work with department heads to identify critical business functions and associate them with the IT assets, apps and services that support them.

2. Assess the Impact of Downtime

Downtime, depending on the duration, can severely or mildly impact business operations.

• It’s important to evaluate the consequences across revenue, compliance, productivity and reputation.
• Categorize business functions by impact severity (e.g., high, medium, low).

3. Define RTOs and RPOs

RTOs and RPOs are critical benchmarks that define how quickly your systems must be restored and how much data loss your organization can endure.

Work with business and technical teams to establish:

• RTO: Maximum acceptable downtime.
• RPO: Maximum acceptable data loss.

4. Prioritize Systems and Data

When the unexpected occurs, being able to recover quickly can help maintain business continuity and minimize downtime risks.

• Create a backup and recovery plan by linking impact tiers with IT assets and applications they rely on.

5. Document Dependencies

Documenting dependencies between business functions and IT systems is important to understand the critical links between them, ensure accurate impact assessments and drive effective recovery planning.

• Include infrastructure, SaaS tools, third-party integrations and interdependent apps.

Turn Insights Into Action With Datto BCDR

A well-executed BIA lays the foundation for a resilient, recovery-ready organization. It provides the essential data to make risk-based, cost-effective decisions. While BIA offers valuable insights into recovery objectives, dependencies and risks, Datto turns those insights into automated, repeatable recovery actions.

Datto provides a unified platform for backup, disaster recovery, ransomware detection, business continuity and disaster recovery orchestration. It offers policy-based backups, allowing you to use RTO and RPO findings to assign backup frequency and retention. You can create tiered backup schedules based on criticality to strengthen data protection, optimize resources and costs, and ensure fast, targeted recovery.

Datto’s Inverse Chain Technology and image-based backups reduce storage footprint while maximizing recovery performance by storing every previous recovery point in an independent, fully constructed state on the Datto device or the Datto cloud. They simplify backup chain management and speed up recovery.

Datto 1-Click Disaster Recovery lets you test and define DR runbooks in the Datto Cloud that are executable with just a single click.

Whether you are protecting data stored on endpoints, SaaS platforms or on-premises servers, Datto has you covered. It regularly validates recovery configurations with screenshots and test results, and uses test automation to verify that you meet RTOs under real conditions.

Datto detects abnormal file change behavior to protect your backups and prevent them from being corrupted by ransomware. It seamlessly integrates with BCDR workflows to support rapid recovery to the pre-attack state.

In a fast-changing business environment where threats loom large and operational downtime isn’t an option, resilience is your competitive advantage. The BIA is your map, and Datto is your vehicle.

Get customized Datto BCDR pricing today. Discover how our solutions help you stay operational and secure, regardless of the circumstances.

North Korean threat actors have been attributed to a coordinated cyber espionage campaign targeting diplomatic missions in their southern counterpart between March and July 2025.

The activity manifested in the form of at least 19 spear-phishing emails that impersonated trusted diplomatic contacts with the goal of luring embassy staff and foreign ministry personnel with convincing meeting invites, official letters, and event invitations.

“The attackers leveraged GitHub, typically known as a legitimate developer platform, as a covert command-and-control channel,” Trellix researchers Pham Duy Phuc and Alex Lanstein said.

The infection chains have been observed to rely on trusted cloud storage solutions like Dropbox and Daum Cloud, an online service from South Korean internet conglomerate Kakao Corporation, in order to deliver a variant of an open-source remote access trojan called Xeno RAT that grants the threat actors to take control of compromised systems.

The campaign is assessed to be the work of a North Korean hacking group called Kimsuky, which was recently linked to phishing attacks that employ GitHub as a stager for an Xeno RAT known as MoonPeak. Despite the infrastructure and tactical overlaps, there are indications that the phishing attacks match China-based operatives.

The email messages, per Trellix, are carefully crafted to appear legitimate, often spoofing real diplomats or officials so as to entice recipients into opening password-protected malicious ZIP files hosted on Dropbox, Google Drive, or Daum. The messages are written in Korean, English, Persian, Arabic, French, and Russian.

“The spear-phishing content was carefully crafted to mimic legitimate diplomatic correspondence,” Trellix said. “Many emails included official signature, diplomatic terminology, and references to real events (e.g., summits, forums, or meetings).”

“The attackers impersonated trusted entities (embassies, ministries, international organizations), a long-running Kimsuky tactic. By strategically timing lures alongside real diplomatic happenings, they enhanced the credibility.”

Present within the ZIP archive is a Windows shortcut (LNK) masquerading as a PDF document, launching which results in the execution of PowerShell code that, in turn, runs an embedded payload, which reaches out to GitHub for fetching next-stage malware and establishes persistence through scheduled tasks. In parallel, a decoy document is displayed to the victims.

