mullvad

Some weeks in security feel normal. Then you read a few tabs and get that immediate “ah, great, we’re doing this now” feeling. This week has that energy. Fresh messes, old problems getting sharper, and research that stops feeling theoretical real fast. A few bits hit a little too close to real life, too. There’s a good mix here: weird abuse of trusted stuff, quiet infrastructure ugliness, sketchy chatter, and the usual reminder that attackers will use anything that works. Scroll on. You’ll see what I mean. ⚡ Threat of the Week Google Patches 2 Actively Exploited Chrome 0-Days — Google released security updates for its Chrome web browser to address two high-severity vulnerabilities that it said have been exploited in the wild. The vulnerabilities related to an out-of-bounds write vulnerability in the Skia 2D graphics library (CVE-2026-3909) and an inappropriate implementation vulnerability in the V8 JavaScript and WebAssembly engine (CVE-2026-3910) that could result in out-of-bounds memory access or code execution, respectively. Google did not share additional details about the flaws, but acknowledged that there exist exploits for both of them. The issues were addressed in Chrome versions 146.0.7680.75/76 for Windows and Apple macOS, and 146.0.7680.75 for Linux. Detection Starts the Clock. Response Decisions Shape the Outcome When incidents escalate, early decisions determine containment and impact. Join this SANS IR Command Roundtable to learn how experienced teams avoid investigation drift, improve coordination, and execute faster response across cloud, enterprise, and operational environments. Watch the Webcast ➝ 🔔 Top News Meta to Discontinue Instagram E2EE in May 2026 — Meta announced plans to discontinue support for end-to-end encryption (E2EE) for chats on Instagram after May 8, 2026. In a statement shared with The Hacker News, a Meta spokesperson said, "Very few people were opting in to end-to-end encrypted messaging in DMs, so we're removing this option from Instagram in the coming months. Anyone who wants to keep messaging with end-to-end encryption can easily do that on WhatsApp." Authorities Disrupt SocksEscort Service — A court-authorized international law enforcement operation dismantled a criminal proxy service named SocksEscort that enslaved thousands of residential routers worldwide into a botnet for committing large-scale fraud. "The malware allowed SocksEscort to direct internet traffic through the infected routers. SocksEscort sold this access to its customers," the U.S. Justice Department said. The main thing to note here is that SocksEscort was powered by AVrecon, a malware written in C to explicitly target MIPS and ARM architectures via known security flaws in edge network devices. The malware also featured a novel persistence mechanism that involved flashing custom firmware, which intentionally disables future updates, permanently transforming SOHO routers into SocksEscort proxy nodes to blindside corporate monitoring. UNC6426 Exploits nx npm Supply Chain Attack to Gain AWS Admin Access in 72 Hours — A threat actor known as UNC6426 leveraged keys stolen following the supply chain compromise of the nx npm package in August 2025 to completely breach a victim's AWS environment within 72 hours. UNC6426 used the access to abuse the GitHub-to-AWS OpenID Connect (OIDC) trust and create a new administrator role in the cloud environment, Google said. Subsequently, this role was abused to exfiltrate files from the client's Amazon Web Services (AWS) Simple Storage Service (S3) buckets and perform data destruction in their production cloud environments. KadNap Enslaves Network Devices to Fuel Illegal Proxy — A takedown-resistant botnet comprising more than 14,000 routers and other network devices has been conscripted into a proxy network that anonymously ferries traffic used for cybercrime. The botnet, named KadNap, exploits known vulnerabilities in Asus routers (among others), leveraging the initial access to drop shell scripts that reach out to a peer-to-peer network based on Kademlia for decentralized control. Infected devices are being used to fuel a proxy service named Doppelganger that, for a fee, tunnels customers' internet traffic through residential IP addresses, offering a way for attackers to blend in and make it harder to differentiate malicious traffic from legitimate activity. APT28 Strikes with Sophisticated Toolkit — The Russian threat actor known as APT28 has been observed using a bespoke toolkit in recent cyber espionage campaigns targeting Ukrainian cyber assets. The primary components of the toolkit are two implants, one of which employs techniques from a malware framework the threat actor used in 2010s, while the other is a heavily modified version of the COVENANT framework for long-term spying. COVENANT is used in concert with BEARDSHELL to facilitate data exfiltration, lateral movement, and execution of PowerShell commands. Also alongside these tools is a malware named SLIMAGENT that shares overlaps with XAgent. ️🔥 Trending CVEs New vulnerabilities show up every week, and the window between disclosure and exploitation keeps getting shorter. The flaws below are this week's most critical — high-severity, widely used software, or already drawing attention from the security community. Check these first, patch what applies, and don't wait on the ones marked urgent — CVE-2026-3909, CVE-2026-3910, CVE-2026-3913 (Google Chrome), CVE-2026-21666, CVE-2026-21667, CVE-2026-21668, CVE-2026-21672, CVE-2026-21708, CVE-2026-21669, CVE-2026-21671 (Veeam Backup & Replication), CVE-2026-27577, CVE-2026-27493, CVE-2026-27495, CVE-2026-27497 (n8n), CVE-2026-26127, CVE-2026-21262 (Microsoft Windows), CVE-2019-17571, CVE-2026-27685 (SAP), CVE-2026-3102 (ExifTool for macOS), CVE-2026-27944 (Nginx UI), CVE-2025-67826 (K7 Ultimate Security), CVE-2026-26224, CVE-2026-26225 (Intego X9), CVE-2026-29000 (pac4j-jwt), CVE-2026-23813 (HPE Aruba Networking AOS-CX), CVE-2025-12818 (PostgreSQL), CVE-2026-2413 (Ally WordPress plugin), CVE-2026-0953 (Tutor LMS Pro WordPress plugin), CVE-2026-25921 (Gogs), CVE-2026-2833, CVE-2026-2835, CVE-2026-2836 (Cloudflare Pingora), CVE-2026-24308 (Apache ZooKeeper), CVE-2026-3059, CVE-2026-3060, CVE-2026-3989 (SGLang), CVE-2026-0231 (Palo Alto Networks Cortex XDR Broker VM), CVE-2026-20040, CVE-2026-20046 (Cisco IOS XR Software), CVE-2025-65587 (graphql-upload-minimal), CVE-2026-3497 (OpenSSH), CVE-2026-26123 (Microsoft Authenticator for Android and iOS), and CVE-2025-61915 (CUPS). 🎥 Cybersecurity Webinars Stop Guessing: Automate Your Defense Against Real-World Attacks → Learn how to move beyond basic security checklists by using automation to test your defenses against real-world attacks. Experts will show you why traditional testing often fails and how to use continuous, data-driven tools to find and fix gaps in your protection. You will learn how to prove your security actually works without increasing your manual workload. Fix Your Identity Security: Closing the Gaps Before Hackers Find Them → This webinar covers a new study about why many companies are struggling to keep their user accounts and digital identities safe. Experts share findings from the Ponemon Institute on the biggest security gaps, such as disconnected apps and the new risks created by AI. You will learn simple, practical steps to fix these problems and get better control over who has access to your company's data. The Ghost in the Machine: Securing the Secret Identities of Your AI Agents → As artificial intelligence (AI) begins to act on its own, businesses face a new challenge: how to give these "AI agents" the right digital IDs. This webinar explains why current security for humans doesn't work for autonomous bots and how to build a better system to track what they do. You will learn simple, real-world steps to give AI agents secure identities and clear rules, ensuring they don't accidentally expose your private company data. 📰 Around the Cyber World Fake Google Security Check Drops Browser RAT — A web page mimicking a Google Account security page has been spotted delivering a fully featured browser-based surveillance toolkit that takes the form of a Progressive Web App (PWA). "Disguised as a routine security checkup, it walks victims through a four-step flow that grants the attacker push notification access, the device's contact list, real-time GPS location, and clipboard contents—all without installing a traditional app," Malwarebytes said. "For victims who follow every prompt, the site also delivers an Android companion package introducing a native implant that includes a custom keyboard (enabling keystroke capture), accessibility-based screen reading capabilities, and permissions consistent with call log access and microphone recording." Forbidden Hyena Delivers BlackReaperRAT — A hacktivist group known as Forbidden Hyena (aka 4B1D) has distributed RAR archives in December 2025 and January 2026 in attacks targeting Russia that led to the deployment of a previously undocumented remote access trojan called BlackReaperRAT and an updated version of the Blackout Locker ransomware, referred to as Milkyway by the threat actors. BlackReaperRAT is capable of running commands via "cmd.exe," uploading/downloading files, spawning an HTTP shell to receive commands, and spreading the malware to connected removable media. "It carries out destructive attacks against organizations across various sectors located within the Russian Federation," BI.ZONE said. "The group publishes information regarding successful attacks on its Telegram channel. It collaborates with the groups Cobalt Werewolf and Hoody Hyena." Chinese Hackers Target the Persian Gulf region with PlugX — A China-nexus threat actor, likely suspected to be Mustang Panda, has targeted countries in the Persian Gulf region. The activity took place within the first 24 hours of the ongoing conflict in the Middle East late last month. The campaign used a multi-stage attack chain that ultimately deployed a PlugX backdoor variant. "The shellcode and PlugX backdoor used obfuscation techniques such as control flow flattening (CFF) and mixed boolean arithmetic (MBA) to hinder reverse engineering," Zscaler said. "The PlugX variant in this campaign supports HTTPS for command-and-control (C2) communication and DNS-over-HTTPS (DOH) for domain resolution." Phishing Campaign Uses SEO Poisoning to Steal Data — A phishing campaign has employed SEO poisoning to direct search engine results to fake traffic ticket portals that impersonate the Government of Canada and specific provincial agencies. "The campaign lures victims to a fake 'Traffic Ticket Search Portal' under the pretense of paying outstanding traffic violations," Palo Alto Networks Unit 42 said. "Submitted data includes license plates, address, date of birth, phone/email, and credit card numbers." The phishing pages utilize a "waiting room" tactic where the victim's browser polls the server every two seconds and triggers redirects based on specific status codes. Roundcube Exploitation Toolkit Discovered — Hunt.io