Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Cybersecurity Threats. Show all posts
Social Media Safety
AI Misuse Cyber Fraud Cybersecurity Threats Deepfake Fraud Digital Literacy Financial Fraud Online Scams Social Media Safety

Deepfake Video of Sadhguru Used to Defraud Bengaluru Woman of Rs 3.75 Crore


 

As a striking example of how emerging technologies are used as weapons for deception, a Bengaluru-based woman of 57 was deceived out of Rs 3.75 crore by an AI-generated deepfake video supposedly showing the spiritual leader Sadhguru. The video was reportedly generated by an AI-driven machine learning algorithm, which led to her loss of Rs 3.75 crore. 

During the interview, the woman, identifying herself as Varsha Gupta from CV Raman Nagar, said she did not know that deepfakes existed when she saw a social media reel that appeared to show Sadhguru promoting investments in stocks through a trading platform, encouraging viewers to start with as little as $250. She had no idea what deepfakes were when she saw the reel. 

The video and subsequent interactions convinced her of its authenticity, which led to her investing heavily over the period of February to April, only to discover later that she had been deceived by the video and subsequent interactions. During that time, it has been noted that multiple fake advertisements involving artificial intelligence-generated voices and images of Sadhguru were circulating on the internet, leading police to confirm the case and launch an investigation. 

It is important to note that the incident not only emphasises the escalation of financial risk resulting from deepfake technology, but also the growing ethical and legal issues associated with it, as Sadhguru had recently filed a petition with the Delhi High Court to protect his rights against unauthorised artificial intelligence-generated content that may harm his persona. 

Varsha was immediately contacted by an individual who claimed to be Waleed B, who claimed to be an agent of Mirrox, and who identified himself as Waleed B. In order to tutor her, he used multiple UK phone numbers to add her to a WhatsApp group that had close to 100 members, as well as setting up trading tutorials over Zoom. After Waleed withdrew, another man named Michael C took over as her trainer when Waleed later withdrew. 

Using fake profit screenshots and credit information within a trading application, the fraudsters allegedly constructed credibility by convincing her to make repeated transfers into their bank accounts, in an effort to gain her trust. Throughout the period February to April, she invested more than Rs 3.75 crore in a number of transactions. 

 After she declined to withdraw what she believed to be her returns, everything ceased abruptly after she was informed that additional fees and taxes would be due. When she refused, things escalated. Despite the fact that the investigation has begun, investigators are partnering with banks to freeze accounts linked to the scam, but recovery remains uncertain since the complaint was filed nearly five months after the last transfer, when it was initially filed. 

Under the Bharatiya Nyaya Sanhita as well as Section 318(4) of the Information Technology Act, the case has been filed. Meanwhile, Sadhguru Jaggi Vasudev and the Isha Foundation formally filed a petition in June with the Delhi High Court asking the court to provide him with safeguards against misappropriation of his name and identity by deepfake content publishers. 

Moreover, the Foundation issued a public advisory regarding social media platform X, warning about scams that were being perpetrated using manipulated videos and cloned voices of Sadhguru, while reaffirming that he is not and will not endorse any financial schemes or commercial products. It was also part of the elaborate scheme in which Varsha was added to a WhatsApp group containing almost one hundred members and invited to a Zoom tutorial regarding online trading. 

It is suspected that the organisers of these sessions - who later became known as fraudsters - projected screenshots of profits and staged discussions aimed at motivating participants to act as positive leaders. In addition to the apparent success stories, she felt reassured by what seemed like a legitimate platform, so she transferred a total of 3.75 crore in several instalments across different bank accounts as a result of her confidence in the platform. 

Despite everything, however, the illusion collapsed when she attempted to withdraw her supposed earnings from her account. A new demand was made by the scammers for payment of tax and processing charges, but she refused to pay it, and when she did, all communication was abruptly cut off. It has been confirmed by police officials that her complaint was filed almost five months after the last transaction, resulting in a delay which has made it more challenging to recover the funds, even though efforts are currently being made to freeze the accounts involved in the scam. 

It was also noted that the incident occurred during a period when concern over artificial intelligence-driven fraud is on the rise, with deepfake technology increasingly being used to enhance the credibility of such schemes, authorities noted. In April of this year, Sadhguru Jaggi Vasudev and the Isha Foundation argued that the Delhi High Court should be able to protect them from being manipulated against their likeness and voice in deepfake videos. 

