Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Cyber Hackers. Show all posts
Malware Attack
APT44 Cyber Attacks Cyber Hackers Data Hackers Data protection data security data wipers Data Wiping Malware Hacker attack Malware Attack

Russian Sandworm Hackers Deploy New Data-Wipers Against Ukraine’s Government and Grain Sector

 

Russian state-backed hacking group Sandworm has intensified its destructive cyber operations in Ukraine, deploying several families of data-wiping malware against organizations in the government, education, logistics, energy, and grain industries. According to a new report by cybersecurity firm ESET, the attacks occurred in June and September and form part of a broader pattern of digital sabotage carried out by Sandworm—also known as APT44—throughout the conflict. 

Data wipers differ fundamentally from ransomware, which typically encrypts and steals data for extortion. Wipers are designed solely to destroy information by corrupting files, damaging disk partitions, or deleting master boot records in ways that prevent recovery. The resulting disruption can be severe, especially for critical Ukrainian institutions already strained by wartime pressures. Since Russia’s invasion, Ukraine has faced repeated wiper campaigns attributed to state-aligned actors, including PathWiper, HermeticWiper, CaddyWiper, WhisperGate, and IsaacWiper.

ESET’s report documents advanced persistent threat (APT) activity between April and September 2025 and highlights a notable escalation: targeted attacks against Ukraine’s grain sector. Grain exports remain one of the country’s essential revenue streams, and ESET notes that wiper attacks on this industry reflect an attempt to erode Ukraine’s economic resilience. The company reports that Sandworm deployed multiple variants of wiper malware during both June and September, striking organizations responsible for government operations, energy distribution, logistics networks, and grain production. While each of these sectors has faced previous sabotage attempts, direct attacks on the grain industry remain comparatively rare and underscore a growing focus on undermining Ukraine’s wartime economy. 

Earlier, in April 2025, APT44 used two additional wipers—ZeroLot and Sting—against a Ukrainian university. Investigators discovered that Sting was executed through a Windows scheduled task named after the Hungarian dish goulash, a detail that illustrates the group’s use of deceptive operational techniques. ESET also found that initial access in several incidents was achieved by UAC-0099, a separate threat actor active since 2023, which then passed control to Sandworm for wiper deployment. UAC-0099 has consistently focused its intrusions on Ukrainian institutions, suggesting coordinated efforts between threat groups aligned with Russian interests. 

Although Sandworm has recently engaged in more espionage-driven operations, ESET concludes that destructive attacks remain a persistent and ongoing part of the group’s strategy. The report further identifies cyber activity linked to Iranian interests, though not attributed to a specific Iranian threat group. These clusters involved the use of Go-based wipers derived from open-source code and targeted Israel’s energy and engineering sectors in June 2025. The tactics, techniques, and procedures align with those typically associated with Iranian state-aligned hackers, indicating a parallel rise in destructive cyber operations across regions affected by geopolitical tensions. 

Defending against data-wiping attacks requires a combination of familiar but essential cybersecurity practices. Many of the same measures advised for ransomware—such as maintaining offline, immutable backups—are crucial because wipers aim to permanently destroy data rather than exploit it. Strong endpoint detection systems, modern intrusion prevention technologies, and consistent software patching can help prevent attackers from gaining a foothold in networks. As Ukraine continues to face sophisticated threats from state-backed actors, resilient cybersecurity defenses are increasingly vital for preserving both operational continuity and national stability.
Read more »
LLM security
AI cybercrime AI technology Cyber Hackers Cyber Security CyberCrime Hacker attack LLM LLM security

Rise of Evil LLMs: How AI-Driven Cybercrime Is Lowering Barriers for Global Hackers

 

As artificial intelligence continues to redefine modern life, cybercriminals are rapidly exploiting its weaknesses to create a new era of AI-powered cybercrime. The rise of “evil LLMs,” prompt injection attacks, and AI-generated malware has made hacking easier, cheaper, and more dangerous than ever. What was once a highly technical crime now requires only creativity and access to affordable AI tools, posing global security risks. 

While “vibe coding” represents the creative use of generative AI, its dark counterpart — “vibe hacking” — is emerging as a method for cybercriminals to launch sophisticated attacks. By feeding manipulative prompts into AI systems, attackers are creating ransomware capable of bypassing traditional defenses and stealing sensitive data. This threat is already tangible. Anthropic, the developer behind Claude Code, recently disclosed that its AI model had been misused for personal data theft across 17 organizations, with each victim losing nearly $500,000. 

