Tag: threat actor
49 articles
GitHub Facades Used to Disguise EtherRAT Malware Distribution
Malicious actors have been using 44 cleverly disguised GitHub facades to spread EtherRAT malware, masquerading as legitimate admin and dev tools between December 2025 and April 2026. These fake repositories were designed to manipulate search results, leading victims to download a malicious MSI installer hidden in a second, secret GitHub account.
LofyGang Revives With Minecraft-Focused LofyStealer Campaign
Meet LofyGang, a notorious threat actor that's back in the game with a sneaky new campaign called LofyStealer, targeting Minecraft fans with malware disguised as a hack called 'Slinky'. This Brazil-based group has a history of infiltrating gaming communities and digital entertainment services.
TGR-STA-1030 Intensifies Espionage Push in Central, South America
The threat group TGR-STA-1030 is ramping up its espionage efforts in Central and South America, with sustained and widespread activity observed across multiple countries since February. This persistent campaign has recently intensified, with a heavy focus on regions within Central and South America.
Dort Unmasked: Alarming Rise of Kimwolf Botmaster Threat
Meet Dort, the mysterious mastermind behind the notorious Kimwolf botnet, a cybercrime powerhouse wreaking havoc on the internet. As the true identity and motives of this elusive threat actor remain shrouded in mystery, one thing is certain: their malicious activities have sent shockwaves through the cybersecurity landscape.
BeaverTail and OtterCookie: Stunning Critical Threat
Cisco Talos warns a North Korean group is fusing BeaverTail’s credential-theft with OtterCookie’s browser persistence into single, stealthier JavaScript malware that’s harder to spot — defenders should start hunting for blended behaviors and tighten basics like MFA, patching, and anomaly detection now.
Rhysida ransomware: Stunningly Dangerous Threat
Microsoft revoked more than 200 fraudulent certificates after attackers used fake Teams installers to deliver the Oyster backdoor and Rhysida ransomware — a reminder that even seemingly trusted files can be malicious. Treat unexpected downloads with suspicion, enforce layered defenses, and prioritize timely revocation and certificate hygiene to stay safer.
cloud backup service Risky Breach: Must-Have Fixes
SonicWall says attackers accessed cloud backup files holding encrypted firewall credentials and configs — turning the safety net meant to speed recovery into a potential roadmap for targeted attacks. If you used their Cloud Backup, assume exposure: rotate keys and credentials, review firewall and VPN access, and verify your backups and key management now.
SnakeDisk worm: Stunning Risky Thai-Targeted Threat
A China-aligned group called Mustang Panda has paired an updated TONESHELL backdoor with a USB worm named SnakeDisk that only activates for Thailand-based devices to drop a persistent Yokai backdoor — a surgical, geographically targeted campaign that ups the stakes for anyone who plugs in removable media. Stay cautious with USB drives and tighten removable-media policies: this is a reminder that one careless plug can invite long-term access.
AI-powered operations: Stunning Exposure, Defender Win
An attacker’s bid for stealth backfired when legitimate security software exposed their AI‑assisted playbook — Huntress telemetry captured model‑like artifacts that turned a covert campaign into a forensic treasure trove, proving AI speeds attacks but also leaves telltale traces defenders can use.
signed Windows kernel driver: Stunning Risky Backdoor
When a Microsoft‑signed WatchDog driver (amsdk.sys) was abused to neuter endpoint defenses and plant ValleyRAT, it proved that a valid signature isn’t a guarantee of safety. This Silver Fox campaign underscores why organizations must stop trusting signatures alone and add behavior‑based controls and tighter vetting for privileged drivers.
APT28 LameHug: Exclusive Risky AI Threat Warning
MITRE’s take on APT28’s LameHug at Black Hat is a wake-up call: while crude now, this testbed shows how AI and automation could quickly turn basic tools into powerful cyber weapons. Defenders, policymakers, and everyday users should sharpen defenses and share intel now—before experiments like this graduate into routine attacks.
QR Phishing FIDO Keys: Exclusive Risky Threat Revealed
Think your FIDO key makes you untouchable? PoisonSeed’s QR‑phishing scam shows how a convincing QR scan and fake approval prompt can trick users into granting access—learn how these attacks work and what simple steps you can take to stay safe.
Threat Actor Targets Indian Defense Sector: Key Insights Revealed
Discover how the elusive APT36 cyber-espionage group is stealthily targeting Indias defense sector, revealing the urgent need for stronger digital defenses in a world where cyber warfare reshapes national security.
Threat Actor Targets Indian Defense Sector in Rising Cyberattack
A stealthy cyber threat group is intensifying attacks on Indias defense networks, revealing how vulnerable even the most secure secrets can be in today’s digital battlefield.
Threat Actor Targeting Indian Defense Sector Raises Security Alarms
A sophisticated cyber-espionage group is zeroing in on India’s defense sector, exposing critical vulnerabilities and sparking urgent calls for stronger digital defenses to protect national security.
Texas Dept. of Transportation breached, 300k crash records stolen
Texas Dept. of Transportation breach: 300K crash records stolen, raising major data security concerns and prompting urgent investigations.
APT41 Leverages Google Calendar for Stealthy Malware Control Operations
APT41 leverages Google Calendar to manage covert malware operations, using scheduled commands to hide control activities and evade detection.
Craft CMS Vulnerability: Hackers Exploit CVE-2025-32432 to Deploy Cryptominer and Proxyware
Craft CMS vulnerability (CVE-2025-32432) exploited by hackers to deploy cryptominer and proxyware, compromising system security and data integrity.
Chrome Unveils One-Click Update for Compromised Passwords
Chrome introduces a one-click update for compromised passwords, streamlining security and simplifying password management for safer browsing.
Twilio Refutes Breach Allegations Amid Alleged Steam 2FA Code Leak
Twilio denies breach allegations amid claims of a leaked Steam 2FA code. Discover the facts behind the security controversy and the company’s firm denial.
DPRK-Backed TA406 Targets Ukraine With Malware Campaigns
DPRK-backed TA406 targets Ukraine with malware campaigns. Discover its tactics, evolving cyber threats, and the potential impact on regional security.
Chinese hackers behind attacks targeting SAP NetWeaver servers
Chinese hackers behind targeted attacks on SAP NetWeaver servers exploit vulnerabilities, escalating global cybersecurity concerns.
Commvault Confirms Hackers Exploited CVE-2025-3928 as Zero-Day in Azure Breach
Commvault confirms hackers exploited CVE-2025-3928, a zero-day vulnerability in an Azure breach, exposing critical flaws and prompting urgent security reviews.
Mustang Panda Expands Operations in Myanmar with StarProxy, EDR Bypass, and TONESHELL Enhancements
Mustang Panda expands in Myanmar, enhancing operations with StarProxy, EDR bypass techniques, and TONESHELL improvements for advanced cyber capabilities.