Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label Business Security. Show all posts
ZIP files
Artificial Intelligence Business Security LameHug malware ZIP files

AI-Powered Malware ‘LameHug’ Attacks Windows PCs via ZIP Files

 

Cybersecurity researchers have discovered a new and alarming trend in the world of online threats: "LameHug". This malicious program distinguishes out because it uses artificial intelligence, notably large language models (LLMs) built by companies such as Alibaba. 

LameHug, unlike classic viruses, can generate its own instructions and commands, making it a more adaptive and potentially difficult to detect adversary. Its primary goal is to infiltrate Windows-based personal PCs and then take valuable data surreptitiously. 

The malicious program typically begins its infiltration camouflaged as ordinary-looking ZIP files. These files are frequently sent via fraudulent emails that seem to come from legitimate government sources. When a user opens the seemingly innocent archive, the hidden executable and Python files inside begin to work. The malware then collects information about the affected Windows PC. 

Following this first reconnaissance, LameHug actively looks for text documents and PDF files stored in popular computer directories before discreetly transferring the obtained data to a remote web server. Its ability to employ AI to write its own commands makes it exceptionally cunning in its actions. 

LameHug was discovered by the Ukrainian national cyber incident response team (CERT-UA). Their investigation points to the Russian cyber group APT028, as the most likely source of this advanced threat. The malware is written in Python and uses Hugging Face's programming interfaces. These interfaces, in turn, are powered by a special Alibaba Cloud language model known as Qwen-2.5-Coder-32B-Instruct LLM, demonstrating the complex technological foundation of this new digital weapon. 

LameHug's arrival marks the first instance of malicious software being observed to use artificial intelligence to produce its own executable commands. Existing security software, which is often made to identify known attack patterns, has significant challenges as a result of these capabilities. The ongoing and intensifying arms race in the digital sphere is highlighted by this breakthrough as well as the mention of other emerging malware, such as "Skynet," that may elude AI detection techniques.
Read more »
Vulnerabilities and Exploits
Business Security Elasticsearch Infostealer Shellter Project Vulnerabilities and Exploits

Attackers Exploit Compromised Shellter Red Team Tool to Deploy Infostealers

 

Shellter Project, which makes a commercial AV/EDR evasion loader for penetration testing, admitted that hackers exploited its Shellter Elite product in assaults after a client leaked a copy of the software.

The exploitation has been ongoing for several months, and despite security researchers detecting the activity in the wild, Shellter has not received notification. The vendor stated that this is the first recorded case of misuse since implementing its stringent license policy in February 2023. 

"We discovered that a company which had recently purchased Shellter Elite licenses had leaked their copy of the software," Shellter noted in a statement. "This breach led to malicious actors exploiting the tool for harmful purposes, including the delivery of infostealer malware.”

Exploitation in the wild 

Security experts (red teams and penetration testers) employ Shellter Elite, a commercial AV/EDR evasion loader, to covertly install payloads inside authentic Windows binaries while avoiding EDR tools during security engagements. In addition to dynamic runtime evasion through AMSI, ETW, anti-debug/VM checks, call stack and module unhooking avoidance, and decoy execution, the product offers static evasion through polymorphism. 

Elastic Security Labs reported on July 3rd that numerous hacking outfits, including Rhadamanthys, Lumma, and Arechclient2, had been utilising Shellter Elite v11.0 to launch infostealers. Elastic researchers discovered that the activity began in at least April, with the distribution mechanism relying on YouTube comments and phishing emails. Based on the unique licensing timestamps, the researchers speculated that the threat actors were utilising a single leaked copy, which Shellter later validated.

Elastic has designed detections for v11.0-based samples, thus payloads created using that version of Shellter Elite are now detectable. Shellter launched Elite version 11.1, which will only be available to authorised clients, excluding the one who leaked the prior version. Elastic Security Labs' lack of contact was deemed "reckless and unprofessional" by the vendor, who criticised Elastic for failing to notify them of their findings earlier. 

