kraken

The Kraken cryptocurrency exchange announced that a cybercrime group is trying to extort the company by threatening to release videos showing internal systems that host client data. The company’s Chief Security Officer, Nick Percoco, stated that the incident did not put client funds at risk and involved an insider threat, with two instances of improper access to limited customer data by support employees. Kraken says that it will not pay or negotiate with the threat actor. “We are currently being extorted by a criminal group threatening to release videos of our internal systems with client data shown if we do not comply with their demands,” stated Percoco. “It’s important to start with the most important points: our systems were never breached; funds were never at risk; we will not pay these criminals; we will not ever negotiate with bad actors.” Kraken is a U.S.-based cryptocurrency exchange that enables millions of users across 190 countries to buy, sell, and trade digital assets such as Bitcoin, Ethereum, and 200 others. It is considered one of the largest and most established exchanges, with a daily trading volume of hundreds of millions of U.S. dollars. Following a “tip from a trusted source” in February 2025 about cybercriminals circulating a video demonstrating access to its client support systems, Kraken initiated an investigation and uncovered a support employee recruited by the threat actor. More recently, Kraken received a tip about another, more recent video showing insider access to its systems. In both cases, the company reacted quickly by revoking the employee’s access, launching investigations, and strengthening controls. Where user exposure was identified, Kraken notified affected users directly. According to Percoco, the incident affects only about 2,000 accounts, which represents 0.02% of Kraken’s user base. For this small subset, the exposed information reportedly only concerns client support data. Kraken stated that its investigation has gathered enough evidence to legally prosecute all involved individuals attempting to blackmail them, and the company is closely working with federal law enforcement across multiple jurisdictions towards this goal. Insider threats and malicious recruitment are a broader problem impacting multiple industries, and especially the cryptocurrency sector. In mid-2025, it was revealed that another major American cryptocurrency exchange, Coinbase, suffered a data breach after hackers bribed employees of an India-based customer support agency to disclose to them private client support information. In that case, the incident impacted 70,000 customers, with Coinbase estimating the total financial damages to be $400 million. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Researchers at Google have identified an iOS exploit chain, named DarkSword, that has been used since late last year by multiple actors to infect iPhones with malware in targeted attacks. DarkSword combines six vulnerabilities in iOS and Safari to deploy malware on the device. It demonstrates, once again, how important it is to keep up with updates. The exploit works against iPhones running iOS versions 18.4 through 18.7, and simply visiting a malicious or compromised website with a vulnerable device can be enough to get infected (a drive‑by attack). Update April 2, 2026 The researchers found that several groups are using the tool to attack their preferred targets. DarkSword has been used both by commercial spyware vendors and by state‑backed actors, with campaigns observed in Saudi Arabia, Turkey, Malaysia, and Ukraine. In Saudi Arabia, attackers used a fake Snapchat lookalike. In Ukraine, attackers compromised at least two Ukrainian websites, including a government site. Upon successful exploitation, malware is executed on the device. The type of malware depends on the attacker. In the Ukrainian campaign, that malware is known as Ghostblade, one example of a payload delivered via the DarkSword exploit chain. Ghostblade is a JavaScript‑based data‑stealer that exfiltrates unique device identifiers, SMS and iMessage messages, call history, contacts, Wi‑Fi configuration and passwords, Safari cookies and browsing history, location data, notes, calendar entries, health data, photos, iCloud Drive files, SIM information, emails, a list of installed apps, saved passwords, and the message history from Telegram and WhatsApp. Beyond this, Ghostblade stands out because it also targets cryptocurrency‑related data, actively seeking apps for major exchanges (Coinbase, Binance, Kraken, Kucoin, OKX, Mexc) and wallet apps (Ledger, Trezor, Metamask, Exodus, Uniswap, Phantom, Gnosis Safe). Researchers note that Ghostblade is not built for long‑term surveillance: once it has collected the data, it deletes its temporary files and terminates itself. The risks Vulnerable devices can be infected just by visiting that one malicious or compromised website. And the consequences can be severe. DarkSword turns a single website visit into full device compromise, followed by Ghostblade exfiltrating as much data as it can in one go. Data theft: Ghostblade and related payloads can grab communications (SMS, iMessage, Telegram, WhatsApp, email), photos, health data, location history, Wi‑Fi credentials, keychain items, and more in one sweep. Crypto theft and profiling: The malware enumerates specific exchange and wallet apps, which allows both direct theft and lets criminals use the stolen information to build a detailed profile of financially interesting targets. Forensic evasion: Because Ghostblade wipes its own traces after stealing all that information, it can take a long time before victims figure out something is wrong. Many victims may never know they were compromised. Since the same exploit kit is being reused across commercial surveillance firms and state‑aligned actors, the number of campaigns and victims will increase over time. The solutions Update to the latest iOS available for your device. DarkSword can affect iOS versions 18.4 through 18.7, and Apple’s recent releases include fixes for CVE‑2026‑20700 and related vulnerabilities. If you have reason to believe you’re a potential target for attacks of this nature (journalists, activists, or people that have access to sensitive data) it is advisable to enable Lockdown Mode: Open the Settings app. Tap Privacy & Security. Scroll down, tap Lockdown Mode, then tap Turn On Lockdown Mode. Read the presented information and tap Turn On Lockdown Mode. Tap Turn On & Restart. Enter your device passcode when prompted. Do inform yourself about the consequences of turning on Lockdown Mode. It makes your device a lot less user-friendly, but it has proven effective against highly targeted attacks. Here are some more general tips: Use up-to-date, real-time anti-malware protection for your device to block malicious websites where possible. Avoid following links sent in unsolicited messages, especially for services like Snapchat, crypto exchanges, banking, or email. Use content blockers (for example Malwarebytes Browser Guard) in Safari to reduce exposure to malicious content (though they are not a silver bullet for zero‑days). Move high‑value crypto assets to hardware wallets or dedicated devices, and use mobile wallets only for smaller amounts. Use a password manager with strong authentication, and turn on extra security settings like Face ID/Touch ID and avoid auto‑filling high‑risk credentials. Enable multi-factor authentication (FIDO2 security keys or app‑based 2FA) on exchanges and financial accounts, so stolen passwords alone are not enough to plunder your accounts. Regularly review app permissions and revoke access to sensitive data (Location, Photos, Contacts, Microphone, Camera, Health) revoke where unnecessary. Scammers know more about you than you think. Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in.