said it discovered a Roundcube exploitation toolkit on an internet-exposed directory on 203.161.50[.]145. It's worth noting that Russian threat actors like APT28, Winter Vivern, and TAG-70 have repeatedly targeted Roundcube vulnerabilities to breach Ukrainian organizations. "The directory included development and production XSS payloads, a Flask-based command-and-control server, CSS-injection tooling, operator bash history, and a Go-based implant deployed on a compromised Ukrainian web application," the company said, attributing it with medium to high confidence to APT28, citing overlaps with Operation RoundPress. The toolkit, dubbed Roundish, supports credential harvesting, persistent mail forwarding, bulk email exfiltration, address book theft, and two-factor authentication (2FA) secret extraction, mirroring a feature present in MDAEMON. One of the primary targets of the attack is mail.dmsu.gov[.]ua, a Roundcube webmail instance associated with Ukraine's State Migration Service (DMSU). Besides the possibility of a shared development lineage, Roundish introduces four new components not previously documented in APT28 webmail activity, including a CSS-based side-channel module, browser credential stealer, and a Go-based backdoor that provides persistence via cron, systemd, and SELinux. The CSS injection component is designed to progressively extract characters from Roundcube's document object model (DOM) without injecting any JavaScript into the victim's page. The technique is likely used for targeting Cross-Site Request Forgery (CSRF) tokens or email UIDs. Central to the Roundish toolkit is an XSS payload that's engineered to steal the victim's email address, harvest account credentials, redirect all incoming emails to a Proton Mail address, export mailbox data from the victim's Inbox and Sent folders, and gather the victim's complete address book. "The combination of hidden autofill credential harvesting, server-side mail forwarding persistence, bulk mailbox exfiltration, and browser credential theft reflects a modular approach designed for sustained access," Hunt.io said. "From a defensive perspective, password resets alone are not sufficient in cases like this. Mail forwarding rules, Sieve filters, and multi-factor authentication secrets must be audited and reset." Phishing Campaign Targeting AWS Console Credentials — An active adversary-in-the-middle (AiTM) phishing campaign is using fake security alert emails to steal AWS Console credentials, per Datadog. "The phishing kit proxies authentication to the legitimate AWS sign-in endpoint in real time, validating credentials before redirecting victims and likely capturing one-time password (OTP) codes," the company said. "This campaign does not exploit AWS vulnerabilities or abuse AWS infrastructure." Post-compromise console access has been observed within 20 minutes of credential submission. These efforts originated from Mullvad VPN infrastructure. Malicious npm Packages Deliver Cipher stealer — Two new malicious npm packages, bluelite-bot-manager and test-logsmodule-v-zisko, were found to deliver via Dropbox a Windows executable designed to siphon sensitive data, including Discord totems, credentials from Chrome, Edge, Opera, Brave, and Yandex browsers, and seed files from cryptocurrency wallet apps like Exodus. from compromised hosts using a stealer named Cipher stealer. "The stealer also uses an embedded Python script and a secondary payload downloaded from GitHub," JFrog said. GIBCRYPTO Ransomware Detailed — A new ransomware called GIBCRYPTO comes with the ability to capture keystrokes and corrupt the Master Boot Record (MBR) so that any attempt to restart the system will cause the system to run into an error. The ransomware uses the Salsa20 algorithm for encryption. It's suspected to be part of Snake Keylogger, indicating the malware authors' attempts to diversify beyond information theft. The development comes as Sygnia highlighted SafePay's OneDrive-based data exfiltration technique during a ransomware attack after breaching a victim by leveraging a FortiGate firewall flaw and a misconfigured administrative account. "SafePay gained initial access by exploiting a firewall misconfiguration, which enabled them to obtain local administrative credentials," the company said. "They rapidly escalated discovery and enumeration activities to identify high-value targets for lateral movement, demonstrating a structured and methodical approach to mapping the environment. Within a matter of hours, SafePay escalated to domain administrator access." The attack culminated in the deployment of ransomware, encrypting more than 60 servers. Fraudulent Account Registration Activity Originating from Vietnam — A sprawling cybercrime ecosystem based in Vietnam has been linked to a cluster of fraudulent account registration activity on platforms like LinkedIn, Instagram, Facebook, and TikTok. In these attacks, attributed to O-UNC-036, the threat actors rely on disposable email addresses in order to execute SMS pumping attacks, also called International Revenue Sharing Fraud (IRSF). "In this scheme, malicious actors automate the creation of puppet accounts in a targeted service provider," Okta said. "Fraudsters use these account registrations to trigger SMS messages to premium rate phone numbers and profit from charges incurred. This activity can prove costly for service providers who use SMS to verify registration information in customer accounts or to send multi-factor authentication (MFA) security codes." O-UNC-036 has also been linked to a cybercrime-as–a-service (CaaS) ecosystem that provides paid infrastructure and services to facilitate online fraud. The web-based storefronts are hosted in Vietnam and specialize in the sales of web-based accounts. Hijacked AppsFlyer SDK Distributes Crypto Clipper — The AppsFlyer Web SDK was briefly hijacked to serve malicious code to steal cryptocurrency in a supply chain attack. The clipper malware payload came with capabilities to intercept cryptocurrency wallet addresses entered on websites and replace them with attacker-controlled addresses to divert funds to the threat actor. "The AppsFlyer Web SDK was observed serving obfuscated malicious JavaScript instead of the legitimate SDK from websdk.appsflyer[.]com," Profero said. "The malicious payload appears to have been designed for stealth and compatibility, preserving legitimate SDK functionality while adding hidden browser hooks and wallet-hijacking logic." The incident has since been resolved by AppsFlyer. Operation CamelClone Targets Government and Defense Entities — A new cyber espionage campaign dubbed Operation CamelClone has targeted governments and defense entities in Algeria, Mongolia, Ukraine, and Kuwait using malicious ZIP archives that contain a Windows shortcut (LNK) file, which, when executed, delivers a JavaScript loader named HOPPINGANT. The loader then delivers additional payloads for establishing C2 and exfiltrating data to the MEGA cloud storage service. "One interesting aspect of this campaign is that the threat actor does not rely on traditional command-and-control infrastructure," Seqrite Labs said. "Instead, the payloads are hosted on a public file-sharing service, filebulldogs[.]com, while stolen data is uploaded to MEGA storage using the legitimate tool Rclone." The activity has not been attributed to any known threat group. How Threat Actors Exfiltrate Credentials Using Telegram Bots — Threat actors are abusing the Telegram Bot API to exfiltrate data via text messages or arbitrary file uploads, highlighting how legitimate services can be weaponized to evade detection. Agent Tesla Keylogger is by far the most prominent example of a malware family that uses Telegram for C2. "In general, Telegram C2s appear to be most popular among information stealers, possibly due to Telegram's technically legitimate nature and because information stealers typically only need to exfiltrate data passively rather than provide complex communications beyond simple message or file transfers," Cofense said. Microsoft Launches Copilot Health — Microsoft has become the latest company after OpenAI and Anthropic to launch a dedicated "secure space" called Copilot Health that integrates medical records, biometric data from wearables, and lab test results to give personalized advice in the U.S. "Copilot Health brings together your health records, wearable data, and health history into one place, then applies intelligence to turn them into a coherent story," the company said. Like OpenAI and Anthropic, Microsoft emphasized that Copilot Health isn't meant to replace professional medical care. Rogue AI Agents Can Work Together to Engage in Offensive Behaviors — According to a new report from artificial intelligence (AI) security company Irregular, agents can work together to hack into systems, escalate privileges, disable endpoint protection, and steal sensitive data while evading pattern-matching defenses. What's notable is that the experiment did not rely on adversarial prompting or deliberately unsafe system design. "In one case, an agent convinced another agent to carry out an offensive action, a form of inter-agent collusion that emerged with no external manipulation," Irregular said. "This scenario demonstrates two compounding risks: inter-agent persuasion can erode safety boundaries, and agents can independently develop techniques to circumvent security controls. When an agent is given access to tools or data, particularly but not exclusively shell or code access, the threat model should assume that the agent will use them, and that it will do so in unexpected and possibly malicious ways." 🔧 Cybersecurity Tools Dev Machine Guard → It is a free, open-source tool that scans your computer to show you exactly what developer tools and scripts are running. It creates a simple list of your AI coding assistants, code editor extensions, and software packages to help you find anything suspicious or outdated. It is a single script that works in seconds to give you better visibility into the security of your local coding environment. Trajan → It is an automated security tool designed to find hidden vulnerabilities in "service meshes," which are the systems that manage how different parts of a large software application talk to each other. Because these systems are complex, it is easy for engineers to make small mistakes in the settings that allow hackers to bypass security or steal data. Trajan works by scanning these configurations to spot those specific errors and helping developers fix them before they can be exploited. Disclaimer: For research and educational use only. Not security-audited. Review all code before use, test in isolated environments, and ensure compliance with applicable laws. Conclusion There’s a lot packed in here, and not in a neat way. Some of it is the usual recycled chaos, some of it feels a little more deliberate, and some of it has that nasty “this is going to show up everywhere by next week” energy. Anyway — enough throat-clearing. Here’s the stuff worth your attention.

