Tag: malware operations
776 articles
Chinese Hackers Target Central Asian Governments with OctLurk and SilkLurk Malware
Chinese hackers have launched a stealthy cyberattack on government organizations across six Central Asian countries, infiltrating ministries, hospitals, and schools with sophisticated malware. The targeted countries include Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab Republic.
XCSSET Malware Evolves With Advanced Evasion Tactics
Malicious hackers have unleashed a powerful new version of XCSSET malware that can turn unsuspecting developer workstations into launchpads for supply-chain attacks, infecting thousands of users through poisoned Xcode projects. This latest variant, XCSSET v40, uses advanced evasion tactics to spread rapidly and quietly.
HollowFrame Loader Deploys Matryoshka Backdoor in Targeted Law Firm Attacks
Cyber attackers have deployed a sneaky duo, HollowFrame and Matryoshka, to gain a persistent foothold in targeted law firm attacks, allowing them to execute remote commands, snoop on Active Directory, and transfer files. It all started with a cleverly crafted spear-phishing message containing a malicious link that set off a multi-stage chain of events.
Malware Evolves with AI-Driven Tactics
Malware is getting a scary upgrade: attackers are harnessing AI-driven tactics to create a surge in suspicious and malicious activity, with tens of thousands of dubious AI "skills" already detected. This emerging threat landscape is multiplying opportunities for hackers to exploit, making it a critical concern for anyone online.
Chinese Hackers Leverage DeepSeek for Autonomous Exploits
Meet the sneaky Chinese hackers who've been using an AI-powered tool called DeepSeek to launch autonomous cyber attacks on over 460 targets - and get a glimpse into their clever tactics. With just a single Telegram instruction, DeepSeek can infiltrate and exploit systems all on its own.
Cryptominer Exploits Linux PAM to Evade Detection
Cybercriminals have found a sneaky way to evade detection by exploiting Linux PAM, using a trusted third-party relationship as a backdoor to spread a Monero mining campaign. By abusing the pam_rootok policy, they can impersonate multiple standard accounts without needing passwords, creating a forensic smokescreen.
SilverFox Exploits New Drivers in BYOVD Attacks on Japanese Manufacturer
Meet the sneaky SilverFox hackers who've been exploiting new drivers to launch BYOVD attacks on a Japanese industrial manufacturer, using clever tactics like DLL sideloading and defense evasion to stay one step ahead. Their attack began with a simple yet effective invoice-themed phishing lure, delivered via popular Chinese services QQ and Tencent Cloud.
Amazon Exposes North Korean Hacking Campaign Targeting Open-Source Software
A North Korea-linked hacking group has been exploiting widely-used open-source software, infecting millions of users through compromised packages like axios, which alone receives over 100 million downloads weekly. This campaign, linked to a single financially motivated actor, has been targeting major JavaScript packages since March 2025.
Amazon Ties npm Hijack to North Korea's Sapphire Sleet
In a shocking supply-chain hijack, North Korea's Sapphire Sleet group compromised over 2 billion weekly downloads of popular npm packages, including debug and chalk, in a brazen attack tied to multiple other malicious campaigns. Amazon Threat Intelligence has linked this September 2025 incident to a string of attacks dating back to March 2025.
North Korea Targets Low-Profile Packages in Warm-Up for Axios Hack
Amazon's chief information security officer CJ Moses reveals that a March 2025 crypto campaign was likely a rehearsal for a more significant attack, specifically targeting low-profile packages. This campaign was linked to a notorious hacking group also responsible for the recent axios library compromise.
Flying Eagle Android RAT Source Code Circulates, 170 Servers Compromised
Researchers have uncovered a massive operation linked to the Flying Eagle Android RAT, with 170 internet servers compromised, allowing hackers to capture sensitive info, record screens, and even impersonate legitimate apps. This powerful toolkit can be used to create customized malware that steals payment passwords, keystrokes, and more.