Russia-linked hackers use advanced iPhone exploit to target Ukrainians A likely Russia-linked threat actor deployed a sophisticated iPhone hacking tool to target Ukrainian users and steal sensitive data, according to research published on Wednesday. The malware, dubbed DarkSword, allows attackers to break into iPhones with little to no user interaction, extract sensitive data within minutes, and then erase traces of the intrusion, researchers at cybersecurity firm Lookout said. They attributed the activity to a threat actor tracked as UNC6353. Little is known about the group’s infrastructure or broader affiliations, but it has previously targeted victims in Ukraine using the Coruna exploit chain. The DarkSword campaign has been active since at least late 2025 and continued through March, primarily targeting visitors to compromised Ukrainian websites in so-called “watering hole” attacks, where hackers infect sites frequented by their intended victims. Among the affected sites were a regional news outlet covering the war and a local court’s website. Researchers also identified a possible infection at a Ukrainian food processing company in February. Once a victim visits an infected page, the attack is triggered automatically, allowing hackers to gain deep access to the device and retrieve emails, messages, photos, credentials and data from cryptocurrency wallets. Unlike traditional spyware campaigns designed for long-term surveillance, DarkSword appears to operate on a “hit-and-run” model, according to Lookout. It rapidly collects and exfiltrates data, often within minutes, before deleting itself from the device. “This malware is highly sophisticated and appears to be a professionally designed platform,” researchers said, noting that it was built to support modular development and long-term use. The latest UNC6353 campaign combines espionage with financial motives, targeting a wide range of cryptocurrency platforms, including Coinbase, Binance and Kraken, as well as popular wallets such as MetaMask and Ledger. Given the malware’s capabilities, researchers said the hackers may have access to high-end exploit tools typically associated with government clients or commercial surveillance vendors. “The discoveries of DarkSword and previously Coruna suggest a secondary market for advanced exploits,” Lookout said, allowing actors with fewer resources to acquire and deploy sophisticated capabilities. Despite the advanced tooling, the attackers themselves may not be highly sophisticated. Analysts noted limited efforts to conceal parts of the operation and suggested the group may rely on purchased exploits and even artificial intelligence to develop additional malware components. According to a report by Google on Wednesday, DarkSword was deployed by various threat actors to target users in Saudi Arabia, Turkey and Malaysia. Apple patched the vulnerabilities exploited in these attacks in late 2025 after they were disclosed, researchers said. Daryna Antoniuk is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.

A series of big-game hunting incidents and double extortion attacks carried out by Kraken, a Russian-speaking operation that has emerged from the ashes of the HelloKitty cartel, was observed in August 2025 by Cisco Talos and detailed in an advisory published last week. The group has been linked to intrusions where Server Message Block (SMB) flaws were abused for entry, followed by the use of Cloudflare for persistence and SSH Filesystem (SSHFS) for data theft before encryption. Kraken’s toolkit spans Windows, Linux and VMware ESXi, giving it reach across many enterprise environments. A New Ransomware Strain What’s new is Kraken’s unusual benchmarking step, which measures how quickly a victim machine can process encryption before the malware initiates its file-locking routine. This allows the attackers to tailor the encryption method for maximum impact while reducing the chance of triggering system instability or detection. The group also announced a new underground discussion space, The Last Haven Board, on its leak site, in an effort to create a secure hub for cybercrime collaboration. Kraken, active since February 2025, relies on double extortion and appears opportunistic rather than focused on specific sectors. Victims listed on its site include organizations in the US, the UK, Canada, Denmark, Panama and Kuwait. It applies the .zpsc extension, issues a ransom note titled readme_you_ws_hacked.txt and threatens to publish stolen files if contacted through its onion service. External reporting and Talos observations indicate possible overlap with the HelloKitty threat group. Kraken’s leak portal references HelloKitty by name, and both groups use the same ransom note filename. The launch of Last Haven included claimed support from HelloKitty operators and WeaCorp, an exploit-buying outfit, adding weight to the theory that Kraken spun out from the earlier cartel. Kraken Attack Tactics Talos documented one case in which Kraken actors broke in through an exposed SMB service, extracted privileged credentials, then returned via Remote Desktop. Afterward, they installed Cloudflare to maintain access, deployed SSHFS to browse and siphon data, and pushed the encryptor across the network via Remote Desktop Protocol (RDP). They demanded roughly $1m in Bitcoin and pledged decryption and non-disclosure after payment. Key elements of Kraken’s tactics include: Cross-platform encryptors Benchmark-based encryption decisions Multi-threaded modules targeting SQL databases, network shares, local drives and virtual machines Talos attributed this activity to an increasingly organized group attempting to claim the space left vacant by the collapse of the HelloKitty cartel. To defend against threats such as this, organizations should strengthen credential hygiene, limit exposure of remote services, harden backup strategies and adopt continuous monitoring to spot abnormal tunneling or data access activity early.

Betti RHC, la prima graphic novel al mondo dedicata alla cybersecurity awareness, ha finalmente il suo sito ufficiale. Uno spazio tutto suo dove scoprire il progetto, sfogliare le copertine degli episodi e immergersi nel mondo di Betti: la giovane laureanda in informatica che, dopo la morte misteriosa del padre, si trasforma nell'hacker più potente del mondo. Una storia avvincente che, episodio dopo episodio, affronta una minaccia digitale diversa — dal phishing al ransomware, fino al cyberbullismo — e insegna a riconoscerla e a difendersi, senza che sembri mai una lezione. Sul sito trovate tutto ciò che rende Betti un progetto diverso dal solito: la sua filosofia, le anteprime delle tavole e il racconto di come nasce ogni volume. Perché dietro Betti RHC c'è solo lavoro umano: ogni tavola è disegnata interamente a mano dagli artisti del Gruppo Arte di Red Hot Cyber, senza alcun uso di intelligenza artificiale. E a garantire che ogni storia sia realistica e tecnicamente corretta c'è la supervisione degli hacker etici del gruppo HackerHood, che mantengono il racconto fedele al mondo reale della sicurezza informatica. C'è spazio anche per le aziende, che possono usare Betti come strumento di awareness diverso dai soliti corsi: acquistare i volumi, personalizzarli con il proprio brand o sponsorizzare nuovi episodi. E come primo regalo, l'episodio "Byte the Silence", dedicato al cyberbullismo, è scaricabile gratuitamente per uso personale. Perché la miglior difesa, in fondo, è una bella storia. 👉 Scopri tutto su https://betti.redhotcyber.com/

The Kraken ransomware, which targets Windows, Linux/VMware ESXi systems, is testing machines to check how fast it can encrypt data without overloading them. According to Cisco Talos researchers, Kraken's feature is a rare capability that uses temporary files to choose between full and partial data encryption. The Kraken ransomware emerged at the begining of the year as a continuation of the HelloKitty operation, and engages in big-game hunting attacks with data theft for double extortion. On the gang's data leak sites there are listed victims from the United States, the UK, Canada, Panama, Kuwait, and Denmark. Cisco researchers note that various mentions on Kraken’s site, as well as similarities in the ransom note, indicate connections with the now defunct HelloKitty ransomware that gained prominence in 2021 and attempted a rebranding after the leak of its source code. Apart from the ransomware operation, Kraken has also launched a new cybercrime forum named “The Last Haven Board” to facilitate supposedly secure communications and exchanges. Kraken attack chain According to Cisco’s observations, Kraken ransomware attacks typically begin with the exploitation of SMB vulnerabilities on internet-facing assets, providing the threat actors with an initial foothold. Next, the intruder extracts admin account credentials and uses them to re-enter the environment via Remote Desktop Protocol (RDP) and deploy the