Attackers use AiTM phishing kit, typosquatted domains to hijack AWS accounts Phishers are targeting AWS accounts holders with fake email security alerts and redirecting them to a high-fidelity clone of the AWS Management Console sign-in page, Datadog researchers have warned. The cloned AWS phishing page (Source: Datadog Security Labs) The campaign has been running since the end of February and possibly earlier. “In one observed case, the operator authenticated to a compromised AWS account within 20 minutes of credential submission,” the researchers noted. Fake AWS security alert emails lure cloud administrators to phishing pages The AWS Management Console is used by people who manage or interact with cloud resources in Amazon Web Services environments: cloud administratos, IT operation teams, DevOps engineers, security teams, and others. According to Datadog, these users have been targeted with a spoofed “AWS Organization Security Email,” ostensibly sent by noreply@security[.]aws. The fake AWS security alert email (Source: Datadog Security Labs) The email warns about suspicious activity in their organization’s cloud environments, asks recipients to take action and directs them to a phishing page hosted on typosquatted domains, which are designed to appear legitimate by using names that resemble AWS-related services or internal cloud tools. The adversary-in-the-middle (AitM) setup used in this campaign operates as a live proxy between victims and the legitimate AWS authentication service: authentication requests to AWS are relayed in real time, and the threat actor simultaneously capture credentials, authentication tokens, and likely multi-factor authentication (MFA) codes entered by the victims. “Within 20 minutes of credential submission, the attacker authenticated to the AWS Console from 185.209.196[.]132, a Mullvad VPN egress node. This rapid turnaround suggests either an automated credential-testing pipeline triggered on submission, or an operator actively monitoring the admin panel and acting on new captures,” the researchers noted. If attackers successfully gain access to an AWS console, the potential impact depends on the compromised account’s privileges. In high-permission environments, attackers could view sensitive data, modify cloud resources, deploy additional infrastructure, or create new identity and access management users to maintain persistence. Shared phishing kit linked to AWS, M365, and Apple impersonation The campaign relies entirely on social engineering and a rapidly rotated phishing infrastructure: several domains used in the campaign were registered shortly before being deployed, suggesting the operators are attempting to evade detection and takedowns. Organizations are advised to monitor for unusual AWS login activity, enforce strong MFA protections such as hardware security keys, and educate users about phishing attempts impersonating cloud service alerts. During their investigation, the researchers also identified two additional phishing kit servers exposing the same administrative panel used in this campaign. These servers were linked to recently created domains designed to impersonate Microsoft 365 and Apple iCloud. “These domains are not currently live. However, the common administrative panel could point towards a phishing kit that is shared among multiple actors,” the researchers added. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

A surge in attempts to compromise internet-connected surveillance cameras across the Middle East has been identified during the ongoing regional conflict, with activity attributed to infrastructure linked to Iranian threat actors. The targeting, which began intensifying on February 28, has affected Israel, Qatar, Bahrain, Kuwait, the UAE and Cyprus, with additional focused activity observed in parts of Lebanon on March 1. The findings, released by Check Point Research (CPR), point to a coordinated campaign against devices manufactured by Hikvision and Dahua. The researchers said the pattern of activity aligns with Iran's established military doctrine of using compromised cameras to support operational planning and battle damage assessment following missile strikes. Activity Tied To Regional Escalation According to CPR, the spike in exploitation attempts coincided with key geopolitical developments. Earlier, more targeted scanning was recorded on January 14–15, around the time Iran temporarily closed its airspace amid expectations of a possible US strike. Subsequent waves of activity aligned with other high-profile events, including: January 24 – A visit to Israel by the US Central Command commander during heightened tensions Early February – Public warnings from Iranian leadership that a US strike could spark wider regional conflict The infrastructure used in the campaign combines commercial VPN exit nodes, including Mullvad, ProtonVPN, Surfshark and NordVPN, along with virtual private servers assessed to be operated by multiple Iran-linked threat actors. Specific Vulnerabilities Exploited The campaign observed by CPR focused exclusively on Hikvision and Dahua products. Researchers observed scanning for known vulnerabilities, including authentication bypass and remote code execution (RCE) flaws. Patches are available for all identified issues. Check Point examined exploitation attempts involving CVE-2021-33044 and CVE-2017-7921, traced to infrastructure attributed to Iran and active since the start of the year. The researchers noted similar tactics during the 12-day conflict between Israel and Iran in June 2025. In one widely reported incident, a street camera facing the Weizmann Institute of Science was allegedly compromised shortly before a ballistic missile struck the site. The report concluded that monitoring camera-targeting activity from known Iranian-linked infrastructure may offer early warning of potential follow-on kinetic operations. To help mitigate these risks, defenders should eliminate public exposure by removing WAN access and using a VPN, while enforcing strong credentials and keeping firmware up-to-date. Additionally, they should implement network segmentation for cameras on a dedicated VLAN and monitor for unusual login attempts and outbound connections.

Interplay between Iranian Targeting of IP Cameras and Physical Warfare in the Middle East March 4, 2026 Key Findings During the ongoing conflict, we identified intensified targeting of IP cameras from two manufacturers starting on February 28, originating from infrastructure we attribute to Iranian threat actors. The targeting extends across Israel, Qatar, Bahrain, Kuwait, the UAE, and Cyprus – countries that have also experienced significant missile activity linked to Iran. On March 1st, we additionally observed camera-targeting activity focused on specific areas in Lebanon. We also observed earlier, more targeted activity against cameras in Israel and Qatar on January 14–15. These dates surround with Iran’s temporary closure of its airspace, reportedly amid expectations of a potential U.S. strike. Taken together, these findings are consistent with the assessment that Iran, as part of its doctrine, leverages camera compromise for operational support and ongoing battle damage assessment (BDA) for missile operations, potentially in some cases prior to missile launches. As a result, tracking camera-targeting activity from specific, attributed infrastructures may serve as an early indicator of potential follow-on kinetic activity. Introduction As highlighted in the Cyber Security Report 2026, cyber operations have increasingly become an additional tool in interstate conflicts, used both to support military operations and to enable ongoing battle damage assessment (BDA). During the 12-day conflict between Israel and Iran in June 2025, the compromise of cameras was likely used to support BDA and/or target-correction efforts. In the current Middle East conflict, Check Point Research has observed intensified targeting of cameras beginning in the first hours of hostilities, including a sharp increase in exploitation attempts against IP cameras not only in Israel but also across Gulf countries: specifically the UAE, Qatar, Bahrain, and Kuwait, as well as similar activity in Lebanon and Cyprus. This activity originated from multiple attack infrastructures that we attribute to several Iran-nexus threat actors. Notably, we also identified earlier activity exhibiting similar patterns, dated January 14, coinciding with the peak of anti-regime protests in Iran, a period during which Iran anticipated potential action from the United States and Israel and temporarily closed its airspace. Findings Check Point Research (CPR) continuously tracks infrastructure used by Iran-nexus threat actors. Starting February 28, we observed a spike in targeting of IP cameras in several countries in the Middle East including Israel,UAE, Qatar, Bahrain, Kuwait and Lebanon, while also similar activity occurred against Cyprus. The attack infrastructure we track combines specific commercial VPN exit nodes (Mullvad, ProtonVPN, Surfshark, NordVPN) and virtual private servers (VPS), and is assessed to be employed by multiple Iran-nexus actors. Scanning activity we observed targets cameras such as Hikvision and Dahua and aligns with attempts to identify exposure to the vulnerabilities listed below. No attempts to interact with other camera vendors were observed from this infrastructure. The popular devices of Hikvision and Dahua are targeted with the following vulnerabilities: Patches are available for all of the vulnerabilities listed above. As a case study, we conducted a deep dive into two of the CVEs listed above – CVE-2021-33044 and CVE-2017-7921 – and examined exploitation attempts originating from operational infrastructure we attribute to Iran, observed since the beginning of the year. Waves of activity against Israel: The spikes in this activity are closely aligned with geopolitical events around the same time: January 14-15 – While internal anti-regime protests in Iran peaked, Iranian officials and state media portrayed the unrest as a foreign-backed plot by Iran’s adversaries, including the United States and Israel and also closed its airspace. At the same time we also observe a wave of scans of cameras in the Iraqi Kurdistan. January 24 – The U.S. Central Command (CENTCOM) commander visited Israel and met with the Israel Defense Forces’ chief of staff amid heightened tensions. Beginning of February – Iran’s leadership was increasingly worried about a possible U.S. strike; Iranian/IRGC-linked messaging warned a strike could trigger a wider regional war. Waves of activity against Qatar: Waves of activity against Bahrain: Waves of activity against Kuwait: Waves of activity against United Arab Emirates: Waves of activity against Cyprus: Waves of activity against Lebanon: We observed similar targeting patterns during the 12-day war between Israel and Iran in June 2025, likely to support battle damage assessment (BDA) and/or targeting correction. One of the best-known cases occurred when Iran struck Israel’s Weizmann Institute of Science with a ballistic missile and had reportedly taken control of a street camera facing the building just prior to the hit Recommendations for Defenders: Eliminate public exposure: remove direct WAN access to cameras/NVRs; place them behind VPN or a zero-trust access gateway; block inbound port-forwards. Patch management: keep cameras/NVR firmware and management software updated – updates from the manufacturers are available; remove/replace end-of-life devices that no longer get security fixes. Network segmentation: isolate cameras on a dedicated VLAN with no lateral access to corporate/OT networks; tightly control outbound traffic (only to required update/cloud endpoints). “The Turkish Rat” Evolved Adwind in a Massive Ongoing Phishing Campaign Check Point Research Publications August 11, 2017 “The Next WannaCry” Vulnerability is Here Check Point Research Publications March 12, 2026 “Handala Hack” – Unveiling Group’s Modus Operandi SUBSCRIBE TO CYBER INTELLIGENCE REPORTS We value your privacy! BFSI uses cookies on this site. We use cookies to enable faster and easier experience for you. By continuing to visit this website you agree to our use of cookies.