On dark web marketplaces, purpose-built “evil LLMs” like FraudGPT and WormGPT are being sold for as little as $100, specifically tailored for phishing, fraud, and malware generation. Prompt injection attacks have become a particularly powerful weapon. These techniques allow hackers to trick language models into revealing confidential data, producing harmful content, or generating malicious scripts. 

Experts warn that the ability to override safety mechanisms with just a line of text has significantly reduced the barrier to entry for would-be attackers. Generative AI has essentially turned hacking into a point-and-click operation. Emerging tools such as PromptLock, an AI agent capable of autonomously writing code and encrypting files, demonstrate the growing sophistication of AI misuse. According to Huzefa Motiwala, senior director at Palo Alto Networks, attackers are now using mainstream AI tools to compose phishing emails, create ransomware, and obfuscate malicious code — all without advanced technical knowledge. 

This shift has democratized cybercrime, making it accessible to a wider and more dangerous pool of offenders. The implications extend beyond technology and into national security. Experts warn that the intersection of AI misuse and organized cybercrime could have severe consequences, particularly for countries like India with vast digital infrastructures and rapidly expanding AI integration. 

Analysts argue that governments, businesses, and AI developers must urgently collaborate to establish robust defense mechanisms and regulatory frameworks before the problem escalates further. The rise of AI-powered cybercrime signals a fundamental change in how digital threats operate. It is no longer a matter of whether cybercriminals will exploit AI, but how quickly global systems can adapt to defend against it. 

As “evil LLMs” proliferate, the distinction between creative innovation and digital weaponry continues to blur, ushering in an age where AI can empower both progress and peril in equal measure.
Read more »
Malware Attack
Cyber Attacks Cyber Hackers Data Leak data security Data Transfer Database Security GitHub leaked sensitive data Malicious Files Malware Attack

GitHub Supply Chain Attack ‘GhostAction’ Exposes Over 3,000 Secrets Across Ecosystems

 

A newly uncovered supply chain attack on GitHub, named GhostAction, has compromised more than 3,300 secrets across multiple ecosystems, including PyPI, npm, DockerHub, GitHub, Cloudflare, and AWS. The campaign was first identified by GitGuardian researchers, who traced initial signs of suspicious activity in the FastUUID project on September 2, 2025. The attack relied on compromised maintainer accounts, which were used to commit malicious workflow files into repositories. These GitHub Actions workflows were configured to trigger automatically on push events or manual dispatch, enabling the attackers to extract sensitive information. 

Once executed, the malicious workflow harvested secrets from GitHub Actions environments and transmitted them to an attacker-controlled server through a curl POST request. In FastUUID’s case, the attackers accessed the project’s PyPI token, although no malicious package versions were published before the compromise was detected and contained. Further investigation revealed that the attack extended well beyond a single project. Researchers found similar workflow injections across at least 817 repositories, all exfiltrating data to the same domain. To maximize impact, the attackers enumerated secret variables from existing legitimate workflows and embedded them into their own files, ensuring multiple types of secrets could be stolen. 

GitGuardian publicly disclosed the findings on September 5, raising issues in 573 affected repositories and notifying security teams at GitHub, npm, and PyPI. By that time, about 100 repositories had already identified the unauthorized commits and reverted them. Soon after the disclosures, the exfiltration endpoint used by the attackers went offline, halting further data transfers. 

The scope of the incident is significant, with researchers estimating that roughly 3,325 secrets were exposed. These included API tokens, access keys, and database credentials spanning several major platforms. At least nine npm packages and 15 PyPI projects remain directly affected, with the risk that compromised tokens could allow the release of malicious or trojanized versions if not revoked. GitGuardian noted that some companies had their entire SDK portfolios compromised, with repositories in Python, Rust, JavaScript, and Go impacted simultaneously. 

While the attack bears some resemblance to the s1ngularity campaign reported in late August, GitGuardian stated that it does not see a direct connection between the two. Instead, GhostAction appears to represent a distinct, large-scale attempt to exploit open-source ecosystems through stolen maintainer credentials and poisoned automation workflows. The findings underscore the growing challenges in securing supply chains that depend heavily on public code repositories and automated build systems.
Read more »
Ransomwares
AI Chatbots AI Models AI Techniques Cyber Crime Cyber Extortion Cyber Hackers Data Extortion international cybercrime operation Ransomwares

Hacker Exploits AI Chatbot Claude in Unprecedented Cybercrime Operation

 

A hacker has carried out one of the most advanced AI-driven cybercrime operations ever documented, using Anthropic’s Claude chatbot to identify targets, steal sensitive data, and even draft extortion emails, according to a new report from the company. 