Cloudflared and SSHFS tools. Cloudflared is used for creating a reverse tunnel from the victim host back to the attacker’s infrastructure, and SSHFS allows exfiltrating data through mounted remote filesystems. Using persistent Cloudflared tunnels and RDP, Kraken operators navigate compromised networks and move laterally to all reachable machines to steal valuable data and lay the ground for the deployment of the ransomware binaries. Setting the encryption mode When the encryption command is issued, Kraken will perform a performance benchmark on each machine, the researchers say. The process includes the creation of a temporary file with random data, encrypting it in a timed operation, calculating the result, and then deleting the file. Based on the result, the encryption decides if the data will be encrypted completely or partially. Cisco Talos notes that assessing the machine's capabilities is likely to move quickly with the final stage of the attack and deal maximum damage without triggering alerts due to intensive resource usage. Before triggering the actual encryption, Kraken deletes shadow volumes and the Recycle Bin and stops backup services running on the system. Cisco explains that the Windows version of Kraken features four encryption modules: SQL database – Identifies Microsoft SQL Server instances through registry keys, locates their database file directories, verifies the paths, and encrypts the SQL data files. Network share – Enumerates accessible network shares via WNet APIs, ignores ADMIN$ and IPC$, and encrypts files on all other reachable shares. Local drive – Scans available drive letters, targets removable, fixed, and remote drives, and encrypts their contents using separate worker threads. Hyper-V – Uses embedded PowerShell commands to list VMs, obtain their virtual disk paths, forcibly stop running VMs, and encrypt the associated VM disk files. The Linux/ESXi version enumerates and forcibly terminates running virtual machines to unlock their disk files, and then performs multi-threaded full or partial encryption using the same benchmarking logic as the Windows version. After finishing the encryption, an auto-generated ‘bye_bye.sh’ script executes to remove all logs, shell history, the Kraken binary, and finally the script itself. Encrypted files are appended with the ‘.zpsc’ file extension, and a ransom note (‘readme_you_ws_hacked.txt’) is dropped on impacted directories. Cisco notes that in one case, it has observed a ransom demand of $1 million to be paid in Bitcoin. The complete indicators of compromise (IoCs) associated with Kraken ransomware attacks are available on this GitHub repository. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

The ToolShell exploit, affecting on-premises Microsoft SharePoint servers, has driven a rise in threat actors exploiting public-facing applications for initial access. In the last quarter, this tactic appeared in over 60% Cisco Talos Incident Response (Talos IR) engagements, an increase from 10% in the previous quarter. Almost 40% of all engagements involved ToolShell activity, majorly contributing to this tactic’s rise in popularity, Cisco Talos explained in a recent report. The ToolShell exploit chain was first made public in mid-July 2025. The attack sees CVE-2025-53770 and CVE-2025-53771, two critical and high-severity vulnerabilities in internet-facing SharePoint servers, exploited. In July 2025, Microsoft warned that Chinese-based threat groups, Linen Typhoon and Violet Typhoon, were actively targeting the SharePoint vulnerabilities. This is likely part of a strategic campaign to gain initial access to targets across government, defense, academia and NGOs. Active exploitation of the ToolShell vulnerabilities was first observed in the wild on July 18, a day before Microsoft issued its emergency advisory. “Almost all Talos IR engagements responding to ToolShell activity kicked off within the following 10 days,” Cisco explained in its Quarterly Trends report, published on October 23. Network Segmentation Crucial The cybersecurity firm highlighted the need for network segmentation to prevent these attacks enabling threat actors to laterally move within an organization. In one engagement by the Talos IR, the firm said the victim organization was impacted by ToolShell exploitation against a SharePoint server, then experienced a ransomware attack a few weeks later. In the ransomware attack, Talos IR analysis indicated the actors transferred credential stealing malware from the affected public-facing SharePoint server to a SharePoint database server on the victim’s internal network. This, Talos IR said, demonstrates how they leveraged the trusted relationship between the two servers to expand their foothold. Ransomware Remains a Persistent Threat Other findings in the Cisco Talos update showed that ransomware incidents made up around 20% of engagements in the third quarter of 2025, down from 50% in the previous quarter. Talos IR responded to Warlock, Babuk and Kraken ransomware variants for the first time, while also responding to previously seen families Qilin and LockBit. The company responded to a ransomware engagement in Q3 that it assessed with moderate confidence was attributable to the Storm-2603 threat group based on overlapping techniques, tactics and procedures (TTPs), such as the deployment of both LockBit and Warlock ransomware. The Qilin ransomware group were also particularly active, and Cisco Talos said it will very likely continue to be a top ransomware threat through at least the remainder of 2025, pending any disruption or intervention. Image credit: PhotoGranary02 / Shutterstock.com

Updates added to the bottom of the article. The connected sex toy platform Lovense is vulnerable to a zero-day flaw that allows an attacker to get access to a member's email address simply by knowing their username, putting them at risk of doxxing and harassment. Lovense is an interactive sex toy manufacturer, best known for producing app-controlled sex toys with names like the Lush, the Gush, and, perhaps most boldly, the Kraken. The company claims to have 20 million customers worldwide. While Lovense toys are commonly used for both local and long-distance entertainment, they are also popular among cam models who allow viewers to tip or subscribe for remote control of their toys. However, the connected experience can also expose their Lovense username, and due to this flaw, potentially reveal their private email address. Lovense usernames are often publicly shared on forums and social media, making them easy targets for attackers. The flaw was discovered by security researcher BobDaHacker, who collaborated with researchers Eva and Rebane to reverse engineer the app and automate the attack. The researchers disclosed two flaws over four months ago, on March 26, 2025. However, only one of the flaws, a critical account hijacking flaw, was subsequently fixed. The Lovense flaws The vulnerability stems from the interaction between Lovense's XMPP chat system, used for communication between users, and the platform's backend. "So it all started when I was using the Lovense app and muted someone. That's it. Just muted them," explains BobDaHacker's report. "But then I saw the API response and was like... wait, is that an email address? Why is that there? After digging deeper, I figured out how to turn any username into their email address." To exploit the flaw, an attacker makes a POST request to the /api/wear/genGtoken API endpoint with their credentials, which returns a gtoken (authentication token) and AES-CBC encryption keys. The attacker then takes any publicly known Lovense username and encrypts it using the retrieved encryption keys. This encrypted payload is sent to the /app/ajaxCheckEmailOrUserIdRegisted?email={encrypted_username} API endpoint. The server responds with data containing a fake email address, which the researcher converted into a fake Jabber ID (JID) used by Lovense's XMPP server. By adding this fake JID to their XMPP contact list and sending a presence subscription over XMPP (similar to a friend request), the attacker can refresh the roster (contact list), which now includes both the fake JID and the real one associated with the target's account. However, the problem is that the real JID is constructed using the user's actual email, in the format [email protected], allowing attackers to extract the victim's email address. For example, if it returned [email protected], the resulting actual email of the Lovense account is [email protected]. The researchers confirmed that the entire process can be completed in less than one second per user with a script. BleepingComputer created a fake account today and shared our username with BobDaHacker, allowing them to simply connect as a friend and return the email we registered with. The researcher also stated that it's not necessary to accept a friend request to exploit the flaw. BleepingComputer also confirmed that it