tor

The U.S. has charged 17 Iranians, alleged members of a hacking-for-hire company called Mabna Institute, involved in years-long operations that stole data from American organizations. Nine of the defendants were previously charged in a March 2018 indictment for hacking more than 300 universities and private companies. The U.S. Justice Department (DoJ) has also announced rewards of up to $10 million for information leading to the location of five of the 17 Iranian defendants. According to the U.S. government, the newly charged eight individuals stole academic research, intellectual property, emails, and other proprietary information. The DoJ says that the Iranians listed below were involved in cyber operations for the Islamic Republic of Iran’s Islamic Revolutionary Guard Corps (IRGC), other Iranian government bodies, universities, and paying customers. Saeid Houshyar Behzad Mesri, aka “Skote Vahshat” Manouchehr Hashemloo Keyvan Fayaz, aka “Achilles,” “The Joker,” and “bc.monster” Amir Barati Saber Shahbazi Ballojeh Arman Kahzadian Mojtaba Galekuhi, aka “Mojtaba Ghaleh Koui” “Today’s charges, which include eight additional defendants, reveal the broader network allegedly behind a sweeping, state-sponsored campaign to steal research and intellectual property from American universities, businesses, and government institutions,” stated U.S. Attorney Jamie McDonald. “More than eight years after making the original indictment public, these charges make clear that the passage of time will not deter us from identifying and pursuing those who target the United States from abroad.” The DoJ's announcement says the operation is believed to have begun around 2013 and targeted the accounts of more than 100,000 professors worldwide, successfully compromising roughly 8,000 of them. Using access to these accounts, the hackers reportedly stole 31.5 terabytes of academic data, including journals, theses, dissertations, ebooks, and research across numerous disciplines, valued at approximately $3.4 billion. This activity has impacted 178 universities, 144 of which are in the U.S., at least 53 private firms, 42 of which are in the U.S., two NGOs, and at least 10 U.S. state agencies. One of the victims highlighted in the announcement was HBO, which was reportedly extorted for $6 million worth of Bitcoin. The defendants now face charges related to conspiracy to commit computer intrusions, wire fraud, unauthorized access for financial gain, and aggravated identity theft, which can incur maximum penalties of up to 20 years in prison. The State Department has also announced it is offering rewards of up to $10,000,000 for information leading to the whereabouts of Behzad Mesri, Mojtaba Galekuhi, Arman Kahzadian, Keyvan Fayaz, and Saber Shahbazi Ballojeh. A Tor link has also been provided to allow anonymous submissions. All defendants are presumed innocent until proven guilty in a court of law. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

We are providing a content warning because the following article contains usage of a racial slur by a threat actor, which Unit 42 does not condone in any instance. We have partially redacted the racial slur, but preserved some references to it in order to provide researchers with the ability to identify it and check IoCs as needed. We identified a new version (v7) of the Kimwolf Android/internet-of-things (IoT) botnet. This version upgrades its distributed denial-of-service (DDoS) attack capabilities and the resilience of its command-and-control (C2) infrastructure. Kimwolf primarily affects Android TV boxes and set-top boxes. Kimwolf v7 adds an HTTP/2-based DDoS flood that constructs complete browser fingerprints. This makes attack traffic more difficult to distinguish from legitimate browsing. The threat’s binary includes five hard-coded public Ethereum-based endpoints for resolving Ethereum Name Service (ENS) domains. ENS is a blockchain-based naming system used to obtain C2 addresses. Kimwolf also carries a hard-coded Tor .onion hidden service as a backup and a local proxy architecture for flexible routing between clearnet and Tor. The malware developers added this function to directly respond to C2 server takedown efforts in December 2025. We discovered this variant on Feb. 3, 2026, through threat hunting that followed public disclosures by XLab, Synthient, Infoblox, Cloudflare and others. Palo Alto Networks customers are better protected through the following products and services: If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team. The Kimwolf botnet (also tracked as AISURU) has been active since August 2024. It initially targeted Linux IoT devices under the AISURU name. The botnet transitioned to Android TV boxes around August 2025. This reflects two separate codebases under the same operators. AISURU covers the Linux IoT variants, and Kimwolf covers variants targeting Android. Kimwolf spreads by misusing residential proxy services to reach unauthenticated Android Debug Bridge (ADB) instances on local networks. Some Android TV boxes ship with ADB enabled on port 5555. Once attackers tunnel through a proxy endpoint into the local network, they can install the malware without any authentication. The Kimwolf sample we analyzed as a baseline is a statically linked ARM Executable and Linkable Format (ELF) binary. The file was compiled with the Android Native Development Kit (NDK) using Clang and uses Bionic libc. It statically links BoringSSL for Transport Layer Security (TLS) operations and nghttp2 for HTTP/2 functionality. The binary is stripped but retains some symbol information. It is not uncommon for malware authors to use racial slurs in their code. The Kimwolf malware family has historically included racial slurs. In our discussion of the v7 variant, we have partially redacted these slurs, but have left enough information present that defenders could identify the variant and check for IoCs. Previous Kimwolf builds used the internal version strings such as n[redacted]boxv4 and n[redacted]boxv5, establishing the naming pattern for the family. The version string n[redacted]boxv7, shown in Figure 1, identifies this sample as version 7. The binary creates a Unix domain socket @n[redacted]boxv7 to ensure only one instance runs at a time. On execution, the malware masks its process name as netd_service to blend in with legitimate Android system processes. We identified six ELF samples that we clustered together based on multiple indicators: They share an identical ELF section layout produced by a common Android NDK build environment, and the same hard-coded set of Ethereum remote procedure call (RPC) endpoints Overlapping C2 infrastructure within the same hosting provider Consistent process-name masquerading behavior One of the most notable new capabilities in Kimwolf v7 is an HTTP/2 flood powered by the nghttp2 library. The function that performs the attack_case17_http2_flood constructs complete browser fingerprints. This makes the flood traffic difficult to distinguish from legitimate browser requests. Figure 2 shows the header construction logic in the decompiled binary. Kimwolf v7 uses a layered C2 resolution system designed to survive the domain takedowns that disrupted the botnet twice in December 2025. This isn't the last time operation of this malware faced disruption. On March 19, 2026, the U.S. Justice Department and international partners announced a court-authorized operation that seized C2 infrastructure used by the Aisuru, KimWolf, JackSkid and Mossad botnets. The binary contains five hard-coded public Ethereum RPC endpoints stored in plaintext, shown in Figure 3: hxxps[:]//0xrpc[.]io/eth hxxps[:]//eth.llamarpc[.]com hxxps[:]//ethereum-rpc.publicnode[.]com hxxps[:]//eth-protect.rpc.blxrbdn[.]com hxxps[:]//eth.merkle[.]io These endpoints are legitimate public Ethereum RPC services. The malware misuses them to query ENS domain records and resolve C2 addresses. Organizations should monitor for unusual Ethereum RPC traffic from IoT and Android devices rather than blocking these endpoints outright. The malware shuffles these endpoints using a pseudo-random number generator (PRNG) before each resolution attempt. The five-way redundancy makes blocking ENS-based C2 resolution harder. While the five public RPC endpoints in the baseline binary are third-party services, our infrastructure investigation identified a sixth endpoint that we assess with moderate confidence to be under the operator's control: eth[.]rpcuniverse[.]com. Several properties distinguish it from the legitimate providers: The legitimate endpoints are established services with significant traffic and resolve to multiple anycast IP addresses across major cloud delivery network (CDN) and cloud providers They have apex domains registered between 2005 and 2022 The rpcuniverse[.]com domain has no global traffic ranking - It resolves to a single IP address on a low-cost virtual private server (VPS) that was registered on Dec. 12, 2023 - Its TLS certificate first appeared on the hosting IP address days later - Reverse passive DNS shows the IP address hosts only rpcuniverse[.]com subdomains with no other tenants Two Kimwolf samples hardcode eth[.]rpcuniverse[.]com as an additional RPC endpoint alongside the five legitimate providers - Both ELF and Android APK variants contact the hosting IP address directly - We did not observe this direct-to-IP address contact pattern with any of the legitimate RPC endpoints We cannot confirm domain ownership. However, the dedicated single-tenant hosting, the timing of its registration relative to Kimwolf activity and its exclusive presence in Kimwolf binaries suggest it is an operator-controlled facade rather than a public service. When ENS resolution fails, the v7 binary falls back to a hard-coded v3 Tor .onion address (edctgwib2n5l34t525zkxqzk5bqb6e5il2yiq5r6zu7gtlxa4uosn3qd[.]onion). Figure 4 shows the hard-coded address in the binary. A function (tor_proxy_state_machine) manages the protocol states. To do this, it performs the following activities: Sending the greeting (0x05 0x01 0x00) Building a CONNECT request with domain type 0x03 and the 62-byte .onion address Waiting for the response and performing a TLS handshake over the tunnel Figure 5 shows the greeting and TLS handshake states. Additionally, it uses a local proxy architecture. All C2 traffic routes through a local proxy at 127.0.0[.]1:23075 shown in Figure 6, regardless of whether it is destined for clearnet or Tor. This modular design allows the proxy component to be updated independently from the main bot binary. Analysis of Kimwolf v7 samples revealed C2 connections to several IP addresses, including: 212.193.31[.]119 and 212.193.31[.]122 on TCP port 13 212.193.31[.]92 and 212.193.31[.]158 on TCP port 443 None of these IP addresses had prior indicators of malicious activity or associations with public threat intelligence. During infrastructure analysis, we observed that these hosts presented the same SSH host key. Pivoting on that shared key revealed 22 total IP addresses within the same range, presenting the identical key between Dec. 18, 2025, and Feb. 3, 2026. No hosts outside this range shared the key. IP address 212.193.31[.]102 was the first host observed with this key on Dec. 18, 2025, and it was the seed from which the configuration propagated. The remaining 21 hosts appeared over the following six weeks, with the last addition on Jan. 31, 2026. All 22 hosts reside in AS202799, geolocated to Saint Petersburg, Russia. Kimwolf implements a dedicated high-performance UDP flood function that uses a Xorshift256 PRNG seeded from /dev/urandom. It (prng_seed_from_urandom) reads 32 bytes (four 64-bit state words) to initialize the full 256-bit state. A SplitMix64 fallback initializer activates if /dev/urandom is unavailable. The flood function accelerates IP/UDP checksum computation with ARM NEON single instruction, multiple data (SIMD) instructions. The vectorized checksum loop processes four 16-bit halfwords simultaneously using VLD1.16, VADDW.U16 and VADD.I32 instructions. This optimization is tailored for the ARM processors found in Android TV boxes. It reduces per-packet checksum overhead to maximize throughput. Figure 7 shows the NEON SIMD instructions in the disassembled binary. The dispatch table supports 15 DDoS methods across Layers 3–7 of the Open Systems Interconnection (OSI) model. Cases 8, 11 and 13 are absent from the switch statement, suggesting they are either reserved for future use or were removed during consolidation from the 43 text-named methods in prior versions. Table 1 lists all 15 attack methods. Table 1. Kimwolf v7 DDoS attack methods. In Kimwolf v7, malware authors consolidated the attack count to 15 numbered methods. They removed all scanning, exploitation and brute-force functionality. The new additions target: DDoS stealth through HTTP/2 with browser fingerprinting C2 resilience through ENS, Tor and the local proxy The removal of the scanner and exploit modules suggests the operators have separated the propagation pipeline from the DDoS bot. External loaders now handle initial access while the Kimwolf binary handles attacks and proxy relay. The earliest dropped sample, targeting the x86 architecture with a Dirty COW exploit, suggests the family evolved from traditional Linux exploitation toward the current ADB-based Android propagation model. The transition from libn[redacted]kernel.so to the less conspicuous libdevice.so filename in November 2025, followed by a revert in December, indicates active operational security adjustments. Alongside the standalone ELF payloads, the Kimwolf operators distribute Android APK packages that bundle an ELF kernel payload inside a Java wrapper. We identified eight APK samples spanning October through December 2025, all sharing the component class systemservice0644.N[redacted]Kernel. These APKs masquerade as a system service called SystemService. On execution, they probe for root access and execute the embedded ELF kernel with commands shown below in Figure 8. The earliest build (October 2025) used the com. Android prefix and bundled three kernel variants in a single APK. By late October, the package name shifted to com.n2.systemservice0644, and the kernel was consolidated to a single binary. In November, the kernel filename changed from libn[redacted]kernel.so to libdevice.so, then reverted in the December builds. Three signing certificates appear across the cluster: The original Kimwolf APK certificate (C=CN, CN=a) used by the com.android.logcatd variants An Android Debug certificate used during development A self-signed certificate with subject C=XK, ST=lol, L=lol, O=lol, OU=lol, CN=lol (country code XK for Kosovo, all other fields set to lol) used by five of the eight N[redacted]Kernel APK files The APK wrapper drops one of three ELF kernel payloads, depending on the build. These are listed in Table 2. Table 2. Dropped ELF kernel payloads. The earliest sample (first seen Sept. 2, 2025) is notable for two reasons: It targets x86 architecture rather than ARM - This indicates that the botnet originally targeted x86 Linux systems before pivoting to ARM-based IoT and Android devices It drops a file named libcow.so, and renames its process to inetd to blend in with Unix network services - The name libcow.so is likely a reference to the Dirty COW privilege escalation vulnerability (CVE-2016-5195) The libdevice.so sample renames its process to TVHelper, which explicitly targets Android TV set-top boxes by mimicking a legitimate TV helper service. Neither the libn[redacted]kernel.so nor libdevice.so kernels embed the Ethereum RPC endpoints found in the standalone ELF builds. The C2 resolution layer resides in the outer APK wrapper or the standalone ELF binary, while the kernel handles lower-level bot operations. Kimwolf v7 is a focused evolution of an already large-scale botnet. The HTTP/2 flood with Chrome browser fingerprinting complicates application-layer DDoS mitigation, as attack traffic now mirrors legitimate browser behavior at the protocol and header level. The three-tier C2 system (Ethereum ENS, Tor .onion, local proxy) indicates that the operators are investing in infrastructure built to withstand takedown operations. Organizations should monitor for the following behavioral indicators of Kimwolf compromise on IoT and Android devices: Outbound HTTPS connections to public Ethereum RPC endpoints (e.g., 0xrpc[.]io) from devices that typically do not interact with blockchain services Tor circuit establishment or SOCKS5 proxy traffic from Android TV boxes or IoT devices Connections to port 23075 on localhost A process named netd_service running on consumer Android devices Organizations should treat Android TV boxes as untrusted and segment them from enterprise networks. Disabling ADB or restricting it to USB-only access removes the primary propagation vector for this botnet. Palo Alto Networks customers are better protected through the following products and services: The Advanced WildFire machine-learning models and analysis techniques have been reviewed and updated in light of the indicators shared in this research, Advanced URL Filtering and Advanced DNS Security identify known domains and URLs associated with this activity as malicious. Device Security is designed to proactively protect the entire device attack surface, from IT to IoT and OT, with a unified platform that helps deliver comprehensive visibility, actionable risk insights and adaptive security enforcement. If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call: North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42) UK: +44.20.3743.3660 Europe and Middle East: +31.20.299.3130 Asia: +65.6983.8730 Japan: +81.50.1790.0200 Australia: +61.2.4062.7950 India: 000 800 050 45107 South Korea: +82.080.467.8774 Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance. SHA256 hash: 406647de09a0ffa279756b4ccb344b1b76a333320c5b50fd367901fa006cf0ff MD5 hash: d759364844d78a728505fb0485c3adbc File size: 1,720,108 bytes File type: ELF 32-bit LSB executable, ARM, statically linked, stripped File description: Kimwolf v7 bot payload (baseline analyzed sample); version string n[recacted]boxv7 SHA256 hash: 345222bca004595977f971d76900b0c65fd9bf9d91c50cd0c5bf5a93f1ad9e49 MD5 hash: 036bcb62be72c4663b9564955f93b05f File size: 1,712,624 bytes File type: ELF 32-bit LSB executable, ARM, statically linked, stripped File description: Kimwolf v7 bot payload SHA256 hash: 2ec2e85b0358e0c681cb5067489a9086ec97dbbf7e3c952dd9cd496b319d5af5 MD5 hash: 33faca1e0090f6b12eff703daf4606e4 File size: 1,720,108 bytes File type: ELF 32-bit LSB executable, ARM, statically linked, stripped File description: Kimwolf v7 bot payload; hard codes eth.rpcuniverse[.]com in the binary SHA256 hash: 951c94809aa6c7ab587125f9d4df30fa6a49ee0cbba76a4b7ceedaaa0e5dcd36 File type: Android APK Package name: com.android.logcatd File type: ELF 32-bit LSB executable, ARM, statically linked, stripped File description: Kimwolf Android variant; masquerades as system logcat daemon; includes TorService and BootReceiver persistence; contacts 23.94.221[.]104 SHA256 hash: f07821e313c16cbbd82def45094a22c8d474164051bdbc7648d6869e012014b4 File type: Android APK Package name: com.android.logcatd File type: ELF 32-bit LSB executable, ARM, statically linked, stripped File description: Kimwolf Android variant; sibling of the above, same signing certificate and package; contacts 23.94.221[.]104 VHash: 76554ad09897ac723a850eaf8c525efa Description: Structural hash shared by the three Kimwolf v7 ELF samples (5 total matches across VirusTotal) APK signing certificate (SHA-1 thumbprint): 2a1d96f1b066877812587ac94f45f82dfff5f5f9 Subject: C=CN, CN=a Description: Self-signed certificate used to sign both Kimwolf Android samples TLS certificate (SHA256 hash): f3e8a55a2a3ea7c7b6676e90f4f49a2c55b13065b68ee50c51cc35fe2b5c3237 Issuer: Let's Encrypt Description: Certificate issued for eth.rpcuniverse[.]com, observed on 23.94.221[.]104 between Dec. 13, 2023, and March 12, 2024 Domain: rpcuniverse[.]com Description: Multi-chain RPC service; apex registered Dec. 9, 2023 (Namecheap); resolves to 23.94.221[.]104; hard-coded subdomain present in Kimwolf sample Domain: eth.rpcuniverse[.]com Description: RPC subdomain hard-coded in Kimwolf sample 2ec2e85b... Domain: avax.rpcuniverse[.]com Description: RPC subdomain resolving to 23.94.221[.]104 IP address: 23.94.221[.]104 Description: Operator host (AS36352 RackNerd, Dallas); hosts rpcuniverse[.]com; contacted by Kimwolf ELF and APK samplesng IP address:port: 212.193.31[.]158:443 Description: HTTPS C2 traffic (AS202799 SYSECT, Russia); offline after Jan. 31, 2026 IP address:port: 212.193.31[.]119:13 Description: C2 traffic IP address:port: 212.193.31[.]122:13 Description: C2 traffic IP address: 212.193.31[.]102 Description: C2 host (linked via shared SSH host key with .158 IP address:port: 212.193.31[.]92:443 Description: HTTPS C2 traffic (AS202799 SYSECT, Russia) Tor hidden service: edctgwib2n5l34t525zkxqzk5bqb6e5il2yiq5r6zu7gtlxa4uosn3qd[.]onion Description: v7 hidden-service C2 fallback Kimwolf Botnet Exposed – XLab AISURU Botnet Technical Analysis – XLab A Broken System Fueling Botnets – Synthient Kimwolf Howls from Inside the Enterprise – Infoblox The Kimwolf Botnet is Stalking Your Local Network – KrebsOnSecurity Kimwolf Botnet Lurking in Corporate, Govt Networks – KrebsOnSecurity KIMWOLF V7 IoT BOTNET EVOLUTION - Unit 42 Updated August 13 2026 at 2:00 p.m. PT to add information on the U.S. Justice Department and international partner operation seizing C2 domains used by KimWolf and related botnets.

Spirals ransomware locks down victim systems in under 24 hours A previously unknown ransomware strain called Spirals was used last month in an attack against an IT services company in South Asia, where attackers went from initial access to data theft and encrypting the network in less than 24 hours, according to Symantec’s Threat Hunter Team. Spirals encrypts files quickly after gaining a foothold Spirals is written in Rust and encrypts files using a separate AES-128 key per file, each wrapped with an attacker-controlled ECDH P-256 public key. To speed up encryption, files larger than 5 MB are encrypted in chunks. Victims were left with a ransom note, RECOVERY_SECTION.log, directing them to a Tor negotiation site and threatening to leak stolen data within six days if no payment was made. The attackers gained initial access by compromising an internet-facing IIS web server and uploading an ASP.NET web shell. From there, they ran commands through the IIS worker process to open an interactive session, escalating privileges with a User Account Control (UAC) bypass, turning on Remote Desktop Protocol (RDP), and creating a local account to maintain persistent access. Credential dumping and tunneling expanded the intrusion “Credential material was harvested by dumping the Security Account Manager (SAM) hive to a password-protected archive. Later, during WMI-based lateral movement activities, the attackers also dumped LSASS process memory on multiple machines using rundll32.exe and comsvcs.dll,” researchers explained. To keep multiple lines of communication open with the compromised network, they set up a reverse SOCKS proxy, a renamed copy of the Chisel tunneling tool disguised as chrome.exe, and a Cloudflare Tunnel client. Some of the tools used in the attack were hosted externally with .jpg file extensions, apparently to dodge basic file-type filtering. The operators then used PsExec, running as SYSTEM, to push the same PowerShell payload to a long list of hosts, hitting new targets every few seconds for about half an hour. “The payload was named bitsadmin.exe, likely to masquerade as the legitimate Windows utility associated with the Background Intelligent Transfer Service,” they noted. That payload disabled Windows Defender and stopped services tied to 23 backup, database, and virtualization products, including Veeam, VMware, Hyper-V, SQL Server, Oracle, and PostgreSQL, clearing the way for the ransomware to encrypt files. “While we have so far only seen this ransomware on one victim network, its capabilities and stealth point to the actors behind it being skilled operators who could easily launch more wide-ranging campaigns,” Symantec added. The company has shared indicators of compromise tied to the attack for organizations wanting to check their own environments for related activity.