It Anthropic disclosed that the attacker leveraged Claude Code — a version of its AI model designed for generating computer code — to assist in nearly every stage of the operation. The campaign targeted at least 17 organizations across industries including defense, finance, and healthcare, making it the most comprehensive example yet of artificial intelligence being exploited for cyber extortion. 

Cyber extortion typically involves hackers stealing confidential data and demanding payment to prevent its release. AI has already played a role in such crimes, with chatbots being used to write phishing emails. However, Anthropic’s findings mark the first publicly confirmed case in which a mainstream AI model automated nearly the entire lifecycle of a cyberattack. 

The hacker reportedly prompted Claude to scan for vulnerable companies, generate malicious code to infiltrate systems, and extract confidential files. The AI system then organized the stolen data, analyzed which documents carried the highest value, and suggested ransom amounts based on victims’ financial information. It also drafted extortion notes demanding bitcoin payments, which ranged from $75,000 to more than $500,000. 

Jacob Klein, Anthropic’s head of threat intelligence, said the operation was likely conducted by a single actor outside the United States and unfolded over three months. “We have robust safeguards and multiple layers of defense for detecting this kind of misuse, but determined actors sometimes attempt to evade our systems through sophisticated techniques,” Klein explained. 

The report revealed that stolen material included Social Security numbers, bank records, medical data, and files tied to sensitive defense projects regulated by the U.S. State Department. Anthropic did not disclose which companies were affected, nor did it confirm whether any ransom payments were made. 

While the company declined to detail exactly how the hacker bypassed safeguards, it emphasized that additional protections have since been introduced. “We expect this model of cybercrime to become more common as AI lowers the barrier to entry for sophisticated operations,” Anthropic warned. 

The case underscores growing concerns about the intersection of AI and cybersecurity. With the AI sector largely self-regulated in the U.S., experts fear similar incidents could accelerate unless stronger oversight and security standards are enforced.
Read more »
Reporters
Black Hut Cyber Attacks Cyber Hackers CyberCrime Cybersecurity CyberThreat Reporters

Black Hat 25 Reveals What Keeps Cyber Experts Awake


 

In an era where cyber threats are becoming increasingly complex, Black Hat USA 2025 sounded alarms ringing with a sense of urgency that were unmistakable in the way they were sounded. As Nicole Perlroth, formerly a New York Times reporter, and now a founding partner at Silver Buckshot Ventures, made her presentation to a global security audience, she warned that cyber threats are evolving faster than the defenses that are designed to contain them, are failing. 

It was discussed in the presentation how malware has moved from a loud disruption to a stealthy, autonomous persistence, and ransomware has now mimicked legitimate commerce by mimicking subscription-based models that have industrialized extortion. 

Perlroth warned us that artificial intelligence, as well as supercharging attacks, is also corroding trust through distortions that are eroding trust. She argued that the consequences go beyond the corporate networks, and that democratic institutions, critical infrastructure, and public discourse are all directly in the crossfire of a new digital war.

During the past few years, artificial intelligence has emerged as both a powerful shield and a formidable weapon for cybersecurity, transforming attacks in both speed and scale while challenging traditional defenses simultaneously. According to experts at Black Hat, despite the rise of artificial intelligence, the industry is still grappling with longstanding security issues including application security, vulnerability management, and data protection, issues which remain unresolved despite decades of effort. 

In a keynote address at the event, Paul Wheatman noted that, alongside these persistent challenges, artificial intelligence is bringing about a new set of opportunities and threats that have never existed before. The use of artificial intelligence is accelerating defense by enabling quicker, smarter threat detection, reducing false positives, and allowing security teams to prioritize strategy over triage, among other things. 

In contrast, it is empowering adversaries with a wide range of tools, including automation of vulnerability discovery, persuasive phishing lures, and evasive malware, which lowers the barriers for attackers, even those who are not very experienced. Although technology vendors are quick to highlight the benefits of artificial intelligence, Wheatman noted that they are far less likely to address the risks of the technology. 