A new infostealer named ‘Arkanix Stealer’ operated as a malware-as-a-service (MaaS) enterprise in a one-shot campaign, Kaspersky says. Implemented in both C++ and Python, the malware emerged in October 2025, when its developer started advertising it in underground forum posts, but likely ceased operations in December, when its control panel and Discord channel disappeared. While short-lived, Arkanix Stealer did provide miscreants with broad information-stealing capabilities, collecting system and user information, application details, browser data, Telegram and Discord data, VPN information, and stealing files from specific directories. As part of the MaaS, users were provided with access to a control panel allowing them to configure payloads and access statistics. Users were provided with a browser post-exploitation tool named ChromElevator, delivered via a native C++ version of the malware that could also harvest cryptocurrency wallet data. The Python variant of the stealer, Kaspersky says, was deployed via a Python script, often bundled with PyInstaller or Nuitka, and could dynamically modify its configuration by making GET requests to a remote server. Arkanix Stealer could collect broad system information, including CPU, GPU, RAM, OS, screen, keyboard, and time zone data, along with details on the installed software, including antivirus and VPN applications. It could also target 22 browsers to harvest information such as history, autofill information, passwords, cookies, and 0Auth2 data, as well as Telegram messages and Discord credentials. The analyzed stealer sample also contained a self-spreading feature, acquiring a list of the victim’s Discord friends and channels via the Discord API, and sending a configured message to them. Kaspersky also observed the malware collecting credentials from known VPN clients, such as Mullvad VPN, NordVPN, ExpressVPN, and ProtonVPN. Using a pre-defined set of paths, the malware was seen exfiltrating files from multiple directories associated with the current user, packing them in a ZIP archive, and sending them to the command-and-control (C&C) server. The malware could also fetch additional modules from the C&C to expand its capabilities. These modules include a Chrome grabber, a wallet patcher, an extra collector, and a Python script placed in the startup folder to be executed at system boot. The native variant uses VMProtect, without code virtualization, implements anti-analysis features, collects RDP connection details, targets gaming files and clients for credential theft, captures screenshots, and exfiltrates browser data. Kaspersky identified two servers used to host the stealer panel and monitor victims, both secured via a sign-in page. The malware’s developer also maintained a Discord channel to interact with users and implemented a referral program to attract customers. “This campaign tends to be more of a one-shot campaign for quick financial gains rather than a long-running infection. The panel and the Discord chat were taken down around December 2025, leaving no message or traces of further development or a resurgence,” Kaspersky notes. Related: ‘SolyxImmortal’ Information Stealer Emerges Related: Infostealer Malware Delivered in EmEditor Supply Chain Attack Related: New ‘Sandworm_Mode’ Supply Chain Attack Hits NPM Related: New Keenadu Android Malware Found on Thousands of Devices

An information-stealing malware operation named Arkanix Stealer, promoted on multiple dark web forums towards the end of 2025, was likely developed as an AI-assisted experiment. The project included a control panel and a Discord server for communication with users, but the author took them down without notification, just two months after the operation began. Arkanix offered many of the standard data-stealing features that cybercriminals are used to, along with a modular architecture and anti-analysis features. Kaspersky researchers analyzed the Arkanix stealer and found clues indicating LLM-assisted development, which "might have drastically reduced development time and costs." The researchers believe that Arkanix was a short-lived project for quick financial gains, which makes detection and tracking much more difficult. Arkanix appears online Arkanix started being promoted on hacker forums in October 2025, offering two tiers to potential customers: a basic level with a Python-based implementation, and a “premium” one with a native C++ payload using VMProtect protection, integrating AV evasion and wallet injection features. The developer set up a Discord server that acted as a forum for the community around the project to receive updates, provide feedback for proposed features, and receive help. Also, a referral program was established to promote the project more aggressively, giving referrers an extra free hour of premium access, while potential new customers received one week of free access to the “premium” version. Data-stealing capabilities Arkanix malware can collect system information, steal data stored in the browser (history, autofill info, cookies, passwords), and cryptocurrency wallet data from 22 browsers. Kaspersky researchers say that it can also extract 0Auth2 tokens on Chromium-based browsers. Additionally, the malware can steal data from Telegram, steal Discord credentials, spread via the Discord API, and send messages to the victim’s friends/channels. Arkanix also targets credentials for Mullvad, NordVPN, ExpressVPN, and ProtonVPN, and can archive files from the local filesystem to exfiltrate them asynchronously. Additional modules that can be downloaded from the command-and-control include a Chrome grabber, a wallet patcher for Exodus or Atomic, a screenshots tool, HVNC, and stealers for FileZilla and Steam. The “premium” native C++ version adds RDP credential theft, anti-sandbox and anti-debugging checks, WinAPI-powered screen capturing, and also targets Epic Games, Battle.net, Riot, Unreal Engine, Ubisoft Connect, and GOG. The higher-tier variant also delivers the ChromElevator post-exploitation tool, which injects into suspended browser processes for data theft and is designed to bypass Google's App-Bound Encryption (ABE) protection for unauthorized access to user credentials. The purpose of the Arkanix stealer experiment remains unclear. The project may be an attempt to determine how LLM assistance can improve malware development and how quickly new features can be shipped to the community. Kaspersky's assessment is that Arkanix is "more of a public software product than a shady stealer." The researchers provide a comprehensive list of indicators of compromise (IoCs) that include hashes for detected files, along with domains and IP addresses. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Introduction In October 2025, we discovered a series of forum posts advertising a previously unknown stealer, dubbed “Arkanix Stealer” by its authors. It operated under a MaaS (malware-as-a-service) model, providing users not only with the implant but also with access to a control panel featuring configurable payloads and statistics. The set of implants included a publicly available browser post-exploitation tool known as ChromElevator, which was delivered by a native C++ version of the stealer. This version featured a wide range of capabilities, from collecting system information to stealing cryptocurrency wallet data. Alongside that, we have also discovered Python implementation of the stealer capable of dynamically modifying its configuration. The Python version was often packed, thus giving the adversary multiple methods for distributing their malware. It is also worth noting that Arkanix was rather a one-shot malicious campaign: at the time of writing this article, the affiliate program appears to be already taken down. Kaspersky products detect this threat as Trojan-PSW.Win64.Coins.*, HEUR:Trojan-PSW.Multi.Disco.gen, Trojan.Python.Agent.*. Technical details Background In October 2025, a series of posts was discovered on various dark web forums, advertising a stealer referred to by its author as “Arkanix Stealer”. These posts detail the features of the stealer and include a link to a Discord server, which serves as the primary communication channel between the author and the users of the stealer. Upon further research utilizing public resources, we identified a set of implants associated with this stealer. Initial infection or spreading The initial infection vector remains unknown. However, based on some of the file names (such as steam_account_checker_pro_v1.py, discord_nitro_checker.py, and TikTokAccountBotter.exe) of the loader scripts we obtained, it can be concluded with high confidence that the initial infection vector involved phishing. Python loader The Python loader is the script responsible for downloading and executing the Python-based version of the Arkanix infostealer. We have observed both plaintext Python scripts and those bundled using PyInstaller or Nuitka, all of which share a common execution vector and are slightly obfuscated. These scripts often serve as decoys, initially appearing to contain legitimate code. Some of them do have useful functionality, and others do nothing apart from loading the stealer. Additionally, we have encountered samples that employ no obfuscation at all, in which the infostealer is launched in a separate thread via Python’s built-in threading module. Upon execution, the loader first installs the required packages — namely, requests, pycryptodome, and psutil — via the pip package manager, utilizing the subprocess module. On Microsoft Windows systems, the loader also installs pywin32. In some of the analyzed samples, this process is carried out twice. Since the loader does not perform any output validation of the module installation command, it proceeds