is relatively easy to find legitimate usernames on forums and Lovense-related sites, like lovenselife.com. The researcher also claims that the FanBerry extension, created by Lovense, can be used to harvest usernames as many of the cam models use the same username, making wide-scale email harvesting possible. The researchers also discovered a critical vulnerability that let them completely hijack an account. Using only an email address, an attacker could generate authentication tokens without needing a password. Using these tokens, an attacker could impersonate a user on Lovense platforms, including Lovense Connect, StreamMaster, and Cam101. These tokens reportedly worked on admin accounts as well. While Lovense has mitigated this flaw by rejecting the tokens on its APIs, the researchers noted that gtokens can still be generated without a password. Both issues were reported to Lovense on March 26, 2025. In April, after also submitting the bugs on HackerOne, Lovense informed the researchers that the email issue was already known and fixed in an upcoming version. The company initially downplayed the account hijacking flaw, but after being told it could allow full admin account access, Lovense reclassified it as critical. In total, the researchers received $3,000 for the disclosure of the flaws. On June 4, the company claimed the flaws were fixed, but the researchers confirmed this was not the case. Lovense ultimately fixed the account hijack flaw in July but stated that it would take approximately 14 months to resolve the email flaw, as it would break compatibility with older versions of their app. "We've launched a long-term remediation plan that will take approximately ten months, with at least four more months required to fully implement a complete solution," Lovense told the researcher. "We also evaluated a faster, one-month fix. However, it would require forcing all users to upgrade immediately, which would disrupt support for legacy versions. We've decided against this approach in favor of a more stable and user-friendly solution." The researchers criticized this response, stating the company repeatedly claimed the issues were fixed when they were not. "Your users deserve better. Stop putting old app support over security. Actually fix things. And test your fixes before saying they work," BobDaHacker wrote in the report. Ultimately, Lovense says they deployed a proxy feature on July 3rd that was suggested by the researchers to mitigate the attack. However, even after doing a force update of the app, the flaw was not fixed, so its unclear what was changed. In 2016, multiple Lovense flaws exposed email addresses or allowed attackers to determine if an email address had an account at Lovense. After the publishing of this story, BobDaHacker was told that other researchers named @Krissy and @SkeletalDemise discovered the same account takeover bug in 2023, which was disclosed through HackerOne. However, Lovense allegedly marked the flaw as fixed when it was not, changing the severity from high to medium, and only paying out a $350 bug bounty for the disclosure. The researchers also found another API, /api/getUserNameByEmailV2, that allowed you to convert a username to an email address or vice-versa, without having to utilize XMPP. This API was allegedly patched and stopped working after the disclosure, without alerting the researcher. Update 7/29/25 10:51 AM ET: In a statement to BleepingComputer, Lovense thanked BobDaHacker for disclosing the flaws and said that a fix is rolling out in the app stores. "We are pleased to inform you that the update addressing the latest vulnerabilities, as referenced by the researcher in his/her blog post last night, was already submitted to app stores before the post was published," Lovense told BleepingComputer. "The full update is expected to be pushed to all users within the next week. Once all users have updated to the new version and we disable older versions, this issue will be completely resolved." However, the spokesperson also stated that the flaw that exposed email addresses was fixed at the end of June. This statement conflicts with how the researcher demonstrated to BleepingComputer yesterday that they could retrieve our email address for our test account simply by accepting their friend request. BleepingComputer sent follow-up questions to Lovense about the flaw still working and will update our story with any reply. Update 7/30/25: While Lovense did not respond to our email yesterday, the researcher has now confirmed that both flaws have been fully fixed. The technique used to expose an email address for a user no longer works in the researcher's tests and an API previously used to create authentication tokens was taken offline. It should be noted that the account take over flaw was already fixed prior to the deprecation of this endpoint. BleepingComputer contacted Lovense for confirmation on the fixes but has not heard back at this time. Update 7/31/25: Lovense CEO Dan Liu shared a statement with BleepingComputer confirming that all of the flaws have now been fixed, reassuring users that there is no indication they were exploited or used to steal data. "These vulnerabilities were discovered under controlled conditions by the researcher, who is part of a bug bounty platform we joined in 2018, and not through malicious activity," said Liu. "All identified vulnerabilities have been fully addressed." "As of today, there is no evidence suggesting that any user data, including email addresses or account information, has been compromised or misused." However, the Lovense CEO disputes the claims that the email flaw was fixed with a "simple" two-day fix. "The originally scheduled long term 14-month system reconstruction plan was completed significantly ahead of schedule due to the team's dedicated efforts and increased resource allocation," continued Liu. "Reducing this comprehensive project to a simple "fixable in two days" is not only misleading but also overlooks the immense work put forth by our team." BleepingComputer once again asked why Lovense previously stated the email flaw was fixed, when it was demonstrated to not be, and will update the story if we receive a response. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Some risks don’t breach the perimeter—they arrive through signed software, clean resumes, or sanctioned vendors still hiding in plain sight. This week, the clearest threats weren’t the loudest—they were the most legitimate-looking. In an environment where identity, trust, and tooling are all interlinked, the strongest attack path is often the one that looks like it belongs. Security teams are now challenged to defend systems not just from intrusions—but from trust itself being turned into a weapon. ⚡ Threat of the Week Microsoft SharePoint Attacks Traced to China — The fallout from an attack spree targeting defects in on-premises Microsoft SharePoint servers continues to spread a week after the discovery of the zero-day exploits, with more than 400 organizations globally compromised. The attacks have been attributed to two known Chinese hacking groups tracked as Linen Typhoon (aka APT27), Violet Typhoon (aka APT31), and a suspected China-based threat actor codenamed Storm-2603 that has leveraged the access to deploy Warlock ransomware. The attacks leverage CVE-2025-49706, a spoofing flaw, and CVE-2025-49704, a remote code execution bug, collectively called ToolShell. Bloomberg reported that Microsoft is investigating whether a leak from Microsoft Active Protections Program (MAPP), which provides early access to vulnerability information to security software providers, may have led to the zero-day exploitation. China has denied allegations it was behind the campaign. Flare Customers Saw 321% ROI, Says Forrester Consulting Total Economic Impact™ (TEI) Study A new Forrester Consulting study commissioned by Flare shows how Flare’s threat exposure management platform delivered 321% ROI, cut manual work by 75%, and paid for itself in under 6 months for a composite organization representative of interviewed customers. Get the full business case. Read the Study ➝ 🔔 Top News U.S. Treasury Sanctions N. Korean Company for IT Worker Scheme — The U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) sanctioned a North Korean front company and three associated individuals for their involvement in the fraudulent remote information technology (IT) worker scheme designed to generate illicit revenues for Pyongyang. In a related move, Christina Marie Chapman, a laptop farmer in Arizona responsible for facilitating the scheme, was sentenced to jail for eight-and-a-half years, after raising $17 million in illicit funds for the regime. In these schemes, IT workers from North Korea use well-crafted, carefully curated portfolios, complete with full social media profiles, AI-enhanced photos and deepfakes, and stolen identities to pass background checks and land jobs at various