"They were aware of the issue for several months but failed to notify us. Instead of collaborating to mitigate the threat, they opted to withhold the information in order to publish a surprise exposé—prioritizing publicity over public safety," Shellter noted. 

However, Elastic gave Shellter the necessary samples to identify the problematic client. The firm apologised to its "loyal customers" and underlined that it does not interact with cybercriminals, stating a willingness to work with law authorities when necessary.
Read more »
Threat Intelligence
Business Security Cyber Security Email Bombing Microsoft Office 365 Threat Intelligence

Office 365's Microsoft Defender Now Thwarts Email Bombing Assaults

 

Microsoft claims that the cloud-based email security suite Defender for Office 365 can now automatically detect and prevent email bombing attacks. 

Defender for Office 365 (previously known as Office 365 Advanced Threat Protection or Office 365 ATP) guards organisations working in high-risk industries and dealing with sophisticated attackers from malicious threats delivered via email messages, links, or collaboration tools.

"We're introducing a new detection capability in Microsoft Defender for Office 365 to help protect your organization from a growing threat known as email bombing," Redmond notes in a Microsoft 365 message center update. "This form of abuse floods mailboxes with high volumes of email to obscure important messages or overwhelm systems. The new 'Mail Bombing' detection will automatically identify and block these attacks, helping security teams maintain visibility into real threats.”

In late June 2025, the new 'Mail Bombing' feature began to roll out, and by late July, it should be available to all organisations. All messages detected as being a part of a mail bombing operation will be automatically routed to the Junk folder, require no manual configuration, and be toggled on by default. 

Security operations analysts and administrators can now employ Mail Bombing as a new detection type in Threat Explorer, the Email entity page, the Email summary panel, and Advanced Hunting, the company announced over the weekend.

By leveraging specialised cybercrime services that can send a high number of emails or by subscribing to several newsletters, attackers can use mail bombing operations to bombard their targets' email inboxes with thousands or tens of thousands of messages in a matter of minutes.

In the majority of cases, the perpetrators' ultimate goal is to overwhelm email security systems as part of social engineering schemes, creating the way for malware or ransomware operations that can aid in the exfiltration of sensitive data from victims' compromised devices. 

Email bombing has been used in attacks by cybercrime and ransomware outfits for more than a year. It all started with the BlackBasta gang, who employed this approach to flood their victims' mailboxes with emails just minutes before beginning their attacks.

In order to deceive overwhelmed staff members into allowing remote access to their devices via AnyDesk or the integrated Windows Quick Assist application, they would follow up with voice phishing cold calls, pretending to be their IT support teams. Before unleashing ransomware payloads, the attackers would proceed laterally through corporate networks after penetrating their systems and deploying a variety of malicious tools and malware implants.
Read more »
User Privacy
Business Security Cyber Security Document-Borne Malware Malicious Campaign User Privacy

Here's Why Businesses Need to be Wary of Document-Borne Malware

 

The cybersecurity experts are constantly on the lookout for novel tactics for attack as criminal groups adapt to better defences against ransomware and phishing. However, in addition to the latest developments, some traditional strategies seem to be resurfacing—or rather, they never really went extinct. 

Document-borne malware is one such strategy. Once believed to be a relic of early cyber warfare, this tactic remains a significant threat, especially for organisations that handle huge volumes of sensitive data, such as those in critical infrastructure.

The lure for perpetrators is evident. Routine files, including Word documents, PDFs, and Excel spreadsheets, are intrinsically trusted and freely exchanged between enterprises, often via cloud-based systems. With modern security measures focussing on endpoints, networks, and email filtering, seemingly innocuous files can serve as the ideal Trojan horse. 

Reasons behind malicious actors using document-borne malware 

Attacks utilising malicious documents seems to be a relic. It's a decades-old strategy, but that doesn't make it any less detrimental for organisations. Still, while the concept is not novel, threat groups are modernising it to keep it fresh and bypass conventional safety procedures. This indicates that the seemingly outdated method remains a threat even in the most security-conscious sectors.