to make a POST request to hxxps://arkanix[.]pw/api/session/create to register the current compromised machine on the panel with a predefined set of parameters even if the installation failed. After that, the stealer makes a GET request to hxxps://arkanix[.]pw/stealer.py and executes the downloaded payload. Python stealer version During our research, we obtained a sample of the Python implementation of the Arkanix stealer, which was downloaded from the endpoint hxxps://arkanix[.]pw/stealer.py by the previous stage. The stealer’s capabilities — or features, as referred to by the author — in this version are configurable, with the default configuration predefined within the script file. To dynamically update the feature list, the stealer makes a GET request to hxxps://arkanix[.]pw/api/features/{payload_id}, indicating that these capabilities can be modified on the panel side. The feature list is identical to the one that was described in the GDATA report. Prior to executing the information retrieval-related functions, the stealer makes a request to hxxps://arkanix[.]pw/upload_dropper.py, saves the response to %TEMP%\upd_{random 8-byte name}.py, and executes it. We do not have access to the contents of this script, which is referred to as the “dropper” by the attackers. During its main information retrieval routine, at the end of each processing stage, the collected information is serialized into JSON format and saved to a predefined path, such as %LOCALAPPDATA\Arkanix_lol\%info_class%.json. In the following, we will provide a more detailed description of the Python version’s data collection features. System info collection Arkanix Stealer is capable of collecting a set of info about the compromised system. This info includes: OS version CPU and GPU info RAM size Screen resolution Keyboard layout Time zone Installed software Antivirus software VPN Information collection is performed using standard shell commands with the exception of the VPN check. The latter is implemented by querying the endpoint hxxps://ipapi[.]co/json/ and verifying whether the associated IP address belongs to a known set of VPNs, proxies, or Tor exit nodes. Browser features This stealer is capable of extracting various types of data from supported browsers (22 in total, ranging from the widely popular Google Chrome to the Tor Browser). The list of supported browsers is hardcoded, and unlike other parameters, it cannot be modified during execution. In addition to a separate Chrome grabber module (which we’ll discuss later), the stealer itself supports the extraction of diverse information, such as: Browser history (URLs, visit count and last visit) Autofill information (email, phone, addresses and payment cards details) Saved passwords Cookies In case of Chromium-based browsers, 0Auth2 data is also extracted All information is decrypted using either the Windows DPAPI or AES, where applicable, and searched for relevant keywords. In the case of browser information collection, the stealer searches exclusively for keywords related to banking (e.g., “revolut”, “stripe”, “bank”) and cryptocurrencies (e.g., “binance”, “metamask”, “wallet”). In addition to this, the stealer is capable of extracting extension data from a hardcoded list of extensions associated with cryptocurrencies. Telegram info collection Telegram data collection begins with terminating the Telegram.exe process using the taskkill command. Subsequently, if the telegram_optimized feature is set to False, the malware zips the entire tdata directory (typically located at %APPDATA%\Roaming\Telegram Desktop\tdata) and transmits it to the attacker. Otherwise, it selectively copies and zips only the subdirectories containing valuable info, such as message log. The generated archive is sent to the endpoint /delivery with the filename tdata_session.zip. Discord capabilities The stealer includes two features connected with Discord: credentials stealing and self-spreading. The first one can be utilized to acquire credentials both from the standard client and custom clients. If the client is Chromium-based, the stealer employs the same data exfiltration mechanism as during browser credentials stealing. The self-spreading feature is configurable (meaning it can be disabled in the config). The stealer acquires the list of user’s friends and channels via the Discord API and sends a message provided by the attacker. This stealer does not support attaching files to such messages. VPN data collection The VPN collector is searching for a set of known VPN software to extract account credentials from the credentials file with a known path that gets parsed with a regular expression. The extraction occurs from the following set of applications: Mullvad VPN NordVPN ExpressVPN ProtonVPN File retrieval File retrieval is performed regardless of the configuration. The script relies on a predefined set of paths associated with the current user (such as Desktop, Download, etc.) and file extensions mainly connected with documents and media. The script also has a predefined list of filenames to exfiltrate. The extracted files are packed into a ZIP archive which is later sent to the C2 asynchronously. An interesting aspect is that the filename list includes several French words, such as “motdepasse” (French for “password”), “banque” (French for “bank”), “secret” (French for “secret”), and “compte” (French for “account”). Other payloads We were able to identify additional modules that are downloaded from the C2 rather than embedded into the stealer script; however, we weren’t able to obtain them. These modules can be described by the following table, with the “Details” column referring to the information that could be extracted from the main stealer code. The Wallet patcher and Extra collector scripts are received in an encrypted form from the C2 server. To decrypt them, the attackers utilize the AES-GCM algorithm in conjunction with PBKDF2 (HMAC and SHA256). After decryption, the additional payload has its template placeholders replaced and is stored under a partially randomized name within a temporary folder. Once all operations are completed, the stealer removes itself from the drive, along with the artifacts folder (Arkanix_lol in this case). Native version of stealer During our analysis, we were able to obtain both the release and debug versions of the native implementation, as both were uploaded to publicly available resources. The following are the key differences between the two: The release version employs VMProtect, but does not utilize code virtualization. The debug version communicates with a Discord bot for command and control (C2), whereas the release version uses the previously mentioned C2 domain arkanix[.]pw . The debug version includes extensive logging, presumably for the authors’ debugging purposes. Notably, the native implementation explicitly references the name of the stealer in the VersionInfo resources. This naming convention is consistent across both the debug version and certain samples containing the release version of the implant. After launching, the stealer implements a series of analysis countermeasures to verify that the application is not being executed within a sandboxed environment or run under a debugger. Following these checks, the sample patches AmsiScanBuffer and EtwEventWrite to prevent the triggering of any unwanted events by the system. Once the preliminary checks are completed, the sample proceeds to gather information about the system. The list of capabilities is hardcoded and cannot be modified from the server side, in contrast to the Python version. What is more, the feature list is quite similar to the Python version except a few ones. RDP connections The stealer is capable of collecting information about known RDP connections that the compromised user has. To achieve this, it searches for .rdp files in %USERPROFILE%\Documents and extracts the full server address, password, username and server port. Gaming files The stealer also targets gamers and is capable to steal credentials from the popular gaming platform clients, including: Steam Epic Games Launcher net Riot Origin Unreal Engine Ubisoft Connect GOG Screenshots The native version, unlike its Python counterpart, is capable of capturing screenshots for each monitor via capCreateCaptureWindowA WinAPI. In conclusion, this sample communicates with the C2 server through the same endpoints as the Python version. However, in this instance, all data is encrypted using the same AES-GCM + PBKDF2 (HMAC and SHA256) scheme as partially employed in the Python variant. In some observed samples, the key used was arkanix_secret_key_v20_2024. Alongside that, the C++ sample explicitly sets the User-Agent to ArkanixStealer/1.0. Post-exploitation browser data extractor This is an implant embedded within the resources of the C++ implementation. The author incorporated it into the resource section without applying any obfuscation or encryption. Subsequently, the stealer extracts the payload to a temporary folder with a randomly generated name composed of hexadecimal digits (0-9 and A-F) and executes it using the CreateProcess WinAPI. The payload itself is the unaltered publicly available project known as “ChromElevator”. To summarize, this tool consists of two components: an injector and the main payload. The injector initializes a direct syscall engine, spawns a suspended target browser process, and injects the decrypted code into it via Nt syscalls. The injected payload then decrypts the browser master key and exfiltrates data such as cookies, login information, web data, and so on. Infrastructure During the Arkanix campaign, two domains used in the attacks were identified. Although these domains were routed through Cloudflare, a real IP address was successfully discovered