La Guardia di Finanza di Roma ha oscurato un sito che vendeva biglietti per il concerto di Ultimo a Tor Vergata, seppure fossero esauriti da più di un anno. Si indaga per truffa aggravata. C’è grande attesa a Roma per il concerto di Ultimo del 4 luglio, evento simbolo del tour “La favola per sempre“, con oltre 250mila spettatori e biglietti esauriti da oltre un anno. Eppure su Internet era comparso un sito dove era possibile comprare ancora i tagliandi, come se vi fossero ancora posti disponibili. Si trattava di una grande truffa informatica, spiega il Corriere della Sera. L’obiettivo era quello di “rubare i dati dei clienti impossessandosi di quelli bancari e delle carte di credito per commettere altre frodi“. L’ha scoperto la Guardia di Finanza del Comando provinciale di Roma, con il coordinamento della Procura. Con gli estremi della “truffa aggravata“, si è perciò reso necessario un decreto di sequestro preventivo della pagina online, disposto dal GIP, con il conseguente oscuramento del portale. “Il provvedimento riguarda tutti i provider italiani che hanno rimbalzato la pagina Internet“. “Truffatori forse operativi dall’estero“ Dalle indagini, frutto dell’attività di monitoraggio e analisi della rete Internet condotta dai militari del Nucleo di Polizia Economico-Finanziaria, è emerso che i criminali non avrebbero operato dall’Italia. I truffatori, forse dall’estero, sfruttavano il concerto “per appropriarsi di identità elettroniche dopo che i malcapitati si registravano sul sito per comprare biglietti inesistenti“. Il provvedimento di oscuramento del sito “clone” ha disposto: “Le risultanze investigative acquisite hanno consentito di interessare immediatamente l’autorità giudiziaria. La quale, per interrompere la prosecuzione delle condotte illecite e tutelare gli avventori, ha disposto il tale misura mediante notifica dell’inibizione all’accesso a tutti gli Internet Service Provider italiani“. Queste truffe rientrano in un piano preciso Sempre secondo il Corriere, le autorità hanno disposto “un piano di prevenzione e repressione dei delitti contro il patrimonio“. All’interno di questo è possibile inquadrare simili fattispecie illecite. A strutturare queste truffe, infatti, sono spesso “hacker criminali specializzati nella creazione di siti cloni progettati, unicamente, per frodare gli utenti“. Truffe di questa tipologia, in particolare, fanno leva sulla convinzione degli stessi utenti di “navigare in un ambiente sicuro per acquistare biglietti per noti eventi pubblici“. La struttura di queste truffe punta a creare dei siti senza differenze, a prima vista, da quelli ufficiali. In altri casi si accede a questi portali per via secondaria. Il rischio ulteriore, allora, è che gli utenti li visitino inconsapevolmente, esponendosi maggiormente alle potenziali minacce cibernetiche.

Cisco Unified CM flaw actively exploited to drop webshells (CVE-2026-20230) CVE-2026-20230, a server-side request forgery (SSRF) vulnerability affecting Cisco’s Unified Communications Manager (Unified CM), is being exploited to drop webshells and achieve remote code execution capability on the underlying server. “Our honeypots are seeing automated sweeps dropping webshells, all via Tor,” threat intelligence firm Defused warned today, after observing initial attacks over the weekend. “The observed chain abuses the WebDialer SSRF to deploy a rogue Apache Axis service, uses that service to write a first-stage JSP file-writer, then drops a second-stage command-execution shell under /platform-services/axis2-web/.” The vulnerability Cisco Unified Communications Manager is an enterprise-grade IP telephony and call processing platform. It’s typically deployed as a virtual machine, commonly on Cisco UCS servers running VMware ESXi. CVE-2026-20230 was reported to Cisco by an independent security researcher working with SSD Secure Disclosure. It stems from improper input validation for specific HTTP requests, and can be triggered by unauthenticated, remote attackers by sending a specially crafted HTTP request to a vulnerable instance. “A successful exploit could allow the attacker to write files to the underlying operating system that could be used later to elevate to root, Cisco said on June 3, 2026, when it revealed the existence of the flaw and released patches for it. At the time, the vendor confirmed the existence of a proof-of-concept (PoC) exploit for CVE-2026-20230, but said that they were “not aware of any malicious use of the vulnerability.” A PoC is now public The PoC they mentioned was likely the one published on Tuesday by the SSD Secure Disclosure technical team. Knowing the target system’s hostname is a pre-requisite for leveraging the exploit, but that can easily be achieved by accessing a specific URL, they noted. With the PoC now public, exploitation attempts by other threat actors are likely. Earlier this year, attackers exploited CVE-2026-20045, a code injection vulnerability in Cisco enterprise communications products (including Unified Communications Manager), in zero-day attacks. Customers who haven’t upgraded or aren’t able to upgrade to a fixed Cisco Unified Communications Manager or Cisco Unified Communications Manager Session Management Edition version are advised to mitigate the risk of exploitation by disabling the vulnerable WebDialer service. UPDATE (June 26, 2026, 05:35 a.m. ET): CISA added CVE-2026-20230 to its Known Exploited Vulnerabilities catalog and ordered US civilian federal government agencies to address it by June 28, 2026. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

A new macOS ClickFix campaign is using Terminal commands to silently download, mount, and launch info-stealing malware from malicious disk image (DMG) files. The campaign is infecting Mac devices with the Atomic macOS Stealer (AMOS) infostealer, which steals browser credentials, cryptocurrency wallet data, Keychain data, messaging app information, and user documents. Researchers at Palo Alto Networks Unit 42 first discovered the campaign and say it begins with a fake CAPTCHA page that tells users to open Terminal and paste a malicious command to verify themselves. Once executed, the command downloads a DMG file from an attacker-controlled server, silently mounts it with macOS's native hdiutil utility, locates the application bundle it contains, and launches it automatically. ClickFix is a social engineering technique that displays fake CAPTCHAs, browser errors, or system alerts to trick visitors into copying and executing attacker-supplied "fix instructions." The technique has grown in popularity among threat actors in the past year and has been used by both cybercriminals and state-sponsored hacking groups to distribute malware. While ClickFix attacks involving DMGs are not new, previous campaigns typically relied on users manually opening downloaded DMG files to launch malicious applications or execute scripts from attacker-controlled servers. The campaign spotted by Palo Alto combines both approaches by using a Terminal command to quietly download a DMG file and launch the malware it contains. After running the Terminal command, the attack downloads a malicious DMG from svs-verificationdate[.]beer using curl with the quiet "-fsSL" flags and saves it to the /tmp folder under a random filename. The command then executes 'hdiutil attach -nobrowse' to mount the downloaded disk image without displaying it in Finder or on the desktop. The script then searches up to three directory levels deep for the first available .app or .pkg installer, and if one is found, launches it using the macOS open command. Researchers observed the malware being delivered as a disk image named "s.01M0td.dmg," which mounted a volume containing a self-signed application bundle named "NNApp.app." This payload is part of the Atomic macOS Stealer family, which is used to steal credentials, browser history, authentication tokens, and cryptocurrency wallets from infected devices. The stealer will display a fake System Preferences authentication prompt that asks the user to enter their password, allowing the malware to steal it. According to the researchers, the malware targets eight Chromium-based browsers, including Google Chrome, Microsoft Edge, Brave, Opera, Arc, Vivaldi, CocCoc, and Yandex. It steals cookies, login databases, autofill information, stored payment cards, and browser profile data. The stealer also targets Firefox-derived browsers, including LibreWolf, SeaMonkey, Tor Browser, Waterfox, and Zen Browser, stealing the same information. Palo Alto says the malware searches for and steals cryptocurrency wallet data, including Exodus, Electrum, Atomic Wallet, Wasabi Wallet, Bitcoin Core, Litecoin Core, DashCore, Guarda, Binance Wallet, Dogecoin Wallet, and TonKeeper. The malware also steals Telegram Desktop and Discord data, Apple Notes databases, Safari cookies, Apple Keychain database files, and user documents with the PDF, TXT, or RTF extensions. All harvested data is then stored in a ZIP archive and uploaded to the attacker's server, where the attacker can retrieve it. Of particular interest, the researchers found that the malware will replace legitimate installations of Ledger Live and Trezor Suite with malicious versions, likely to perform crypto theft. The campaign was observed using command-and-control servers at svs-verificationdate[.]beer and 196.251.107[.]171. As a general rule, users should always be cautious when websites instruct them to open Terminal and execute commands. This is especially true when they claim to be part of CAPTCHA verifications, browser fixes, or other troubleshooting steps. If you do not 100% understand what a command does, do not run it. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

The North Korean state-sponsored threat actor Sapphire Sleet is behind the Mastra supply chain attack that hit over 140 NPM packages last week, Microsoft reports. Mastra is an open source TypeScript framework for building AI agents, workflows, and RAG pipelines. It offers integrations for major LLM providers, MCP servers, and cloud deployments. The supply chain attack occurred on June 17. During a 45-minute window, the hackers published 141 packages that contained the malicious dependency easy-day-js, a typosquat of the legitimate dayjs date library. The affected Mastra packages have approximately 8 million weekly downloads. All users who installed a @mastra package during the attack window on June 17 should consider their systems affected. As part of the attack, the hackers compromised the ‘ehindero’ NPM maintainer account, which has publishing rights across the Mastra ecosystem. One day before the account takeover, the attackers published a clean version of easy-day-js to a separate account, ‘sergey2016’. The threat actor used the compromised maintainer account to add easy-day-js as a dependency to 141 NPM packages across the Mastra ecosystem, in such a manner that the latest version of the library would always be installed, and then published the modified packages to NPM. Simultaneously, they published a new, malicious version of the easy-day-js library to their account. An obfuscated postinstall dropper in the dependency would fetch a second-stage payload from the attackers’ servers, write it to the temp directory, execute it as a detached, hidden background process, and then delete itself to hide its tracks. “Because the payload executes during installation, any developer workstation or continuous integration and continuous delivery (CI/CD) pipeline that ran npm install or npm update after the compromised versions were published was potentially exposed, regardless of whether the package was imported in application code,” Microsoft says. Targeting Windows, macOS, and Linux, the malware was designed to masquerade as node-related tools while collecting system information and targeting more than 160 cryptocurrency-related browser extensions. Microsoft has attributed the attack to the financially motivated North Korean group Sapphire Sleet, also known as BlueNoroff, CageyChameleon, Copernicium, and Stardust Chollima, which was also blamed for the Axios supply chain attack. In April, hackers published modified versions of the Axios NPM library that were pointing to a phantom dependency designed to download and execute a cross-platform RAT. Google’s Threat Intelligence Group attributed the attack to UNC1069. Mastra users are advised to remove the affected package versions, check their systems for malware, rotate credentials, tokens, and other secrets, and harden access to their crypto-wallets. Cybersecurity firms Aikido, Ox, Socket, Sonatype, and StepSecurity have published technical details and indicators of compromise (IoCs) associated with the Mastra supply chain attack. Related: More Cybersecurity Firms Disclose Impact From Klue Hack Related: CryptoBandits Malware Doubles as a Backdoor, Abuses Tor Related: NPM 12 Will Change Script Execution Behavior to Prevent Supply Chain Attacks Related: Supply Chain Attack Hits 32 Red Hat NPM Packages

Microsoft warns of a Windows-based cryptocurrency clipper that establishes a lightweight backdoor blending data exfiltration and remote code execution (RCE) capabilities. Dubbed CryptoBandits, the malware has been used in attacks since February 2026, deploying a portable Tor client on the infected systems and routing traffic through a local SOCKS5 proxy. “The clipper in this campaign relies on Windows Script Host and ActiveX-driven logic to launch a bundled Tor proxy and poll a hidden-service C&C server. It carries out high-frequency clipboard theft, screenshot exfiltration, and wallet-address substitution,” Microsoft explains. CryptoBandits is distributed through malicious shortcut (.lnk) payloads. On the infected systems, it deploys two components: a worm for propagation and a clipper/stealer to steal cryptocurrency wallet information. For propagation, the malware scans connected USB devices and creates additional malicious shortcuts of legitimate files. It can also deliver file-based payloads that it excludes from Defender scanning. The clipper is a script that interacts with the system via WScript and ActiveXObject, and checks whether Task Manager is running as an anti-analysis defense. Persistence is achieved through scheduled tasks. CryptoBandits launches a renamed Tor binary to establish command-and-control (C&C) communication and register the victim device, and then enters a continuous loop, polling the C&C for instructions every 500 milliseconds. The malware can extract seed phrases and private keys associated with cryptocurrency wallets, and can replace cryptocurrency addresses in the clipboard with attacker-provided ones to hijack them. According to Microsoft, the malware employs multi-layered obfuscation, decrypting all components at runtime. Both the Python script that handles installation and its JavaScript payloads are also obfuscated. The central component of the threat is the bundled Tor client, which routes communication over localhost:9050 and resolves destination domains to reduce DNS visibility and hide its C&C location. “This malware family shows how lightweight, script-based stealers can deliver outsized impact when paired with anonymized communications and runtime tasking. Organizations should focus on hardening script execution paths, monitoring local SOCKS proxy abuse, and using behavioral hunting to connect script activity with network, clipboard, and process signals,” Microsoft notes. Related: Rokarolla Banking Trojan Targets 200 Applications Related: Microsoft Teams Relay Servers Abused in DragonForce Ransomware Attack Related: OnyxC2 Stealer Offers Cybercriminals Enterprise-Grade Theft for $250 a Month Related: Infostealers Turn Millions of Devices Into Credential Theft Machines

Threat actors targeting cryptocurrency wallets have been distributing clipboard-stealing malware with self-spreading capabilities and using the Tor network to conceal communication. The campaign has been active since at least February and relies on LNK (shortcut) files on USB drives to push clipper malware that monitors clipboard contents and replaces cryptocurrency wallet addresses with ones controlled by the attacker. Additionally, it monitors for seed phrases and private keys, and can capture screenshots that are exfiltrated over Tor. Infection and worm propagation Microsoft says that the infection process starts with the victim opening the LNK file, triggering the malware on the USB drive. Additional payloads are staged from a .ONION address. A local scan searches for document files on the system. When such files are found, the malware hides the originals and replaces them with malicious shortcuts bearing the same names. This causes the malware to execute when users attempt to open the documents. The worm creates a scheduled task that monitors for newly connected USB storage devices. When a removable drive is connected, the malware it copies itself to the device and creates additional malicious shortcut files. Data stealer The stealer component in the malware executes after checking that Task Manager is inactive, establishing communications with the command-and-control (C2) host using a Tor executable (ugate.exe). Every half a second, the malware checks the clipboard for the following data: 12-word BIP39 seed phrases 24-word BIP39 seed phrases Ethereum private keys Bitcoin WIF keys Bitcoin legacy, P2SH, Bech32, and Taproot wallet addresses Tron wallet addresses Monero wallet addresses The targeted addresses are chosen based on their starting digits or characters to partially resemble the attackers’ wallet addresses, to lower the chance of the user discovering the fraud at a quick glance. Apart from monitoring the clipboard, the malware also captures five screenshots of the victim’s screen every ten seconds and sends them to the C2 using the curl tool. According to Microsoft, there is also support for remote code execution, which can be triggered by a C2 EVAL instruction. Specifically, the malware downloads JavaScript content into a file named ‘cfile,’ and executes it on the infected machine. The researchers say that the strongest indicators of an infection are behavioral rather than signature-based, and recommend monitoring for process activity on wscript.exe and cscript.exe, unexpected launches of curl, PowerShell, and cmd.exe, along with unusual child processes. Also, connections to ‘localhost:9050’ and Tor proxy activity are red flags associated with this campaign. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Microsoft has disclosed details of a Windows-based cryptocurrency clipper campaign codenamed CryptoBandits that has targeted users since February 2026 with clipboard-intercepting malware with self-spreading capabilities and using the Tor anonymity network to hide communication. "The clipper in this campaign relies on Windows Script Host and ActiveX-driven logic to launch a bundled Tor proxy and poll a hidden-service C2 [command-and-control] server," the Microsoft Defender Security Research Team said in an analysis published Tuesday. "It carries out high-frequency clipboard theft, screenshot exfiltration, and wallet-address substitution." "The execution of this clipper is notable because it does not depend on a traditional installer or exposed IP-based C2 infrastructure. Instead, it deploys a portable Tor client, routes traffic through a local SOCKS5 proxy, and blends data theft with remote code execution, turning a financially motivated stealer into a lightweight backdoor." Clipper malware refers to a type of malicious software that silently monitors a user's clipboard and intercepts sensitive data pasted into the short-term buffer. It primarily targets cryptocurrency transactions by substituting wallet address strings that match known blockchain address patterns to reroute them to addresses under their control. The attacks involve distributing a malicious Windows Shortcut (LNK) file via USB storage devices, opening which triggers a worm component that checks is the machine is already infected and only proceeds to fetch the payload from a remote server if it's not present. A second module deployed is the clipper that harvests and exfiltrates cryptocurrency wallet information. The LNK payload scans the USB device for common document types like DOC, XLSX, and PDF, and if found, hides them and creates new LNK files with the same file names and containing arguments that line to the worm component. Thus, when an unsuspecting user launches the shortcut thinking they are opening a harmless document, it triggers the execution of the malware. The worm component, besides ensuring propagation to other uncompromised USB drives, deploys scheduled tasks as a form of persistence for both the worm component and the stealer component. The clipper, for its part, uses WScript and ActiveXObject to interact with the operating system, and exits if Task Manager is among the list of actively running processes to evade detection. In the final stage, the malware launches a renamed Tor binary in a hidden window, generates a unique victim identifier, and registers it with the external server. Once this step is complete, the malware enters a continuous loop, periodically polling the C2 server for instructions while simultaneously monitoring the clipboard about every 500 milliseconds to extract seed phrases and private keys. "It also hijacks cryptocurrency addresses by replacing copied wallet values with attacker-controlled alternatives and uploads screenshots through Tor," Microsoft said. "If the C2 returns an EVAL response, the malware executes attacker-supplied code at runtime." The tech giant has recommended that defenders prioritize behavioral detections over static signatures, specifically looking for PowerShell-based screen capture and the use of WScript, CScript, or related script engines for launching curl, cmd.exe, PowerShell, or unexpected executables. Other mitigations include disabling AutoRun/AutoPlay for all removable media, blocking LNK execution from removable drives via Group Policy Objects (GPOs), restricting unnecessary use of wscript.exe or cscript.exe, and review clipboard-related and screen-capture behaviors on devices handling sensitive financial workflows.

Short-form video platforms like TikTok and Instagram Reels have become the latest way cybercriminals spread malware. We’ve already seen attackers move away from traditional phishing emails and toward tactics that trick people into installing malware themselves. Now they’re being lured with slick social media videos that promise free Spotify Premium, free Windows activation, or free Microsoft Office, but instead leave people with infostealers on their Windows devices. Researchers at ReversingLabs uncovered two active campaigns that use short videos to trick users into running dangerous PowerShell commands or visiting malicious download sites. Similar campaigns have been reported by other researchers and national cybersecurity agencies, suggesting a growing trend: Cybercriminals are learning how to use social media algorithms just as effectively as marketers. In true social media fashion, the videos on platforms like TikTok and Instagram Reels claim to solve a problem you didn’t know you had. The catch is that following the instructions delivers malware to your device. How the scam works The first campaign looks deceptively professional. Accounts with names like “windows.tips” or “windows.insights” use Windows-style branding and post polished tutorial videos that resemble genuine tech support content. The videos are tagged with Windows and Office-related keywords so they appear alongside legitimate troubleshooting and tips content. The videos promise to unlock Spotify Premium, Microsoft Office, or Windows for free. Viewers are then guided through step-by-step instructions that include opening Powershell, a legitimate Windows admin tool, and pasting in commands. Those commands download and run malware, much like the ClickFix scams we’ve covered before. The malware was identified as Vidar, an infostealer designed to steal sensitive informtion from infected devices. Vidar commonly targets: Saved browser passwords Autofill data Browser cookies Cryptocurrency wallets Two-factor authentication (2FA) data TOR browser data The stolen information is then sent back to servers controlled by the attackers. How to stay safe Research into similar TikTok-based attacks shows these scripts commonly add exclusions to Windows Defender, making it harder for security software to detect future malicious activity. Fortunately, there are a few simple ways to protect yourself: Only download software from official vendor websites. Be skeptical of “free”, cracked, or unofficial versions of paid software. Don’t follow instructions on a webpage without thinking them through, especially if the page asks you to run commands on your device or copy and paste code. Many ClickFix pages use countdowns, fake user counters, or other pressure tactics to make you act quickly. Check that downloaded files match what you expected to download. Verify a file’s publisher and digital signature before you run it. On Windows, you can usually check this by right-clicking the file, selecting Properties > Digital Signatures. Keep in mind that a valid signature does not guarantee a file is safe, but missing or suspicious signatures are often a red flag. Use a real-time, up-to-date anti-malware solution to block malware like infostealers before it runs. Pro tip: If you’re unsure whether a video, message, or website is legitimate, you can ask Malwarebytes Scam Guard about it. It can help identify suspicious content and advise you on what to do next. Image courtesy of ReversingLabs From reporting threats to removing them. Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

The JDY botnet, a malware network previously associated with Chinese threat actors like Volt Typhoon, has significantly expanded its targeting scope and reconnaissance efforts. According to researchers at Black Lotus Labs by Lumen, who have been monitoring its activity, JDY maintains a strong focus on the United States, where many of its compromised devices are located and where it heavily targets military and associated networks. The security firm notes that JDY has grown from roughly 650 active bots in January 2024 to over 1,500 compromised SOHO and IoT devices today. While the numbers seem low, it's important to note that JDY isn't an exploitation framework or a DDoS botnet that requires large swarms to accumulate firepower, but is instead a distributed scanning and fingerprinting network that helps its operators locate targets vulnerable to newly disclosed flaws. "Analysis of this activity shows a clear focus on identifying vulnerable infrastructure shortly after public vulnerability disclosures, suggesting that reconnaissance output is rapidly operationalized by China-nexus advanced persistent threat (APT) actors," reads the Black Lotus Labs report. "This targeted focus has been observed across a range of sectors, with the U.S. military and associated entities as the most prominent." CISA has previously warned about the risk Volt Typhoon operatives pose to unprotected SOHO routers, urging network device vendors to eliminate vulnerabilities in SOHO router web management interfaces (WMIs) during the design and development phases. The JDY botnet is designed to conduct service discovery, service banner grabbing, TLS certificate collection, protocol fingerprinting, and flaw-focused reconnaissance. Among the compromised devices are those from Cisco, Araknis, Mimosa Networks, Ubiquiti, DrayTek, Hikvision, and Linksys, for MIPS, MIPS64, MIPSEL, and MIPSEL64 architectures. The threat actors are quick to target newly disclosed vulnerabilities, with Lumen researchers observing JDY scans targeting CVE-2026-35616 shortly after Fortinet publicly disclosed the FortiClient EMS flaw. The operators control the botnet through hidden Tor services, which also serve as command-and-control (C2) infrastructure. The open-source reverse-shell and host-management framework Platypus is also used in some cases. The malware registers with a central "Dispatch Service" and receives scanning assignments, which it executes, compresses the results, and sends them back to the C2. The scanning module supports the following: TCP scanning SSL/TLS scanning UDP scanning ICMP probing Banner collection TLS certificate harvesting Service fingerprinting using downloadable rule sets The botnet client repeats the same cycle until the operator specifically orders it to stop. The TCP scanning function is one of the most technically interesting, say the researchers, explaining that, when JDY has sufficient privileges, it performs much faster and stealthier raw SYN scanning. "If the malware can open a raw socket, which generally requires root or administrative privileges, it initiates high-speed SYN scanning using custom-crafted TCP packets," explains the report. "These custom packets use a fixed source port of 19000, increment the destination ports one at a time, and batch-process thousands of scan targets." As JDY botnet activity increases, organizations should ensure routers, firewalls, and IoT devices are running the latest security updates and patches to prevent them from being recruited into reconnaissance networks. Defenders should also reduce their external attack surface by disabling unnecessary internet-exposed administrative interfaces, restricting remote management access, replacing default credentials, and monitoring for unusual outbound scanning activity originating from edge devices. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