According to him, artificial intelligence is simultaneously the greatest asset of cybersecurity as well as the greatest threat, which is why the technology is both its greatest asset and its greatest threat in 2025. It has been reported that 13% of organizations have already experienced security incidents linked to artificial intelligence models or applications, and 97% of them occurred in environments which had no proper access controls in place. 

This is particularly true of the fact that the use of generative AI has allowed attackers to create phishing schemes and social engineering schemes faster and more convincing than they were once able to, eroding the barriers that once separated skilled adversaries from opportunistic criminals. There is a race on the defensive side of organizations, where they are rewriting policies, retraining their staffs, and overhauling incident response frameworks in order to keep up with an adversary that is no longer only dependent on human creativity. 

In the opinion of Ken Phelan, chief technology officer at Gotham Technology Group in New York City, this rapid acceleration is more than simply a software problem, but also a fundamental infrastructure problem, which requires a rethinking of the very systems that support digital security. 

In addition to the increasing complexity of the cybersecurity landscape, Black Hat USA also underscored how artificial intelligence is now used as a tool as well as a shield, and the cloud is now becoming the new arena on which battles are being fought. 

This year's keynote sessions focused on how automation and artificial intelligence are amplifying the scale of malicious activity, which has turned malware from an inconvenience in the past into an advanced threat weapon used by financially motivated, organized threat actors. In today's world, the stakes for defenders are high as attacks are no longer solely targeted at code, but also people, institutions, and even society. 

CISOs face both a tremendous challenge and an opportunity to showcase the strategic value of their work and investments as a result of this volatility, which is both an enormous challenge and an opportunity. Even so, the role of the CISO has also grown more challenging as it is becoming increasingly necessary to bring order to a chaotic and noisy environment. It has been well known for the past five years that more tools do not always result in stronger defences. 

This is why vendors are now proving that their products are actually measurable, rather than positioning themselves as optional add-ons. A shift in cybersecurity posture was also highlighted at the conference, with experts stressing the importance of moving from a reactive to a proactive posture. At an executive panel organised by Dataminr, panellists shared how AI-powered platforms, like the Dataminr Pulse for Cyber Risk, are making it possible for teams to analyse huge amounts of data at machine speed, prioritise threats more effectively, and maximise existing resources using big data. 

Without these approaches, there will remain a widening gap between increasingly agile threat actors and under-resourced defenders. A number of discussions at Black Hat USA 2025 made it impossible to ignore the fact that cybersecurity is no longer a siloed technical issue, but rather a societal imperative requiring agility, foresight, and collaboration at the global level. 

There is no doubt that artificial intelligence, automation, and cloud technologies are transforming both the threat landscape as well as organisations' defensive capabilities, but the real challenge for companies lies in adapting strategy at the same speed as adversaries are adapting tactics. According to experts, tool investments are not a replacement for investments in people, processes, and governance.

Leadership and cultural readiness are as important as technology in ensuring resilience, they stressed. Cybersecurity risks are now becoming increasingly intertwined with geopolitical tensions, supply chain instability, and the erosion of digital trust, proving that the stakes go far beyond the value of corporate assets. 

The message was clear to many attendees: cybersecurity leaders are being challenged not only to protect networks, but also to safeguard institutions, economies, and the integrity of public discourse itself in addition to protecting networks. This challenge is not only a daunting one, but also a great opportunity for the profession to take on a historic role in shaping the future of digital security, when the lines between defence strategy and survival have all but vanished in an era where the lines between defence, strategy, and survival are almost nonexistent.
Read more »
Vulnerabilities
Andriod ATR Cyber Hackers Cybersecurity CyberThreat MaaS malware NFC SiperCard TLS Vulnerabilities

New Android Threat Raises Concern Over NFC Relay Attack Vulnerabilities

 


In recent times, there has been considerable concern with regards to some newly uncovered Android-based malware-as-a-service (Maas) platforms, particularly those based on Android and known as SuperCard X. This is because this platform was able to execute these attacks in near-field communication (NFC). A sophisticated tool such as this enables threat actors to make unauthorised contactless payments, allowing them to withdraw money without requiring direct physical access to their cards. 

Through advanced near-field communication (NFC) relay techniques, this malware is able to allow threat actors to authorize illicit transactions at contactless-enabled ATMs and Point-of-Sale (POS) terminals without actually requiring the victim to give them their card details. Using such methods, the attacker deceives users into installing a malicious Android application, during which their payment cards are tapped against their compromised devices. 