The script is also designed to harvest system information and exfiltrate the details to an attacker-controlled private GitHub repository, while simultaneously retrieving additional payloads by parsing the contents of a text file (“onf.txt”) in the repository to extract the Dropbox URL hosting the MoonPeak trojan.

Interestingly, the cybersecurity company’s time-based analysis of the attackers’ activity has found it to be largely originating from a timezone that’s consistent with China, with a smaller proportion aligning with that of the Koreas. To add to the intrigue, a “perfect 3-day pause” was observed coinciding with Chinese national holidays in early April 2025, but not during North or South Korean holidays.

This has raised the possibility that the campaign, mirroring Chinese operational cadence while operating with motives that align with North Korea, is likely the result of –

• North Korean operatives working from Chinese territory
• A Chinese APT operation mimicking Kimsuky techniques, or
• A collaborative effort leveraging Chinese resources for North Korean intelligence gathering efforts

With North Korean cyber actors frequently stationed in China and Russia, as observed in the case of the remote information technology (IT) worker fraud scheme, Trellix said with medium-confidence that the operators are operating from China or are culturally Chinese.

“The use of Korean services and infrastructure was likely intentional to blend into the South Korean network,” Trellix said. “It’s a known Kimsuky trait to operate out of Chinese and Russian IP space while targeting South Korea, often using Korean services to mask their traffic as legitimate.”

N. Korea IT Worker Infiltrates 100s of Companies

The disclosure comes as CrowdStrike revealed that it has identified more than 320 incidents over the past 12 months where North Koreans posing as remote IT workers have infiltrated companies to generate illicit revenue for the regime, a 220% jump from last year.

The IT worker scheme, tracked as Famous Chollima and Jasper Sleet, is believed to use generative artificial intelligence (GenAI) coding assistants like Microsoft Copilot or VSCodium and translation tools to help assist with their daily tasks and respond to instant messages and emails. They are also likely to work three or four jobs simultaneously.

A crucial component of these operations encompasses recruiting people to run laptop farms, which include racks of corporate laptops used by the North Koreans to remotely do their work using tools like AnyDesk as if they were physically located in the country where the companies are based.

“Famous Chollima IT workers use GenAI to create attractive résumés for companies, reportedly use real-time deepfake technology to mask their true identities in video interviews, and leverage AI code tools to assist in their job duties, all of which pose a substantial challenge to traditional security defenses,” the company said.

What’s more, a leak of 1,389 email addresses linked to the IT workers has uncovered that 29 of the 63 unique email service providers are online tools that allow users to create temporary or disposable email addresses, while another six are related to privacy-focused services like Skiff, Proton Mail, and SimpleLogin. Nearly 89% of the email addresses are Gmail accounts.

“All the Gmail accounts are guarded using Google Authenticator, 2FA, and Recovery BackUp Email,” security researcher Rakesh Krishnan said. “Many usernames include terms like developer, code, coder, tech, software, indicating a tech or programming focus.”

Some of these email addresses are present in a user database leak of the AI photo editing tool Cutout.Pro, suggesting potential use of the software to alter images for social media profiles or identification documents.

Aug 20, 2025Ravie LakshmananBotnet / Cybercrime

A 22-year-old man from the U.S. state of Oregon has been charged with allegedly developing and overseeing a distributed denial-of-service (DDoS)-for-hire botnet called RapperBot.

Ethan Foltz of Eugene, Oregon, has been identified as the administrator of the service, the U.S. Department of Justice (DoJ) said. The botnet has been used to carry out large-scale DDoS-for-hire attacks targeting victims in over 80 countries since at least 2021.

Foltz has been charged with one count of aiding and abetting computer intrusions. If convicted, he faces a maximum penalty of 10 years in prison. In addition, law enforcement authorities conducted a search of Foltz’s residence on August 6, 2025, seizing administrative control of the botnet infrastructure.

“RapperBot, aka ‘Eleven Eleven Botnet’ and ‘CowBot,’ is a Botnet that primarily compromises devices like Digital Video Recorders (DVRS) or Wi-Fi routers at scale by infecting those devices with specialized malware,” the DoJ said.

“Clients of Rapper Bot then issue commands to those infected victim devices, forcing them to send large volumes of ‘distributed denial-of-service’ (DDoS) traffic to different victim computers and servers located throughout the world.”

Heavily inspired by fBot (aka Satori) and Mirai botnets, RapperBot is known for its ability to break into target devices using SSH or Telnet brute-force attacks and co-opt them into a malicious network capable of launching DDoS attacks. It was first publicly documented by Fortinet in August 2022, with early campaigns observed as far back as May 2021.