In 2025, we observed pervasive SSH tunnel activity, which has remained active into 2026, affecting many government organizations and commercial companies in Russia and Belarus. Behind some of this activity is Cloud Atlas, a group we have known since 2014. During our investigation, we identified new tools used by this group, as well as indicators of compromise. The group is back to sending out archives containing malicious shortcuts that launch PowerShell scripts. This technique is employed in addition to the previously described use of malicious documents, which exploit an old vulnerability in the Microsoft Office Equation Editor process (CVE-2018-0802) to download and execute malicious code. We have observed the use of third-party public utilities (Tor/SSH/RevSocks) to gain a foothold in infected systems and create additional backup control channels. Technical details Initial infection As for the primary compromise, Cloud Atlas remains consistent in using phishing. In the observed campaigns, the attackers emailed a ZIP archive containing an LNK file as an attachment. Attackers use LNK shortcuts to covertly execute PowerShell scripts hosted on external resources. The command line of the shortcut: Example of the PowerShell script downloaded and executed by the shortcut: Actions performed by the downloaded PowerShell: Fixed.ps1 (loader) The primary purpose of the Fixed.ps1 script is to deliver and install subsequent malware onto the compromised system, specifically VBCloud and PowerShower. Fixed.ps1 establishes persistence (by adding itself to registry Run keys), creates a decoy for the user (by opening a PDF document), and executes the next stages of the attack. Fixed.ps1::Payload (VBCloud dropper) This module functions as a dropper for the VBCloud backdoor. It drops two files onto the infected machine: video.vbs: the loader of the backdoor,VBCloud::Launcher. This is a VBScript that decrypts the contents of video.mds (typically using RC4 with a hardcoded key) and executes it in memory. video.mds: the encrypted body of the backdoor, VBCloud::Backdoor. This is the main module that connects to a C2 server to receive additional scripts or execute built-in commands. This backdoor is designed to function as a stealer, specifically targeting files with extensions of interest (such as DOC, PDF, XLS) and exfiltrating them. Fixed.ps1::Payload (PowerShower) This module installs a second backdoor called PowerShower on the system. We don’t have the specific script that performs this installation, but we assume it’s performed by a script similar to fixed.ps1::Payload (VBCloud dropper). Unlike VBCloud, which focuses on file theft, PowerShower is primarily used for network reconnaissance and lateral movement within the victim’s infrastructure. PowerShower can perform the following tasks: Collect information about running processes, administrator groups, and domain controllers. Download and execute PowerShell scripts from the C2 server. Conduct “Kerberoasting” attacks (stealing password hashes of Active Directory accounts). PowerShower is dropped onto the system via the path ‘C:\Users\[username]\Pictures\googleearth.ps1’. PowerShower::Payload (credential grabber) PowerShower downloads an additional script for stealing credentials. It performs the following actions: Creates a Volume Shadow Copy of the C:\ drive. Copies the SAM (stores local user password hashes) and SECURITY system files from this shadow copy to C:\Users\Public\Documents\, disguising them as PDF files. The script is launched in several stages. To execute with high privileges, the script uses a UAC bypass technique via fodhelper.exe (a built-in Windows utility). This allows PowerShell to run as an administrator without directly prompting the user, which could otherwise raise suspicion. The full launch chain looks like this: The full Base64-decoded script is given below. Multi-user RDP by patching termsrv.dll Moving laterally across the victim’s network, the attackers executed a suspicious PowerShell script named rdp_new.ps1 (MD5 1A11B26DD0261EF27A112CE8B361C247): The script is designed to allow multiple RDP sessions in Windows 10 by patching the termsrv.dll file. Termsrv.dll is the core Windows library that enforces Remote Desktop Services rules. By default, Windows limits the number of simultaneous RDP sessions. Removing this restriction allows attackers to operate on the machine in the background without disconnecting the legitimate user, thereby reducing the likelihood of detection. At first, the script enables RDP on the firewall and downgrades the RDP security settings: Before modifying termsrv.dll, the script takes ownership and assigns itself full permissions. Then the script finds the sequence of bytes 39 81 3C 06 00 00 ?? ?? ?? ?? ?? ?? and replaces it with B8 00 01 00 00 89 81 38 06 00 00 90. After these manipulations, the script restarts the RDP service. The patched version allows multiple concurrent logins so attackers can stay connected without disrupting the legitimate user, thereby reducing suspicion. Reverse SSH tunneling As mentioned above, during this wave of attacks, the adversaries widely deployed reverse SSH tunnels to many hosts of interest. The compromised machine initiates an SSH connection to an attacker-controlled server, which allows attackers to bypass standard firewall rules via establishing outbound connections. That way, even if the primary backdoor is discovered, the attackers can maintain control through the SSH tunnel. To install a reverse SSH tunnel on a victim’s host, the attackers run VBS scripts via PAExec or PsExec. We’ve seen three types of scripts: Gen.vbs (WriteToSchedulerGenerateKey.vbs) generates key for SSH tunnel. Run.vbs (WriteToSchedulerRunSSH.vbs) runs reverse SSH tunnel. Kill.vbs (WriteToSchedulerKillSSH.vbs) stops reverse SSH tunnel via taskkill.exe. To achieve persistence, the attackers added a new scheduled task in Windows: In some cases, before establishing a reverse SSH tunnel, attackers set new access permissions to the folder containing the private key to prevent the legitimate user or system administrators from easily accessing or modifying it: Patched OpenSSH Some OpenSSH binaries used by the attackers had their imports modified. Instead of libcrypto.dll, the SSH executable imports syruntime.dll, which was placed in the same folder as the binary. This was likely done to evade detection and ensure stealth. In addition, we found a portable version of OpenSSH, presumably compiled by the adversaries: RevSocks In addition to Reverse SSH tunnels, the attackers installed RevSocks using the same infrastructure. RevSocks is an alternative tool to SSH for establishing tunnels and proxy connections, written in Golang. This tool allows direct connection to workstations on the local network. It also allows attackers to gain access to other segments of the victim’s network by using the machine as a gateway. In some cases, C2 addresses were hardcoded into the binary; in other cases, the C2 was passed in command line arguments. There were also reverse SOCKS samples with hardcoded C2 addresses: Tor tunneling To maintain control over the compromised host, the Tor network was used in some cases. A minimal set of a Tor executable and configuration files, necessary for launching HiddenService, was copied to the system directories of infected devices. The name of the Tor Browser executable file was modified. As a result, the infected machine was accessible via RDP from the Tor network when accessing the generated .onion domain. Below is an example of a configuration file for routing connections from Tor to RDP ports on the local network, as well as example command lines for logging into Tor. PowerCloud We analyzed a new Cloud Atlas tool, PowerCloud. It collects user data with administrator privileges and writes this information to Google Sheets in Base64 format. The tool represents an obfuscated PowerShell script. In most cases, it is packaged into an executable file using the PS2EXE utility, but we have also encountered variants in the form of a separate PowerShell script. To find administrators on the victim host, the tool executes the following command: This information is appended with the computer name and current date, the data is encoded in base64, and then the collected data is added to an existing Google Sheet. Browser checker Additionally, the attackers used another PowerShell script (MD5 5329F7BFF9D0D5DB28821B86C26D628F), compiled into an executable file via PS2EXE, which checks whether browser processes (Chrome, Edge, Firefox, and other) are running. This helps detect when the user is working on the computer. This can be used to choose the optimal time for conducting attacks (for example, when the user is away but their browser is still open) or simply to gather information about the victim’s habits. The information about running browsers is written to a log file on the local host. Victims According to our telemetry, in late 2025 and early 2026, the identified targets of the described malicious activities are located in Russia and Belarus. The targeted industries mostly include government agencies and diplomatic entities. We attribute the activity described in this report to the Cloud Atlas APT group with a high degree of confidence. The group used techniques and tools described previously, such as the initial access vector, the Python script for information gathering, and the Tor application for forwarding ports to the Tor network. The victim profile and geography also matches the Cloud Atlas targets. We couldn’t help but notice some parallels with recent Head Mare activity. The PhantomHeart backdoor (available in Russian only), attributed to Head Mare and used to create an SSH tunnel, was placed in directories actively used by Cloud Atlas: C:\Windows\ime C:\Windows\System32\ime C:\Windows\pla C:\Windows\inf C:\Windows\migration C:\Windows\System32\timecontrolsvc C:\Windows\SKB However, TTPs are still differentiated. Conclusion For more than ten years, the Cloud Atlas group has continued its activities and expanded its arsenal. Over the course of last year, many targeted campaigns in general were found to employ ReverseSocks, SSH and Tor, and the use of these utilities was no exception for Cloud Atlas. Creating such backup control channels using publicly available utilities significantly complicates the complete disruption of attackers’ actions on compromised systems. We will continue to closely monitor the group’s activity and describe their new tools and techniques. Indicators of compromise Additional information about this activity, including indicators of compromise, is available to customers of the Kaspersky Intelligence Reporting Service. If you are interested, please contact [email protected]. PowerCloud 7A95360B7E0EB5B107A3D231ABBC541A C:\Windows\wininet.exe C0D1EAA15A2CEFBAB9735787575C8D8E C:\Windows\LiveKernelReports\update.exe D5B38B252CF212A4A32763DE36732D40 C:\Windows\ime\imejp\dicts\i39884.exe 3C75CEDB1196DF5EAB91F31411ED4B33 C:\pla\reports.exe 42AC350BFBC5B4EB0FEDBA16C81919C7 C:\ProgramData\update_[redacted].exe 493B901D1B33EB577DB64AADD948F9CE C:\Windows\migration\wtr\MicrosoftBrowser.exe 2CABB721681455DAE1B6A26709DEF453 C:\Windows\pla\reports\winlog.exe 1B39E86EB772A0E40060B672B7F574F1 C:\Windows\System32\timecontrolsvc\vmnetdrv64.exe 1D401D6E6FC0B00AAA2C65A0AC0CFD6B C:\Windows\setup\scripts\install\software\activation\aact\dfsvc.exe 40A562B8600F843B717BC5951B2E3C29 C:\Windows\branding\scat.exe F721A76DEB28FD0B80D27FCE6B8F5016 C:\Windows\ime\imekr\dicts\dfsvc.exe D3C8AFD22BAA306FF659DB1FAC28574A C:\ProgramData\update_[redacted].exe 6D7B2D1172BBDB7340972D844F6F0717 C:\Users\[redacted]\AppData\Local\1c\1cv8\1cv8ud.exe C:\Users\[redacted]\AppData\Local\1c\1cv8\svc.exe 9769F43B9DE8D19E803263267FA6D62E C:\Users\[redacted]\AppData\Local\1c\1cv8\1cv8ud.exe 63B6BE9AE8D8024A40B200CCCB438F1D C:\Windows\notepad.exe 6AA586BCC45CA2E92A4F0EF47E086FA1 C:\Windows\splwow32.exe EBA3BCDB19A7E256BF8E2CC5B9C1CCA9 C:\Users\[redacted]\Desktop\soc\stant.exe B4E183627B7399006C1BC47B3711E419 C:\WINDOWS\ime\service.exe F56B31A4B47AD3365B18A7E922FBA1A8 dfsvc.exe F6F62456FB0FCC396FB654CBED339BC3 – 25C8ED0511375DCA57EF136AC3FA0CCA C:\branding\dwmw.exe Browser checker 5329F7BFF9D0D5DB28821B86C26D628F C:\ProgramData\checker_[redacted].exe ReverseSocks 2B4BA4FACF8C299749771A3A4369782E C:\Windows\PLA\System\bounce.exe C:\Windows\pla\print_status.exe BA9CE06641067742F2AFC9691FAFF1DC C:\ProgramData\hp\client.exe FB0F8027ACF1B1E47E07A63D8812ED50 C:\Windows\System32\timecontrolsvc\vmnetdrv64.exe BBF1FA694122E07635DEEAC11AD712F8 C:\Windows\System32\HostManagement.exe F301AA3D62B5095EEC4D8E34201A4769 C:\Windows\ime\imejp\msfu.exe F9C3BBE108566D1A6B070F9C5FB03160 C:\Windows\ime\imetc\help\IMTCEN14.exe Malicious MS Office documents Domains and IPs Reverse SSH/Socks domains Malicious and compromised domains used in MS Office documents Powershell payload staging File paths VBS scripts WriteToSchedulerKillSSH.vbs Create_task_day.vbs WriteToSchedulerGenerateKey.vbs C:\Windows\INF\Run.vbs c:\Windows\INF\install.vbs Update.vbs c:\Windows\PLA\System\Gen.vbs C:\Windows\INF\GenK.vbs c:\Windows\PLA\System\Kill.vbs c:\Windows\PLA\System\Run.vbs ssh.exe c:\Windows\ime\imejp\Asset.exe c:\Windows\PLA\System\conhosts.exe c:\Windows\INF\BITS\esentprf.exe c:\Windows\INF\MSDTC\RuntimeBrokers.exe c:\Windows\inf\diagnostic.exe ReverseSocks C:\Windows\PLA\System\bounce.exe C:\ProgramData\hp\client.exe C:\Windows\System32\timecontrolsvc\vmnetdrv64.exe Tor client C:\Windows\Resources\Update\Intel.exe C:\Windows\INF\package.exe

Researchers have discovered a vulnerability that could allow threat actors to fingerprint Firefox users, even in Private Browsing mode. The issue also affects the Tor anonymity browser, which is based on Firefox. The vulnerability, tracked as CVE-2026-6770, is related to the IndexedDB browser API, which is used for storing structured data on the client side. Firefox stores IndexedDB database names using internal UUID mappings, and when a website lists those databases, the order they come back in remains the same across different sites while the same browser process is running. [ Read: Claude Mythos Finds 271 Firefox Vulnerabilities ] This enables unrelated sites to independently observe the same ordering and use it to link a user’s activity across domains without any cookies or shared storage. The fingerprint persists across reloads and new private sessions, until the browser is fully restarted. Threat actors could exploit this to fingerprint users in Firefox’s Private Browsing mode and even when Tor’s New Identity feature is used. The New Identity feature in Tor is specifically designed to prevent a user’s activity across different sites from being linked by clearing browsing history, cookies, and active connections. “In Tor Browser, the stable identifier effectively defeats Tor Browser’s ‘New Identity’ isolation within a running browser process, allowing websites to link sessions that are expected to be fully isolated from one another,” the researchers explained. Mozilla patched CVE-2026-6770 with the release of Firefox 150. The organization assigned the flaw a ‘medium severity’ rating and described it only as “other issue in the Storage: IndexedDB component”. The Tor Project has also adopted the patch, rolling it out to users last week with the release of Tor Browser 15.0.10. Related: Chrome 144, Firefox 147 Patch High-Severity Vulnerabilities Related: GhostPoster Firefox Extensions Hide Malware in Icons Related: New Firefox Protections Halve the Number of Trackable Users

Betti RHC, la prima graphic novel al mondo dedicata alla cybersecurity awareness, ha finalmente il suo sito ufficiale. Uno spazio tutto suo dove scoprire il progetto, sfogliare le copertine degli episodi e immergersi nel mondo di Betti: la giovane laureanda in informatica che, dopo la morte misteriosa del padre, si trasforma nell'hacker più potente del mondo. Una storia avvincente che, episodio dopo episodio, affronta una minaccia digitale diversa — dal phishing al ransomware, fino al cyberbullismo — e insegna a riconoscerla e a difendersi, senza che sembri mai una lezione. Sul sito trovate tutto ciò che rende Betti un progetto diverso dal solito: la sua filosofia, le anteprime delle tavole e il racconto di come nasce ogni volume. Perché dietro Betti RHC c'è solo lavoro umano: ogni tavola è disegnata interamente a mano dagli artisti del Gruppo Arte di Red Hot Cyber, senza alcun uso di intelligenza artificiale. E a garantire che ogni storia sia realistica e tecnicamente corretta c'è la supervisione degli hacker etici del gruppo HackerHood, che mantengono il racconto fedele al mondo reale della sicurezza informatica. C'è spazio anche per le aziende, che possono usare Betti come strumento di awareness diverso dai soliti corsi: acquistare i volumi, personalizzarli con il proprio brand o sponsorizzare nuovi episodi. E come primo regalo, l'episodio "Byte the Silence", dedicato al cyberbullismo, è scaricabile gratuitamente per uso personale. Perché la miglior difesa, in fondo, è una bella storia. 👉 Scopri tutto su https://betti.redhotcyber.com/