In a public advisory issued by the Foundation, Sadhguru was advised to citizens not to promote financial schemes or commercial products, and to warn them against becoming victims of fraudulent marketing campaigns circulating on social media platforms. Considering that artificial intelligence is increasingly being used for malicious purposes in this age, there is a growing need for greater digital literacy and vigilance in the digital age. 

Despite the fact that law enforcement agencies are continuing to strengthen their cybercrime units, the first line of defence continues to be at the individual level. Experts suggest that citizens exercise caution when receiving unsolicited financial offers, especially those appearing on social media platforms or messaging applications. It can be highly effective to conduct independent verification through official channels, maintain multi-factor authentication on sensitive accounts, and avoid clicking on suspicious links on an impulsive basis to reduce exposure to such traps. 

Financial institutions and banks should be equally encouraged to implement advanced artificial intelligence-based monitoring systems that can detect irregular patterns of transactions and identify fraudulent networks before they cause significant losses. Aside from technology, there must also be consistent public awareness campaigns and stricter regulations governing digital platforms that display misleading advertisements. 

It is now crucial that individuals keep an eye out for emerging threats such as deepfakes in order to protect their personal wealth and trust from these threats. Due to the sophistication of fraudsters, as demonstrated in this case, it is becoming increasingly difficult to protect oneself in this digital era without a combination of diligence, education, and more robust systemic safeguards.
Read more »
Zero Day exploit
Apple Security CVSS Cybersecurity Threats iOS Mobile Device Protection Spyware Campaign Vulnerabilities and Exploits WhatsApp Vulnerability Zero Click Attack Zero Day exploit

WhatsApp 0-Day Exploited in Targeted Attacks on Mac and iOS Platforms

 


Providing a fresh reminder of the constant threat to widespread communication platforms, WhatsApp has disclosed and patched a vulnerability affecting its iOS and macOS applications. The vulnerability has already been exploited in real-world attacks, according to WhatsApp, which warns it may already have been exploited in the past. 

It has a CVSS score of 5.4 and is tracked as CVE-2025-55177. The vulnerability is caused by an insufficient level of authorisation when handling linked device synchronization messages. As a result of the vulnerability, WhatsApp has warned that a malicious actor could potentially compromise the security of users by manipulating content processing using arbitrary URLs on the target device. 

In a statement, the Meta-owned company credited its in-house security team with discovering and analyzing this bug, which is thought to have been exploited in combination with a recently revealed Apple zero-day vulnerability as part of targeted attacks on the company. The incident was deemed to be the result of an "advanced spyware campaign" by Donncha Cearbhaill of Amnesty International's Security Lab, which notes it had been active for approximately 90 days and used zero-click delivery techniques. 

Through this technique, attackers were able to spread malicious exploits through WhatsApp without requiring any interaction from the victim, allowing them to steal data from Apple devices silently and raising serious concerns about the resilience of even highly secure platforms. By way of spokesperson Margarita Franklin, Meta, the parent company of WhatsApp, confirmed that the flaw had been identified and patched several weeks ago, with notification sent to less than 200 users who had been affected. 

Even though the company has not attributed the operation to any specific threat actor or spyware vendor, the lack of attribution highlights how difficult it may be to trace such sophisticated campaigns when it comes to tracking them down. Technology providers are facing increasingly complex and stealthy attacks on popular communication tools, which is why the episode emphasizes the mounting challenges they face in defending them against such attacks. 

Recently, a critical flaw has been discovered in WhatsApp which has been catalogued as CVE-2025-55177, which has once again brought to the fore the security landscape around widely used communication platforms. Based on initial CVSS scores of 5.4 and 8.0, the vulnerability highlights how zero-day exploits continue to pose a challenge to users and device integrity, as well as undermine privacy and device integrity. 

It is believed that the root of the flaw is due to incomplete authorization in the handling of synchronization messages between linked devices. This weakness was the basis of the attack, which could be exploited as a tool to override the expected security features. Using this vulnerability, a malicious actor who has no legitimate association with the target could force a victim's device to process content from an arbitrary URL on its own behalf if exploited. 