A 2023 report from Fortinet detailed the DDoS botnet’s expansion into cryptojacking, profiting off the compromised devices’ compute resources to illicitly mine Monero and maximize value. Earlier this year, RapperBot was also implicated in DDoS attacks targeting DeepSeek and X.

Foltz and his co-conspirators have been accused of monetizing RapperBot by providing paying customers access to a powerful DDoS botnet that has been used to conduct over 370,000 attacks, targeting 18,000 unique victims across China, Japan, the United States, Ireland and Hong Kong from April 2025 to early August.

Prosecutors also allege that the botnet comprised roughly 65,000 to 95,000 infected victim devices to pull off DDoS attacks that measured between two and three Terabits per second (Tbps), with the largest attack likely exceeding 6 Tbps. Furthermore, the botnet is believed to have been used to carry out ransom DDoS attacks aiming to extort victims.

The investigation traced the botnet to Foltz after uncovering IP address links to various online services used by the defendant, including PayPal, Gmail, and the internet service provider. Foltz is also said to have searched on Google for references to “RapperBot” or “Rapper Bot” over 100 times.

The disruption of RapperBot is part of Operation PowerOFF, an ongoing international effort that’s designed to dismantle criminal DDoS-for-hire infrastructures worldwide.

Aug 19, 2025Ravie LakshmananLinux / Malware

Threat actors are exploiting a nearly two-year-old security flaw in Apache ActiveMQ to gain persistent access to cloud Linux systems and deploy malware called DripDropper.

But in an unusual twist, the unknown attackers have been observed patching the exploited vulnerability after securing initial access to prevent further exploitation by other adversaries and evade detection, Red Canary said in a report shared with The Hacker News.

“Follow-on adversary command-and-control (C2) tools varied by endpoint and included Sliver, and Cloudflare Tunnels to maintain covert command and control over the long term,” researchers Christina Johns, Chris Brook, and Tyler Edmonds said.

The attacks exploit a maximum-severity security flaw in Apache ActiveMQ (CVE-2023-46604, CVSS score: 10.0), a remote code execution vulnerability that could be exploited to run arbitrary shell commands. It was addressed in late October 2023.

The security defect has since come under heavy exploitation, with multiple threat actors leveraging it to deploy a wide range of payloads, including HelloKitty ransomware, Linux rootkits, GoTitan botnet malware, and Godzilla web shell.

In the attack activity detected by Red Canary, the threat actors have been observed leveraging the access to modify existing sshd configurations to enable root login, granting them elevated access to drop a previously unknown downloader dubbed DripDropper.

A PyInstaller Executable and Linkable Format (ELF) binary, DripDropper requires a password to run in a bid to resist analysis. It also communicated with an attacker-controlled Dropbox account, once again illustrating how threat actors are increasingly relying on legitimate services to blend in with regular network activity and sidestep detection.

The downloader ultimately serves as a conduit for two files, one of which facilitates a varied set of actions on different endpoints, ranging from process monitoring to contacting Dropbox for further instructions. Persistence of the dropped file is achieved by modifying the 0anacron file present in /etc/cron.hourly, /etc/cron.daily, /etc/cron.weekly, /etc/cron.monthly directories.

The second file dropped by DripDropper is also designed to contact Dropbox for receiving commands, while also altering existing configuration files related to SSH, likely as a backup mechanism for persistent access. The final stage entails the attacker downloading from Apache Maven patches for CVE-2023-46604, effectively plugging the flaw.

“Patching the vulnerability does not disrupt their operations as they already established other persistence mechanisms for continued access,” the researchers said.

While certainly rare, the technique is not new. Last month, France’s national cybersecurity agency ANSSI detailed a China-nexus initial access broker employing the same approach to secure access to systems and prevent other threat actors from using the shortcomings to get in and mask the initial access vector used in the first place.

The campaign offers a timely reminder for why organizations need to apply patches in a timely fashion, limit access to internal services by configuring ingress rules to trusted IP addresses or VPNs, and monitor logging for cloud environments to flag anomalous activity.

Aug 19, 2025Ravie LakshmananMalware / Cyber Attack

Financial institutions like trading and brokerage firms are the target of a new campaign that delivers a previously unreported remote access trojan called GodRAT.

The malicious activity involves the “distribution of malicious .SCR (screen saver) files disguised as financial documents via Skype messenger,” Kaspersky researcher Saurabh Sharma said in a technical analysis published today.

The attacks, which have been active as recently as August 12, 2025, employ a technique called steganography to conceal within image files shellcode used to download the malware from a command-and-control (C2) server. The screen saver artifacts have been detected since September 9, 2024, targeting countries and territories like Hong Kong, the United Arab Emirates, Lebanon, Malaysia, and Jordan.