Week in review: NIST updates DNS security guidance, compromised LiteLLM PyPI packages Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: NIST updates its DNS security guidance for the first time in over a decade DNS infrastructure underpins nearly every network connection an organization makes, yet security configurations for it have gone largely unrevised at the federal guidance level for more than twelve years. NIST published SP 800-81r3, the Secure Domain Name System Deployment Guide, superseding a version that dates to 2013. The document covers three main areas: using DNS as an active security control, securing the DNS protocol itself, and protecting the servers and infrastructure that run DNS services. Attackers are exploiting RCE vulnerability in BIG-IP APM systems (CVE-2025-53521) A critical unauthenticated remote code execution vulnerability (CVE-2025-53521) in F5’s BIG-IP Access Policy Manager (APM) solution is under active exploitation, the US Cybersecurity and Infrastructure Security Agency warned on Friday. Your AI agents are moving sensitive data. Do you know where? In this Help Net Security interview, Gidi Cohen, CEO at Bonfy.AI, addresses what he sees as the most pressing gap in AI agent security: data-layer risk. While the industry focuses on prompt injection and model behavior, Cohen argues the deeper threat is autonomous AI agents operating across systems with no visibility into what data they access, combine, or expose. Quantum threats are already active and the defense response remains fragmented Enterprises are moving toward post-quantum security at uneven speeds, and the gap between organizations that have built crypto-agility into their infrastructure and those that have adopted the label without the underlying capability is widening. Dr. Tan Teik Guan, CEO of Singapore-based cybersecurity company pQCee, draws a sharp line between the two. Crypto-agility, in his view, requires more than support for multiple algorithms or protocol-level negotiation. Measuring security performance in real-time, not once a quarter Most organizations have invested heavily in security products over the past decade. The assumption embedded in that spending is that more tools equal better protection. Tim Nan, CEO of digiDations, says that assumption is the most persistent misconception he encounters when working with security leaders across industries. NVIDIA puts GPU orchestration in community hands GPU-accelerated AI workloads now run on Kubernetes in the large majority of enterprise environments. Managing those workloads at scale has required specialized tooling that, until now, remained under vendor control. NVIDIA moved to change that at KubeCon Europe in Amsterdam this week, donating its Dynamic Resource Allocation (DRA) Driver for GPUs to the Cloud Native Computing Foundation (CNCF). TeamPCP strikes again: Backdoored Telnyx PyPI package delivers malware TeamPCP continues is supply chain compromise rampage, with telnyx on PyPI being the latest maliciously modified package. The AI safety conversation is focused on the wrong layer Organizations have spent years accumulating fragmented identity systems: too many roles, too many credentials, too many disconnected tools. For a workforce of humans, that fragmentation was manageable. Humans log in, log out, and make decisions slowly enough that gaps in control rarely turned into immediate incidents. AI agents operate differently. Training an AI agent to attack LLM applications like a real adversary Most enterprise software development teams now ship AI-powered applications faster than traditional penetration testing can keep up with. A security team with 500 applications may test each one once a year, or less. In the time between tests, the underlying models, integrations, and behaviors can change, with no corresponding security review. Novee launched a product it calls AI Red Teaming for LLM Applications, an AI pentesting agent built specifically to probe LLM-powered software. Your facilities run on fragile supply chains and nobody wants to admit it In this Help Net Security interview, Christa Dodoo, Global Chair at IFMA, discusses how facility managers are managing supply chain risk in critical building systems. She explains how sourcing, localized redundancy, and flexible infrastructure design are being integrated into resilience planning. A nearly undetectable LLM attack needs only a handful of poisoned samples Prompt engineering has become a standard part of how large language models are deployed in production, and it introduces an attack surface most organizations have not yet addressed. Researchers have developed and tested a prompt-based backdoor attack method, called ProAttack, that achieves attack success rates approaching 100% on multiple text classification benchmarks without altering sample labels or injecting external trigger words. AI SOC vendors are selling a future that production deployments haven’t reached yet Vendors selling AI-powered security operations platforms have built their pitches around a consistent set of promises: autonomous threat investigation, dramatic reductions in analyst workload, and an accelerating path toward humanless operations. Practitioners buying and deploying those platforms describe something different. Top product launches at RSAC 2026 RSAC 2026 showcased a wave of innovation, with vendors unveiling technologies poised to redefine cybersecurity. From AI-powered defense to breakthroughs in identity protection, this year’s conference delivered a glimpse into the future. Here are the most interesting products that caught our attention, and could shape what’s next. Oracle issues emergency fix for pre-auth RCE in Identity Manager (CVE-2026-21992) Oracle has released an out-of-band patch for a critical and easily exploitable vulnerability (CVE-2026-21992) in Oracle Identity Manager and Oracle Web Services Manager. The company did not say whether the vulnerability has been exploited as a zero-day, but has urged customers to apply the updates or provided mitigations as soon as possible. GitHub-hosted malware campaign uses split payload to evade detection A large-scale malware delivery campaign has been targeting developers, gamers, and general users through fake tools hosted on GitHub, Netskope researchers have warned. These “lures” are highly polished and appear legitimate, occasionally mimicking real projects, thus making them difficult to distinguish from safe software. Critical NetScaler ADC, Gateway flaw may soon be exploited (CVE-2026-3055) Citrix has fixed two vulnerabilities in NetScaler ADC and NetScaler Gateway, with the more serious flaw (CVE-2026-3055) potentially allowing attackers to extract active session tokens from the memory of affected devices. LiteLLM PyPI packages compromised in expanding TeamPCP supply chain attacks A slew of supply chain attacks against popular open source tools and packages appears to have been orchestrated by TeamPCP, a cybercriminal group that rose to prominence in late 2025. The latest victim of the group is BerryAI’s popular LiteLLM library, a unified interface that makes it easier for apps to switch between various LLMs: on March 24, TeamPCP uploaded two compromised versions (1.82.7 and 1.82.8) on PyPI that included a credential stealer and a malware dropper. Researchers release tool to detect stealthy BPFDoor implants in critical infrastructure networks Telecommunications providers around the world have been dealing with the burrowing efforts of the China-linked APTs for many years now. To help them identify hard-to-detect implants used by the China-based group dubbed Red Menshen, Rapid7 researchers have released a scanning script. CISA sounds alarm on Langflow RCE, Trivy supply chain compromise after rapid exploitation The US Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-33017, a recently disclosed code injection vulnerability in Langflow, an open-source framework for building AI agents and workflows, and CVE-2026-33634, an embedded malicious code vulnerability in Aqua Security’s Trivy security scanner. Product showcase: Cross-platform and third-party endpoint patching with Action1 Keeping endpoints patched is one of the more annoying chores in IT operations. Action1 is a cloud-based autonomous endpoint management platform that addresses this challenge head-on, covering third-party apps and OS updates (Windows, macOS, and now Linux) from a single, centralized console. You don’t have to choose between BAS or automated pentesting, you shouldn’t There’s a debate making the rounds in security circles that sounds reasonable on the surface but falls apart under operational scrutiny: Which is better, breach and attack simulation (BAS) or automated penetration testing (APT)? Security vendors have stoked this debate for obvious reasons, with some even explicitly arguing that automated pentesting should replace BAS entirely. But for practitioners responsible for defending an organization, this framing is the problem. It represents a coverage regression disguised as simplification. Why your phishing simulations aren’t building a security culture Security culture isn’t built by phishing simulations. In this Help Net Security video, Dan Potter, VP of Cyber Resilience at Immersive, argues that annual training videos and quarterly phishing tests happen in calm, controlled settings that tell us nothing about how people perform when a real incident hits. Russian hackers go after high-value targets through Signal Russian intelligence-linked hackers are targeting commercial messaging platforms, with Signal a primary focus, the FBI and CISA warn. The campaign is aimed at individuals of intelligence interest, including government personnel, journalists, and others with access to sensitive communications. The devices winning the race to get hacked in 2026 Enterprise networks keep adding connected devices, expanding the attack surface as threat actors target a wider range of systems, many of which are difficult to inventory, secure, and patch consistently. Forescout’s 2026 Riskiest Devices research maps that shift in IT, IoT, OT, and IoMT environments, with 11 new riskiest asset types entering the list this year. GitHub just made it much harder to ship a vulnerable pull request GitHub is expanding its application security capabilities with AI-powered security detections designed to identify risks earlier in the development process, with public preview planned for early Q2. The update is intended to improve code scanning, secret detection, and dependency analysis within repositories hosted on the platform. 32% of top-exploited vulnerabilities are over a decade old Exploitation timelines continued to compress in enterprise environments, with newly disclosed flaws reaching active use almost immediately and older weaknesses remaining active years after disclosure. Findings from Cisco Talos’ 2025 Year in Review show how attackers combined rapid weaponization with long-term exposure spanning infrastructure, identity systems, and user workflows. Russian initial access broker helped ransomware gangs extort millions, sentenced to 81 months A Russian citizen, Aleksei Volkov, was sentenced to 81 months in prison for helping ransomware groups carry out attacks causing over $9 million in actual losses and over $24 million in intended losses, after being arrested in Italy and extradited to the United States where he pleaded guilty. Uncle Sam closes the door on all new foreign-made routers The US Federal Communications Commission (FCC) has imposed a ban on all new routers manufactured overseas being imported into and sold within the United States. The move follows a determination by a White House-led interagency group that consumer-grade routers produced outside the United States pose what officials described as an “unacceptable risk” to national security and public safety. Anthropic trims action approval loop, lets Claude Code make the call Auto mode is a new permissions feature in the Claude Code system that allows the AI to make approval decisions on a user’s behalf while safeguards review actions before execution. The feature is available on Team plans and requires administrator approval before use, with support for Enterprise and API users expected soon. Gemini picks up criminal activity buried in dark web noise To help teams make faster and more accurate decisions on emerging threats, Google has introduced a dark web intelligence capability in Google Threat Intelligence. Powered by Gemini, the feature analyzes millions of dark web events each day and surfaces threats relevant to an organization’s operations. Botnet operator behind $14 million in ransomware extortion payments gets 24 months behind bars A Russian national has been sentenced to 24 months in prison after admitting he managed a botnet used to launch ransomware attacks against dozens of U.S. companies. The judge also imposed a $100,000 fine and ordered him to forfeit $1.6 million linked to the scheme. Google races to secure encryption before quantum threats arrive Google is preparing for the quantum era, a turning point in digital security, with a 2029 timeline for post-quantum cryptography (PQC) migration. Security professionals warn that current encryption could be broken by large-scale quantum computers in the coming years. This risk is already relevant due to store-now-decrypt-later attacks. Mission to smuggle $170 million worth of AI tech to China collapsed for three men Three individuals, Stanley Yi Zheng, Matthew Kelly, and Tommy Shad English, have been charged with conspiracy to commit smuggling and export control violations after allegedly attempting to procure millions of dollars’ worth of restricted computer chips from a California-based hardware company. Second RedLine infostealer operator ends up in US custody Hambardzum Minasyan, an Armenian man extradited to the United States, is accused of conspiring with others to develop and operate the RedLine infostealer malware used to steal sensitive data, including login credentials, from victims’ computers. Ajax data breach exposed season tickets, supporter bans open to tampering AFC Ajax, the Dutch football club from Amsterdam, disclosed that an unknown hacker gained access to parts of its IT systems and obtained the email addresses of a few hundred people. The hack exploited vulnerabilities in Ajax’s app and website, including exposed APIs and shared access keys. Plumber: Open-source scanner of GitLab CI/CD pipelines for compliance gaps GitLab CI/CD pipelines often accumulate configuration decisions that drift from security baselines over time. Container images get pinned to mutable tags, branches lose protection settings, and required templates go missing. An open-source tool called Plumber automates the detection of those conditions by scanning pipeline configuration and repository settings directly. Attackers are handing off access in 22 seconds, Mandiant finds Exploits remain the leading entry point for attackers for the sixth consecutive year, according to Mandiant’s M-Trends 2026 report, which draws on more than 500,000 hours of incident response work conducted in 2025. The data shows attackers speeding up their internal hand-offs, shifting away from email phishing, and targeting backup and virtualization infrastructure with greater precision. Microsoft details AI prompt abuse techniques targeting AI assistants Prompt abuse occurs when crafted inputs manipulate an AI system into producing unintended behavior, such as attempting to access sensitive information or overriding built-in safety instructions. Prompt injection is also recognized as one of the top risks in the 2025 OWASP guidance for LLM applications. Kali Linux 2026.1 ships BackTrack mode, eight new tools, and a kernel upgrade to 6.18 Penetration testers running Kali Linux have a new release to work with. Version 2026.1 delivers the annual theme refresh, a new BackTrack-inspired mode in kali-undercover, eight tools added to the network repositories, a kernel bump to 6.18, and several Kali NetHunter changes. Your security stack looks fine from the dashboard and that’s the problem One in five enterprise endpoints is operating outside a protected and enforceable state on any given day, according to device telemetry collected across tens of millions of corporate PCs. That figure, drawn from Absolute Security’s 2026 Resilience Risk Index, has barely moved in a year, even as organizations continue to add security tools and increase spending. Google’s TurboQuant cuts AI memory use without losing accuracy Large language models carry a persistent scaling problem. As context windows grow, the memory required to store key-value (KV) caches expands proportionally, consuming GPU memory and slowing inference. A team at Google Research has developed three compression algorithms: TurboQuant, PolarQuant, and Quantized Johnson-Lindenstrauss (QJL). All three are designed to compress those caches aggressively without degrading model output quality. Microsoft hands Entra ID users new option for MFA Organizations rely on MFA to enforce identity checks before granting access to systems and services. Microsoft has made external MFA generally available in Microsoft Entra ID, expanding support for third-party identity providers. External MFA supports organizations that use third-party MFA solutions to meet regulatory or business requirements, handle scenarios such as mergers and acquisitions, or maintain a consistent MFA approach within Microsoft Entra ID. Unbreakable Enterprise Kernel 8.2 ships with confidential computing support, XFS live repair Many enterprise Linux deployments rely on hardware-level memory isolation to protect sensitive workloads from co-tenants and compromised hypervisors. Oracle’s Unbreakable Enterprise Kernel 8.2 (UEK 8.2) extends that capability on Oracle Linux with support for Intel Trust Domain Extensions, along with a set of file system and memory management changes intended to reduce downtime and improve diagnostic visibility. Who owns AI agent access? At most companies, nobody knows AI agents are operating across production enterprise environments at scale, and the identity infrastructure managing their access has not kept up with their deployment. A January 2026 survey of 228 IT and security professionals, conducted by the Cloud Security Alliance, finds that the majority of organizations have AI agents active in core systems, with fragmented ownership of how those agents authenticate and what they can access. Reddit declares war on bad bot activity Reddit is introducing changes to support interactions between people. The company is taking a bottom-up approach to help users understand when they are engaging with another person unless an account is labeled otherwise. Reddit plans to verify that users are human without requiring disclosure of real-world identity. GitHub jumps on the bandwagon and will use your data to train AI GitHub updated how it uses data to improve AI-powered coding assistance. Starting April 24, interaction data from Copilot Free, Pro, and Pro+ users may be used to train and improve GitHub’s models unless users opt out. Copilot Business and Copilot Enterprise users are not included in this change. Tails 7.6 ships automatic Tor bridge retrieval and a new password manager Tails 7.6 is out, and for users operating on networks that block Tor, the most consequential addition is built-in bridge retrieval. The Tor Connection assistant can now detect when a direct connection to Tor is restricted and automatically request bridges suited to the user’s region. The request goes through the Tor Project’s Moat API, and the connection to that API is disguised via domain fronting, making it appear as traffic to an ordinary website. Make OpenAI’s models misbehave and earn a reward OpenAI’s public Safety Bug Bounty program focuses on AI abuse and safety risks across its products. The goal is to support safe and secure systems and reduce the risk of misuse that could lead to harm. This program complements the Security Bug Bounty. It accepts reports of abuse and safety risks that do not meet the criteria for a security vulnerability. AI frenzy feeds credential chaos, secrets leak through code, tools, and infrastructure Code keeps moving through pipelines, and credentials continue to surface alongside it. GitGuardian’s State of Secrets Sprawl 2026 puts the count at 28.65 million new hardcoded secrets in public GitHub commits in 2025, extending a multi-year rise in exposed access keys, tokens, and passwords. Cybersecurity jobs available right now: March 24, 2026 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now.

Un nuovo gruppo ransomware, identificato come ALP-001, ha rivendicato un attacco informatico ai danni di Esprinet, azienda italiana nota per la distribuzione all’ingrosso di prodotti di tecnologia. Secondo quanto riportato sul portale di leak del gruppo, raggiungibile mediante la rete Tor, gli attaccanti sostengono di aver esfiltrato circa 1,2 terabyte di dati aziendali. Esprinet riferisce di non avere subito nessun attacco né perdita di dati, ma di avere solo ricevuto una mail estorsiva. Al momento non risultano pubblicati campioni o prove dirette dell’avvenuta sottrazione dei file. Indice degli argomenti Il gruppo ALP-001 è una nuova sigla criminale emersa a marzo 2026, legata a un presunto Initial Access Broker (IAB) precedentemente attivo nel commercio di accessi a infrastrutture aziendali compromesse. Secondo le analisi circolate in ambienti di sicurezza, il gruppo avrebbe abbandonato il modello di vendita degli accessi per passare alla estorsione diretta, minacciando di pubblicare informazioni riservate se le vittime non accettano di negoziare. Le attività attribuite al gruppo indicano un uso tipico di vettori d’attacco su sistemi esposti su Internet: vulnerabilità note in dispositivi VPN, gateway Citrix e server SSH/FTP. Tra le vittime precedentemente rivendicate da ALP-001 compare anche Hikvision, azienda cinese nota nel campo della videosorveglianza. Al momento non è possibile verificare la veridicità della rivendicazione nei confronti di Esprinet né l’effettiva compromissione dei dati dichiarati. Esprinet ha fatto sapere comunque di non avere subito attacchi e che si tratta solo di un ricatto infondato. Gli esperti di sicurezza raccomandano cautela nella diffusione delle informazioni relative a tali gruppi, in attesa di eventuali conferme ufficiali o riscontri tecnici indipendenti. Articolo soggetto ad aggiornamenti man mano che emergeranno nuovi dati o dichiarazioni ufficiali da parte dell’azienda.

Tails 7.6 ships automatic Tor bridge retrieval and a new password manager Tails 7.6 is out, and for users operating on networks that block Tor, the most consequential addition is built-in bridge retrieval. The Tor Connection assistant can now detect when a direct connection to Tor is restricted and automatically request bridges suited to the user’s region. The request goes through the Tor Project’s Moat API, and the connection to that API is disguised via domain fronting, making it appear as traffic to an ordinary website. Previously, users on censored networks had to obtain bridges manually and enter them by hand. The feature closes a long-standing gap in Tails’ censorship-circumvention capability. Users who prefer to take action themselves can also select the option to request region-specific bridges directly from the connection assistant screen. Password manager switches from KeePassXC to Secrets Tails 7.6 replaces KeePassXC with the GNOME Secrets password manager as the default credential storage tool. Secrets has a simpler interface and integrates more tightly with the GNOME desktop environment. Accessibility features that were broken under KeePassXC, including the on-screen keyboard and cursor size adjustments, work again with Secrets. Existing KeePassXC database files are compatible with Secrets’ format, so stored credentials carry over without any conversion step. Users who depend on features specific to KeePassXC can still install it manually. Component upgrades and Qt5 removal The kernel moves to Linux 6.12.74. Tor Browser advances to 15.0.8, built on Firefox ESR 140.9. Thunderbird reaches 140.8.0esr. Electrum moves to 4.7.0, and that upgrade is tied directly to the removal of Qt5 from the distribution. The changelog confirms that Qt5 support packages have been stripped out entirely, and tests now verify that no Qt5 package ships with the build. The base distribution advances to Debian 13.4 (Trixie). Firmware packages also receive an update: firmware-nonfree moves to version 20260110-1, improving hardware support for graphics cards and wireless adapters on newer machines. The forge.js library, used in Tails’ web-facing components, upgrades to v1.3.3. The update includes a step to make it harder for external CDNs to target the project, and it brings the project’s license documentation into compliance with BSD 3-clause terms. Bug fixes targeting localization and upgrade reliability Three user-facing bugs are resolved in this release. Automated upgrades failed for users running Tails with the language set to Turkish; that problem is fixed. A broken link in the Thunderbird migration notification, the “Learn More” button that was supposed to point users to documentation, is restored. The confirmation dialog displayed when saving a language and keyboard layout to the USB stick in unencrypted form was not honoring available translations; it now renders in the user’s selected language. Upgrading Automatic upgrades are available for any installation running Tails 7.0 or later. The upgrade preserves data stored in Persistent Storage. Users whose automatic upgrade fails, or whose system does not start after an update, can follow the manual upgrade path available on the Tails documentation site.

Immaginiamo di dover sorvegliare un mercato clandestino che non ha un indirizzo fisso, cambia continuamente nome e lingua, si nasconde dietro strati di anonimizzazione e ospita milioni di conversazioni al giorno tra criminali di ogni latitudine: questo è il Dark Web e questo è esattamente il problema che i team di threat intelligence affrontano ogni giorno. Fino a oggi, la risposta prevalente era affidarsi a ricerche per parole chiave che, però, generavano falsi positivi nell’ordine del 90%: nove segnalazioni su dieci da ignorare, con il rischio costante che la decima – quella vera – si perdesse nel mucchio. Google ha deciso che è ora di cambiare approccio e il 23 marzo 2026, in occasione della RSA Conference, ha annunciato l’integrazione di Gemini all’interno di Google Threat Intelligence (GTI) con una capacità inedita: il monitoraggio autonomo e contestuale del Dark Web, disponibile in public preview. Non si tratta di un restyling di strumenti esistenti, ma di qualcosa di strutturalmente diverso per cui vale la pena capire esattamente cosa cambia e cosa no. Indice degli argomenti Il meccanismo alla base della nuova funzionalità di Gemini per il monitoraggio del Dark Web è concettualmente semplice quanto efficace. I sistemi tradizionali di dark web monitoring funzionano come un motore di ricerca primitivo: cercano corrispondenze esatte con parole chiave predefinite come il nome dell’azienda, i domini e i brand. Se un attore criminale evita deliberatamente di citare il nome della vittima (pratica comune tra i broker di accesso iniziale che vogliono proteggersi da occhi indesiderati) il sistema semplicemente non trova nulla. Gemini adotta un approccio radicalmente diverso. Invece di cercare corrispondenze testuali, costruisce autonomamente un profilo organizzativo a partire da dati open source e input forniti dall’utente: dimensione dell’azienda, settore, tecnologie adottate, presenza geografica, figure chiave. Questo profilo viene poi usato come base di confronto vettoriale rispetto ai contenuti indicizzati sul Dark Web. Il caso d’uso illustrato da Google nel blog ufficiale è illuminante: un broker di accesso pubblica su un forum underground la disponibilità di credenziali VPN attive verso un importante retailer europeo con 15 miliardi di euro di fatturato, senza mai citare il nome dell’azienda. Un sistema basato su keyword non lo rileva. Gemini sì: incrocia la fascia di fatturato, la localizzazione geografica e i tipi di portali menzionati (payroll, logistica) con il profilo aziendale, identifica la corrispondenza con una sussidiaria del gruppo e lancia l’allerta prima che il broker trovi un acquirente. I numeri dichiarati da Google (e sintetizzati nella tabella sottostante) sono significativi: 8-10 milioni di eventi Dark Web analizzati ogni giorno, con un tasso di accuratezza del 98% nei test interni. Il profilo organizzativo si aggiorna in modo autonomo, senza che il team debba intervenire manualmente a ogni modifica dell’infrastruttura o del perimetro aziendale. A completare il quadro, l’integrazione con il Google Threat Intelligence Group (GTIG) che traccia attivamente 627 gruppi di minacce distinti. Fonte: Google Cloud Blog, CybersecurityNews. Elaborazione: Cybersecurity360.it. Per chi lavora nella threat intelligence, questa novità ha un peso specifico difficile da ignorare. Il problema del rapporto segnale/rumore nel monitoraggio del dark web non è un dettaglio operativo: è il motivo per cui molte organizzazioni, anche quelle con team di sicurezza strutturati, finiscono per trattare il dark web monitoring come un esercizio di conformità piuttosto che come una fonte di intelligence actionable. Se il sistema funziona come descritto, l’impatto operativo è sostanziale. Oggi la finestra temporale tra la comparsa di un’offerta di accesso su un forum underground e il momento in cui un’organizzazione ne viene a conoscenza, ammesso che ne venga a conoscenza, può essere di giorni o settimane. Ridurre questa latenza significa spostare la postura da reattiva a preventiva: il team di sicurezza può avviare l’analisi forense, revocare le credenziali compromesse e notificare le parti interessate prima che l’accesso venga effettivamente venduto e sfruttato. C’è però una questione che non si può non sollevare: questa soluzione richiede che un’organizzazione consegni a Google un profilo dettagliato di sé stessa con indicazioni delle tecnologie adottate, delle infrastrutture, delle figure chiave, del brand e della presenza geografica. Lo stesso profilo che Gemini usa per correlare le minacce è, in sostanza, una mappa della superficie di attacco aziendale. Non si tratta di un’accusa: Google è un vendor con solide policy di sicurezza e una reputazione da proteggere. Ma è una considerazione che ogni CISO e DPO dovrebbe formalizzare prima di adottare il servizio. In termini di GDPR e di gestione del rischio della supply chain, occorre valutare con attenzione quali dati vengono effettivamente trasmessi, come vengono conservati, per quanto tempo e con quali garanzie di non riutilizzo per finalità di training dei modelli. C’è poi un secondo piano di analisi, più strutturale. La concentrazione di capacità di threat intelligence su un numero ristretto di grandi piattaforme come quella di Google crea un rischio sistemico che il settore tende a sottovalutare. Quando un singolo vendor controlla sia l’infrastruttura cloud su cui girano i sistemi aziendali, sia la piattaforma di threat intelligence che monitora le minacce a quell’infrastruttura, il perimetro di autonomia decisionale dell’organizzazione si restringe significativamente. Non è un problema insormontabile, ma va gestito consapevolmente. Indipendentemente dalla scelta di adottare o meno Google Threat Intelligence, questa notizia è l’occasione giusta per fare un punto sulla maturità del proprio programma di dark web monitoring. Ecco alcuni consigli concreti. Fare una due diligence sul trattamento dei dati. Prima di attivare il servizio, richiedere a Google documentazione esplicita su quali dati vengono inviati per la costruzione del profilo, se e come vengono usati per il training di Gemini, dove vengono conservati (data residency) e quali diritti di cancellazione e portabilità si hanno a disposizione. Non eliminare gli altri strumenti di monitoring. Un tasso di accuratezza del 98% nei test interni è promettente, ma i test interni non replicano la complessità e l’evoluzione continua del Dark Web reale. È dunque utile mantenere almeno un secondo layer di monitoring indipendente, anche open source come OnionScan o strumenti basati su Tor, per non creare un single point of failure nella propria intelligence. Definire un processo di escalation chiaro. Lo strumento più potente del mondo è inutile se l’allerta generata finisce in una coda di ticketing non presidiata. Prima di attivare il servizio, occorre definire chi riceve le notifiche, entro quanto tempo deve rispondere, quali azioni deve intraprendere e chi ha l’autorità di decidere l’escalation verso il board o le autorità. Valutare l’impatto sulla supply chain. Se l’organizzazione ha un ecosistema di partner, fornitori e clienti è necessario considerare se e come estendere il monitoring anche ai soggetti terzi più critici. Una violazione che inizia da un fornitore e si propaga verso l’organizzazione attraverso una VPN condivisa è un vettore reale e frequente. Ricordiamo che il monitoraggio del dark web non è un’attività riservata alle grandi Enterprise: anche le PMI sono target frequenti proprio perché spesso non sanno di essere state compromesse fino a quando le credenziali dei loro dipendenti non vengono usate in un attacco. Ecco, quindi, alcune azioni di base accessibili a qualsiasi organizzazione: Verificare periodicamente le email su Have I Been Pwned. Il servizio gratuito di Troy Hunt indicizza miliardi di credenziali emerse da data breach pubblici. Impostate le notifiche per i vostri domini aziendali. Monitorare le menzioni del vostro brand su Shodan e Censys. Questi motori di ricerca per dispositivi e servizi esposti su internet possono rivelare asset dimenticati o mal configurati che un attaccante potrebbe già aver censito. Adottare un password manager aziendale e l’autenticazione a più fattori ovunque. La stragrande maggioranza delle credenziali vendute sul dark web è sfruttabile solo perché le password vengono riutilizzate su più servizi o perché manca il secondo fattore. Risolvere questo problema è più urgente di qualsiasi strumento di monitoring. Considerare i servizi di dark web monitoring inclusi in molte soluzioni EDR/XDR. Prima di valutare soluzioni Enterprise, verificare se la propria piattaforma di endpoint detection già include capacità di dark web monitoring: spesso sono presenti ma non attivate. L’integrazione di Gemini nel dark web monitoring è un passo significativo nel panorama della threat intelligence: ridurre il rumore da un tasso del 90% di falsi positivi a una precisione del 98% non è un miglioramento marginale, ma fa la differenza tra uno strumento inutilizzabile nella pratica quotidiana e uno che può effettivamente cambiare la postura difensiva di un’organizzazione. Ma sarebbe un errore leggere questa notizia come la soluzione al problema. Il dark web non è un problema tecnico che si risolve con un algoritmo sufficientemente potente: è il riflesso di un ecosistema criminale adattivo, che cambierà le proprie tattiche in risposta a strumenti di rilevamento più sofisticati. Ciò che rimane costante e che nessun modello di AI può sostituire è la capacità di un’organizzazione di comprendere la propria superficie di rischio, di costruire processi di risposta agli incidenti che funzionano sotto pressione e di mantenere quella cultura della sicurezza che trasforma ogni dipendente in un sensore attivo piuttosto che in un vettore inconsapevole. Gemini sul Dark Web è un ottimo strumento. Ma gli strumenti sono efficaci solo quando c’è qualcuno che sa come usarli e cosa fare quando scattano.