As with other email-based techniques, attackers often prefer to hide in plain sight. The majority of attacks use standard file types like PDFs, Word documents, and Excel spreadsheets to carry malware. Malware is typically concealed in macros, encoded in scripts like JavaScript within PDFs, or hidden behind obfuscated file formats and layers of encryption and archiving. 

These unassuming files are used with common social engineering approaches, such as a supplier invoice or user submission form. Spoofed addresses or hacked accounts are examples of email attack strategies that help mask malicious content. 

Organisations' challenges in defending against these threats 

Security analysts claim that document security is frequently disregarded in favour of other domains, such as endpoint protection and network perimeter. Although document-borne attacks are sufficiently commonplace to be overlooked, they are sophisticated enough to evade the majority of common security measures.

There is an overreliance on signature-based antivirus solutions, which frequently fail to detect new document-borne threats. While security teams are often aware of harmful macros, formats such as ActiveX controls, OLE objects, and embedded JavaScript may be overlooked. 

Attackers have also discovered that there is a considerable mental blind spot when it comes to documents that appear to have been supplied via conventional cloud-based routes. Even when staff have received phishing awareness training, there is a propensity to instinctively believe a document that arrives from an expected source, such as Google or Office 365.

Mitigation tips 

As with other evolving cyberattack strategies, a multi-layered strategy is essential to defending against document-borne threats. One critical step is to use a multi-engine strategy to malware scanning. While threat actors may be able to deceive one detection engine, using numerous technologies increases the likelihood of detecting concealed malware and minimises false negatives. 

Content Disarm and Reconstruction (CDR) tools are also critical. These sanitise and remove malicious macros, scripts, and active material while keeping the page intact. Suspect files can then be run through enhanced standboxes to detect previously unknown threats' malicious behaviour while in a controlled environment. 

The network should also be configured with strict file rules, such as limiting high-risk file categories and requiring user authentication before document uploads. Setting file size restrictions can also help detect malicious documents that have grown in size due to hidden coding. Efficiency and dependability are also important here. Organisations must be able to detect fraudulent documents in their regular incoming traffic while maintaining a rapid and consistent workflow for customers.
Read more »
Technology
Business Security Cloud Platform Legacy Software ROI Technology

The True Cost of Legacy Software: A Comprehensive Look

 

Business leaders tend to stay with what they know. It's familiar, comfy, and—above all—seems trustworthy. However, this comfort zone can be costing us more than they realise when it comes to legacy software systems. 

Many leaders focus on the upfront costs of new technology while failing to consider the long-term implications of remaining with outdated systems. As technology advances, it's important to examine how past systems stack up against modern cloud-based options, particularly in terms of scalability, integration, and access to upcoming breakthroughs. 

True cost of legacy systems

The upfront expenses of sustaining legacy systems do not account for all of the challenges that firms should consider. These antiquated systems, for example, often rely on on-site physical servers, necessitating substantial infrastructure expenditure. Setting up a new server can cost up to $10,000, with additional costs for software licenses, maintenance, and support adding up quickly. 

These systems also incur additional operational costs, such as higher power consumption, heat output, supplemental cooling requirements, and a constant demand on bandwidth during data backup. 

Another often-overlooked expense is the knowledge reliance that these systems entail. When key IT personnel leave, they take with them the knowledge required to maintain and troubleshoot these outdated systems. Equally troubling is the increased IT complexity of managing server-based systems, particularly as an organisation grows and scales.

While the disadvantages of legacy software are widely known, there are some legitimate reasons why some organisations continue to use it—at least for the time being. Regulatory or compliance frameworks may require on-premises data storage or auditing transparency, which cloud providers cannot currently provide. In some circumstances, modernisation may be delayed out of necessity rather than choice. 

ROI of cloud-based platforms 

Think of modern cloud-based platforms as growth accelerators rather than cost-cutters. Cloud solutions include scalability, artificial intelligence, and automation. According to McKinsey, firms who go beyond basic cloud adoption and proactively integrate cloud into their operations could unleash up to $3 trillion in global value through faster product creation, better decision-making, and increased operational resilience. 