U.S. companies. Once hired, they take the help of facilitators to receive company-issued laptops and other equipment, which they can then connect to remotely, thereby giving the impression that they are within the country where the company is located. The ongoing efforts operate with the twin goals of generating revenue for the Hermit Kingdom's nuclear program and other efforts via regular salaries, as well as gaining a foothold inside corporate networks for the purpose of planting malware for stealing secrets and extorting their employers. "DPRK's cyber operations challenge the traditional nation-state playbook – merging cryptocurrency theft, espionage, and nuclear ambition within a self-funded system driven by profit, loyalty, and survival," said Sue Gordon, a member of DTEX's Advisory Board and former principal deputy director of U.S. National Intelligence. "Recognizing it as a family-run mafia syndicate unblurs the lines between cybercrime and statecraft. This report pulls back the curtain on their inner workings and psychology, revealing how deeply embedded they already are within our workforce – providing the context needed to anticipate their next move." Soco404 and Koske Target Misconfigured Cloud Instances to Drop Miners — Two different malware campaigns have targeted vulnerabilities and misconfigurations across cloud environments to deliver cryptocurrency miners. These activity clusters have been codenamed Soco404 and Koske. While Soco404 targets both Linux and Windows systems to deploy platform-specific malware, Koske is a Linux-focused threat. There is also evidence to suggest that Koske has been developed using a large language model (LLM), given the presence of well-structured comments, best-practice logic flow with defensive scripting habits, and synthetic panda-related imagery to host the miner payload. XSS Forum Taken Down and Suspected Admin Arrested — Law enforcement notched a significant victory against the cybercrime economy with the disruption of the notorious forum XSS and the arrest of its suspected administrator. That said, it's important to note that takedowns of similar forums have proved short-lived, and threat actors often move to new platforms or other alternatives, such as Telegram channels. The development comes as LeakZone, a self-styled "leaking and cracking forum" where users advertise and share breached databases, stolen credentials, and pirated software, was caught leaking the IP addresses of its logged-in users to the open web. Coyote Trojan Exploits Windows UI Automation — The Windows banking trojan known as Coyote has become the first known malware strain to exploit the Windows accessibility framework called UI Automation (UIA) to harvest sensitive information. Coyote, which is known to target Brazilian users, comes with capabilities to log keystrokes, capture screenshots, and serve overlays on top of login pages associated with financial enterprises. Akamai's analysis found that the malware invokes the GetForegroundWindow() Windows API in order to extract the active window's title and compare it against a hard-coded list of web addresses belonging to targeted banks and cryptocurrency exchanges. "If no match is found Coyote will then use UIA to parse through the UI child elements of the window in an attempt to identify browser tabs or address bars," Akamai said. "The content of these UI elements will then be cross-referenced with the same list of addresses from the first comparison." Cisco Confirms Active Exploits Targeting ISE — Cisco has warned that a set of security flaws in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) have come under active exploitation in the wild. The flaws, CVE-2025-20281, CVE-2025-20337, and CVE-2025-20282, allow an attacker to execute arbitrary code on the underlying operating system as root or upload arbitrary files to an affected device and then execute those files on the underlying operating system as root. The network equipment vendor did not disclose which vulnerabilities have been weaponized in real-world attacks, the identity of the threat actors exploiting them, or the scale of the activity. ️🔥 Trending CVEs Hackers are quick to jump on newly discovered software flaws – sometimes within hours. Whether it’s a missed update or a hidden bug, even one unpatched CVE can open the door to serious damage. Below are this week’s high-risk vulnerabilities making waves. Review the list, patch fast, and stay a step ahead. This week's list includes — CVE-2025-54068 (Laravel Livewire Framework), CVE-2025-34300 (Lighthouse Studio), CVE-2025-6704, CVE-2025-7624 (Sophos Firewall), CVE-2025-40599 (SonicWall SMA 100 Series), CVE-2025-49656, CVE-2025-50151 (Apache Jena), CVE-2025-22230, CVE-2025-22247 (Broadcom VMware Tools), CVE-2025-7783 (form-data), CVE-2025-34140, CVE-2025-34141, CVE-2025-34142, CVE-2025-34143 (Hexagon ETQ Reliance), CVE-2025-8069 (AWS Client VPN for Windows), CVE-2025-7723, CVE-2025-7724 (TP-Link VIGI NVR), CVE-2025-7742 (LG Innotek LNV5110R), CVE-2025-24000 (Post SMTP), CVE-2025-52449, CVE-2025-52452, CVE-2025-52453, CVE-2025-52454, CVE-2025-52455 (Salesforce Tableau Server), and CVE-2025-6241 (SysTrack). 📰 Around the Cyber World Google Removes 1000s of YouTube Channels Tied to Influence Ops — Google removed nearly 11,000 YouTube channels and other accounts tied to state-linked propaganda campaigns from China, Russia and more in the second quarter of 2025. It removed over 2,000 removed channels linked to Russia, including 20 YouTube channels, 4 Ads accounts, and 1 Blogger blog associated with RT, a Russian state-controlled media outlet. The takedown also included more than 7,700 YouTube channels linked to China, which shared content in Chinese and English that promoted the People’s Republic of China, supported President Xi Jinping and commented on U.S. foreign affairs. Surveillance Company Bypasses SS7 Safeguards — An unnamed surveillance company has been using a new attack technique to bypass the Signaling System 7 (SS7) protocol's protections and trick telecommunications companies into disclosing the location of their users. The attack method, likely used since the fourth quarter of 2024, hinges on Transaction Capabilities Application Part (TCAP) manipulation through SS7 commands that have been encoded in such a manner that their contents are not parsed by the protection systems or firewalls at the target network. "We don't have any information on how successful this attack method has been worldwide, as its success is vendor/software specific, rather than being a general protocol vulnerability, but its use as part of a suite indicates that it has had some value," Enea researchers Cathal Mc Daid and Martin Gallagher said. Number of Phishing Sites Aimed at Telegram Spikes — A new report has found that the number of phishing sites aimed at Telegram users increased to 12,500 in the second quarter of 2025. In one variant of the scheme, fraudsters create a phishing page that simulates the login page associated with Telegram or Fragment, a platform on the TON blockchain that allows users to buy and sell unique Telegram usernames and virtual phone numbers. Should victims enter their credentials and the confirmation codes, the accounts are hijacked by the attackers. The second scenario entails the attacker approaching a victim to purchase a rare digital gift from them in Telegram for a large amount. "As payment, the fraudster sends fake tokens," BI.ZONE said. "At first glance, they are indistinguishable from the real ones, but they have no real value. After the transfer, the victim is left without a gift and with a fake digital currency." In a related report, Palo Alto Networks Unit 42 said it identified 54,446 domains hosting phishing sites in a campaign impersonating Telegram dubbed telegram_acc_hijack. "These pages collect Telegram login credentials submitted and real-time one-time passcodes (OTPs) to hijack user accounts," the company added. Former NCA Employee Sentenced to 5.5 Years in Prison — A former officer with the U.K. National Crime Agency (NCA) was sentenced to five-and-a-half years in prison after stealing a chunk of the Bitcoin seized by the agency as part of a law enforcement operation targeting the now-defunct illicit dark web marketplace Silk Road. Paul Chowles, 42, was identified as the culprit after authorities recovered his iPhone, which linked him to an account used to transfer Bitcoin as well as relevant browser search history relating to a cryptocurrency exchange service. "Within the NCA, Paul Chowles was regarded as someone who was competent, technically minded and very aware of the dark web and cryptocurrencies," Alex Johnson, Specialist Prosecutor with the Crown Prosecution Service's Special Crime Division, said. "He took advantage of his position working on this investigation by lining his own pockets while devising a plan that he believed would ensure that suspicion would never fall upon him. Once he had stolen the