The sensitive data from the NFC tags is intercepted and relayed in real time to the attacker-controlled infrastructure while the attack is taking place. It appears that the platform has been part of a Malware-as-a-Service MaasS) ecosystem for Chinese-speaking users. In addition, it appears to have a significant amount of code overlap with NGate, a malicious NFC toolkit that was previously documented by ESET in 2024. The campaign has had a wide-reaching impact on not only banking customers but also credit card issuers and payment processors as well. 

With the help of widely adopted contactless payment technologies, attackers are able to devise an extremely effective means of executing an unauthorised cashout, especially if they trick the user into disabling transaction limits. This campaign's success has been attributed to its combination of streamlined malware and persuasive social engineering, a development that signals a significant change in the tactics used by mobile threat actors in the future.

Apparently, the current campaign appears to be primarily targeting Italian bank customers and cardholders, according to recent research conducted by the fraud prevention firm Cleafy. It is reported that the attackers intend to collect sensitive payment card data through a methodical and layering approach in a very systematic way. Several analysts, including Federico Valentini, Alessandro Strino, and Michele Roviello, have concluded that SuperCard X uses a multiphase strategic attack method. 

Social engineering tactics are used to lure victims into installing malicious Android applications, which can intercept NFC data that has been compromised from a compromised device. This can include SMS-based phishing (smishing) as well as deceptive phone calls that lure victims into installing malicious Android applications. Additionally, preliminary findings indicate that the service is actively promoted on Telegram channels, which suggests that the tool’s distribution and monetisation are being supported by a larger underground network. 

The campaign's focus is on covert data harvesting and real-time exploitation of data, a trend which highlights the importance of mobile devices as a critical point of entry for financial fraudsters. A growing number of mobile payments is highlighting a need for enhanced awareness of users, robust security protocols, and real-time threat intelligence to combat the ever-increasing number of mobile-focused cyberattacks. As far as the malware's operational architecture is concerned, it displays a clever combination of sophistication and subtlety. 

To keep the component known as "Reader" from being detected by security platforms that are based on heuristics or signature-based and signature-driven algorithms, such as VirusTotal, the component is intentionally designed to only ask for basic system permissions as well as some NFC permissions, an intentional design choice. The technical findings of Cleafy indicate significant code reuse from the open-source relay toolkit NFCGate and the malicious variant NGate, both of which were identified by ESET in 2024. 

Using publicly available frameworks has probably accelerated development and led to a quicker onboarding process for new threat actor affiliates because it allows development to take place faster. When victims are coerced into tapping their credit or debit cards against a compromised device, they are silently captured, including low-level smart card responses such as the Answer To Reset (ATR) messages, from the compromised device. This is often done through social engineering.

Data such as this is sent instantly through a command-and-control network that is based on HTTP and protected with mutually negotiated TLS authentication, which limits communication to validated client instances and reduces the probability of external intrusion. During the same time, a secondary application on a separate attacker-controlled Android device called the "Tapper" is played that simulates the victim's card at a payment terminal or contactless ATM by using Host-Based Card Emulation (HCE). 

With a combination of disabling the card spending limits for the victim, this tactic can ensure that the maximum number of fraudulent withdrawals are made while remaining virtually undetectable by standard mobile security solutions. As a result of Cleafy's analysis, SuperCard X is designed to be stealthy, and it has remained undetected by all antivirus solutions listed on VirusTotal until today. 

Having such a restricted permission model, as well as the absence of overtly malicious behaviours, such as screen overlays and intrusive access requests, which are commonly flagged by heuristic-based security engines, contributes greatly to this success. There is an evident high level of technical competence among the threat actors behind SuperCard X, particularly in the implementation of an ATR-based (Answer to Reset) card emulation system, which demonstrates a high level of technical competence. 

A malware program that replicates the initial response sequence of the smartcard convincingly allows fraudulent transactions to be processed without raising suspicions at a payment terminal by convincingly mimicking authentic smartcard behaviour. In addition to this, users have built a command-and-control infrastructure with mutual Transport Layer Security (MTLS), which ensures that no client devices are permitted to communicate unless they are authenticated. 

A certificate-based verification ensures that not only is data integrity protected, but the network traffic analysis process is hindered significantly by security researchers and law enforcement agencies due to the fact that this certificate is based on verification. Together, these technical safeguards ensure that this malware does not leave a large footprint on the networks and demonstrate how mature the campaign is operationally. 