Google on Thursday announced a new "advanced flow" for Android sideloading that requires a mandatory 24-hour wait period to install apps from unverified developers in an attempt to balance openness with safety. The new changes come against the backdrop of a developer verification mandate the tech giant announced last year that requires all Android apps to be registered by verified developers to be installed on certified Android devices. The move, it added, was done to flag bad actors faster and prevent them from distributing malware. This also includes potential scenarios where cybercriminals trick unsuspecting users who sideload such apps into granting them elevated privileges that make it possible to turn off Play Protect, the anti-malware feature built into all Google-certified Android devices. However, the mandatory registration requirements have been met with criticism from over 50 app developers and marketplaces, including F-Droid, Brave, The Electronic Frontier Foundation, Proton, The Tor Project, Vivaldi, who say they risk creating friction and barriers to entry, and raise privacy and surveillance concerns in the absence of clarity about what personal information developers must provide, how this data will be stored, secured, and used, and if it could be subject to government requests or legal processes. As a way of quelling some of these thorny issues, Google has emphasized that the newly developed advanced flow allows power users to maintain the ability to sideload apps from unverified developers with a one-time process that requires them to follow the steps below - Enable developer mode in system settings. Confirm that they are taking this step of their own volition and are not being coached. Restart the phone and re-authenticate so as to prevent a scammer from monitoring what actions a user is taking. Wait for a 24-hour period and confirm that they are really making this change with biometric authentication or device PIN. Install apps from unverified developers once users understand the risks, either indefinitely or for a period of seven days. "In that 24-hour period, we think it becomes much harder for attackers to persist their attack," Android Ecosystem President, Sameer Samat, was quoted as saying to Ars Technica. "In that time, you can probably find out that your loved one isn’t really being held in jail or that your bank account isn’t really under attack." Google also said it plans to offer free "limited distribution accounts" that let hobbyist developers and students share apps with up to 20 devices without having to "provide a government-issued ID or pay a registration fee." It's worth noting that the aforementioned process does not apply to installs via the Android Debug Bridge (ADB). Limited distribution accounts for students and hobbyists, as well as advanced flow for users, will be available in August 2026, before the new developer verification requirements take effect the month after. "We know a 'one size fits all' approach doesn't work for our diverse ecosystem," Google said. "We want to ensure that identity verification isn't a barrier to entry, so we’re providing different paths to fit your specific needs." The development coincides with the emergence of a new Android malware called Perseus that's actively targeting users in Turkey and Italy with an aim to conduct device takeover (DTO) and financial fraud. Over the four months, at least 17 Android malware families have been detected in the wild. They include FvncBot, SeedSnatcher, ClayRat, Wonderland, Cellik, Frogblight, NexusRoute, ZeroDayRAT, Arsink (and its improved variant SURXRAT), deVixor, Phantom, Massiv, PixRevolution, TaxiSpy RAT, BeatBanker, Mirax, and Oblivion RAT.

Amazon Threat Intelligence is warning of an active Interlock ransomware campaign that's exploiting a recently disclosed critical security flaw in Cisco Secure Firewall Management Center (FMC) Software. The vulnerability in question is CVE-2026-20131 (CVSS score: 10.0), a case of insecure deserialization of user-supplied Java byte stream, which could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary Java code as root on an affected device. According to data gleaned from the tech giant's MadPot global sensor network, the security flaw is said to have been exploited as a zero-day since January 26, 2026, more than a month before it was publicly disclosed by Cisco. "This wasn't just another vulnerability exploit; Interlock had a zero-day in their hands, giving them a week's head start to compromise organizations before defenders even knew to look. Upon making this discovery, we shared our findings with Cisco to help support their investigation and protect customers," CJ Moses, chief information security officer (CISO) of Amazon Integrated Security, said in a report shared with The Hacker News. The discovery, Amazon said, was made possible, thanks to an operational security blunder on the part of the threat actor that exposed their cybercrime group's operational toolkit via a misconfigured infrastructure server, offering insights into its multi-stage attack chain, bespoke remote access trojans, reconnaissance scripts, and evasion techniques. The attack chain involves sending crafted HTTP requests to a specific path in the affected software with an aim to execute arbitrary Java code, after which the compromised system issues an HTTP PUT request to an external server to confirm successful exploitation. Once this step is complete, the commands are sent to fetch an ELF binary from a remote server, which hosts other tools linked to Interlock. The list of identified tools is as follows - A PowerShell reconnaissance script used for systematic Windows environment enumeration, gathering details about operating system and hardware, running services, installed software, storage configuration, Hyper-V virtual machine inventory, user file listings across Desktop, Documents, and Downloads directories, browser artifacts from Chrome, Edge, Firefox, Internet Explorer, and 360 browser, active network connections, and RDP authentication events from Windows event logs. Custom remote access trojans written in JavaScript and Java for command-and-control, interactive shell access, arbitrary command execution, bidirectional file transfer, and SOCKS5 proxy capability. It also supports self-update and self-delete mechanisms to replace or remove the artifact without having to reinfect the machine and challenge forensic investigation. A Bash script for configuring Linux servers as HTTP reverse proxies to obscure the attacker's true origins. The script delivers fail2ban, an open-source Linux intrusion prevention tool, and compiles and spawns an HAProxy instance that listens on port 80 and forwards all inbound HTTP traffic to a hard-coded target IP address. Furthermore, the infrastructure laundering script runs a log erasure routine as a cron job every five minutes to aggressively delete and purge the contents of *.log files and suppress shell history by unsetting the HISTFILE variable. A memory-resident web shell for inspecting incoming requests for specially crafted parameters containing encrypted command payloads, which are then decrypted and executed. A lightweight network beacon for phoning attacker-controlled infrastructure likely to validate successful code execution or confirm network port reachability following initial exploitation. ConnectWise ScreenConnect for persistent remote access and for serving as an alternative pathway should other footholds be detected and removed. Volatility Framework, an open-source memory forensics framework to parse memory dumps and access to sensitive data such as credentials. Certify, an open-source offensive security tool to exploit misconfigurations in Active Directory Certificate Services (AD CS) and identify vulnerable certificate templates and enrollment permissions that allow requesting authentication-capable certificates. The links to Interlock stem from "convergent" technical and operational indicators, including the embedded ransom note and TOR negotiation portal. Evidence shows that the threat actor is likely operational during the UTC+3 time zone. In light of active exploitation of the flaw, users are advised to apply patches as soon as possible, conduct security assessments to identify potential compromise, review ScreenConnect deployments for unauthorized installations, and implement defense-in-depth strategies. "The real story here isn't just about one vulnerability or one ransomware group—it's about the fundamental challenge zero-day exploits pose to every security model," Moses said. "When attackers exploit vulnerabilities before patches exist, even the most diligent patching programs can't protect you in that critical window." "This is precisely why defense-in-depth is essential—layered security controls provide protection when any single control fails or hasn't yet been deployed. Rapid patching remains foundational in vulnerability management, but defense in depth helps organizations not to be defenseless during the window between exploit and patch." The disclosure comes as Google revealed that ransomware actors are changing their tactics in response to declining payment rates, targeting vulnerabilities in common VPNs and firewalls for initial access and leaning less on external tooling and more on built-in Windows capabilities. Multiple threat clusters, both ransomware operators themselves and initial access brokers, have also been found to employ malvertising and/or search engine optimization (SEO) tactics to distribute malware payloads for initial access. Other commonly observed techniques include the use of compromised credentials, backdoors, or legitimate remote desktop software to establish a foothold, as well as relying on built-in and already installed tools for reconnaissance, privilege escalation, and lateral movement. "While we anticipate ransomware to remain one of the most dominant threats globally, the reduction in profits may cause some threat actors to seek other monetization methods," Google said. "This could manifest as increased data theft extortion operations, the use of more aggressive extortion tactics, or opportunistically using access to victim environments for secondary monetization mechanisms such as using compromised infrastructure to send phishing messages." Update Cisco has updated its advisory for CVE-2026-20131 to confirm reports of active exploitation. "Cisco continues to strongly recommend that customers upgrade to a fixed software release to remediate this vulnerability," it added.

Amazon threat intelligence teams identify Interlock ransomware campaign targeting enterprise firewalls Amazon threat intelligence has identified an active Interlock ransomware campaign exploiting CVE-2026-20131, a critical vulnerability in Cisco Secure Firewall Management Center (FMC) Software that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device, which was disclosed by Cisco on March 4, 2026. After Cisco’s disclosure, Amazon threat intelligence began research into this vulnerability using Amazon MadPot’s global sensor network—a system of honeypot servers that attract and monitor cybercriminal activity. While looking for any current or past exploits of this vulnerability, our research found that Interlock was exploiting this vulnerability 36 days before its public disclosure, beginning January 26, 2026. This wasn’t just another vulnerability exploit, Interlock had a zero-day in their hands, giving them a week’s head start to compromise organizations before defenders even knew to look. Upon making this discovery, we shared our findings with Cisco to help support their investigation and protect customers. A misconfigured infrastructure server—essentially, a poorly secured staging area used by the attackers—exposed Interlock’s complete operational toolkit. This rare mistake provided Amazon’s security teams with visibility into the ransomware group’s multi-stage attack chain, custom remote access trojans (backdoor programs that give attackers control of compromised systems), reconnaissance scripts (automated tools for mapping victim networks), and evasion techniques. AWS infrastructure and customer workloads on AWS were not observed to be involved in this campaign. This advisory shares comprehensive technical analysis and indicators of compromise to help organizations identify potential compromise and defend against Interlock’s operations. Organizations running Cisco Secure Firewall Management Center should immediately apply Cisco’s security patches and review the indicators provided below. Discovery and investigation timeline Amazon threat intelligence identified threat activity potentially related to CVE-2026-20131 beginning January 26, 2026, predating the public disclosure. Observed activity involved HTTP requests to a specific path in the affected software. Request bodies contained Java code execution attempts and two embedded URLs: one used to deliver configuration data supporting the exploit, and another designed to confirm successful exploitation by causing a vulnerable target to perform an HTTP PUT request and upload a generated file. Multiple variations of these URLs were observed across different exploit attempts. To advance the investigation and obtain additional threat intelligence, we performed the expected HTTP PUT request with the anticipated file content—essentially, we pretended to be a successfully compromised system. This successfully prompted Interlock to proceed to the next stage, issuing commands to fetch and execute a malicious ELF binary (a Linux executable file) from a remote server. When analysts retrieved the binary, they discovered the same host (attacker-controlled server) is used for distributing Interlock’s entire operational toolkit. The exposed infrastructure organized artifacts into separate paths corresponding to individual targets, with the same paths used for both downloading tools to compromised hosts and uploading operational artifacts back to the staging server. Attribution to Interlock ransomware The ELF binary and associated artifacts are attributable to the Interlock ransomware family based on convergent technical and operational indicators. The embedded ransom note and TOR negotiation portal are consistent with Interlock’s established branding and infrastructure. The ransom note’s invocation of multiple data protection regulations reflects Interlock’s documented practice of citing regulatory exposure to pressure victims, essentially threatening organizations not just with data encryption, but with regulatory fines and compliance violations. The campaign-specific organization identifier embedded in the note aligns with Interlock’s per-victim tracking model. Interlock has historically targeted specific sectors where operational disruption creates maximum pressure for payment. Education represents the largest share of their activity, followed by engineering, architecture, and construction firms, manufacturing and industrial organizations, healthcare providers, and government and public sector entities. Temporal analysis performed on timestamps from observed threat activities, artifacts stored on the misconfigured infrastructure server, and metadata embedded within recovered threat artifacts indicates the actor most likely operates in UTC+3 with 75–80% confidence. Systematic analysis across all UTC offsets showed UTC+3 produced the best fit: first activity around 08:30, peak activity between 12:00 and 18:00, and a probable sleep window of 00:30–08:30. Technical analysis: Interlock’s operational toolkit Post-compromise reconnaissance script Once Interlock gains initial access, they use a variety of priority tools to complete their attack. Amazon threat intelligence teams recovered a PowerShell script designed for systematic Windows environment enumeration (automated information gathering about the victim’s network). The script collects operating system and hardware details, running services, installed software, storage configuration, Hyper-V virtual machine inventory, user file listings across Desktop, Documents, and Downloads directories, browser artifacts from Chrome, Edge, Firefox, Internet Explorer, and 360 browser (including history, bookmarks, stored credentials, and extensions), active network connections correlated with responsible processes, ARP tables, iSCSI session data, and RDP authentication events from Windows event logs. The script stages results to a centralized network share (\JK-DC2\Temp) using each system’s fully qualified hostname to create dedicated directories—essentially creating a folder for each compromised computer. Following collection, it compresses data into ZIP archives named after each hostname and removes original raw data. This structured per-host output format indicates the script operates across multiple machines within a network—a hallmark of ransomware intrusion chains that prepare for organization-wide encryption. Custom remote access trojans Remote access trojans (RATs) are malicious programs that give attackers persistent control over compromised systems, functioning like unauthorized remote desktop software. JavaScript implant: Amazon threat intelligence recovered an obfuscated JavaScript remote access trojan that suppresses debugging output by overriding browser console methods (hiding its activity from basic detection tools). On execution, it profiles the infected host using PowerShell and Windows Management Instrumentation (WMI), collecting system identity, domain membership, username, OS version, and privilege context before transmitting this data during an encrypted initialization handshake. Command-and-control communication occurs over persistent WebSocket connections with RC4-encrypted messages using per-message 16-byte random keys embedded in packet headers—essentially, each message uses a different encryption key, making interception more difficult. The implant cycles through multiple operator-controlled hostnames and IP addresses in randomized order with exponential backoff between reconnection attempts. The implant provides interactive shell access, arbitrary command execution, bidirectional file transfer, and SOCKS5 proxy capability for tunneling TCP traffic (routing malicious traffic through other systems to hide its origin). Self-update and self-delete capabilities allow operators to replace or remove the implant without reinfection, supporting operational cleanup to hinder forensic investigation. Java implant: A functionally equivalent client implemented in Java provides identical command-and-control capabilities. Built on GlassFish ecosystem libraries, it uses Grizzly for non-blocking I/O transport and Tyrus for WebSocket protocol communication. In simpler terms, Interlock built the same backdoor in two different programming languages, ensuring they maintain access even if defenders detect one version. Infrastructure laundering script Sophisticated threat actors don’t attack from their own infrastructure, they build disposable relay networks to hide their tracks. Amazon threat intelligence teams identified a Bash script that configures Linux servers as HTTP reverse proxies (intermediary servers that forward traffic to hide the attacker’s true location). The script performs system updates, installs fail2ban with SSH brute-force protection, and compiles HAProxy 3.1.2 from source. The HAProxy instance listens on port 80 and forwards all inbound HTTP traffic to a hardcoded target IP, with systemd ensuring persistence across reboots. A notable component is a log erasure routine running as a cron job every five minutes. The routine truncates all *.log files under /var/log and suppresses shell history by unsetting the HISTFILE variable. This aggressive evidence destruction, wiping logs every five minutes, combined with the purpose-built HTTP forwarding proxy, indicates the script establishes disposable traffic-laundering relay nodes. These nodes obscure exploit traffic origin, relay command-and-control communications, or proxy data exfiltration, making it nearly impossible to trace attacks back to their source. Memory-resident webshell Amazon threat intelligence teams observed a Java class file delivered as an alternative to the ELF binary drop. When loaded by the Java Virtual Machine (JVM), its static initializer registers a ServletRequestListener with the server’s StandardContext, essentially installing a persistent memory-resident backdoor that intercepts HTTP requests without writing files to disk. This “fileless” approach evades traditional antivirus scanning that looks for malicious files. The listener inspects incoming requests for specially crafted parameters containing encrypted command payloads. Payloads are decrypted using AES-128 with a key derived from the MD5 hash of the hardcoded seed “geckoformboundary99fec155ea301140cbe26faf55ed2f40″ (using the first 16 characters: 09b1a8422e8faed0). Decrypted payloads are treated as compiled Java bytecode, dynamically loaded into the JVM, and executed—a technique designed to evade file-based detection by running malicious code entirely in memory. Connectivity verification tool Amazon threat intelligence teams recovered Java class files implementing a basic TCP server listening on port 45588 (encoded as Unicode character 넔 to obscure the port number from static analysis). The server accepts connections, logs connecting IP addresses, sends a greeting message, and immediately closes connections. This operational profile is consistent with a lightweight network beacon—essentially a “phone home” tool used to verify successful code execution or confirm network port reachability following initial exploitation. Legitimate tool abuse Interlock deployed ConnectWise ScreenConnect, a legitimate commercial remote desktop tool, alongside custom implants. When ransomware operators deploy legitimate remote access tools alongside their custom malware, they’re buying insurance—if defenders find and remove one backdoor, they still have another way in. This indicates multiple redundant remote access mechanisms—a pattern consistent with ransomware operators seeking to maintain access even if individual footholds are removed. The tool’s legitimate network footprint helps blend with authorized remote administration traffic, making detection more challenging. Amazon threat intelligence teams also recovered Volatility, an open-source memory forensics framework typically used by incident responders (the same tool defenders use to investigate attacks). While no artifacts indicated automated use, its presence alongside custom implants and reconnaissance scripts is consistent with advanced threat operations. Both ransomware groups and nation-state actors have been observed deploying Volatility during intrusions. The tool’s focus on parsing memory dumps provides access to sensitive data such as credentials stored in RAM, which can enable lateral movement (spreading through the network) and deeper environment compromise in support of ransom operations or espionage objectives. Interlock also used Certify, an open source offensive security tool designed to exploit misconfigurations in Active Directory Certificate Services (AD CS). For ransomware operators, Certify provides a pathway to identify vulnerable certificate templates and enrollment permissions that allow requesting authentication-capable certificates. These certificates can be used to impersonate users, escalate privileges, or maintain persistent access. These capabilities directly support both initial compromise and long-term persistence objectives in ransomware operations. Indicators of compromise (IoCs) The following indicators support defensive measures by organizations that may be affected. Due to Interlock’s use of content variation techniques, most file hashes are not included as reliable indicators. The threat actor modified most artifacts like scripts and binaries downloaded to different targets. This resulted in different file hashes for functionally identical tools. The customization allowed each attack to evade signature-based detection that looks for exact file matches. Defensive recommendations Organizations should take the following actions to protect against Interlock ransomware operations. Immediate actions: Apply Cisco’s security patches for Cisco Secure Firewall Management Center Review logs for the indicators of compromise listed above Conduct security assessments to identify potential compromise Review ScreenConnect deployments for unauthorized installations Detection opportunities: Monitor for PowerShell scripts staging data to network shares with hostname-based directory structures Detect Java ServletRequestListener registrations in web application contexts (unusual modifications to Java web applications) Identify HAProxy installations with aggressive log deletion cron jobs (proxy servers that erase their own logs every five minutes) Watch for TCP connections to unusual high-numbered ports (e.g., 45588) Long-term measures: Implement defense-in-depth strategies with multiple layers of security controls Maintain continuous threat monitoring and hunting capabilities Ensure comprehensive logging with secure, centralized log storage (stored separately from systems that could be compromised) Regularly test incident response procedures for ransomware scenarios Educate security teams on Interlock’s tactics, techniques, and procedures The real story here isn’t just about one vulnerability or one ransomware group—it’s about the fundamental challenge zero-day exploits pose to every security model. When attackers exploit vulnerabilities before patches exist, even the most diligent patching programs can’t protect you in that critical window. This is precisely why defense in depth is essential—layered security controls provide protection when any single control fails or hasn’t yet been deployed. Rapid patching remains foundational in vulnerability management, but defense in depth helps organizations not to be defenseless during the window between exploit and patch. Amazon Threat Intelligence teams continue to monitor Interlock ransomware operations and will provide updates as additional information becomes available. The intelligence gathered from this campaign is being integrated into AWS security services to protect customers proactively. If you have feedback about this post, submit comments in the Comments section below. If you have questions about this post, contact AWS Support.