cryptocurrency, Paul Chowles sought to muddy the waters and cover his tracks by transferring the Bitcoin into mixing services to help hide the trail of money." U.K. Sanctions 3 Russian GRU Units for Sustained Cyber Attacks — The U.K. sanctioned three units of the Russian military intelligence agency (GRU) and 18 military intelligence officers for "conducting a sustained campaign of malicious cyber activity over many years" with an aim to "sow chaos, division and disorder in Ukraine and across the world." The sanctions cover Unit 26165 (linked to APT28), Unit 29155 (linked to Cadet Blizzard), and Unit 74455 (linked to Sandworm), as well as African Initiative, a "social media content mill established and funded by Russia and employing Russian intelligence officers to conduct information operations in West Africa." U.K. Floats Ransomware Payments Ban for Public Bodies — The U.K. government has proposed new legislation that would ban public sector organizations and critical national infrastructure from paying criminal operators behind ransomware attacks, as well as enforce mandatory reporting requirements for all victims to inform law enforcement of attacks. "Public sector bodies and operators of critical national infrastructure, including the NHS, local councils and schools, would be banned from paying ransom demands to criminals under the measure," the government said. "The ban would target the business model that fuels cyber criminals' activities and makes the vital services the public rely on a less attractive target for ransomware groups." Businesses that do not fall under the ambit of the law would be required to notify the government of any intent to pay a ransom. A failure to download patches to address widely exploited vulnerabilities could lead to daily fines of £100,000 or 10 percent of turnover should a digital break-in occur. Thought Lumma Was Out of Commission? Think Again! — The Lumma Stealer operations have recovered following a law enforcement takedown of its infrastructure earlier this year, with the malware being distributed through more discreet channels and stealthier evasion tactics. "Lumma's infrastructure began ramping up again within weeks of the takedown," Trend Micro said. "This rapid recovery highlights the group's resilience and adaptability in the face of disruption." A notable shift is the reduction in volume of domains using Cloudflare's services to obfuscate their malicious domains and make detection more challenging, instead shifting to Russian alternatives like Selectel. "This strategic pivot suggests a move towards providers that might be perceived as less responsive to law enforcement requests, further complicating efforts to track and disrupt their activities," the company added. Lumma Stealer is known for its diverse and evolving delivery methods, leveraging social media posts, GitHub, ClickFix, and fake sites distributing cracks and key generators, as initial access methods. The resurgence of Lumma is par for the course with modern cybercriminal operations that often can quickly resume activity even after significant law enforcement disruptions. In a statement shared with The Hacker News, ESET confirmed the resurgence of Lumma Stealer and that the current activity has approached levels similar to those before the law enforcement action. "Lumma Stealer operators continue to register dozens of new domains weekly – activity that didn’t stop even after the disruption – but switched to primarily resolving them at nameservers located in Russia," Jakub Tománek, ESET malware analyst, said. "The codebase itself has shown minimal changes since the takedown attempt. This indicates the group’s primary focus has been on restoring operations rather than innovating their 'product' and introducing new features." U.S. Government Warns of Interlock Ransomware — The U.S. government has warned of Interlock ransomware attacks targeting businesses, critical infrastructure, and other organizations in North America and Europe since late September 2024. The attacks, designed to target both Windows and Linux systems, employ drive-by downloads from compromised legitimate websites or ClickFix- and FileFix-style lures to drop payloads for initial access. "Actors then use various methods for discovery, credential access, and lateral movement to spread to other systems on the network," the U.S. government said. "Interlock actors employ a double extortion model in which actors encrypt systems after exfiltrating data, which increases pressure on victims to pay the ransom to both get their data decrypted and prevent it from being leaked." Also part of the threat actor's tooling are Cobalt Strike and a custom remote access trojan called NodeSnake RAT, and information stealers like Lumma Stealer and Berserk Stealer to harvest credentials for lateral movement and privilege escalation. Apple Notifies Iranians of Spyware Attacks — Apple notified more than a dozen Iranians in recent months that their iPhones had been targeted with government spyware, according to a digital rights and security organization called Miaan Group. This included individuals who have a long history of political activism. Also notified by Apple were dissidents and a technology worker. It's unclear which spyware maker is behind these attacks. The attacks mark the first known example of advanced mercenary tools being used both inside Iran and against Iranians living abroad. Linux Servers Targeted by SVF Bot — Poorly managed Linux servers are being targeted by a campaign that delivers a Python-based malware called SVF Bot that enlists infected machines in a botnet that can conduct distributed denial-of-service (DDoS) attacks. "When the SVF Bot is executed, it can authenticate with the Discord server using the following Bot Token and then operate according to the threat actor's commands," ASEC said. "Most of the supported commands are for DDoS attacks, with L7 HTTP Flood and L4 UDP Flood being the main types supported." Turkish Companies Targeted by Snake Keylogger — Turkish organizations are the target of a new phishing campaign that delivers an information stealer called Snake Keylogger. The activity, primarily singling out defense and aerospace sectors, involves distributing bogus email messages that impersonate Turkish Aerospace Industries (TUSAŞ) in an attempt to trick victims into opening malicious files under the guise of contractual documents. "Once executed, the malware employs advanced persistence mechanisms – including PowerShell commands to evade Windows Defender and scheduled tasks for auto-execution – to harvest sensitive data, such as credentials, cookies, and financial information, from a wide range of browsers and email clients," Malwation said. Former Engineer Pleads Guilty to Trade Theft — A Santa Clara County man and former engineer at a Southern California company pleaded guilty to stealing trade secret technologies developed for use by the U.S. government to detect nuclear missile launches, track ballistic and hypersonic missiles, and to allow U.S. fighter planes to detect and evade heat-seeking missiles. Chenguang Gong, 59, of San Jose, pleaded guilty to one count of theft of trade secrets. He remains free on a $1.75 million bond. Gong – a dual citizen of the United States and China – transferred more than 3,600 files from a Los Angeles-area research and development company where he worked to personal storage devices during his brief tenure with the company last year. The victim company hired Gong in January 2023 as an application-specific integrated circuit design manager. He was terminated three months later. Gong, who was arrested and charged in February, is scheduled for sentencing on September 29, 2025. He faces up to 10 years in prison. FBI Issues Warning About The Com — The Federal Bureau of Investigation (FBI) is warning the public about an online group called In Real Life (IRL) Com that provides violence-as-a-service (VaaS), including shootings, kidnappings, armed robbery, stabbings, physical assault, and bricking. "Services are posted online with a price breakdown for each act of violence," the FBI said. "Groups offering VaaS advertise contracts on social media platforms to solicit individuals willing to conduct the act of violence for monetary compensation." The threat group is also said to advertise swat-for-hire services via communication applications and social media platforms. IRL Com is assessed to be one of three subsets of The Com (short for The Community), a growing online collective comprising primarily of thousands of English-speaking individuals, many of whom are minors, and engage in a wide range of criminal endeavors. The other two offshoots are Hacker Com, which is linked to DDoS and ransomware-as-a-service (RaaS) groups, and Extortion Com, which primarily involves the exploitation of children. Notably, the Com encompasses threat clusters tracked as LAPSUS$ and Scattered Spider. A similar warning was issued by the