There is some evidence that the activity associated with SuperCard X is currently restricted to Italy geographically, although Cleafy's report cautions that the threat could rapidly escalate on a global scale if the problem is not addressed promptly. Cybercriminals can acquire and deploy malware-as-a-service (MaaaS) tools on dark web marketplaces that are readily available, which makes it easy for them to acquire and deploy malware against targets from any region. This raises concerns about possible expansion into broader markets, including those in North America and Europe. 

Using convincing social engineering tactics, such as urgent text messages masquerading as official communication from financial institutions, the campaign leverages persuasive social engineering techniques. The messages are designed in such a way that they cause panic in users and prompt them to immediately act, such as clicking on malicious links or downloading unauthorised applications, in order to generate immediate results. 

Individuals should ensure that they verify such messages independently by contacting their financial providers directly through trusted channels in cases where the sender's number matches the victim's actual bank number, especially if the sender's number has been spoofed to match that number. Whenever users receive a request to download an application through an external link, they should be aware that it is a red flag. No legitimate bank would ever ask users for this type of request. 

The user should only install applications from verified sources, such as the Google Play Store, which offer banking apps. It is essential to maintain the functionality of built-in security features on users' Android device, such as Google Play Protect, to mitigate the risk of exposure to threats like SuperCard X. This service continuously scans every application users install and any new applications they download for malicious behavior. 

There are a few things users should consider, such as installing a third-party mobile security solution, as well as awareness and good cyber hygiene practices. As this malware continues to circulate in the wild, awareness and good cyber hygiene are the two best ways to combat the increasing number of mobile malware threats.
Read more »
Security Vendors
Credentials Cyber Hackers Cyberattacks CyberCrime Cybersecurity CyberThreat Darkweb Data Breach Security Vendors

Credentials of Major Cybersecurity Vendors Found on Dark Web for $10

 


As a result of recent findings on dark web marketplaces, it has been found that many account credentials from major security vendors are being sold. According to Cyble, the rise of information stealers has been largely responsible for this alarming situation, since the credentials of vendors and their clients are compromised. This poses a substantial risk to both vendors and their clients, which makes the need for enhanced cybersecurity measures more urgent than ever before. 

As a result of these credentials, which can be purchased on cybercrime markets for a mere $10, access to internal accounts, customer systems, and cloud-based environments can be acquired. This is alarming because it encompasses internal enterprise accounts of security companies as well as internal development accounts, thereby posing a severe security threat. 

The best solution would have been to protect these accounts by implementing multifactor authentication (MFA). This would have made it much harder for unauthorized individuals to gain access to these accounts in the first place. It is evident from this incident that there are critical vulnerabilities in access management practices when these protections are not in place or fail, further emphasizing the necessity of robust dark web monitoring as a proactive security measure. 

It is important to detect credential leaks early on so that organizations can minimize the risk of such exposures escalating into large-scale cyberattacks. This will prevent operational integrity from being compromised as well as stakeholder trust from being compromised. It is important to remember that even the most well-defended organizations face persistent threats and that continuous vigilance is essential to preventing those threats from happening. This is a very timely report, as Cyble's data focuses on leaks from the current year, highlighting a more urgent threat than old breaches. 

As these accounts are often associated with sensitive management and development interfaces, attackers may be able to use them to conduct reconnaissance, locate sensitive data, and exploit system vulnerabilities, thereby being able to exploit sensitive data. Even multi-factor authentication (MFA) systems are at risk of misuse because of the stolen credentials, which include company email addresses. 

It has been reported that cybersecurity vendors' credentials are becoming increasingly accessible on dark web marketplaces for as little as $10. According to the findings from Cyble, these credentials were likely harvested from information stealer logs and sold in bulk, which indicates that cybercrime targeting sensitive access data has increased significantly in recent years. In a study aimed at examining leaks occurring in 2025, all 14 vendors that were examined had exposed their customers' and internal credentials.

Among these vendors are those that mainly offer enterprise security solutions and cloud security services, as well as consumer security solutions, but Cyble did not reveal the names of the affected vendors because it wanted to protect their identities and emphasize that such a situation poses a serious risk to the integrity of the company as well as client trust. Based on the findings in this study, it is obvious that drastic security measures, as well as comprehensive monitoring, are required to prevent credential theft from occurring in the cybersecurity sector, as the threat of credential theft continues to grow. 