The manipulation of trusted communication channels could serve as an entry point for remote code execution, or unauthorized delivery of malicious content, directly from the attacker's infrastructure, which can then be used to deliver malicious content. In such a scenario, users' trust is not only compromised, but it also highlights how vulnerable application-level security measures can be if authorization mechanisms are not properly enforced. 

There is an added level of seriousness to this discovery, since the exploit appears to have been a zero-click attack. In contrast to conventional attacks that require the user to open a file or click on a link, zero-click exploits do not require the user to interact with them whatsoever, which significantly reduces the chances of detection. 

As a result of silent compromises, attackers are able to install spyware or malicious code swiftly, discreetly, and with little or no trace until the damage has been done. WhatsApp's internal security team believes that the CVE-2025-55177 vulnerability was not an isolated occurrence. Rather than being isolated from the other vulnerability within Apple's ecosystem, it is thought to have been chained together with a separate vulnerability within the Apple ecosystem – CVE-2025-43300 – to allow sophisticated, targeted attacks.

In the Apple case, a CVSS score of 8.8 was assigned to the ImageIO framework that was characterized by an out-of-bounds write condition. When these vulnerabilities occur during the processing of images, they can corrupt memory, giving way to deeper system-level vulnerabilities. An exploit chaining strategy, whereby an application-level bug is paired up with an operating system vulnerability in order to maximize the scope and stealth of a campaign, is an increasingly popular strategy among advanced adversaries as a means of maximizing the scope and stealth of their operations. 

On August 20, Apple updated its entire product line in order to address CVE-2025-43300, issuing patches for iOS 18.6.2, iPadOS 18.6.2, and 17.7.10, Mac OS Sequoia 15.6.1, Mac OS Sonoma 14.7.2, and Mac OS Ventura 13.7.1. It was noted in the advisory that while the company had refrained from providing detailed technical details, they had been aware of reports that the flaw had already been exploited against specific individuals by users in the wild.

In line with the tactics used by state-sponsored groups and well-funded spyware vendors, these attacks were highly targeted and not indiscriminate, as they suggest that these attacks were highly targeted and not indiscriminate. In addition to mitigating the threat quickly, WhatsApp has also quickly rolled out patches that fix CVE-2025-55177 on all its platforms, rolling it out in late July and early August 2025. As with Apple, WhatsApp's version of iOS 2.2.21.73, WhatsApp Business, and WhatsApp for Mac all came with the patches. 

However, as Apple did, WhatsApp did not provide details of the observed attacks, and provided limited commentary on the nature or scale of the exploitation. The reticence that occurs when a zero-day exploitation is being actively exploited is not unusual, as revealing too much could help threat actors improve their techniques inadvertently. 

While the extent of the campaign is still unknown, the operational sophistication implied by these exploits suggests that an adversary with adequate resources has been engaged in this operation. This is because of the fact that zero-click vectors are being used as well as the seamless chaining of vulnerabilities across both application and operating system layers, which illustrates how complex cyber threats are becoming. 

In the broader context of these incidents, it is important to recognize that attackers are increasingly using multi-layered exploit chains to get around user defenses, get past traditional detection methods, and implant spyware in a highly precise manner. Taking a broader perspective of the WhatsApp and Apple vulnerabilities, it is important to note that today's interconnected digital environment creates a precarious balance between convenience and security. 

With the rapid expansion of messaging platforms, the attack surface is inevitably bound to increase, allowing adversaries to find weaknesses more easily. According to recent disclosures, it is imperative that timely patches, rigorous vulnerability management, and ongoing collaboration between vendors be implemented so that coordinated, high-level exploitation campaigns are limited in impact. 

In order to defend against zero-click exploit campaigns that leverage zero-click exploits, security specialists advise that a routine patch application does not suffice. There is a growing need for organizations to adopt a layered defense strategy that integrates technical safeguards with operational discipline in order to reduce exposure. 

Among the steps to take is updating WhatsApp and other messaging platforms to the most recent patched versions, enforcing mobile device management (MDM) baselines, and implementing solutions for detection and response of mobile endpoints (EDR) that can be used to detect as well as analyse the data. To further enhance resilience, system logs can be monitored for unusual activity, command-and-control traffic can be blocked at the network level, and threat intelligence data can be utilized. 