U.K. National Crime Agency (NCA) earlier this March, calling attention to The Com's trend of recruiting teenage boys to commit a range of criminal acts, from cyber fraud and ransomware to child sexual abuse. Organized Crime Group Behind Large-Scale Fraud Disrupted — A highly organised criminal group involved in large-scale fraud in Western Europe was dismantled in a coordinated operation led by authorities from Romania and the United Kingdom. "The gang had travelled from Romania to several Western European countries, mainly the UK, and withdrew large sums of money from ATM machines," Europol said. "They later laundered the proceeds by investing in real estate, companies, vacations, and luxury products, including cars and jewelry." The operation has led to two arrests, 18 house searches, and the seizure of real estate, luxury cars, electronic devices, and cash. The attackers committed what has been described as Transaction Reversal Fraud (TRF), in which the screen of an ATM is removed and a bank card is inserted to request funds. The transactions were canceled (or reversed) before the funds were dispensed, allowing them to reach inside the ATM and take the cash before it was retracted. The gang is estimated to have plundered about €580,000 (about $681,000) using this method. "The perpetrators were also involved in other criminal activities, including skimming, forging electronic means of payment and transport cards, and conducting bin attacks — a type of card fraud carried out using software designed to identify card numbers and generate illicit income through fraudulent payments," Europol added. The development came as a 21-year-old U.K. student, Ollie Holman, who designed and distributed 1,052 phishing kits linked to £100 million (approximately $134 million) worth of fraud, was jailed for seven years. It is estimated that Holman received £300,000 from selling the kits between 2021 and 2023. The phishing kits were sold via Telegram. Holman previously pleaded guilty to seven counts, including encouraging or assisting the commission of an offence, making or supplying articles for use in fraud, and transferring, acquiring, and possessing criminal property, per the Crown Prosecution Service. Endgame Gear Acknowledges Supply Chain Attack — Gaming peripheral manufacturer Endgame Gear confirmed that unidentified threat actors compromised its official software distribution system to spread dangerous Xred malware to unsuspecting customers for nearly two weeks via the OP1w 4k v2 product page. The security breach occurred between June 26 and July 9, 2025. The company stated that "access to our file servers was not compromised, and no customer data was accessible or affected on our servers at any time," and that "This issue was isolated to the OP1w 4k v2 product page download only." New Campaign Targeted Crypto Users Since March 2024 — A new sophisticated and evasive malware campaign has managed to stay unnoticed and target cryptocurrency users globally since March 2024. Dubbed WEEVILPROXY, the activity leverages Facebook advertisement campaigns masquerading as well-known cryptocurrency-related software and platforms, such as Binance, Bybit, Kraken, Revolut, TradingView, and others, to trick users into downloading fake installers that ultimately drop information stealers and cryptocurrency drainers. "We have also observed the threat actor propagate ads through Google Display Network since April-May 2025, which are displayed throughout the internet in the form of images/videos," WithSecure said. "These ads appear geographically bound as well, for instance, we have observed such ads specifically targeting the Philippines, Malaysia, Thailand, Vietnam, Bangladesh, and Pakistan." VMDetector Loader Delivers Formbook Malware — A new variant of the VMDetector Loader malware has been found embedded within the "pixel data" of a seemingly benign JPG image that's delivered via phishing emails to ultimately deploy an information stealer called Formbook. The JPG image is retrieved from archive.org by means of Visual Basic Scripts present within zipped archives that are sent as attachments to the email messages. Threat Actors Use mount Binary in Hikvision Attacks — Attacks in the wild exploiting CVE-2021-36260, a command injection bug affecting Hikvision cameras, have been uncovered, leveraging the flaw to mount a remote NFS share and execute a file off of it. "The attacker tells mount to make the remote NFS share, /srv/nfs/shared, on 87.121.84[.]34 available locally as the directory ./b," VulnCheck said. How Windows Drivers Can Be Weaponized? — In a new detailed analysis, Security Joes has highlighted the threat posed by kernel-mode attacks and how attacks abusing vulnerable drivers, called the Bring Your Own Vulnerable Driver (BYOVD) technique, can be used by attackers to exploit signed-but-flawed drivers to bypass kernel protections. "Because drivers run in kernel mode, they possess high privileges and unrestricted access to system resources," the company said. "This makes them a high-value target for attackers aiming to escalate privileges, disable security mechanisms such as EDR callbacks, and achieve full control over the system." Organizations' Attack Surface Increases — Organizations have created more entry points for attackers. That's according to a report from ReliaQuest, which found a 27% increase in exposed ports between the second half of 2024 and the first half of 2025, a 35% increase in exposed operational technology (OT), and a surge in vulnerabilities in public-facing systems, such as PHP and WordPress. "Vulnerabilities in public-facing assets more than doubled, rising from 3 per organization in the second half of 2024 to 7 in the first half of 2025," the company said. "From late 2024 to early 2025, the number of exposed access keys for organizations in our customer base doubled, creating twice the opportunity for attackers to slip in unnoticed." Iranian Bank Pasargad Targeted During June Conflict — The Iranian bank known as Pasargad was targeted as part of a cyber attack during the Iran-Israel war in June 2025, impacting access to crucial services. A suspected Israeli operation called Predatory Sparrow claimed responsibility for the attack on another Iranian bank Sepah and the country's largest cryptocurrency exchange, Nobitex. CrowdStrike Outage Impacted Over 750 U.S. Hospitals — A new study undertaken by a group of academics from the University of California, San Diego, found that 759 U.S. hospitals experienced IT outages last July due to a faulty CrowdStrike update. "A total of 1098 distinct network services with outages were identified, of which 631 (57.5%) were unable to be classified, 239 (21.8%) were direct patient-facing services, 169 (15.4%) were operationally relevant services, and 58 (5.3%) were research-related services," the study said. North Korean Actors Employ NVIDIA Lures — The North Korean threat actors behind the Contagious Interview (aka DeceptiveDevelopment) campaign are leveraging ClickFix-style lures to trick unsuspecting job seekers into downloading a supposed NVIDIA-related update to address camera or microphone issues when attempting to provide a video assessment. The attack leads to the execution of a Visual Basic Script that launches a Python payload called PylangGhost that steals credentials and enables remote access via MeshAgent. ACRStealer Variant Distributed in New Attacks — Threat actors are propagating a new variant of ACRStealer that incorporates new features aimed at detection evasion and analysis obstruction. "The modified ACRStealer uses the Heaven's Gate to disrupt detection and analysis," AhnLab said. "Heaven's Gate is a technique used to execute x64 code in WoW64 processes and is widely used for analysis evasion and detection avoidance." The new version has been rebranded as Amatera Stealer, per Proofpoint. It's offered for sale for $199 per month to $1,499 per year. Aeza Group Shifts Infrastructure After U.S. Sanctions — Earlier this month, the U.S. Treasury Department imposed sanctions against Russia-based bulletproof hosting (BPH) service provider Aeza Group for assisting threat actors in their malicious activities, such as ransomware, data theft, and darknet drug trafficking. Silent Push, in a new analysis, said IP ranges from Aeza's AS210644 began migrating to AS211522, a new autonomous system operated by Hypercore Ltd., starting July 20, 2025, in an attempt to evade sanctions enforcement and operate under new infrastructure. Request for Quote Scams Demonstrate Sophistication — Cybersecurity researchers are calling attention to a widespread Request for Quote (RFQ) scam that employs common Net financing options (Net 15, 30, 45) to steal a variety of high-value electronics and goods. "In RFQ campaigns, the actor reaches out to a business to ask for quotes for various products or services," Proofpoint said. "The quotes they receive can be used to make very convincing lures to send malware, phishing