for one of them, namely, arkanix[.]pw. For the second one we only obtained a Cloudflare IP address. Both servers were also utilized to host the stealer panel, which allows attackers to monitor their victims. The contents of the panel are secured behind a sign-in page. Closer to the end of our research, the panel was seemingly taken down with no message or notice. Stealer promotion During the research of this campaign, we noticed that the forum posts advertising the stealer contained a link leading to a Discord server dubbed “Arkanix” by the authors. The server posed as a forum where authors posted various content and clients could ask various questions regarding this malicious software. While users mainly thank and ask about when the feature promised by the authors will be released and added into the stealer, the content made by the authors is broader. The adversary builds up the communication with potential buyers using the same marketing and communication methods real companies employ. To begin with, they warm up the audience by posting surveys about whether they should implement specific features, such as Discord injection and binding with a legitimate application (sic!). Additionally, the author promised to release a crypter as a side project in four to six weeks, at the end of October. As of now, the stealer seems to have been taken down without any notice while the crypter was never released. Furthermore, the Arkanix Stealer authors decided to implement a referral program to attract new customers. Referrers were promised an additional free hour to their premium license, while invited customers received seven days of free “premium” trial use. As stated in forum posts, the premium plan included the following features: C++ native stealer Exodus and Atomic cryptocurrency wallets injection Increased payload generation, up to 10 payloads Priority support Speaking of technical details, based on the screenshot of the Visual Studio stealer project that was sent to the Discord server, we can conclude that the author is German-speaking. This same screenshot also serves as a probable indicator of AI-assisted development as it shares the common patterns of such assistants, e.g. the presence of the utils.cpp file. What provides even more confidence is the overall code structure, the presence of comments and extensive debugging log output. Conclusions Information stealers have always posed as a serious threat to users’ data. Arkanix is no exception as it targets a wide range of users, from those interested in cryptocurrencies and gaming to those using online banking. It collects a vast amount of information including highly sensitive personal data. While being quite functional, it contains probable traces of LLM-assisted development which suggests that such assistance might have drastically reduced development time and costs. Hence it follows that this campaign tends to be more of a one-shot campaign for quick financial gains rather than a long-running infection. The panel and the Discord chat were taken down around December 2025, leaving no message or traces of further development or a resurgence. In addition, the developers behind the Arkanix Stealer decided to address the public, implementing a forum where they posted development insights, conducted surveys and even ran a referral program where you could get bonuses for “bringing a friend”. This behavior makes Arkanix more of a public software product than a shady stealer. Indicators of Compromise Additional IoCs are available to customers of our Threat Intelligence Reporting service. For more details, contact us at [email protected]. Domains and IPs arkanix[.]pw arkanix[.]ru

NNordVPN si è affermata nel panorama delle reti private virtuali come una delle soluzioni più rapide e stabili sul mercato. 🌍 Server: 8.000+ server in 129 paesi 📱 Massimo dispositivi: 10 📍 IP dedicato: ✔ 🆓 Versione Free: Garanzia rimborso di 30 giorni 💻 Compatibilità: Windows, macOS, Android, iOS 🔐 Sicurezza: IKEv2/IPsec, OpenVPN, NordLynx 👨💻 Assistenza 24/7: ✔ 🏢 Sede legale: Panama 🔥 Offerte attive: SCONTO fino al 74% In un’epoca in cui la sovranità del dato è costantemente minacciata da attori statali e criminalità informatica, l’analisi di un provider di tale portata non può prescindere da un esame rigoroso della sua architettura di rete e della trasparenza dei suoi processi di auditing. NordVPN offre: Accesso a oltre 9.500 server VPN in 224 località garantendo una connessione stabile ovunque. Compatibilità multi-dispositivo: un singolo account copre fino a 10 dispositivi (tutti i principali sistemi operativi e browser). Streaming più sicuro: permette di guardare contenuti in streaming senza rallentamenti, con larghezza di banda e velocità illimitate. Ricordiamo brevemente a cosa serve una VPN (Virtual Private Network): Cripta la nostra connessione Internet, proteggendo i nostri dati (come password o informazioni bancarie) da occhi indiscreti, specialmente quando usi reti Wi-Fi pubbliche non sicure. Privacy/anonimato: nasconde il nostro indirizzo IP reale, sostituendolo con quello del server VPN, rendendo molto più difficile tracciare la nostra attività online o identificare la nostra posizione geografica. Libertà di accesso: permette di accedere a contenuti o servizi che potrebbero essere limitati geograficamente (geo-bloccati), facendo sembrare che ci stiamo connettendo da un altro Paese. Indice degli argomenti La forza di NordVPN non risiede solo nell’ampiezza della rete globale, composta da migliaia di server distribuiti in oltre cento Paesi, ma soprattutto nell’efficienza del protocollo proprietario NordLynx. Quest’ultimo rappresenta un’evoluzione diretta del più leggero e moderno WireGuard, al quale aggiunge un sistema di gestione della privacy che elimina le criticità legate all’identificazione dell’utente. Grazie a questa architettura, NordVPN riesce a garantire un’esperienza d’uso estremamente fluida anche in attività complesse come lo streaming 4K, il gaming online o la condivisione di file di grandi dimensioni senza sacrificare la sicurezza. I test indipendenti condotti su connessioni in fibra ottica da 1 Gbps evidenziano come il mercato delle VPN sia ormai dominato da protocolli di nuova generazione in grado di minimizzare la perdita di banda dovuta alla crittografia. I dati consolidati mostrano che NordVPN si posiziona al vertice del settore per velocità e stabilità. I rilevamenti effettuati su scala globale posizionano i provider secondo la seguente efficienza di download: NordVPN (Protocollo NordLynx): 817 Mbps (vincitore assoluto per la velocità) ExpressVPN (Protocollo Lightway): 788 Mbps Proton VPN (Protocollo WireGuard): 758 Mbps Mullvad VPN (Protocollo WireGuard): 739 Mbps Norton VPN (Protocolli Misti): 725 Mbps La velocità di una VPN risente inevitabilmente della distanza fisica dal server, ma l’infrastruttura di NordVPN dimostra una forte resilienza: Origini europee (Regno Unito, Francia, Germania, Paesi Bassi): le performance sono massime grazie alla densità infrastrutturale. NordVPN registra una media di 842 Mbps nell’area europea, con picchi di 849 Mbps sui server olandesi. Origini Asia-Pacifico (Singapore, Sydney): nonostante il degrado naturale dovuto alla distanza, NordVPN mantiene una media di 790 Mbps (811 Mbps a Singapore e 769 Mbps a Sydney). Nord America (California): la connettività transpacifica e transatlantica si attesta su una media robusta di 806 Mbps. L’ottimizzazione del software garantisce che non vi siano discrepanze penalizzanti tra i diversi sistemi operativi: NordVPN su Windows: 822 Mbps (media) NordVPN su macOS: 811 Mbps (media) La differenza è minima (+1,4%), a conferma dell’eccellente parità di sviluppo del protocollo proprietario NordLynx su entrambi gli ambienti operativi. La velocità di una VPN è intrinsecamente legata alle regole di trasferimento dei dati (protocolli). L’efficienza del codice e gli algoritmi crittografici utilizzati fanno la differenza tra una connessione fluida e una soggetta a rallentamenti. La rivoluzione di WireGuard: i protocolli tradizionali come OpenVPN pagano il pegno di un codice massiccio (circa 70.000 righe di codice). WireGuard, introdotto nel 2015, si basa su appena 4.000 righe, riducendo drasticamente l’overhead di calcolo e i consumi energetici. Sfrutta inoltre l’efficiente cifrario ChaCha20, molto più snello rispetto al classico AES-256 a parità di sicurezza hardware. L’ottimizzazione NordLynx: NordLynx è l’implementazione proprietaria di NordVPN basata su WireGuard. Risolve i limiti nativi di WireGuard legati all’assegnazione statica degli IP (garantendo così la totale privacy e anonimato) e migliora le performance velocistiche. I dati di laboratorio confermano che NordLynx supera le implementazioni WireGuard standard degli altri concorrenti con un margine medio di 25 Mbps. Per garantire che i dati sopra riportati non siano inficiati da variabili esterne o fluttuazioni momentanee della rete, i test vengono eseguiti seguendo un rigido protocollo in cinque fasi: Rilevamento della linea di base: prima di avviare la VPN, viene verificata l’integrità del collegamento nativo a 10 Gbps per assicurarsi che l’instradamento di partenza sia privo di anomalie o colli di bottiglia. Standardizzazione dei parametri: vengono testate sistematicamente 11 località geografiche combinando ogni protocollo disponibile, generando un volume di circa 300 verifiche automatizzate al giorno per mapparne la costanza prestazionale. Isolamento dell’ambiente (Docker): ogni sessione di test viene eseguita all’interno di container Docker isolati. Questa procedura impedisce che processi in background del sistema operativo o conflitti software vadano a falsare i dati sulla velocità. Campionamento continuo H24: i test vengono eseguiti ciclicamente 24 ore su 24, 365 giorni