The researchers at Cyble did not attempt to determine whether any credentials were valid. Many of these vulnerabilities were associated with easily accessible web console interfaces, single-sign-on (SSO) logins, and other web-based account access points. The researchers concluded that vulnerabilities likely caused these leaks in potentially critical internal systems, such as password managers, authentication systems, device management platforms, or common internet services, such as Okta, GitHub, Amazon Web Services, Microsoft Online, Salesforce, SolarWinds, Box, WordPress, Oracle, and Zoom. 

There was an incident in which sensitive internal company accounts, including email addresses, developer interfaces, and product accounts of a large vendor, were exposed, posing significant risks depending on the extent of access granted to these accounts. Even if all the exposed accounts were protected by other means, as ideally they should have been, this leak is concerning for another reason. By providing threat actors with insight into how a target's systems operate, including the locations of sensitive data and potential vulnerabilities they can exploit, they can assist in conducting reconnaissance.

Hackers can also expose sensitive information by revealing URLs of management interfaces that are not publicly known, offering attackers further reconnaissance information. Monitoring leaked credentials for essential systems like security tools is necessary to prevent breaches and to hinder hackers from obtaining valuable information about an organization's systems and how to access them. The company stated that, in addition to the direct threats associated with unauthorized access, the exposed credentials could serve as a valuable asset for threat actors as a means of reconnaissance. 

Such access can provide attackers with valuable insights into the systems a potential target relies on, including the location of sensitive data and exploitable vulnerabilities, among other things. Infostealers can also uncover critical information that is not publicly disclosed, thus enhancing an attacker's ability to exploit the target's systems. 

As Cyble highlighted in its analysis, these findings have a broader impact on any organization, since even the largest cybersecurity vendors are susceptible to hacking, making any company vulnerable. Several security measures have been identified in the report, including multi-factor authentication (MFA), zero-trust architecture, effective vulnerability management, and network segmentation, as essential to ensuring the security of an organization. 

Several practices can be implemented to reduce the risk of data breaches, ransomware incidents, or other cyberattacks. This report serves as a stark reminder of the pervasive and ever-evolving nature of cyber threats, making it increasingly imperative to take proactive measures to safeguard both organizational integrity and sensitive data in the future. Finally, dark web monitoring has the potential to play a critical role in the fight against cyber threats. 

It enables the detection of credential leaks that often result in significant incidents, such as breaches of sensitive data and ransomware attacks before they fully materialize Monitoring compromised credentials associated with critical security tools and systems is crucial in preventing unauthorized access and thwarting threat actors from acquiring critical insights into an organization's infrastructure. Such reconnaissance capabilities have been shown to greatly enhance attackers' effectiveness in exploiting vulnerabilities. This study emphasizes that even the largest cybersecurity vendors are vulnerable to infostealer attacks, demonstrating that no organization can be completely protected from cyberattacks. 

To combat these risks, foundational cybersecurity measures are imperative—including multi-factor authentication (MFA), zero-trust architecture, vulnerability management, and network segmentation—to prevent cyber threats from occurring. Such strategies play a pivotal role in minimizing the risk of cyberattacks while effectively mitigating their potential consequences. This highlights the critical need for organizations to adopt a proactive, multi-layered cybersecurity approach. By doing so, they can bolster their resilience and safeguard their assets against the ever-evolving challenges of today’s complex threat environment.
Read more »
Zero-day vulnerability
Cyber Crime Cyber Hackers CyberCrime Cybersecurity CyberThreat Internet Explorer Microsoft North Korea South Korea Zero-day vulnerability

Cyber Threat Alert for South Korea from North Korean Hackers

 


In a recent cyber-espionage campaign targeted at the United States, North Korean state-linked hacker ScarCruft recently exploited a zero-day vulnerability in Internet Explorer to distribute RokRAT malware to targets nationwide. APT37, or RedEyes as it is sometimes called, is one of the most notorious North Korean state-sponsored hacking groups, and its activities are thought to be aimed at cyber espionage. 

There is typically a focus on human rights activists from South Korea, defectors from the country, and political entities in Europe from this group. An unknown threat actor with ties to North Korea has been observed delivering a previously undocumented backdoor and remote access Trojan (RAT) called VeilShell as part of a campaign targeted at Cambodia and potentially other Southeast Asian countries, including Indonesia, Malaysia, and Thailand. 