links, and even additional business email compromise (BEC) and social engineering fraud." Besides using vendor-supplied financing and stolen identities of real employees to steal physical goods, these scams utilize email and legitimate online quote request forms to reach potential victims. Fake Games Distribute Stealer Malware — A new malware campaign is distributing fake installers for indie game titles such as Baruda Quest, Warstorm Fire, and Dire Talon, promoting them via fraudulent websites, YouTube channels, and Discord, to trick unwitting users into infecting their machines with stealers like Leet Stealer, RMC Stealer (a modified version of Leet Stealer), and Sniffer Stealer. The origins of Leet and RMC malware families can be traced back to Fewer Stealer, suggesting a shared lineage. It's believed that the campaign originally targeted Brazil, before expanding worldwide. U.S. FCC Wants to Ban Companies from Using Chinese Equipment When Laying Submarine Cables — The U.S. Federal Communications Commission said it plans to issue new rules that would ban Chinese technology from U.S. submarine cables in order to protect underwater telecommunications infrastructure from foreign adversary threats. "We have seen submarine cable infrastructure threatened in recent years by foreign adversaries, like China," FCC Chairman Brendan Carr said. "We are therefore taking action here to guard our submarine cables against foreign adversary ownership, and access as well as cyber and physical threats." In a recent report, Recorded Future said the risk environment for submarine cables has "escalated" and that the "threat of state-sponsored malicious activity targeting submarine cable infrastructure is likely to rise further amid heightened geopolitical tensions." The cybersecurity company also cited a lack of redundancy, a lack of diversity of cable routes, and limited repair capacity as some of the key factors that raise the risk of severe impact caused by damage to submarine cables. China Warns Citizens of Backdoored Devices and Supply Chain Threats — China's Ministry of State Security (MSS) has issued an advisory, warning of backdoors in devices and supply chain attacks on software. The security agency said such threats not only risk personal privacy and theft of corporate secrets, but also affect national security. "Potential technical backdoor security risks can also be reduced by strengthening technical protection measures, such as formulating patch strategies, regularly updating operating systems, regularly checking device logs, and monitoring abnormal traffic," MSS said, urging organizations to avoid foreign software and instead adopt domestic operating systems. In a separate bulletin, the MSS also alleged that overseas spy intelligence agencies may set up backdoors in its ocean observation sensors to steal data. NyashTeam Hacking Group Infrastructure Disrupted — Russia-based cybersecurity company F6 said it dismantled a network of domains operated by a relatively unknown hacking crew known as NyashTeam, which sells two different remote access trojans known as DCRat (DarkCrystal RAT) and WebRAT through Telegram bots and websites under the malware-as-a-service (MaaS) model. The malware is distributed using YouTube and GitHub by passing them off as game cheats or pirated software. The group is also believed to provide hosting services for cybercriminal infrastructure and support customers through plugins, guides, and data processing tools, appealing to both novice hackers and experienced cybercriminals alike. RenderShock Attack Technique Detailed — Cybersecurity researchers have detailed a zero-click attack strategy called RenderShock that leverages trusted operating system behaviors to conduct reconnaissance and deliver payloads without requiring any user interaction. "By embedding malicious logic in metadata, preview triggers, and document formats, RenderShock capitalizes on system convenience as an unguarded attack vector," CYFIRMA said. "Modern enterprise systems are built for convenience, automatically previewing, indexing, synchronizing, and rendering files across endpoints, cloud platforms, and productivity suites. These systems often process files without explicit user action, trusting that the rendering process is safe. RenderShock exploits these passive execution surfaces: trusted components that parse untrusted files silently in the background." 🎥 Cybersecurity Webinars AI Is Breaking Trust—Here’s How to Save It Before It’s Too Late — Discover how customers are reacting to AI-driven digital experiences in 2025. The Auth0 CIAM Trends Report reveals rising identity threats, new trust expectations, and the hidden costs of broken logins. Join this webinar to learn how AI can be your biggest asset—or your biggest risk. Python Devs: Your Pip Install Could Be a Malware Bomb — In 2025, Python’s supply chain is under siege — from typosquats to hijacked AI libraries. One wrong pip install could inject malware straight into production. This session shows how to secure your builds with tools like Sigstore, SLSA, and hardened containers. Stop hoping your packages are clean — start verifying. 🔧 Cybersecurity Tools Vendetect - It is an open-source tool designed to detect copied or vendored code across repositories — even when the code has been modified. Built for real-world security and compliance needs, it uses semantic fingerprinting and version control analysis to identify where code was copied from, including the exact source commit. Unlike academic plagiarism tools, Vendetect is optimized for software engineering environments: it catches renamed functions, stripped comments, and altered formatting, and helps trace untracked dependencies, license violations, and inherited vulnerabilities often found during security assessments. Telegram Channel Scraper - It is a Python-based tool designed for advanced monitoring and data collection from public Telegram channels. It uses the Telethon library to scrape messages and media, storing everything in optimized SQLite databases. Built for efficiency and scale, it supports real-time scraping, parallel media downloads, and batch data exports. This makes it useful for researchers, analysts, and security teams who need structured access to Telegram content for investigation or archiving — without depending on manual scraping or third-party platforms. Disclaimer: These newly released tools are for educational use only and haven’t been fully audited. Use at your own risk—review the code, test safely, and apply proper safeguards. 🔒 Tip of the Week Don’t Trust Your Browser Blindly — Most people think of their browser as just a tool to get online — but in reality, it’s one of the most exposed parts of your device. Behind the scenes, your browser quietly stores names, emails, companies, and sometimes even payment info. This data often lives in plain, unencrypted files that are easy to extract if someone gains local access — even briefly. For example, in Chrome or Edge, personal autofill details are stored in a file called Web Data, which is a basic SQLite database anyone with access can read. This means that if your machine is compromised — even by a simple script — your personal or even work identity can be quietly stolen. Red teamers and attackers love this kind of recon gold. It doesn’t stop there. Browsers also keep session cookies, local storage, and site databases that often don’t get wiped, even after logout. This data can allow attackers to hijack your logged-in sessions or extract sensitive info stored by web apps — including company tools. Even browser extensions, if malicious or hijacked, can quietly spy on your activity or inject bad code into pages you trust. Another weak spot? Browser extensions. Even legitimate-looking add-ons can have wide permissions — letting them read what you type, track your browsing, or inject scripts. If a trusted extension gets compromised in an update, it can silently become a data theft tool. This happens more often than people think. Here’s how to reduce the risk: Clear autofill, cookies, and site data regularly Disable autofill entirely on workstations Limit extensions — audit them using tools like CRXcavator or Extension Police Use DB Browser for SQLite to inspect stored files (Web Data, Cookies) Use tools like BleachBit to securely wipe traces Browsers are essentially lightweight application platforms. If you’re not auditing how they store data and who can access it, you’re leaving a major gap open — especially on shared or endpoint-exposed machines. Conclusion This week’s signals are less a conclusion and more a provocation: What else might we be misclassifying? What familiar data could become meaningful under a different lens? If the adversary thinks in systems, not symptoms, our defenses must evolve accordingly. Sometimes, the best response isn’t a patch—it’s a perspective shift. There’s value in looking twice where others have stopped looking altogether.