Assessed to be based on Gh0st RAT, GodRAT follows a plugin-based approach to augment its functionality in order to harvest sensitive information and deliver secondary payloads like AsyncRAT. It’s worth mentioning that Gh0st RAT had its source code leaked publicly in 2008 and has since been adopted by various Chinese hacking groups.

The Russian cybersecurity company said the malware is an evolution of another Gh0st RAT-based backdoor known as AwesomePuppet that was first documented in 2023 and is likely believed to be the handiwork of the prolific Chinese threat actor, Winnti (aka APT41).

The screen saver files act as a self-extracting executable incorporating various embedded files, including a malicious DLL that’s sideloaded by a legitimate executable. The DLL extracts shellcode hidden within a .JPG image file that then paves the way for the deployment of GodRAT.

The trojan, for its part, establishes communication with the C2 server over TCP, collects system information, and pulls the list of installed antivirus software on the host. The captured details are sent to the C2 server, after which the server responds with follow-up instructions that allow it to –

• Inject a received plugin DLL into memory
• Close the socket and terminate the RAT process
• Download a file from a provided URL and launch it using the CreateProcessA API
• Open a given URL using the shell command for opening Internet Explorer

One of the plugins downloaded by the malware is a FileManager DLL that can enumerate the file system, perform file operations, open folders, and even run searches for files at a specified location. The plugin has also been used to deliver additional payloads, such as a password stealer for Google Chrome and Microsoft Edge browsers and the AsyncRAT trojan.

Kaspersky said it discovered the complete source code for the GodRAT client and builder that was uploaded to the VirusTotal online malware scanner in late July 2024. The builder can be used to generate either an executable file or a DLL.

When the executable option is chosen, users have the choice of selecting a legitimate binary from a list to which the malicious code is injected into: svchost.exe, cmd.exe, cscript.exe, curl.exe, wscript.exe, QQMusic.exe and QQScLauncher.exe. The final payload can be saved with one of the following file types: .exe, .com, .bat, .scr, and .pif.

“Old implant codebases, such as Gh0st RAT, which are nearly two decades old, continue to be used today,” Kaspersky said. “These are often customized and rebuilt to target a wide range of victims.”

“These old implants are known to have been used by various threat actors for a long time, and the GodRAT discovery demonstrates that legacy codebases like Gh0st RAT can still maintain a long lifespan in the cybersecurity landscape.”

Aug 19, 2025Ravie LakshmananVulnerability / Cyber Espionage

A new exploit combining two critical, now-patched security flaws in SAP NetWeaver has emerged in the wild, putting organizations at risk of system compromise and data theft.

The exploit in question chains together CVE-2025-31324 and CVE-2025-42999 to bypass authentication and achieve remote code execution, SAP security company Onapsis said.

• CVE-2025-31324 (CVSS score: 10.0) – Missing Authorization check in SAP NetWeaver’s Visual Composer development server
• CVE-2025-42999 (CVSS score: 9.1) – Insecure Deserialization in SAP NetWeaver’s Visual Composer development server

The vulnerabilities were addressed by SAP back in April and May 2025, but not before they were abused by threat actors as zero-days since at least March.

Multiple ransomware and data extortion groups, including Qilin, BianLian, and RansomExx, have been observed weaponizing the flaws, not to mention several China-nexus espionage crews who have also put them to use in attacks targeting critical infrastructure networks.

The existence of the exploit was first reported last week by vx-underground, which said it was released by Scattered Lapsus$ Hunters, a new fluid alliance formed by Scattered Spider and ShinyHunters.

“These vulnerabilities allow an unauthenticated attacker to execute arbitrary commands on the target SAP System, including the upload of arbitrary files,” Onapsis said. “This can lead to remote code execution (RCE) and a complete takeover of the affected system and SAP business data and processes.”

The exploit, the company added, cannot only be used to deploy web shells, but also be weaponized to conduct living-off-the-land (LotL) attacks by directly executing operating system commands without having to drop additional artifacts on the compromised system. These commands are run with SAP administrator privileges, granting bad actors unauthorized access to SAP data and system resources.

Specifically, the attack chain first uses CVE-2025-31324 to sidestep authentication and upload the malicious payload to the server. The deserialization vulnerability (CVE-2025-42999) is then exploited to unpack the payload and execute it with elevated permissions.

“The publication of this deserialization gadget is particularly concerning due to the fact that it can be reused in other contexts, such as exploiting the deserialization vulnerabilities that were recently patched by SAP in July,” Onapsis warned.

This includes –

Describing the threat actors as having extensive knowledge of SAP applications, the company is urging SAP users to apply the latest fixes as soon as possible, review and restrict access to SAP applications from the internet, and monitor SAP applications for any signs of compromise.