Known to Securonix as SHROUDED#SLEEP, the activity is believed to have been carried out by APT37, which is also known as InkySquid, Reaper, RedEyes, Ricochet Chollima, Ruby Sleet, and ScarCruft as well as several other names. ScarCruft, also known as APT37, InkySquid, Nickel Foxcroft, Reaper, RedEyes, and Ricochet Chollima, is a state-sponsored cyber-espionage threat group that almost entirely targets South Korean individuals and organizations. 

It uses spear phishing to deliver customized tools via phishing, watering holes, and zero-days for Internet Explorer. It has been reported by AhnLab that APT37 compromised one of the servers of a domestic advertising agency. Hence, the purpose is to push specially crafted 'Toast ads' as a part of an unidentified free software that is widely used by South Koreans. As a result of the CVE-2024-38178 flaw found in the JavaScript 9.dll file (Chakra) of Internet Explorer used for displaying these advertisements, it caused the JavaScript file named 'ad_toast' to trigger remote code execution via CVE-2024-38178 in the JavaScript9.dll file.

There is a deep correlation between the malware that was dropped in this attack and the RokRAT malware, which ScarCruft has been using for years to launch attacks. In essence, RokRATs primary function is to exfiltrate to Yandex cloud instances every 30 minutes file matching 20 extension types (including .doc, .mdb, .xls, .ppt, .txt, .amr) that match these extensions. In addition to keylogging, Keylogger also monitors for changes made to the clipboard and captures screenshots (every three minutes) as well. 

In July 2022, ScarCruft, a North Korean threat actor who operates in North Korean cyberspace, began experimenting with oversized LNK files as a delivery route for RokRAT malware, just a couple of months after Microsoft began blocking macros by default across several Office documents. Check Point has released a new report on its technical analysis of RokRAT that concludes that the malware has not changed significantly over the years, but the deployment method has evolved. RokRAT now uses archives that contain LNK files, resulting in infection chains that move through multiple stages. 

As a result of this round of activity, is another indication of a major trend in the threat landscape, where both APTs, as well as cybercriminals, will try to overcome the restriction on macros coming from untrusted sources. Having made the news in the past few days, a new campaign with the intriguing name "Code on Toast," has raised serious concerns about the vulnerability of software still embedded in widely used systems, even after the retirement of Internet Explorer. According to a joint report by the National Cyber Security Center (NCSC) of South Korea, and AhnLab (ASEC), the incident occurred earlier this year. 

There was a unique way for these malware infections to be spread by using toast pop-up ads as how the campaign was delivered. There is a unique aspect of this campaign that focuses on the way ScarCruft distributes its malware through the use of toast notifications and small pop-ups that appear when antivirus software or free utilities are running. As a result of ScarCruft’s compromise of the server of a domestic ad agency in South Korea, a malicious "toast ad" made by ScarCruft was sent to many South Korean users through a popular, yet unnamed, free piece of software. 

To accomplish ScarCruft’s attack, a zero-day Internet Explorer vulnerability, CVE-2024-38178, with a severity rating of 7.5, must be exploited cleverly. As a consequence of this, Edge users in Internet Explorer mode can potentially execute remote code through a memory corruption bug in the Scripting Engine, which can result in remote code execution. This vulnerability was patched for August 2024 as part of Microsoft's Patch Tuesday update, part of this annual update program. 

By using toast notifications, typically harmless pop-up ads from anti-virus software or utility programs, the group silently delivered malware through a zero-click infection method using a zero-click virus delivery mechanism. As a result, it has become necessary for an attacker to convince a user to click on a URL that has been specially crafted to initiate the execution of malicious code to successfully exploit a vulnerability. 

Having used such advanced techniques, ScarCruft clearly emphasizes the need for South Korea's digital landscape to remain protected from such threats in the future. It is unfortunate that no matter how much effort is put into phasing out outdated systems, security vulnerabilities have caused problems in legacy components like Internet Explorer. Although Microsoft announced it would retire Internet Explorer at the end of 2022, many of the browser's components remain in Windows, or they are being used by third-party products, allowing threat actors to come across new vulnerabilities and exploit them for their purposes. As a result of this campaign, organizations will be reminded of the importance of prioritizing cybersecurity updates and maintaining robust defences against increasingly sophisticated cyber threats backed by governments.
Read more »
Subscribe to: Comments (Atom)