Cloud solutions also enable the use of open APIs, allowing enterprises to seamlessly integrate technologies. Unlike traditional software, which locks firms into rigid systems, contemporary cloud platforms with open APIs allow for unique technology stacks adapted to specific business requirements. This transition allows organisations to select best-in-class systems for finance, customer management, logistics, and marketing automation. 

These skills are especially important in healthcare, where interconnected systems can simplify operations and improve patient care. According to another McKinsey analysis, 62% of healthcare professionals feel generative AI offers the greatest potential to boost consumer engagement, but just 29% have begun to deploy it, indicating a considerable gap between opportunity and implementation.
Read more »
threat report
Business Security Cyber Security HoneyWell ransomware attacks threat report

Ransomware Attacks Continue to Rise in an Alarming Trend

 

The frequency and intensity of cyberthreats seem to be increasing despite businesses' ongoing efforts to thwart malicious actors. Honeywell, a global technology and manufacturing firm that also provides cybersecurity solutions, reported a 46% rise in ransomware extortion attacks between October 1, 2024, and March 31, 2025, as compared to the previous six-month period. 

Win32.Worm.Ramnit, a Trojan that typically targets the banking sector to steal account details, was found in 37% of files blocked by Honeywell's SMX product. That represented a 3,000% rise from the second quarter of 2024, when Honeywell last reported on it. 

In its investigation report, Honeywell stated that "it can likely be assumed it has been repurposed to extract control system credentials" due to the Trojan's saturation presence in the ecosystems of its industrial clients. "Existing adversaries continue to disrupt operations across critical sectors, even in the absence of new ransomware variants specifically designed for industrial control systems." 

1,929 ransomware incidents were made public throughout the reporting period. Eight verticals accounted for the vast majority (71%) of the cases, with the industries most affected being manufacturing, construction, healthcare, and technology. 

Given that ransomware attacks are normally "more opportunistic, typically creating a normal distribution of attacks across different industries," Honeywell noted that this was a really unusual pattern. The report claims that supply chain disruptions, manual failovers, and forced production outages caused by ransomware have been experienced by manufacturing plants, water treatment facilities, and energy providers. 

In response to the elevated threats, during the reporting period, some organisations "doubled down on best practices that would be considered baseline," according to Honeywell. Such procedures include, for example, immutable data backups and regular vulnerability assessments. According to Honeywell, as of October 2024, victimised organisations had paid out more than $1 billion in ransomware. 

Another new cybersecurity report, from the Information Security Media Group, focused on artificial intelligence, which it described as the "defining force" of cybersecurity-related disruption. 

As businesses use AI to automate threat detection and scale response capabilities, "adversaries are using the same technologies to enhance phishing, generate polymorphic malware, and conduct identity fraud with unprecedented precision," according to the ISMG research. ISMG added that the combination of AI and quantum computing "further signals a critical shift requiring crypto-agility and forward planning.”
Read more »
Threat Landscape
Business Security Cyber Security Ransomware attack Threat Intelligence Threat Landscape

Understanding the Dynamic threat Landscape of Ransomware Attacks

 

The constant expansion of cyber threats, particularly malware and ransomware, necessitates our undivided attention. Our defence strategy must evolve in tandem with the threats. So far this year, ransomware has targeted Frederick Health Medical Group, Co-op Supermarkets, and Marks & Spencer. 

This meant that critical data got into the wrong hands, supply networks were interrupted, and online transactions were halted. Almost 400,000 PCs were attacked with Lumma Stealer malware, a ClickFix malware version went viral, and a new spyware dubbed 'LOSTKEYS' appeared.

The threat landscape is always evolving, making traditional security methods ineffective. Effective protection methods are not only useful; they are also required to protect against severe data loss, financial damage, and reputational impact that these attacks can cause. Understanding the nature of these enemies is a critical first step towards developing strong defences. 