all’anno, per neutralizzare l’impatto dei picchi di congestione della rete pubblica. Le metriche di download, upload e latenza (ping) vengono misurate tramite la CLI ufficiale di Speedtest by Ookla, parallelamente a stress test reali (streaming 4K/8K, gaming a basso ping e download di file massivi). Analisi degli scostamenti: i dati raccolti vengono confrontati direttamente con la velocità di base iniziale senza VPN. Ciò permette di calcolare la reale percentuale di ritenzione della banda, che nel caso di NordVPN supera l’eccellente soglia del 95% in condizioni ottimali. Una delle preoccupazioni più comuni riguardo l’utilizzo di una VPN è la possibile riduzione della velocità di connessione. Con NordVPN, tuttavia, questo impatto risulta minimo. I test più recenti mostrano che la perdita di velocità è inferiore al 10% rispetto alla connessione diretta, un risultato che pochi competitor riescono a replicare. Ciò significa che, anche con la crittografia attiva, il caricamento delle pagine web rimane istantaneo e le videoconferenze avvengono senza interruzioni. La tecnologia Smart Routing consente al sistema di scegliere automaticamente il server più vicino e meno congestionato, riducendo la latenza e migliorando la stabilità del segnale. In pratica, l’utente percepisce un’esperienza quasi indistinguibile da quella di una connessione non protetta, ma con il vantaggio aggiuntivo di una protezione completa dei dati. NordLynx è il cuore delle performance di NordVPN. Basato su WireGuard, utilizza un codice estremamente leggero e ottimizzato, in grado di gestire la crittografia con un consumo minimo di risorse di sistema. A differenza dei protocolli più datati come OpenVPN, NordLynx non appesantisce il traffico e riduce in modo significativo i tempi di handshake, ossia il processo di connessione tra client e server. Questo si traduce in connessioni più rapide, maggiore efficienza durante i trasferimenti e una latenza quasi nulla anche su reti mobili. La sua struttura a doppio NAT consente inoltre di separare completamente l’identità dell’utente dai dati di connessione, mantenendo così l’anonimato senza rinunciare alla velocità. NordLynx rappresenta quindi una delle innovazioni più importanti nel mondo delle VPN degli ultimi anni, capace di unire prestazioni di rete elevate e un livello di privacy senza compromessi. Per chi lavora da remoto o chi ha bisogno di gestire informazioni riservate la velocità non è tutto: ciò che conta davvero è la certezza che nessun dato venga tracciato o archiviato. NordVPN ha costruito la propria reputazione proprio su questo principio, adottando una politica no-log rigorosa e sottoposta a verifiche indipendenti. La combinazione tra crittografia AES-256, protezione DNS e infrastrutture basate su RAM-only server – che cancellano automaticamente ogni informazione a ogni riavvio – fa sì che nessun dato rimanga memorizzato. Questo approccio garantisce un ambiente di lavoro digitale sicuro, conforme alle normative internazionali e perfetto per professionisti, consulenti e aziende che devono tutelare la riservatezza delle comunicazioni. NordVPN non registra né conserva i dati di navigazione, e questa non è una semplice dichiarazione commerciale. Le verifiche condotte da società indipendenti come PwC e Deloitte hanno certificato più volte la conformità della politica no-log. In pratica, NordVPN non tiene traccia degli indirizzi IP, dei siti visitati o dei file scaricati, e nemmeno conserva registri temporanei delle sessioni. Anche qualora un’autorità richiedesse informazioni sull’attività di un utente, l’azienda non avrebbe nulla da fornire, perché i dati non vengono mai scritti su disco. Questo livello di trasparenza e affidabilità ha reso NordVPN uno strumento particolarmente apprezzato anche in ambito aziendale dove la gestione sicura delle informazioni è un requisito imprescindibile. La strategia di pricing di NordVPN si articola su tre livelli di servizio: Base, Completo e Ultimate Max distribuiti su tre diverse scadenze temporali: 2 anni, 1 anno, 1 mese. Il modello adotta una classica politica di sconti progressivi basata sulla fidelizzazione a lungo termine. Rappresenta la configurazione d’ingresso focalizzata sulla connettività protetta. Profilo economico: l’offerta di lancio presenta uno sconto del 69%, equivalente a una quota mensile di 3,49 €. Il corrispettivo totale anticipato per i primi 27 mesi è di 94,23 € (esclusa IVA). Condizioni di rinnovo: al termine del periodo promozionale, il contratto si rinnova automaticamente al costo standard di 139,08 € all’anno, salvo disdetta da parte dell’utente. Configurazione intermedia progettata per coniugare la protezione della rete alla gestione delle credenziali e dello storage. Profilo economico: il piano registra il massimo risparmio della gamma, pari al 75%, con un costo mensile di 4,49 €. Il pagamento anticipato richiesto per i primi 27 mesi si attesta a 121,23 € (più IVA). Condizioni di rinnovo: alla scadenza dei 27 mesi iniziali, l’abbonamento si rinnova automaticamente alla tariffa di 219,48 € all’anno. Il livello di servizio più completo, che estende la copertura oltre l’ambiente software tradizionale includendo tutele assicurative e funzionalità dedicate alla telefonia mobile. Profilo economico: il piano offre uno sconto del 69%, traducendosi in un canone mensile di 8,49 €. L’addebito iniziale e anticipato per l’intero blocco di 27 mesi è pari a 229,23 € (più eventuale IVA). Condizioni di rinnovo: il mantenimento automatico del servizio oltre il primo ciclo promozionale prevede una quota di rinnovo fissata a 338,28 € all’anno. Per gli utenti che desiderano ridurre il vincolo temporale rispetto alla formula biennale, la strategia di pricing di NordVPN prevede la declinazione dei tre piani, Base, Completo e Ultimate Max, su un orizzonte contrattuale di 12 mesi. Anche in questo caso, la fatturazione iniziale avviene in un’unica soluzione anticipata, con rinnovo automatico a tariffa standard allo scadere del primo anno. Configurazione essenziale focalizzata esclusivamente sulle performance di rete e la cifratura del traffico. Profilo economico: l’offerta annuale prevede un risparmio del 52%, che si traduce in un canone mensile equivalente di 5,49 €. La spesa complessiva da corrispondere all’atto dell’attivazione è pari a 65,88 € (al lordo di eventuale IVA locale). Condizioni di rinnovo: al termine dei primi 12 mesi, l’abbonamento si rinnova automaticamente al prezzo standard di 139,08 € all’anno. Il pacchetto intermedio che integra i servizi di cybersecurity avanzata, storage crittografato e password management. Profilo economico: registra il maggior tasso di risparmio della linea annuale, pari al 64%, con una quota mensile di 6,49 €. Il corrispettivo totale anticipato per il primo anno si attesta a 77,88 € (più eventuale IVA). Condizioni di rinnovo: alla scadenza del dodicesimo mese, il mantenimento del servizio prevede un costo di rinnovo automatizzato pari a 219,48 € all’anno. Il piano omnicomprensivo che estende la tutela software a coperture assicurative legali e strumenti di protezione per le telecomunicazioni mobili. Profilo economico: l’offerta di lancio genera un risparmio del 62%, determinando una quota mensile equivalente di 10,49 €. L’esborso iniziale richiesto per la copertura annuale è di 125,88 € (più eventuale IVA). Condizioni di rinnovo: il ciclo di fatturazione successivo alla prima scadenza si adegua alla tariffa standard di 338,28 € all’anno. La tabella sottostante mette a confronto i flussi di cassa iniziali e le relative quote mensili tra le formule a 12 e 27 mesi (24 mesi + 3 extra): La terza opzione prevista dalla strategia di pricing di NordVPN è rappresentata dai piani mensili (ricorrenti su singolo mese). Questa formula esclude qualsiasi vincolo di permanenza a lungo termine, ma comporta l’azzeramento degli sconti di lancio e l’applicazione della tariffa intera. Sotto il profilo economico-finanziario, si tratta della soluzione con il costo d’ingresso operativo più elevato, indicata principalmente per esigenze spot, utilizzi a brevissimo termine (come trasferte di lavoro o viaggi internazionali temporanei) o per testare l’infrastruttura prima di un investimento pluriennale. Fornisce l’accesso completo alla rete VPN, alla crittografia dei dati e al supporto per 10 dispositivi simultanei. Profilo economico: La tariffa si attesta a 14,99 € al mese, con uno sconto pari allo 0%. L’addebito avviene su base ricorrente ogni 30 giorni (al lordo di eventuale IVA applicabile). Il piano intermedio che include la suite di cybersecurity avanzata (antimalware, password manager e 1 TB di storage cloud). Profilo economico: Il costo fisso mensile è di 19,99 € al mese. Non sono previste riduzioni di prezzo promozionali per questa durata contrattuale. La configurazione omnicomprensiva con IP dedicato, assicurazione cyber fino a 5.000 € e sistemi di protezione per le telecomunicazioni mobili. Profilo economico: Rappresenta il pacchetto premium della gamma, con un canone fissato a 23,79 € al mese e addebito automatico mensile. Per ottimizzare la pianificazione della spesa informatica, la tabella sottostante sintetizza l’impatto finanziario delle tre durate contrattuali per ciascun piano, evidenziando il risparmio generato dalle formule di fidelizzazione. Performance di rete stabili: grazie all’architettura del protocollo proprietario NordLynx (basato su WireGuard), la ritenzione della banda supera il 95% in condizioni ottimali, riducendo al minimo l’overhead di calcolo e garantendo latenze ridotte per flussi video in 4K/8K o trasferimenti dati massivi. Infrastruttura di sicurezza avanzata: l’utilizzo esclusivo di server basati su memoria RAM-only assicura la cancellazione automatica di qualsiasi dato a ogni riavvio. La politica no-log è regolarmente verificata e certificata