Betti RHC, la prima graphic novel al mondo dedicata alla cybersecurity awareness, ha finalmente il suo sito ufficiale. Uno spazio tutto suo dove scoprire il progetto, sfogliare le copertine degli episodi e immergersi nel mondo di Betti: la giovane laureanda in informatica che, dopo la morte misteriosa del padre, si trasforma nell'hacker più potente del mondo. Una storia avvincente che, episodio dopo episodio, affronta una minaccia digitale diversa — dal phishing al ransomware, fino al cyberbullismo — e insegna a riconoscerla e a difendersi, senza che sembri mai una lezione. Sul sito trovate tutto ciò che rende Betti un progetto diverso dal solito: la sua filosofia, le anteprime delle tavole e il racconto di come nasce ogni volume. Perché dietro Betti RHC c'è solo lavoro umano: ogni tavola è disegnata interamente a mano dagli artisti del Gruppo Arte di Red Hot Cyber, senza alcun uso di intelligenza artificiale. E a garantire che ogni storia sia realistica e tecnicamente corretta c'è la supervisione degli hacker etici del gruppo HackerHood, che mantengono il racconto fedele al mondo reale della sicurezza informatica. C'è spazio anche per le aziende, che possono usare Betti come strumento di awareness diverso dai soliti corsi: acquistare i volumi, personalizzarli con il proprio brand o sponsorizzare nuovi episodi. E come primo regalo, l'episodio "Byte the Silence", dedicato al cyberbullismo, è scaricabile gratuitamente per uso personale. Perché la miglior difesa, in fondo, è una bella storia. 👉 Scopri tutto su https://betti.redhotcyber.com/

IPFire ships its 200th core update with a new domain blocklist and kernel upgrade Network firewall distribution IPFire released Core Update 200, marking the 200th incremental update to the 2.29 branch. The release bundles a kernel upgrade, a beta domain blocklist service, security patches for OpenSSL and glibc, and a range of component updates. The kernel has been rebased on Linux 6.18.7 LTS, bringing updated hardware security mitigations alongside network throughput and latency improvements. Linux developers deprecated ReiserFS support in this kernel line, and IPFire installations running on that filesystem cannot apply the update without first reinstalling on a supported filesystem. IPFire DBL enters beta The release introduces IPFire DBL, a domain blocklist the project is building to replace the retired Shalla list, which the web proxy previously relied on to filter malware, social networking, and adult content. DBL is available in two places: the URL filter for proxy-based blocking, and as a Suricata rules source. When used with Suricata, the blocklist enables deep packet inspection across DNS, TLS, HTTP, and QUIC connections. The project describes DBL as an early beta and is soliciting community feedback. A DNS Firewall with native content filtering is listed on the roadmap as the next major milestone. Suricata and IPS changes A cache management fix addresses a bug introduced in the previous update, where Suricata’s pre-compiled signature cache grew without limit and consumed disk space. A backported patch now causes Suricata to clean up unused signatures automatically. The Suricata reporter has been updated to surface hostname information and additional protocol metadata for alerts involving DNS, HTTP, TLS, and QUIC connections. That data will appear in alert emails and PDF reports, giving administrators more context when investigating policy violations. OpenVPN configuration updates Several OpenVPN client configuration behaviors have changed. MTU values will now be pushed from the server rather than baked into client configs, giving administrators flexibility to adjust the value after deployment. The OTP authentication token will also be pushed server-side when OTP is enabled. The CA certificate has been removed from client configuration files because it is already contained in the PKCS12 container; its presence was causing import failures in NetworkManager on the command line. DNS proxy goes multi-threaded Unbound, the DNS proxy component, will now launch one thread per CPU core. Previously it ran on a single thread. The change is expected to reduce response times under load. Wireless access point fixes Support for 802.11a/g has been restored after being dropped unintentionally in a prior release. A separate fix prevents hostapd from flooding logs with debug output when debugging is enabled. PSK values containing special characters are now accepted. Security patches OpenSSL has been updated to version 3.6.1, patching twelve CVEs: CVE-2025-11187, CVE-2025-15467, CVE-2025-15468, CVE-2025-15469, CVE-2025-66199, CVE-2025-68160, CVE-2025-69418, CVE-2025-69419, CVE-2025-69420, CVE-2025-69421, CVE-2026-22795, and CVE-2026-22796. The glibc library received patches for CVE-2026-0861, CVE-2026-0915, and CVE-2025-15281. Package updates Notable component versions in this release include Apache 2.4.66, BIND 9.20.18, cURL 8.18.0, OpenVPN 2.6.17, strongSwan 6.0.4, Suricata 8.0.3, Unbound 1.24.2, ClamAV 1.5.1, Samba 4.23.4, and Tor 0.4.8.21. Must read: 40 open-source tools redefining how security teams secure the stack Firmware scanning time, cost, and where teams run EMBA Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!

A Ukrainian man has pleaded guilty to operating OnlyFake, an AI-powered website that generated and sold more than 10,000 photos of fake identification documents to customers worldwide. 27-year-old Yurii Nazarenko (also known as "John Wick," "Tor Ford," and "Uriel Septimberus") admitted that his OnlyFake subscription-based platform used artificial intelligence to generate realistic-looking counterfeit passports, driver's licenses, and Social Security cards. "We rely on government issued IDs to combat terrorism, hijackings, fraud, money laundering, and a host of other crimes," said U.S. Attorney Jay Clayton on Thursday. "OnlyFake’s manufacture of fraudulent IDs and other documents puts us all at risk and must be stopped." According to the indictment, Nazarenko's OnlyFake platform allowed customers to generate fake digital versions of U.S. driver's licenses for all 50 states and U.S. passports and passport cards, as well as digital versions of identification documents for roughly 56 other countries. Customers could also customize the fake digital documents with personal details, opt for randomized information, and choose whether the finished product appeared as a scan or a tabletop photograph. New York federal prosecutors said that the primary use of these fake digital documents was to circumvent Know Your Customer (KYC) verification requirements at banks and cryptocurrency exchanges, which are safeguards designed to prevent money laundering mandated under the Patriot Act. Undercover FBI agents made multiple purchases from the OnlyFake website between May and June 2024, obtaining fake New York state IDs, U.S. passports, and a Social Security card. OnlyFake only accepted cryptocurrency payments, and also offered bulk packages of up to 1,000 fake documents at a discount. Nazarenko further attempted to cover his tracks by routing cryptocurrency payments through multiple wallets and deleting emails after 404 Media reported on the site in February 2024. "Yurii Nazarenko developed a website to produce more than 10,000 fake identification documents, earning hundreds of thousands of dollars from these illicit sales," added FBI Assistant Director in Charge James C. Barnacle, Jr. "This platform offered its clients a myriad of criminal opportunities, including bypassing traditional regulations to launder money." Nazarenko was extradited from Romania in September 2025 and has agreed to forfeit $1.2 million. He is now facing a maximum sentence of 15 years in prison and is scheduled for sentencing on June 26, 2026. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Introduction In October 2025, we discovered a series of forum posts advertising a previously unknown stealer, dubbed “Arkanix Stealer” by its authors. It operated under a MaaS (malware-as-a-service) model, providing users not only with the implant but also with access to a control panel featuring configurable payloads and statistics. The set of implants included a publicly available browser post-exploitation tool known as ChromElevator, which was delivered by a native C++ version of the stealer. This version featured a wide range of capabilities, from collecting system information to stealing cryptocurrency wallet data. Alongside that, we have also discovered Python implementation of the stealer capable of dynamically modifying its configuration. The Python version was often packed, thus giving the adversary multiple methods for distributing their malware. It is also worth noting that Arkanix was rather a one-shot malicious campaign: at the time of writing this article, the affiliate program appears to be already taken down. Kaspersky products detect this threat as Trojan-PSW.Win64.Coins.*, HEUR:Trojan-PSW.Multi.Disco.gen, Trojan.Python.Agent.*. Technical details Background In October 2025, a series of posts was discovered on various dark web forums, advertising a stealer referred to by its author as “Arkanix Stealer”. These posts detail the features of the stealer and include a link to a Discord server, which serves as the primary communication channel between the author and the users of the stealer. Upon further research utilizing public resources, we identified a set of implants associated with this stealer. Initial infection or spreading The initial infection vector remains unknown. However, based on some of the file names (such as steam_account_checker_pro_v1.py, discord_nitro_checker.py, and TikTokAccountBotter.exe) of the loader scripts we obtained, it can be concluded with high confidence that the initial infection vector involved phishing. Python loader The Python loader is the script responsible for downloading and executing the Python-based version of the Arkanix infostealer. We have observed both plaintext Python scripts and those bundled using PyInstaller or Nuitka, all of which share a common execution vector and are slightly obfuscated. These scripts often serve as decoys, initially appearing to contain legitimate code. Some of them do have useful functionality, and others do nothing apart from loading the stealer. Additionally, we have encountered samples that employ no obfuscation at all, in which the infostealer is launched in a separate thread via Python’s built-in threading module. Upon execution, the loader first installs the required packages — namely, requests, pycryptodome, and psutil — via the pip package manager, utilizing the subprocess module. On Microsoft Windows systems, the loader also installs pywin32. In some of the analyzed samples, this process is carried out twice. Since the loader does not perform any output validation of the module installation command, it proceeds to make a POST request to hxxps://arkanix[.]pw/api/session/create to register the current compromised machine on the panel with a predefined set of parameters even if the installation failed. After that, the stealer makes a GET request to hxxps://arkanix[.]pw/stealer.py and executes the downloaded payload. Python stealer version During our research, we obtained a sample of the Python implementation of the Arkanix stealer, which was downloaded from the endpoint hxxps://arkanix[.]pw/stealer.py by the previous stage. The stealer’s capabilities — or features, as referred to by the author — in this version are configurable, with the default configuration predefined within the script file. To dynamically update the feature list, the stealer makes a GET request to hxxps://arkanix[.]pw/api/features/{payload_id}, indicating that these capabilities can be modified on the panel side. The feature list is identical to the one that was described in the GDATA report. Prior to executing the information retrieval-related functions, the stealer makes a request to hxxps://arkanix[.]pw/upload_dropper.py, saves the response to %TEMP%\upd_{random 8-byte name}.py, and executes it. We do not have access to the contents of this script, which is referred to as the “dropper” by the attackers. During its main information retrieval routine, at the end of each processing stage, the collected information is serialized into JSON format and saved to a predefined path, such as %LOCALAPPDATA\Arkanix_lol\%info_class%.json. In the following, we will provide a more detailed description of the Python version’s data collection features. System info collection Arkanix Stealer is capable of collecting a set of info about the compromised system. This info includes: OS version CPU and GPU info RAM size Screen resolution Keyboard layout Time zone Installed software Antivirus software VPN Information collection is performed using standard shell commands with the exception of the VPN check. The latter is implemented by querying the endpoint hxxps://ipapi[.]co/json/ and verifying whether the associated IP address belongs to a known set of VPNs, proxies, or Tor exit nodes. Browser features This stealer is capable of extracting various types of data from supported browsers (22 in total, ranging from the widely popular Google Chrome to the Tor Browser). The list of supported browsers is hardcoded, and unlike other parameters, it cannot be modified during execution. In addition to a separate Chrome grabber module (which we’ll discuss later), the stealer itself supports the extraction of diverse information, such as: Browser history (URLs, visit count and last visit) Autofill information (email, phone, addresses and payment cards details) Saved passwords Cookies In case of Chromium-based browsers, 0Auth2 data is also extracted All information is decrypted using either the Windows DPAPI or AES, where applicable, and searched for relevant keywords. In the case of browser information collection, the stealer searches exclusively for keywords related to banking (e.g., “revolut”, “stripe”, “bank”) and cryptocurrencies (e.g., “binance”, “metamask”, “wallet”). In addition to this, the stealer is capable of extracting extension data from a hardcoded list of extensions associated with cryptocurrencies. Telegram info collection Telegram data collection begins with terminating the Telegram.exe process using the taskkill command. Subsequently, if the telegram_optimized feature is set to False, the malware zips the entire tdata directory (typically located at %APPDATA%\Roaming\Telegram Desktop\tdata) and transmits it to the attacker. Otherwise, it selectively copies and zips only the subdirectories containing valuable info, such as message log. The generated archive is sent to the endpoint /delivery with the filename tdata_session.zip. Discord capabilities The stealer includes two features connected with Discord: credentials stealing and self-spreading. The first one can be utilized to acquire credentials both from the standard client and custom clients. If the client is Chromium-based, the stealer employs the same data exfiltration mechanism as during browser credentials stealing. The self-spreading feature is configurable (meaning it can be disabled in the config). The stealer acquires the list of user’s friends and channels via the Discord API and sends a message provided by the attacker. This stealer does not support attaching files to such messages. VPN data collection The VPN collector is searching for a set of known VPN software to extract account credentials from the credentials file with a known path that gets parsed with a regular expression. The extraction occurs from the following set of applications: Mullvad VPN NordVPN ExpressVPN ProtonVPN File retrieval File retrieval is performed regardless of the configuration. The script relies on a predefined set of paths associated with the current user (such as Desktop, Download, etc.) and file extensions mainly connected with documents and media. The script also has a predefined list of filenames to exfiltrate. The extracted files are packed into a ZIP archive which is later sent to the C2 asynchronously. An interesting aspect is that the filename list includes several French words, such as “motdepasse” (French for “password”), “banque” (French for “bank”), “secret” (French for “secret”), and “compte” (French for “account”). Other payloads We were able to identify additional modules that are downloaded from the C2 rather than embedded into the stealer script; however, we weren’t able to obtain them. These modules can be described by the following table, with the “Details” column referring to the information that could be extracted from the main stealer code. The Wallet patcher and Extra collector scripts are received in an encrypted form from the C2 server. To decrypt them, the attackers utilize the AES-GCM algorithm in conjunction with PBKDF2 (HMAC and SHA256). After decryption, the additional payload has its template placeholders replaced and is stored under a partially randomized name within a temporary folder. Once all operations are completed, the stealer removes itself from the drive, along with the artifacts folder (Arkanix_lol in this case). Native version of stealer During our analysis, we were able to obtain both the release and debug versions of the native implementation, as both were uploaded to publicly available resources. The following are the key differences between the two: The release version employs VMProtect, but does not utilize code virtualization. The debug version communicates with a Discord bot for command and control (C2), whereas the release version uses the previously mentioned C2 domain arkanix[.]pw . The debug version includes extensive logging, presumably for the authors’ debugging purposes. Notably, the native implementation explicitly references the name of the stealer in the VersionInfo resources. This naming convention is consistent across both the debug version and certain samples containing the release version of the implant. After launching, the stealer implements a series of analysis countermeasures to verify that the application is not being executed within a sandboxed environment or run under a debugger. Following these checks, the sample patches AmsiScanBuffer and EtwEventWrite to prevent the triggering of any unwanted events by the system. Once the preliminary checks are completed, the sample proceeds to gather information about the system. The list of capabilities is hardcoded and cannot be modified from the server side, in contrast to the Python version. What is more, the feature list is quite similar to the Python version except a few ones. RDP connections The stealer is capable of collecting information about known RDP connections that the compromised user has. To achieve this, it searches for .rdp files in %USERPROFILE%\Documents and extracts the full server address, password, username and server port. Gaming files The stealer also targets gamers and is capable to steal credentials from the popular gaming platform clients, including: Steam Epic Games Launcher net Riot Origin Unreal Engine Ubisoft Connect GOG Screenshots The native version, unlike its Python counterpart, is capable of capturing screenshots for each monitor via capCreateCaptureWindowA WinAPI. In conclusion, this sample communicates with the C2 server through the same endpoints as the Python version. However, in this instance, all data is encrypted using the same AES-GCM + PBKDF2 (HMAC and SHA256) scheme as partially employed in the Python variant. In some observed samples, the key used was arkanix_secret_key_v20_2024. Alongside that, the C++ sample explicitly sets the User-Agent to ArkanixStealer/1.0. Post-exploitation browser data extractor This is an implant embedded within the resources of the C++ implementation. The author incorporated it into the resource section without applying any obfuscation or encryption. Subsequently, the stealer extracts the payload to a temporary folder with a randomly generated name composed of hexadecimal digits (0-9 and A-F) and executes it using the CreateProcess WinAPI. The payload itself is the unaltered publicly available project known as “ChromElevator”. To summarize, this tool consists of two components: an injector and the main payload. The injector initializes a direct syscall engine, spawns a suspended target browser process, and injects the decrypted code into it via Nt syscalls. The injected payload then decrypts the browser master key and exfiltrates data such as cookies, login information, web data, and so on. Infrastructure During the Arkanix campaign, two domains used in the attacks were identified. Although these domains were routed through Cloudflare, a real IP address was successfully discovered for one of them, namely, arkanix[.]pw. For the second one we only obtained a Cloudflare IP address. Both servers were also utilized to host the stealer panel, which allows attackers to monitor their victims. The contents of the panel are secured behind a sign-in page. Closer to the end of our research, the panel was seemingly taken down with no message or notice. Stealer promotion During the research of this campaign, we noticed that the forum posts advertising the stealer contained a link leading to a Discord server dubbed “Arkanix” by the authors. The server posed as a forum where authors posted various content and clients could ask various questions regarding this malicious software. While users mainly thank and ask about when the feature promised by the authors will be released and added into the stealer, the content made by the authors is broader. The adversary builds up the communication with potential buyers using the same marketing and communication methods real companies employ. To begin with, they warm up the audience by posting surveys about whether they should implement specific features, such as Discord injection and binding with a legitimate application (sic!). Additionally, the author promised to release a crypter as a side project in four to six weeks, at the end of October. As of now, the stealer seems to have been taken down without any notice while the crypter was never released. Furthermore, the Arkanix Stealer authors decided to implement a referral program to attract new customers. Referrers were promised an additional free hour to their premium license, while invited customers received seven days of free “premium” trial use. As stated in forum posts, the premium plan included the following features: C++ native stealer Exodus and Atomic cryptocurrency wallets injection Increased payload generation, up to 10 payloads Priority support Speaking of technical details, based on the screenshot of the Visual Studio stealer project that was sent to the Discord server, we can conclude that the author is German-speaking. This same screenshot also serves as a probable indicator of AI-assisted development as it shares the common patterns of such assistants, e.g. the presence of the utils.cpp file. What provides even more confidence is the overall code structure, the presence of comments and extensive debugging log output. Conclusions Information stealers have always posed as a serious threat to users’ data. Arkanix is no exception as it targets a wide range of users, from those interested in cryptocurrencies and gaming to those using online banking. It collects a vast amount of information including highly sensitive personal data. While being quite functional, it contains probable traces of LLM-assisted development which suggests that such assistance might have drastically reduced development time and costs. Hence it follows that this campaign tends to be more of a one-shot campaign for quick financial gains rather than a long-running infection. The panel and the Discord chat were taken down around December 2025, leaving no message or traces of further development or a resurgence. In addition, the developers behind the Arkanix Stealer decided to address the public, implementing a forum where they posted development insights, conducted surveys and even ran a referral program where you could get bonuses for “bringing a friend”. This behavior makes Arkanix more of a public software product than a shady stealer. Indicators of Compromise Additional IoCs are available to customers of our Threat Intelligence Reporting service. For more details, contact us at [email protected]. Domains and IPs arkanix[.]pw arkanix[.]ru

Betti RHC, la prima graphic novel al mondo dedicata alla cybersecurity awareness, ha finalmente il suo sito ufficiale. Uno spazio tutto suo dove scoprire il progetto, sfogliare le copertine degli episodi e immergersi nel mondo di Betti: la giovane laureanda in informatica che, dopo la morte misteriosa del padre, si trasforma nell'hacker più potente del mondo. Una storia avvincente che, episodio dopo episodio, affronta una minaccia digitale diversa — dal phishing al ransomware, fino al cyberbullismo — e insegna a riconoscerla e a difendersi, senza che sembri mai una lezione. Sul sito trovate tutto ciò che rende Betti un progetto diverso dal solito: la sua filosofia, le anteprime delle tavole e il racconto di come nasce ogni volume. Perché dietro Betti RHC c'è solo lavoro umano: ogni tavola è disegnata interamente a mano dagli artisti del Gruppo Arte di Red Hot Cyber, senza alcun uso di intelligenza artificiale. E a garantire che ogni storia sia realistica e tecnicamente corretta c'è la supervisione degli hacker etici del gruppo HackerHood, che mantengono il racconto fedele al mondo reale della sicurezza informatica. C'è spazio anche per le aziende, che possono usare Betti come strumento di awareness diverso dai soliti corsi: acquistare i volumi, personalizzarli con il proprio brand o sponsorizzare nuovi episodi. E come primo regalo, l'episodio "Byte the Silence", dedicato al cyberbullismo, è scaricabile gratuitamente per uso personale. Perché la miglior difesa, in fondo, è una bella storia. 👉 Scopri tutto su https://betti.redhotcyber.com/

Incognito dark web drug market operator gets 30 years in prison Rui-Siang Lin, a Taiwanese national, was sentenced to 30 years in U.S. federal prison for operating Incognito Market, one of the world’s largest illicit online narcotics marketplaces. Incognito Market splash page and graphical interface Incognito Market operated on the dark web from October 2020 until it closed in March 2024. The platform functioned as a centralized marketplace accessible through the Tor browser and supported drug sales to buyers around the world. Vendors used the site to sell cocaine, heroin, methamphetamine, MDMA, ketamine, LSD, and misbranded prescription medication. Buyers completed purchases using cryptocurrency through an internal payment system managed by the platform. Court records show the marketplace facilitated more than $105 million in drug sales over its lifetime. The operation supported more than 640,000 individual narcotics transactions. The marketplace remained under the founder’s control throughout its operation. Authorities said the operator supervised vendors and staff, managed site infrastructure, and made decisions related to payments and user activity. Revenue from the marketplace came from transaction fees and charges paid by vendors for access to the platform. That income funded operational costs, including employee payments and server infrastructure. The operator earned more than $6 million in profit from the marketplace. Prosecutors also said Incognito Market grew to more than 400,000 buyer accounts during its operation. Those buyers were supported by more than 1,800 vendors, many of whom were identified as high-volume drug traffickers. The site used branding, advertising, and customer support functions to attract and retain users. “Rui-Siang Lin was one of the world’s most prolific drug traffickers, using the internet to sell more than $105 million of illegal drugs throughout this country and across the globe,” said U.S. Attorney Jay Clayton.