Ransomware: An ongoing and profitable menace 

Ransomware deserves special attention. It encrypts data and demands payment for its release, frequently spreading through phishing or software weaknesses. More complex ransomware variations take data before encrypting it, combining the threat with blackmail. The effects of ransomware include:

Data loss: May be permanent without backups. 

Financial costs: Includes ransom, restoration, and penalties 

Reputational damage: If publicly exposed, trust is lost. 

Ransomware's profitability makes it particularly tenacious. It does not just impact huge companies; small firms, healthcare systems, and educational institutions are all common targets. Its ease of deployment and high return on investment continue to attract cybercriminals, resulting in more aggressive campaigns.

Ransomware attacks increasingly frequently use "double extortion," in which attackers exfiltrate data before encrypting it. Victims confront two threats: inaccessible data and public exposure. This strategy not only enhances the chance of ransom payment, but also raises the stakes for organisations who are already battling to recover.

Challenges

Malware and ransomware are challenging to detect due to evasive strategies. Attackers are getting more creative, using legitimate administrative tools, zero-day vulnerabilities, and social engineering to get around defences. A multi-layered security approach that includes behavioural detection, endpoint hardening, and regular system updates is necessary to defend against these threats.

In the end, protecting against malware and ransomware involves more than just technology; it also involves mentality. Professionals in cybersecurity need to be knowledgeable, proactive, and flexible. The defenders must adapt to the ever-changing threats.
Read more »
Technology
Alert Fatigue Business Security Human Psychology Neuroscience Technology

Here's How 'Alert Fatigue' Can Be Combated Using Neuroscience

 

Boaz Barzel, Field CTO at OX Security, recently conducted research with colleagues at OX Security and discovered that an average organisation had more than half a million alerts at any given time. More astonishing is that 95% to 98% of those alerts are not critical, and in many cases are not even issues that need to be addressed at all. 

This deluge has resulted in the alert fatigue issue, which jeopardises the foundations of our digital defence and is firmly entrenched in neuroscience. 

Security experts must constantly manage alerts. Veteran security practitioner Matt Johansen of Vulnerable U characterises the experience as follows: "You're generally clicking 'No, this is OK.'" 'No, this is OK' 99 times out of a hundred, and then, 'No, this is not OK.' And then this is going to be a very exciting and unique day." 

This creates a perilous scenario in which alerts keep coming, resulting in persistent pressure. According to Johansen, many security teams are understaffed, resulting in situations in which "even big, well-funded organisations" are "stretched really thin for this frontline role.”

Alert overload 

As the former director of the Gonda Multidisciplinary Brain Research Centre at Israel's Bar-Ilan University and the Cognitive Neuroscience Laboratory at Harvard Medical School and Massachusetts General Hospital, Professor Moshe Bar is regarded as one of the world's foremost cognitive neuroscientists. According to Bar, alert weariness is especially pernicious since it not only lowers productivity but also radically changes how professionals operate.

"When you limit the amount of resources we have," Bar notes, "it's not that we do less. We actually change the way we do things. … We become less creative. We become … exploitatory, we exploit familiar templates, familiar knowledge, and we resort to easier solutions.” 

The science driving this transformation is alarming. When neurones fire frequently during sustained attention activities, they produce what Bar refers to as "metabolic waste." With little recovery time, waste builds and we are unable to effectively clean it. What was the result? Degraded cognitive function and depleted neurotransmitters such as dopamine and serotonin, which regulate our reward systems and "reward" us for various activities, not just at work but in all aspects of our lives.

The path ahead

Alert fatigue poses a serious threat to security efficacy and is not only an operational issue. When security personnel are overburdened, Bar cautions, "you have someone narrow like this, stressed, and opts for the easiest solutions." The individual is different. 

Organisations can create more sustainable security operations that safeguard not only their digital assets but also the health and cognitive capacities of individuals who defend them by comprehending the neurological realities of human attention.
Read more »
Subscribe to: Posts (Atom)