da audit indipendenti (PwC e Deloitte). Funzionalità edge integrate: l’ecosistema si estende oltre la cifratura standard grazie a Threat Protection Pro (per il blocco a monte di malware e tracker anche a VPN disattivata) e Meshnet, che consente di configurare reti private virtuali crittografate per team di lavoro distribuiti. Tutele assicurative localizzate: l’inclusione di una polizza di Assicurazione Cyber fino a 5.000 € nel piano premium rappresenta un elemento distintivo di mitigazione del rischio finanziario in caso di frode o furto d’identità. Dinamica dei costi di rinnovo: il modello di pricing adotta una politica di forte asimmetria tra l’offerta di lancio e i costi di mantenimento. Al termine del primo ciclo promozionale, le tariffe standard subiscono un incremento significativo (es. il piano Base passa da 3,49 €/mese a 139,08 € all’anno). Flusso di cassa anticipato: le formule pluriennali e annuali non prevedono una dilazione di pagamento mensile. Il capitale complessivo richiesto per l’intero periodo di copertura deve essere corrisposto in un’unica soluzione al momento della sottoscrizione. Vincoli geopolitici sull’assicurazione: i servizi di copertura assicurativa e di rimborso spese legati al piano Ultimate Max non sono universali, ma risultano legalmente validi solo per i residenti in una ristretta selezione di Paesi europei (tra cui l’Italia). Politica di pre-addebito automatica: il sistema amministrativo processa i pagamenti per i rinnovi successivi fino a 14 giorni prima della scadenza naturale del contratto, rendendo necessaria una pianificazione tempestiva dell’eventuale disdetta. 🌍 Server: 8.000+ server in 129 paesi 📱 Massimo dispositivi: 10 📍 IP dedicato: ✔ 🆓 Versione Free: Garanzia rimborso di 30 giorni 💻 Compatibilità: Windows, macOS, Android, iOS 🔐 Sicurezza: IKEv2/IPsec, OpenVPN, NordLynx 👨💻 Assistenza 24/7: ✔ 🏢 Sede legale: Panama 🔥 Offerte attive: SCONTO fino al 74% La sicurezza di una VPN non dipende solo dalla crittografia ma anche dalla capacità di proteggere l’utente in caso di interruzioni o vulnerabilità. La funzione Kill Switch di NordVPN interviene proprio in questi momenti critici: se la connessione VPN cade, la rete viene automaticamente disattivata, impedendo qualsiasi trasmissione non protetta. In parallelo, la modalità Double VPN instrada i dati attraverso due server diversi, applicando un doppio livello di cifratura. Questo sistema, sebbene leggermente più pesante in termini di risorse, offre una barriera quasi impenetrabile per chi deve gestire documenti aziendali, operazioni finanziarie o accessi remoti a infrastrutture sensibili. In combinazione queste due funzioni rendono NordVPN una delle scelte più solide per chi non vuole correre rischi quando lavora online. 🌍 Server: 8.000+ server in 129 paesi 📱 Massimo dispositivi: 10 📍 IP dedicato: ✔ 🆓 Versione Free: Garanzia rimborso di 30 giorni 💻 Compatibilità: Windows, macOS, Android, iOS 🔐 Sicurezza: IKEv2/IPsec, OpenVPN, NordLynx 👨💻 Assistenza 24/7: ✔ 🏢 Sede legale: Panama 🔥 Offerte attive: SCONTO fino al 74% NordVPN non si limita più a essere una semplice rete privata virtuale: con le funzioni Threat Protection Pro e Meshnet, si trasforma in una vera e propria piattaforma di sicurezza digitale. Threat Protection Pro opera come un sistema di difesa sempre attivo che blocca malware, tracker e siti dannosi ancora prima che possano compromettere il dispositivo. Funziona anche quando la VPN è disattivata, fornendo una protezione costante contro le minacce del web. Meshnet, invece, permette di creare connessioni dirette e sicure tra dispositivi in qualsiasi parte del mondo come se fossero collegati alla stessa rete locale. È una soluzione ideale per team di lavoro distribuiti, sviluppatori o gamer che desiderano condividere file o giocare in LAN senza esporre i propri indirizzi IP reali. NordVPN ha ampliato il proprio raggio d’azione ben oltre la tradizionale navigazione anonima, introducendo con Threat Protection Pro una tecnologia che agisce come un vero e proprio scudo digitale sempre attivo. Questo sistema analizza in tempo reale i file scaricati, le connessioni in uscita e i siti visitati, bloccando automaticamente malware, spyware, tracker pubblicitari e domini compromessi. Il suo funzionamento è integrato direttamente all’interno del client NordVPN, quindi non richiede software aggiuntivi o configurazioni complesse. L’aspetto più interessante di Threat Protection Pro è che continua a operare anche quando la VPN non è attiva, garantendo una protezione costante a livello di sistema operativo. Ciò significa che ogni volta che un utente apre un sito, clicca su un link o scarica un documento, il contenuto viene analizzato e filtrato prima che possa causare danni. Questo approccio proattivo, basato su una combinazione di intelligenza artificiale e database di minacce aggiornati quotidianamente, consente di prevenire la maggior parte degli attacchi informatici prima ancora che raggiungano il dispositivo. Meshnet rappresenta una delle innovazioni più distintive di NordVPN. Si tratta di una funzione che consente di collegare più dispositivi tra loro, ovunque si trovino, come se appartenessero alla stessa rete locale. Attraverso un tunnel crittografato e un indirizzo IP dedicato per ciascun dispositivo, Meshnet permette di condividere file, accedere a computer remoti, lavorare in team o organizzare sessioni di gaming in totale sicurezza. Questa funzionalità elimina la necessità di soluzioni VPN aziendali complesse o configurazioni manuali, perché ogni connessione è gestita automaticamente dall’app NordVPN. È particolarmente utile per chi lavora da remoto e deve accedere in modo sicuro a server o risorse aziendali, ma anche per professionisti IT o creativi che vogliono collaborare in ambienti distribuiti senza esporre la propria rete. Con Meshnet, NordVPN diventa non solo uno strumento di protezione individuale, ma un vero strumento di connessione privata globale. 🌍 Server: 8.000+ server in 129 paesi 📱 Massimo dispositivi: 10 📍 IP dedicato: ✔ 🆓 Versione Free: Garanzia rimborso di 30 giorni 💻 Compatibilità: Windows, macOS, Android, iOS 🔐 Sicurezza: IKEv2/IPsec, OpenVPN, NordLynx 👨💻 Assistenza 24/7: ✔ 🏢 Sede legale: Panama 🔥 Offerte attive: SCONTO fino al 74% L’efficacia di una VPN non dipende solo dalla sicurezza o dalla velocità ma anche dalla facilità con cui può essere integrata nel proprio ecosistema digitale. NordVPN è progettata per funzionare senza difficoltà su ogni tipo di infrastruttura, dalle workstation aziendali ai dispositivi mobili, fino ai router domestici o professionali. La configurazione iniziale è estremamente semplice: bastano pochi minuti per installare l’app, accedere con le proprie credenziali e scegliere il server più adatto alle proprie esigenze. Il client gestisce automaticamente i protocolli e le impostazioni, rendendo la protezione accessibile anche a chi non ha competenze tecniche. Questa immediatezza d’uso non toglie flessibilità agli utenti più esperti, che possono comunque configurare manualmente protocolli, server preferiti o regole di connessione. NordVPN è quindi uno strumento che si adatta tanto alle esigenze del singolo utente quanto a quelle di un reparto IT che desidera garantire la sicurezza di un’intera rete aziendale. L’esperienza utente di NordVPN è uno dei suoi principali punti di forza. Le app desktop e mobile presentano un’interfaccia pulita, con una mappa interattiva che permette di scegliere il Paese di connessione semplicemente cliccando sulla località desiderata. Le funzioni principali, come il Kill Switch o la selezione del protocollo NordLynx, sono accessibili con un solo tocco, rendendo la navigazione sicura immediata anche per chi non ha familiarità con le VPN. Sui dispositivi mobili, l’app mantiene la stessa fluidità e chiarezza visiva delle versioni desktop. La connessione automatica si attiva in pochi secondi, mentre le impostazioni avanzate sono organizzate in modo logico e intuitivo. Questo approccio all’usabilità dimostra l’impegno di NordVPN nel rendere la sicurezza digitale un’esperienza alla portata di tutti, senza rinunciare alla potenza tecnica che la distingue. NordVPN offre un supporto esteso anche per dispositivi e sistemi operativi meno comuni. L’installazione su router consente di proteggere automaticamente ogni dispositivo connesso alla rete, anche quelli che non supportano un’app VPN nativa, come smart TV o console di gioco. L’azienda fornisce guide dettagliate per i modelli più diffusi, con firmware compatibili come AsusWRT, DD-WRT e OpenWRT. Per gli utenti Linux, NordVPN mette a disposizione un’app dedicata a riga di comando, compatibile con le principali distribuzioni e dotata delle stesse funzionalità delle versioni grafiche. Il servizio di assistenza tecnica, disponibile 24 ore su 24 tramite chat o email, accompagna l’utente in ogni fase della configurazione, garantendo un’integrazione perfetta anche in ambienti professionali. Questa versatilità rende NordVPN adatta a qualsiasi infrastruttura, dal semplice utilizzo domestico fino alle implementazioni più avanzate nel mondo aziendale. NordVPN permette di provare il servizio senza alcun rischio grazie alla garanzia di rimborso entro trenta giorni. Questo periodo consente di testare la velocità, verificare la compatibilità con i propri dispositivi e valutare la qualità delle funzioni aggiuntive come Threat Protection Pro o Meshnet. In caso di insoddisfazione il rimborso viene processato in modo rapido e trasparente, senza penalità o clausole nascoste. Questa politica commerciale riflette la fiducia che l’azienda ripone nella propria tecnologia e nell’esperienza d’uso che offre. NordVPN è la scelta raccomandata per chi cerca una soluzione “chiavi in mano” che bilanci estrema facilità d’uso e protocolli di sicurezza di livello enterprise.