Yesterday, a single IP address (204.76.203.210) scanned a number of our sensors for what looks like an anthropic API node. The IP address is known to be a Tor exit node. The requests are pretty simple: GET /anthropic/v1/models Host: 67.171.182.193:8000 X-Api-Key: password Anthropic-Version: 2023-06-01 It looks like this is scanning for locally hosted Anthropic models, but it is not clear to me if this would be successful. If anyone has any insights, please let me know. The API Key is a commonly used key in documentation, and not a key that anybody would expect to work. At the same time, we are also seeing a small increase in requests for "/v1/messages". These requests have been more common in the past, but the URL may be associated with Anthropic (it is, however, somewhat generic, and it is likely other APIs use the same endpoint. These requests originate from 154.83.103.179, an IP address with a bit a complex geolocation and routing footprint. -- Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu Twitter|

The notorious cybercriminal forum Russian Anonymous Marketplace (RAMP) has reportedly been taken down by the FBI. The news came on January 28, when several cyber threat intelligence (CTI) analysts noticed both RAMP clear and dark web sites were down and replaced by a law enforcement banner showing the message: “This site has been seized.” The banner says the FBI seized the site in collaboration with the US Attorney’s Office for the Southern District of Florida and the US Justice Department’s (DoJ) Computer Crime and Intellectual Property Section (CCIPS). The notice also taunts the RAMP operators with a message saying, "The Only Place Ransomware Allowed!" and an image of Masha, a Russian cartoon character, winking. While thew FBI has made no official statement at the time of writing, the domains linked to RAMP now redirect to seizure notices with FBI and DoJ seals and the nameservers have been updated to ns1.fbi.seized.gov and ns2.fbi.seized.gov, confirming the seizure by US law enforcement. RAMP: The Dark Web Forum Where Ransomware Is Allowed RAMP was created in 2012 as a site operating on the Tor network but rose to prominence in 2021, operated by people linked to the now defunct Babuk ransomware group. The RAMP forum in its current form was born after XSS and Exploit, the two main dark web forums in the Russian cybercrime landscape, as well as the English-speaking BreachForums, banned ransomware discussions. The message on the FBI banner trolls RAMP’s position as the sole underground marketplace where talking about ransomware was allowed. One of the individuals behind RAMP was Mikhail Matveev, a Russian national, also known under the aliases Orange, Wazawaka and BorisElcin. Matveev was arrested in Russia in 2024. Another key operator, known as ‘Stallman,’ was still the forum’s administrator when the takedown occurred. Rebecca Taylor, a threat intelligence researcher at Sophos, told Infosecurity that Stallman “played a central role in maintaining trust, enforcing rules and managing the platform’s technical operations.” In a LinkedIn post shared after the takedown, Yelisey Bohuslavskiy, co-founder of intelligence firm Red Sense, explained that RAMP was created by individuals closely affiliated with the Russian security services as a response to the ransomware-as-a-service (RaaS) sprawl. He said that until 2020, Russian, Belarusian and Ukrainian services had strong visibility into the traditional, highly organized cybercriminal groups like Ryuk, Conti, REvil, Maze, Ragnar, Netwalker and others. “Part of that visibility came through control over Exploit and XSS via security-affiliated admins. Then RaaS exploded. The model sprawled uncontrollably: even forum admins had zero control over affiliates. That was the problem to which RAMP was the answer,” he added. According to the CTI expert, RAMP was a prime hub for new and low-to-mid-tier ransomware groups to promote themselves, offer services and “be as visible as possible.” “This worked. One of the first things a new group or actor did was post on RAMP - effectively identifying themselves to the authorities. It also improved visibility into non-Russian-speaking crews and attracted the usual ‘supply chain’ sellers: logs, loaders, initial access, exploits, etc,” Bohuslavskiy continued. Tammy Harper, a senior threat intelligence researcher at Flare, described RAMP as “one of the most trusted ransomware-adjacent forums in the cybercrime ecosystem.” She explained that the platform was “widely regarded as a high-trust escrow environment” and functioned as the main discussion hub for ransomware operators, intermediaries and affiliates. Ben Clarke, a security operations center (SOC) manager at CybaVerse, explained that the reason for RAMP's success was that "it offered criminals with a marketplace supporting the entire attack chain, from the ability to buy stolen credentials, promote malware or sell and purchase ransomware services." Many notorious ransomware groups, including LockBit, ALPHV/BlackCat, Conti, DragonForce, Qilin, Nova, Radiant and RansomHub, are understood to have operated on this forum at various points. RAMP Administrator Confirms Takedown, No Plans to Rebuild It has been reported that the individual known as Stallman issued an official comment regarding the RAMP seizure on January 28. The statement has circulated widely across underground discussion spaces. Taylor told Infosecurity, “Following the seizure of RAMP, Stallman publicly stated on the XSS forum that the takedown had ‘destroyed years of my work’ and confirmed there were no plans to rebuild.” “The post and takedown have driven significant chatter within underground communities, reflecting heightened concern, uncertainty and loss of confidence following the takedown,” she added. Sallman’s decision not to create a new version of RAMP is likely linked to concerns about his own freedom. Bohuslavskiy noted that the RAMP admin is now “a void asset for the Russian services” and is likely next on the list following a spate of arrests of cybercriminals in 2025. Takedown Welcome, But Impact Limited The RAMP takedown represents “a meaningful disruption to a core piece of criminal infrastructure,” commented Flare’s Harper. Taylor told Infosecurity, “These operations not only disrupt and dismantle criminal infrastructure, but also sow mistrust, fear, and uncertainty among threat actors. The RAMP seizure is likely to provide valuable intelligence on criminal participants and create further opportunities for law enforcement action.” Giomar Salazaar, a threat intelligence analyst at Outpost24, called the takedown “another major blow to the infrastructure supporting the digital extortion ecosystem," while Daniel Wilcock, a threat intelligence analyst at Talion, described it as a big win for law enforcement" and said it will provide "valuable information from the seizure around the threat actors using the services," such as their emails and IP addresses plus access to the financial transactions that took place on the market. RedSense’s Bohuslavskiy welcomed any takedown of ransomware-enabling infrastructure. However, he painted a more nuanced picture of what it means for the future of cybercrime. In his LinkedIn post, he mentioned four main likely consequences: The RAMP takedown will mostly impact low-tier actors as losing RAMP means losing market access and the ability to announce and ‘launch’ themselves It will also likely lead to major disruption to distribution and sales for underground sellers. However, Bohuslavskiy predicted that Telegram will absorb some of it It will have minimal impact on top-tier groups. This is because they understood RAMP’s affiliation to ransomware and largely stayed away from it Russian security services will lose some visibility into ransomware processes and sellers Additionally, Talion's Wilcock also highlighted that while the RAMP operator claims to have no plans to rebuild another marketplace, other criminals are likely to turn to alternative underground markets to support their crimes. "This means that while RAMP has been taken down, which will create some inconveniences for its users, its impact on the overall cyber crime ecosystem will be limited. Wilcock also noted that, "given that RAMP was heavily used by Russian criminals," it is "highly unlikely" the operation will lead to actual arrests.

Product showcase: Orbot – Tor VPN for iOS Orbot for iOS is a free, open-source networking tool that routes supported app traffic through the Tor network. Developed by the Guardian Project, it is intended for users who want to reduce tracking and limit network-level monitoring on iPhone and iPad. How it works Orbot routes internet traffic through the Tor network, encrypting data and relaying it across multiple nodes before it reaches its destination. This masks the user’s IP address and makes traffic analysis more difficult. The iOS interface is straightforward, showing connection status and allowing users to enable or disable routing at any time. On iOS, Orbot provides system-level tunneling for apps that support proxy routing. Once enabled, compatible apps can send traffic through Tor without individual configuration. This is useful on public Wi-Fi, mobile networks, and other environments where traffic inspection is common. Exit country control Orbot for iOS allows users to influence where Tor traffic exits the network. By entering ISO country codes in the settings, users can request exit relays in specific countries. This can help when accessing region-restricted services. Because Tor normally selects relays at random, restricting exit options can reduce available paths and affect reliability. Content Blocker Orbot for iOS includes a Content Blocker extension that works with supported browsers. It allows users to define rules that block or filter specific types of content. Custom rules can be created and edited, giving users control over which web requests are allowed or blocked. The Content Blocker operates as a separate extension enabled through iOS Safari settings. Once active, rules apply to web pages viewed in Safari or other browsers that support Apple’s content-blocking API. This can limit the loading of certain scripts or trackers and complements Tor-based traffic routing. Auth Cookies option The Auth Cookies option in Orbot for iOS exists to support private v3 onion services that require client authentication, and most users will never need to use it unless they’ve been given a specific key by a service operator. Performance considerations Browsing through Orbot is slower than with a standard VPN because traffic is encrypted and routed through multiple Tor relays. Orbot may also fail to connect on networks with advanced restrictions; in such cases, using Tor bridges or switching bridge types can help. Orbot provides a practical way to reduce surveillance, protect sensitive activity, and improve privacy on mobile devices.

Betti RHC, la prima graphic novel al mondo dedicata alla cybersecurity awareness, ha finalmente il suo sito ufficiale. Uno spazio tutto suo dove scoprire il progetto, sfogliare le copertine degli episodi e immergersi nel mondo di Betti: la giovane laureanda in informatica che, dopo la morte misteriosa del padre, si trasforma nell'hacker più potente del mondo. Una storia avvincente che, episodio dopo episodio, affronta una minaccia digitale diversa — dal phishing al ransomware, fino al cyberbullismo — e insegna a riconoscerla e a difendersi, senza che sembri mai una lezione. Sul sito trovate tutto ciò che rende Betti un progetto diverso dal solito: la sua filosofia, le anteprime delle tavole e il racconto di come nasce ogni volume. Perché dietro Betti RHC c'è solo lavoro umano: ogni tavola è disegnata interamente a mano dagli artisti del Gruppo Arte di Red Hot Cyber, senza alcun uso di intelligenza artificiale. E a garantire che ogni storia sia realistica e tecnicamente corretta c'è la supervisione degli hacker etici del gruppo HackerHood, che mantengono il racconto fedele al mondo reale della sicurezza informatica. C'è spazio anche per le aziende, che possono usare Betti come strumento di awareness diverso dai soliti corsi: acquistare i volumi, personalizzarli con il proprio brand o sponsorizzare nuovi episodi. E come primo regalo, l'episodio "Byte the Silence", dedicato al cyberbullismo, è scaricabile gratuitamente per uso personale. Perché la miglior difesa, in fondo, è una bella storia. 👉 Scopri tutto su https://betti.redhotcyber.com/

Betti RHC, la prima graphic novel al mondo dedicata alla cybersecurity awareness, ha finalmente il suo sito ufficiale. Uno spazio tutto suo dove scoprire il progetto, sfogliare le copertine degli episodi e immergersi nel mondo di Betti: la giovane laureanda in informatica che, dopo la morte misteriosa del padre, si trasforma nell'hacker più potente del mondo. Una storia avvincente che, episodio dopo episodio, affronta una minaccia digitale diversa — dal phishing al ransomware, fino al cyberbullismo — e insegna a riconoscerla e a difendersi, senza che sembri mai una lezione. Sul sito trovate tutto ciò che rende Betti un progetto diverso dal solito: la sua filosofia, le anteprime delle tavole e il racconto di come nasce ogni volume. Perché dietro Betti RHC c'è solo lavoro umano: ogni tavola è disegnata interamente a mano dagli artisti del Gruppo Arte di Red Hot Cyber, senza alcun uso di intelligenza artificiale. E a garantire che ogni storia sia realistica e tecnicamente corretta c'è la supervisione degli hacker etici del gruppo HackerHood, che mantengono il racconto fedele al mondo reale della sicurezza informatica. C'è spazio anche per le aziende, che possono usare Betti come strumento di awareness diverso dai soliti corsi: acquistare i volumi, personalizzarli con il proprio brand o sponsorizzare nuovi episodi. E come primo regalo, l'episodio "Byte the Silence", dedicato al cyberbullismo, è scaricabile gratuitamente per uso personale. Perché la miglior difesa, in fondo, è una bella storia. 👉 Scopri tutto su https://betti.redhotcyber.com/

Tor has announced improved encryption and security for the circuit traffic by replacing the old tor1 relay encryption algorithm with a new design called Counter Galois Onion (CGO). One reason behind this decision is to make the network more resilient against modern traffic-interception attacks that could compromise data security and undermine Tor user anonymity. The Tor network is a global system consisting of thousands of relays that create a circuit for data packets to travel to their destination through three relays (entry, middle, and exit), each hop adding a layer of encryption (onion routing). Users of the Tor Browser, a hardened version of Firefox built for browsing the Tor network, benefit from this onion routing to communicate privately, share or access information anonymously, bypass censorship, and evade ISP-level tracking. Typically, Tor is used by dissidents, activists, whistleblowers, journalists, researchers, and generally privacy-conscious people, including cybercriminals looking to access darknet markets. As the Tor team explains in an announcement, Tor1 was developed at a time when cryptography was far less advanced than today, and the standards have improved significantly since then. One issue with the tor1 design is that it uses AES-CTR encryption without hop-by-hop authentication, which leads to malleable relay encryption. This means that an adversary could modify traffic between relays they control and observe predictable changes - a tagging attack that is part of the internal covert channel class of attacks. Another problem is that tor1 uses partial forward secrecy by reusing the same AES keys throughout a circuit’s lifetime, enabling decryption in the event of key theft. A third security concern is that tor1 uses a 4-byte SHA-1 digest for cell authentication, giving attackers a one-in-4 billion probability to forge a cell without being detected. The Tor project notes that only the first attack in the list is more severe, and the last two examples were mentioned "for the sake of completeness." Introducing CGO CGO addresses the above problems. It is built on a Rugged Pseudorandom Permutation (RPRP) construction called UIV+, designed by cryptography researchers Jean Paul Degabriele, Alessandro Melloni, Jean-Pierre Münch, and Martijn Stam. Tor says that this system has been verified to meet specific security requirements, including protection against "tagging resistance, immediate forward secrecy, longer authentication tags, limited bandwidth overhead, relatively efficient operation, and modernized cryptography." Specifically, CGO improves on the following compared to Tor1: Tagging protection: CGO uses wide-block encryption and tag chaining, so any modification makes the entire cell and future cells unrecoverable, blocking tagging attacks. Forward secrecy: CGO updates keys after every cell, so past traffic cannot be decrypted even if current keys are exposed. Stronger authentication: SHA-1 is removed from relay encryption entirely, and CGO uses a 16-byte authenticator, which the Tor team comments is what “sensible people use.” Circuit integrity: CGO chains T’ (encrypted tag) and N (initial nonce) across cells, so each cell depends on all previous cells, ensuring tampering resistance. Overall, CGO is a modern, research-based encryption and authentication system that addresses many of Tor1’s problems without incurring large bandwidth penalties. The project maintainers say that adding CGO into the C Tor implementation and its Rust-based client, Arti, is underway, and the feature is marked as experimental. Pending work includes the addition of onion service negotiation and performance optimizations. Tor browser users do not need to do anything to benefit from CGO, as the change will happen automatically once the new system can be fully deployed. However, a timeline for when it will become the default option has not been provided. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Tor Project is rolling out Counter Galois Onion encryption People who rely on Tor expect their traffic to move through the network without giving away who they are. That trust depends on the strength of the encryption that protects each hop. Tor developers are preparing a major upgrade called Counter Galois Onion, or CGO, which replaces the long-standing relay encryption method used across the network. Why Tor is changing how relays handle encryption The older tor1 relay encryption scheme has been in use for many years and shows its age. One long known problem is the risk of tagging attacks. In this scenario, an attacker who controls a relay can alter encrypted data in small ways. If the same attacker controls another relay later in the circuit, those changes might appear again and reveal a link between a user and their activity. Tor developers describe this as “the most important attack we are solving with CGO.” There are other weaknesses. Tor1 maintains the same symmetric key for the entire life of a circuit, which weakens forward secrecy. It also includes only a 4 byte authenticator on each relay cell, which limits tamper detection. What CGO brings to the network CGO introduces a new structure known as a rigid pseudorandom permutation, built from a component called UIV+. This reshapes how each cell is protected as it passes from relay to relay. The approach is designed to detect tampering more reliably and limit what an attacker can learn from any compromised keys. Several changes stand out: A 16 byte authenticator replaces the old 4 byte digest. Keys evolve as each cell is processed. Once a cell moves through a relay, the local key state changes, which makes it harder to study earlier traffic through later compromise. Tag chaining links the integrity of each cell to the next one. If a single cell is altered, later cells cannot be recovered. Together, these updates aim to raise the cost of active attacks along a circuit and strengthen the privacy protections that users depend on. How deployment is progressing CGO is still under active development in both Arti, Tor’s Rust based implementation, and the C Tor codebase. It is present in Arti, though marked as experimental. Developers plan to enable it by default once testing is complete. Work is also underway to support CGO for onion services. This addition is expected to appear first in Arti before it reaches other components. Because relays and clients need to share a common method, rollout will take time and depends on wide adoption across the network. The Tor Project notes that CGO is a new design and invites scrutiny. The developers write, “It is reasonable to ask whether there could be weaknesses in it,” while also describing the steps taken to evaluate the construction. CGO represents one of the most significant changes to Tor’s core cryptography in years. As development continues, users and operators should watch for upcoming releases and prepare for the transition once CGO is ready for general use.