Compromised npm Packages Deliver DEV#POPPER Malware via Blockchain
Malicious npm packages have been discovered delivering DEV#POPPER malware via blockchain, with two beta releases in the @joyfill namespace containing a sneaky JavaScript implant that springs into action the moment Node.js loads the package. This stealthy implant can execute in any process that requires the compromised package, making it a serious threat.
Mirage Kitten Unveils New Malware Arsenal for Middle East Espionage
Mirage Kitten hackers have unleashed a potent new malware arsenal targeting the Middle East, threatening aerospace, aviation, defense, and telecom organizations with stealthy backdoors and tunnelers that enable covert surveillance and data relay. Their latest Windows backdoor, NightLedger, masquerades as a legitimate system file to infiltrate and gather intel.
Phishing Attacks Propel Cyber Incidents to New Highs
Phishing attacks are now the top threat, making up over half of all cyber incidents - a significant jump from the previous quarter when they accounted for just one-third of cases. This resurgence in phishing has propelled cyber incidents to new highs, putting organizations on high alert.
Dysphoria Botnet Spreads to 200k Devices, Enables Global DDoS Attacks
A rapidly growing botnet called Dysphoria has infected over 200,000 devices worldwide, enabling massive global DDoS attacks. This sneaky threat uses blockchain technology to hide its tracks and evade detection.
SourTrade Malvertising Campaign Builds Malware in Browser
Meet SourTrade, a sneaky malvertising campaign that's assembling malware right in your browser - all while security tools and network logs show nothing out of the ordinary. Its operators impersonate popular trading and crypto platforms to trick victims into a stealthy malware delivery process.
TELESHIM Malware Exploits Telegram for C2 in Middle East Attacks
TELESHIM malware has launched a sophisticated attack in the Middle East, using a multi-stage chain to infect systems and cleverly leveraging Telegram's API to disguise its command-and-control communications as legitimate internet traffic. This sneaky tactic allows the malware to blend in seamlessly, making it a formidable threat.
Ransomware Groups Master EDR Kill Techniques
Ransomware groups have mastered the art of disabling endpoint detection and response (EDR) tools, making it standard practice to shut them down before encryption begins. This sinister tactic has significantly shortened defenders' response time, leaving them with limited opportunities to detect and contain attacks.
Steam Forum Abused in ClickFix Attacks Spreading XMRig Cryptominers
Cyber attackers are exploiting Steam's forum by creating fake accounts that offer 'helpful' fixes to users with game issues, tricking them into downloading and installing a notorious XMRig cryptominer. This sneaky tactic uses a PowerShell script to quietly install the malware as a persistent Windows service.
Malvertising Campaign SourTrade Exploits Browsers to Deliver Malware
Meet SourTrade, a sneaky malvertising campaign that's exploiting browsers to deliver malware - without leaving a single piece of malware on the network. This clever attack uses a complex web of code to assemble Windows executables right inside your browser.
Malvertising Campaign Exploits Browsers to Assemble Malware in Memory
Meet the sneaky malvertising campaign that's turning web browsers into malware factories, assembling attacks entirely in memory using fake pages for popular services like Solana, Luno, and TradingView. This stealthy operation has been active since late 2024, targeting users across 12 countries and 25 languages.
Botnets Persist Despite Takedowns, Fueled by Residential Proxy Networks
Botnets just won't quit, and it's no surprise why - there's a thriving market for access to millions of IPs, making it easy for them to keep growing and snaring more victims. Residential proxy networks are fueling this expansion, with nearly 60 million victim IP addresses globally and a significant chunk of them right here in the US.
BlueNoroff Phishing Kit Targets Crypto Wallets with Zoom Lures
BlueNoroff's phishing kit is a masterclass in deception, using Zoom lures and compromised industry contacts to trick victims into divulging their crypto wallet info. This sophisticated scam combines social engineering and malware to selectively target high-value victims.
Golden Chickens Malware Evolves With Modular Implants
The Golden Chickens malware has taken a significant leap forward with the emergence of four new, highly modular malware families, signaling a major evolution in the threat landscape. This development is a red flag, as it suggests a more sophisticated and adaptable attack strategy from the financially motivated malware-as-a-service developer behind it.