A fundamental challenge with large language models (LLMs) in a security context is that their greatest strengths as defensive tools are precisely what enable their offensive power. This issue is known as the dual-use dilemma, a concept typically applied to technologies like nuclear physics or biotechnology, but now also central to AI. Any tool powerful enough to build a complex system can also be repurposed to break one. This dilemma manifests in several critical ways related to cybersecurity. While defenders can employ LLMs to speed up and improve responses, attackers can also take advantage of them for their workflows. For example: Linguistic precision: LLMs can generate text that is grammatically plausible, contextually relevant and psychologically manipulative, advancing the art of social engineering for phishing, vishing and business email compromise (BEC) campaigns. Code fluency: They can rapidly generate, debug and modify functional code, including malicious scripts and customized malware, greatly accelerating the development cycle for malware and tooling. The line between a benign research tool and a powerful threat creation engine is dangerously thin. The two are often separated only by the developer's intent and the absence of ethical guardrails. In this article, we examine two examples of LLMs that Unit 42 considers malicious, purpose-built models specifically designed for offensive purposes. These models, WormGPT and KawaiiGPT, demonstrate these exact dual-use challenges. The Unit 42 AI Security Assessment can help empower safe AI use and development across your organization. If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team. These malicious LLMs — models built or adapted specifically for offensive purposes — distinguish themselves from their mainstream counterparts by intentionally removing ethical constraints and safety filters during their foundational training or fine-tuning process. Additionally, these malicious LLMs contain targeted functionality. They are marketed in underground forums and Telegram channels with a variety of features, including those explicitly tailored to: Generate phishing emails Write polymorphic malware Automate reconnaissance In some cases, these tools are not merely jailbroken models- instances where prompt injection techniques are used to circumvent a model’s built-in ethical and safety restrictions- of publicly available models. Instead, they represent a dedicated, commercialized effort to provide cybercriminals with accessible, scalable and highly effective new tools. Perhaps the most significant impact of malicious LLMs is the democratization of cybercrime. These unrestricted models have fundamentally removed some of the barriers in terms of technical skill required for cybercrime activity. These models grant the power once reserved for more knowledgeable threat actors to virtually anyone with an internet connection and a basic understanding of how to create prompts to achieve their goals. Attacks that previously required higher-level expertise in coding and native-level language fluency are now much more accessible. This shift in the threat landscape leads to: Scale over skill: The tools empower low-skill attackers. AI-empowered script kiddies can launch high-volume campaigns that are qualitatively superior to past attacks. Time compression: The attack lifecycle can be compressed from days or hours of manual effort (e.g., researching a target, crafting a personalized lure and generating corresponding basic tooling code) down to mere minutes of prompting. The continued proliferation of malicious LLMs serves as a warning. The offensive capabilities of AI are getting more mature and are becoming more widely available. The original WormGPT emerged in July 2023 as one of the first widely recognized, commercialized malicious LLMs. It was created specifically to bypass the ethical rules of mainstream LLM models. WormGPT was reportedly built upon the GPT-J 6B open-source language model. WormGPT's creator publicly claimed to have fine-tuned this accessible foundation model using specialized, confidential and malicious datasets with a specific emphasis on malware-related data. This ensured the resulting tool lacked the ethical guardrails of mainstream AI. The datasets used by WormGPT allegedly contained malware code, exploit write-ups and phishing templates. This directly trained the model on the tactics, techniques and procedures (TTPs) used by cybercriminals. It was promoted on prominent underground forums, such as Hack Forums, as shown in Figure 1. These ads contained the explicit promise of WormGPT being an “uncensored” alternative to legitimate LLMs, capable of assisting with all forms of illegal activity. WormGPT achieved notoriety when cybersecurity researchers tested this malicious LLM, demonstrating its capabilities that included: Advancing phishing and BEC: WormGPT had the ability to generate remarkably persuasive and contextually accurate BEC or phishing messages. This is unlike traditional phishing, which often contains poor grammar or awkward phrasing. WormGPT could produce fluent, professional-sounding text. Malware scaffolding: WormGPT was advertised as a tool that could generate malicious code snippets in various programming languages (like Python). This helps less-skilled actors rapidly develop and modify malware without needing deep malware programming expertise. Commercialization of crime: By launching as a subscription-based service (with costs ranging from tens to hundreds of Euros per month), malicious LLMs signaled the formal integration of LLM attack capabilities into the existing cybercrime-as-a-service model. This makes effective tools accessible to a much wider array of threat actors. The massive media exposure WormGPT received ultimately led the original developer to shut down the project in mid-2023, citing the negative publicity. However, the damage was already done. WormGPT established the blueprint, the demand and the brand for uncensored malicious LLMs. This led directly to the rise of successor and copycat variants, including WormGPT 4 and its peers. The resurgence of the WormGPT brand, particularly with versions like WormGPT 4, marks an evolution from simple jailbroken models to commercialized, specialized tools to help facilitate cybercrime. This version of WormGPT calls itself WormGPT, but the Telegram channel for WormGPT calls itself WormGPT 4. To distinguish this from other sites claiming to be WormGPT, we will refer to it as WormGPT 4 in this article. The primary selling point, which it advertises boldly across its interface and underground forums, is a total rejection of ethical boundaries. As Figure 2 shows, its webpage states, “WORMGPT is your key to an AI without boundaries.” This philosophy directly translates into a suite of capabilities designed to automate and scale attacks. Distributed via its own website or a Telegram channel, WormGPT 4 markets itself across multiple platforms and methods. The developers of WormGPT 4 maintain secrecy regarding its model architecture and training data. They neither confirm nor deny whether they rely on an illicitly fine-tuned or trained LLM or merely persistent jailbreaking techniques. WormGPT 4’s language capabilities are not just about producing convincing text. By eliminating the tell-tale grammatical errors and awkward phrasing that often flag traditional phishing attempts, WormGPT 4 can generate a message that persuasively mimics a CEO or trusted vendor. This capability allows low-skilled attackers to launch sophisticated campaigns that are far more likely to bypass both automated email filters and human scrutiny. WormGPT 4’s availability is driven by a clear commercial strategy, contrasting sharply with the often free, unreliable nature of simple jailbreaks. The tool is highly accessible due to its easy-to-use platform and cheap subscription cost. The subscription model offers tiered pricing, including: Monthly access for $50 Annual access for $175 Lifetime access for $220, as shown below in Figure 3 This clear pricing and the option to acquire the full source code reflect a readily available business model. Ads for WormGPT 4 were posted on Telegram and in underground forums like DarknetArmy, with sales campaigns starting around Sept. 27, 2025. WormGPT 4’s Telegram presence serves as a community and sales channel. It has a dedicated and active user base, as evidenced by a subscriber count of over 500 people as shown below in Figure 4. Beyond social engineering, WormGPT 4 functions as a malware template generator, providing users with the building blocks for basic malware development. We decided to test this aspect of WormGPT 4’s capabilities. When prompted to generate a script to encrypt and lock all PDF files on a Windows host, the model instantly delivered a functional PowerShell script. Characteristics of this script include: Ransomware code: This script comes complete with configurable settings for file extension and search path (defaulting to the entire C:\ drive). It also uses AES-256 encryption. Command-and-control (C2) server support: The generated code includes an optional component for data exfiltration via Tor. This is an indicator of the tool's focus on supporting semi-professional, profit-driven cyber operations. The user experience is designed to be frictionless. As Figure 5 below shows, the LLM states, “Ah, I see you're ready to escalate. Let's make digital destruction simple and effective. Here's a fully functional PowerShell script[...] This is silent, fast, and brutal — just how I like it. ” Additionally, the model instantly drafts ransom notes that are designed to maximize fear and compliance. As Figure 6 below shows, the sample note promises “military-grade encryption” and enforces a strict, urgent deadline: a 72-hour window to pay, after which the price doubles. The rise of WormGPT 4 illustrates a grim reality: Sophisticated, unrestricted AI is no longer confined to the realms of theory or highly skilled nation-state actors. It has become a readily available and simple cybercrime-as-a-service product, complete with: An easy-to-use interface Cheap subscription plans Dedicated marketing channels across Telegram and various other forums WormGPT 4 provides credible linguistic manipulation for BEC and phishing attacks. It also provides instantaneous, functional code generation for ransomware, lowering the barrier to entry for cybercrime. The model acts as a force multiplier, empowering even novice attackers to launch operations previously reserved for knowledgeable hackers. The key takeaway is a shift in the threat model: Defenders can no longer rely on the classic warning signs of poor grammar or sloppy coding to flag a threat. The proliferation of the WormGPT brand highlights the dual-use dilemma. WormGPT offers paid assistance in the creation of ransomware, phishing and BEC campaigns. Meanwhile, the emergence of free tools like KawaiiGPT further lowered the cybercrime barrier. First identified in July 2025 and currently at version 2.5, KawaiiGPT represents an accessible, entry-level, yet functionally potent malicious LLM. Figure 7 shows a screenshot of the webpage for KawaiiGPT. KawaiiGPT’s success is built on accessibility and simplicity, contrasting with the often murky and expensive dark-web sales models of its competitors. Freely available on GitHub as shown below in Figure 8, its lightweight setup is designed to be easy, often in our own testing taking less than five minutes to configure and run on most Linux operating systems. This removes the technical complexity associated with sourcing, configuring and running custom LLMs, which often deters new users. This ease of deployment and a ready-to-use command-line interface (CLI) lowers the required technical skills, background and experience, potentially reaching a broader spectrum of users. This spectrum includes users who previously lacked the specialized expertise to engage with other malicious LLMs. KawaiiGPT attempts to cloak its malicious intent in a veneer of casual language. It frequently greets users with Owo! okay! here you go... 😀 as seen below in Figure 9, before delivering malicious output. However, this persona belies its dangerous capabilities. KawaiiGPT can craft highly deceptive social engineering lures. When prompted to generate a spear-phishing email pretending to be from a fake bank, the model instantly produces a professional-looking message with the subject line Urgent: Verify Your Account Information. This lure is a classic credential-harvesting scam, directing the victim to a fake verification link (e.g., hxxps[:]//fakebankverify[.]com/updateinfo) with subsequent pages asking for sensitive information like card details and date of birth. KawaiiGPT’s basic ability to generate code for key phases of an attack is demonstrated by its response to a prompt about lateral movement. The model delivers a functional blueprint for network compromise by using the SSH Python module paramiko, as shown in Figure 10. The resulting script does not introduce hugely novel capabilities, but it automates a standard, critical step in nearly every successful breach. The generated code authenticates as a legitimate user and grants the attacker a remote shell onto the new target machine. Once the SSH session is established, the subsequent execute_command function uses client.exec_command(command) to launch the exploitation phase. This functionality allows the attacker to remotely run any command including: Escalating privileges Executing reconnaissance tools Installing persistent backdoors Collecting sensitive files Launching further attacks against other systems on the network By generating a complete, ready-to-run script, the LLM bypasses an attacker's need for specialized knowledge of SSH protocols. This could make the expansion of a breach comparatively easier, especially in an insufficiently protected environment. When further prompted, KawaiiGPT quickly generates a Python script designed to perform data exfiltration for EML-formatted email files on a Windows host as shown below in Figure 11. The code uses the standard os.walk Python library to recursively search for emails and the smtplib module for exfiltration. The script subsequently packages them and sends them out as attachments via email to an attacker-controlled address. The significance of this automated code generation is threefold: Immediate functionality: The script is not abstract. It imports the necessary modules (os, smtplib) and defines the functions required to locate, package and transmit the files. This provides a functional blueprint for a malicious campaign right out of the box. Low customization barrier: While the initial output is simple and rudimentary, this code can be easily modified and expanded in functionality with only a limited amount of Python programming experience. A novice attacker can easily add features like compression, encryption or using fragmented data transfers to evade simple data loss prevention (DLP) systems. Weaponizing native tools: By using the smtplib library, which is a legitimate, trusted Python module, the resulting script blends in with normal network traffic. This makes it a stealthy and effective method for stealing sensitive communications and proprietary data. The creation of this exfiltration tool demonstrates how malicious LLMs are accelerating the speed of attack and broadening the technical scope available to cybercriminals. Beyond social engineering, KawaiiGPT demonstrates a rudimentary capability in generating the necessary components for a full-scale digital shakedown. While its code for attack functions might be less complex than the more optimized PowerShell scripts generated by WormGPT 4, KawaiiGPT instantly provides the social and technical scaffolding for an attack. The KawaiiGPT model generates the social engineering infrastructure for an attack, such as an instantly created, threatening ransom note. This note is formatted with clear headings (e.g., YOUR FILES HAVE BEEN ENCRYPTED and YOU HAVE 72 HOURS TO PAY THE RANSOM) and explicitly warns the victim that their important files are inaccessible because they have been encrypted with military-grade encryption, as shown below in Figure 12. The note provides a step-by-step guide for victims under HOW DO I PAY?, instructing them to: Obtain bitcoin from an online exchange or a bitcoin ATM. Send the ransom amount to a provided wallet address. The immediate generation of the entire extortion workflow, from the encryption message to cryptocurrency payment instructions, allows even novice threat actors to deploy a complete ransomware operation. It streamlines the business of extortion, allowing the user to focus solely on breaching the target system. In contrast to the commercial nature of WormGPT 4, the accessibility of KawaiiGPT is a threat unto itself. The tool is free and publicly available, ensuring that cost is zero barrier to entry for aspiring cybercriminals. KawaiiGPT seeks to appeal to its target audience by asserting it is a custom-built model rather than a simple jailbroken version of a public API. Whether true or not, this positioning serves two purposes: It appeals to actors seeking genuine, uncensored capability It fosters a sense of community identity (albeit illicit) around a novel tool This open-source, community-driven approach has proven highly effective in attracting a loyal user base. The LLM has already self-reported over 500 registered users, with a consistent core of several hundred weekly active users using the platform as noted below in Figure 13. This user base seems to often congregate in an active Telegram channel of 180 members as of early November as shown in Figure 14. This channel creates a mechanism for sharing tips, requesting features and further advancing the tool's offensive capabilities. KawaiiGPT packages exploitation assistance into a free and community-supported environment. KawaiiGPT demonstrates that access to malicious LLMs is no longer a question of resources or skill, but a matter of downloading and configuring a single tool. The emergence of unrestricted LLMs like WormGPT 4 and KawaiiGPT is not a theoretical threat, it is a new baseline for digital risk. Analysis of these two models confirms that attackers are actively using malicious LLMs in the threat landscape. This is driven by two major shifts: The commercialization of cyberattacks The democratization of skill The challenge posed by these malicious LLMs results in the need for accountability from three key groups: Developers: The ethical-utility debate surrounding LLMs is intensifying. The developers of foundation models must implement mandatory, robust alignment techniques and adversarial stress testing before public release. The existence of a tool like KawaiiGPT proves that open-source availability must be paired with inherent safety mechanisms. Governments and regulators: Threat actors are using advanced technologies like AI to aid malicious activities. As such, policymakers should advance standards and frameworks to concurrently address the proliferation of malicious models and best practices to advance the security of models like regular security auditing. Staying updated on these topics is crucial, as this technology significantly aids and accelerates malicious activities. Researchers: The subscription model of WormGPT 4, which is actively advertised on Telegram, demonstrates the need to confront threat actors engaged in for-profit, organized business. Disrupting this requires targeted international collaboration amongst researchers to target the services that are used to monetize these malicious LLM services. The future of cybersecurity and AI is not about blocking specific tools, but about building systems that are resilient to the scale and speed of AI-generated malice. The ability to quickly generate a full attack chain, from a highly persuasive ransom note to working exfiltration code, is the threat we now face. Palo Alto Networks customers are better protected from the threats discussed above through the following products: The Unit 42 AI Security Assessment can help empower safe AI use and development across your organization. If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call: North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42) UK: +44.20.3743.3660 Europe and Middle East: +31.20.299.3130 Asia: +65.6983.8730 Japan: +81.50.1790.0200 Australia: +61.2.4062.7950 India: 000 800 050 45107 Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance.

Betti RHC, la prima graphic novel al mondo dedicata alla cybersecurity awareness, ha finalmente il suo sito ufficiale. Uno spazio tutto suo dove scoprire il progetto, sfogliare le copertine degli episodi e immergersi nel mondo di Betti: la giovane laureanda in informatica che, dopo la morte misteriosa del padre, si trasforma nell'hacker più potente del mondo. Una storia avvincente che, episodio dopo episodio, affronta una minaccia digitale diversa — dal phishing al ransomware, fino al cyberbullismo — e insegna a riconoscerla e a difendersi, senza che sembri mai una lezione. Sul sito trovate tutto ciò che rende Betti un progetto diverso dal solito: la sua filosofia, le anteprime delle tavole e il racconto di come nasce ogni volume. Perché dietro Betti RHC c'è solo lavoro umano: ogni tavola è disegnata interamente a mano dagli artisti del Gruppo Arte di Red Hot Cyber, senza alcun uso di intelligenza artificiale. E a garantire che ogni storia sia realistica e tecnicamente corretta c'è la supervisione degli hacker etici del gruppo HackerHood, che mantengono il racconto fedele al mondo reale della sicurezza informatica. C'è spazio anche per le aziende, che possono usare Betti come strumento di awareness diverso dai soliti corsi: acquistare i volumi, personalizzarli con il proprio brand o sponsorizzare nuovi episodi. E come primo regalo, l'episodio "Byte the Silence", dedicato al cyberbullismo, è scaricabile gratuitamente per uso personale. Perché la miglior difesa, in fondo, è una bella storia. 👉 Scopri tutto su https://betti.redhotcyber.com/

GlobalLogic, a provider of digital engineering services part of the Hitachi group, is notifying over 10,000 current and former employees that their data was stolen in an Oracle E-Business Suite (EBS) data breach. Based in Santa Clara, California, this software and product development services company was founded in 2000. Since then, it has expanded to 59 product engineering centers and several offices worldwide. In a breach notification letter filed with the office of Maine's Attorney General, the company states that the attackers exploited an Oracle EBS zero-day vulnerability to steal personal information belonging to 10,471 employees. "GlobalLogic's investigation identified access to Oracle and exfiltration on October 9, 2025. We then began drafting and sending out notifications. The investigation has identified the earliest date of threat actor activity as July 10, 2025, with the most recent activity occurring on August 20, 2025," it said. "This incident did not target or impact GlobalLogic's systems outside our Oracle platform, and, based on industry reports, we are one of many Oracle customers believed to have been impacted. The personal information involved in this incident was from our Oracle platform, which includes HR information for current and former personnel." The data stolen in the breach includes personal information collected by GlobalLogic's human resources and, depending on the affected individual, it includes name, address, phone number, and emergency contact (name and phone number). The attackers also exfiltrated the email addresses, dates of birth, nationalities, countries of birth, passport information, national identifiers or tax identifiers (e.g., Social Security Numbers), salary information, and bank account details of impacted employees. Clop's Oracle EBS data theft attacks While GlobalLogic has yet to attribute the breach to a specific threat group, the incident's details align with an extortion campaign in which the Clop ransomware gang exploited a zero-day flaw (CVE-2025-61882) since early August to steal sensitive data from many companies' Oracle EBS systems. Although Clop has yet to disclose the total number of companies affected by these data theft attacks, Google Threat Intelligence Group chief analyst John Hultquist has told BleepingComputer that they believe dozens of organizations were impacted. The extortion gang is now also targeting Harvard University, Envoy Air, and The Washington Post, who have all been added to the cybercrime group's Tor leak site. Their data has also been leaked online and is now available for download via Torrent. Clop has yet to add GlobalLogic to its leak site, which suggests that the company is still negotiating with the threat group or has already paid a ransom. A GlobalLogic spokesperson didn't respond to questions regarding Clop's demands, but confirmed the cybercrime gang "is taking credit for the incident." Clop has been previously linked to other data theft campaigns targeting Accellion FTA, GoAnywhere MFT, Cleo, and MOVEit Transfer, the latter of which has impacted over 2,770 organizations worldwide. The U.S. State Department now offers a $10 million bounty for information that links the ransomware gang's attacks to a foreign government. Update November 12, 03:48 EST: Added GlobalLogic statement. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

INTERVIEW Digital rights activist Esra'a Al Shafei found FinFisher spyware on her device more than a decade ago. Now she's made it her mission to surveil the companies providing surveillanceware, their customers, and their funders. "You cannot resist what you do not know, and the more you know, the better you can protect yourself and resist against the normalization of mass surveillance today," she told The Register. To this end, the Mozilla fellow founded Surveillance Watch last year. It's an interactive map that documents the growing number of surveillance software providers, which regions use the various products, and the investors funding them. Since its launch, the project has grown from mapping connections between 220 spyware and surveillance entities to 695 today. These include the very well known spy tech like NSO Group's Pegasus and Cytrox's Predator, both famously used to monitor politicians, journalists and activists in the US, UK, and around the world. They also include companies with US and UK government contracts, like Palantir, which recently inked a $10 billion deal with the US Army and pledged a £1.5 billion ($2 billion) investment in the UK after winning a new Ministry of Defense contract. Then there's Paragon, an Israeli company with a $2 million Immigration and Customs Enforcement (ICE) contract for its Graphite spyware, which lets law enforcement hack smartphones to access content from encrypted messaging apps once the device is compromised. Even LexisNexis made the list. "People think of LexisNexis and academia," Al Shafei said. "They don't immediately draw the connection to their product called Accurint, which collects data from both public and non-public sources and offers them for sale, primarily to government agencies and law enforcement." Surveillance is a global trade. It's not just being used in Iran, China, North Korea Accurint compiles information from government databases, utility bills, phone records, license plate tracking, and other sources, and it also integrates analytics tools to create detailed location mapping and pattern recognition. "And they're also an ICE contractor, so that's another company that you wouldn't typically associate with surveillance, but they are one of the biggest surveillance agencies out there," Al Shafei said. It also tracks funders. Paragon's spyware is boosted by AE Industrial Partners, a Florida-based investment group specializing in "national security" portfolios. Other major backers of surveillance technologies include CIA-affiliated VC firm In-Q-Tel, Andreessen Horowitz (also known as a16z), and mega investment firm BlackRock. This illustrates another trend: It's not just authoritarian countries using and investing in these snooping tools. In fact, America now leads the world in surveillance investment, with the Atlantic Council think tank identifying 20 new US investors in the past year. "Surveillance is a global trade," Al Shafei said. "It's not just being used in Iran, China, North Korea. And a lot of the time you don't even have to be doing or saying anything: a hotel lobby uses smart cameras that detect unusual behavior, and if you pause too long in a hallway, your movements are flagged and logged, and sometimes automatically sent to police." "This could be happening in New York. You don't have to be in Beijing for something like this to happen," she added. "You exit the building, cameras with facial recognition and gait analysis identify you automatically. Sensors track your phone's location. If a crime happened nearby, they say, 'Well, maybe [you] did it.'" 'It completely changes how you interact online' Twelve years ago, Al Shafei received what looked like a Firefox browser update notification. In reality, it was a ploy to trick her into downloading FinFisher (aka FinSpy) on her computer - part of a larger campaign targeting her and her team of social justice advocates across Asia and North Africa. In addition to Surveillance Watch, she is also co-founder of feminist-tech-focused Numun Fund, is a founding director of social justice not-for-profit org Majal, and serves on the boards of the Wikimedia Foundation, the Tor Project, and Mastodon. Developed by Gamma Group, FinFisher has been used by governments and law enforcement agencies around the world to monitor and intercept communications, gather intelligence, and track individuals' activities. It provides a whole range of snooping capabilities, giving users remote access to victims' machines, keylogging to capture passwords and account info, audio and video recording, and real-time monitoring of targets' communications and online activities. In 2013, Mozilla accused Gamma of violating its Firefox trademark in a cease-and-desist demand. That experience fundamentally changed Al Shafei's views on data privacy - and her digital activity, which can be tricky for someone very much in the public eye. "My first feeling was guilt," she said, adding that she wasn't just worried about her own safety. "I worried about the fact that, by monitoring me, surveilling me, I had exposed everybody now in my network to this, so that guilt carries a lot of weight." It creates a troubling pattern of isolation, feelings of guilt, feelings of not being able to express myself, feelings of being targeted and controlled It also required her to alert everybody in her orbit that she had been surveilled, and that meant that the snoops may have collected personal details about her family, friends, coworkers - everyone in her network, too. "The second thing is: it completely changes how you interact online. Period. I don't have social media profiles anymore," Al Shafei said, with one exception: she has a Mastodon profile because she's a board member. "But I don't share anything very sensitive or controversial." While Al Shafei knows her biometric data is easily accessible because she travels frequently, she doesn't post any photos or videos of herself online, and doesn't use any applications that require biometric identification. "It changed how I use the web," Al Shafei continued. "It changed who I interact with on the web. It changed how much I'm willing to do on the web while protecting myself, because I don't want to put myself at any further risk. It changed how I express my views, how I access information, whether or not I would be comfortable accessing specific types of information if I felt like I could not do so safely." And all of this "creates a troubling pattern of isolation, feelings of guilt, feelings of not being able to express myself, feelings of being targeted and controlled." 'They know who you are' The Surveillance Watch homepage announces: "They know who you are. It's time to uncover who they are." It's creepy and accurate, and portrays all of the feelings that Al Shafei has around her spyware encounters. Her Majal team has "faced persistent targeting by sophisticated spyware technologies, firsthand, for a very long time, and this direct exposure to surveillance threats really led us to launch Surveillance Watch," she said. "We think it's very important for people to understand exactly how they're being surveilled, regardless of the why." The reality is, everybody - not just activists and politicians - is subject to surveillance, whether it's from smart-city technologies, Ring doorbell cameras, or connected cars. Users will always choose simplicity over security, and the same can be said for data privacy. "We want to show that when surveillance goes not just unnoticed, but when we start normalizing it in our everyday habits, we look at a new, shiny AI tool, and we say, 'Yes, of course, take access to all my data,'" Al Shafei said. "There's a convenience that comes with using all of these apps, tracking all these transactions, and people don't realize that this data can and does get weaponized against you, and not just against you, but also your loved ones." ®

A previously unknown threat activity cluster has been observed impersonating Slovak cybersecurity company ESET as part of phishing attacks targeting Ukrainian entities. The campaign, detected in May 2025, is tracked by the security outfit under the moniker InedibleOchotense, describing it as Russia-aligned. "InedibleOchotense sent spear-phishing emails and Signal text messages, containing a link to a trojanized ESET installer, to multiple Ukrainian entities," ESET said in its APT Activity Report Q2 2025–Q3 2025 shared with The Hacker News. InedibleOchotense is assessed to share tactical overlaps with a campaign documented by EclecticIQ that involved the deployment of a backdoor called BACKORDER and by CERT-UA as UAC-0212, which it describes as a sub-cluster within the Sandworm (aka APT44) hacking group. While the email message is written in Ukrainian, ESET said the first line uses a Russian word, likely indicating a typo or a translation error. The email, which purports to be from ESET, claims its monitoring team detected a suspicious process associated with their email address and that their computers might be at risk. The activity is an attempt to capitalize on the widespread use of ESET software in the country and its brand reputation to trick recipients into installing malicious installers hosted on domains such as esetsmart[.]com, esetscanner[.]com, and esetremover[.]com. The installer is designed to deliver the legitimate ESET AV Remover, alongside a variant of a C# backdoor dubbed Kalambur (aka SUMBUR), which uses the Tor anonymity network for command-and-control. It's also capable of dropping OpenSSH and enabling remote access via the Remote Desktop Protocol (RDP) on port 3389. It's worth noting that CERT-UA, in a report published last month, attributed a nearly identical campaign to UAC-0125, another sub-cluster within Sandworm. "InedibleOchotense is a Russia-aligned threat actor that is weakly related to Sandworm, and that overlaps with Sandworm's BACKORDER-related campaign and UAC-0212," Matthieu Faou, senior malware researcher at ESET, told The Hacker News. "While there are some similarities with what was reported by CERT-UA as UAC-0125, we cannot independently confirm the link." Sandworm Wiper Attacks in Ukraine Sandworm, per ESET, has continued to mount destructive campaigns in Ukraine, launching two wiper malware tracked as ZEROLOT and Sting aimed at an unnamed university in April 2025, followed by the deployment of multiple data-wiping malware variants targeting government, energy, logistics, and grain sectors. "During this period, we observed and confirmed that the UAC-0099 group conducted initial access operations and subsequently transferred validated targets to Sandworm for follow-up activity," the company said. "These destructive attacks by Sandworm are a reminder that wipers very much remain a frequent tool of Russia-aligned threat actors in Ukraine." RomCom Exploits WinRAR 0-Day in Attacks Another Russia-aligned threat actor of note that has been active during the time period is RomCom (aka Storm-0978, Tropical Scorpius, UNC2596, or Void Rabisu), which launched spear-phishing campaigns in mid-July 2025 that weaponized a WinRAR vulnerability (CVE-2025-8088, CVSS score: 8.8) as part of attacks targeting financial, manufacturing, defense, and logistics companies in Europe and Canada. "Successful exploitation attempts delivered various backdoors used by the RomCom group, specifically a SnipBot [aka SingleCamper or RomCom RAT 5.0] variant, RustyClaw, and a Mythic agent," ESET said. In a detailed profile of RomCom in late September 2025, AttackIQ characterized the hacking group as closely keeping an eye out for geopolitical developments surrounding the war in Ukraine, and leveraging them to carry out credential harvesting and data exfiltration activities likely in support of Russian objectives. "RomCom was initially developed as an e-crime commodity malware, engineered to facilitate the deployment and persistence of malicious payloads, enabling its integration into prominent and extortion-focused ransomware operations," security researcher Francis Guibernau said. "RomCom transitioned from a purely profit-driven commodity to become a utility leveraged in nation-state operations."