To eliminate possible persistence mechanisms, factory resets should be recommended when a compromise is suspected. Likewise, it is crucial to build user awareness by providing training on spyware risks and incident reporting, in addition to reviewing incident response playbooks to ensure they address zero-day and zero-click exploitation scenarios. In addition to these practices, organizations should adopt strict communication security policies, and conduct regular third-party risk assessments in order to strengthen their defense against stealthy spyware operations and reduce the impact of sophisticated intrusion attempts on their systems. 

There has been a sharp reminder resulting from the revelations surrounding WhatsApp and Apple vulnerabilities that no platform, no matter how popular or secure it appears to be, is immune to exploitation. In this day and age, zero-click spyware is becoming increasingly sophisticated, which underscores the necessity to treat mobile device security as a strategic priority rather than something people take for granted. 

The best way to do this for individuals would be to develop the habit of downloading and installing software updates as soon as they become available, to exercise caution when unusual behavior occurs on their mobile devices, and to consider the use of trusted mobile security tools. 

Organizations need to shift from compliance checklists and develop a culture of proactive resilience rather than relying on compliance checklists. This means investing in multiple defenses, continuous monitoring, and cross-team collaboration between the IT, security, and legal departments in order to better detect and contain incidents.

It is imperative that technology vendors, independent researchers, and civil society organisations collaboratively work together in order to hold spyware operators accountable for their actions and ensure that users retain trust in their digital communications in the future. 

In spite of vulnerabilities continuing to be found in the digital ecosystem, a combination of rapid response, transparency, and a security-first mindset can turn such incidents into opportunities for stronger defenses and more resilient digital ecosystems by eliminating vulnerabilities as quickly as possible.
Read more »
VPN
Agent AI AI Anthropic Anthropic Report Artificial Intelligence Cryptocurrency Crime Cybersecurity Threats FBI IT North Korea Cybercrime Ransomware Technology Vibe Hacking VPN

Misuse of AI Agents Sparks Alarm Over Vibe Hacking


 

Once considered a means of safeguarding digital battlefields, artificial intelligence has now become a double-edged sword —a tool that can not only arm defenders but also the adversaries it was supposed to deter, giving them both a tactical advantage in the digital fight. According to Anthropic's latest Threat Intelligence Report for August 2025, shown below, this evolving reality has been painted in a starkly harsh light. 

It illustrates how cybercriminals are developing AI as a product of choice, no longer using it to support their attacks, but instead executing them as a central instrument of attack orchestration. As a matter of fact, according to the report, malicious actors are now using advanced artificial intelligence in order to automate phishing campaigns on a large scale, circumvent traditional security measures, and obtain sensitive information very efficiently, with very little human oversight needed. As a result of AI's precision and scalability, the threat landscape is escalating in troubling ways. 

By leveraging AI's accuracy and scalability, modern cyberattacks are being accelerated, reaching, and sophistication. A disturbing evolution of cybercrime is being documented by Anthropologic, as it turns out that artificial intelligence is no longer just used to assist with small tasks such as composing phishing emails or generating malicious code fragments, but is also serving as a force multiplier for lone actors, giving them the capacity to carry out operations at scale and with precision that was once reserved for organized criminal syndicates to accomplish. 

Investigators have been able to track down a sweeping extortion campaign back to a single perpetrator in one particular instance. This perpetrator used Claude Code's execution environment as a means of automating key stages of intrusion, such as reconnaissance, credential theft, and network penetration, to carry out the operation. The individual compromised at least 17 organisations, ranging from government agencies to hospitals to financial institutions, and he has made ransom demands that have sometimes exceeded half a million dollars in some instances. 

It was recently revealed that researchers have conceived of a technique called “vibe hacking” in which coding agents can be used not just as tools but as active participants in attacks, marking a profound shift in both cybercriminal activity’s speed and reach. It is believed by many researchers that the concept of “vibe hacking” has emerged as a major evolution in cyberattacks, as instead of exploiting conventional network vulnerabilities, it focuses on the logic and decision-making processes of artificial intelligence systems. 

In the year 2025, Andrej Karpathy started a research initiative called “vibe coding” - an experiment in artificial intelligence-generated problem-solving. Since then, the concept has been co-opted by cybercriminals to manipulate advanced language models and chatbots for unauthorised access, disruption of operations, or the generation of malicious outputs, originating from a research initiative. 

By using AI, as opposed to traditional hacking, in which technical defences are breached, this method exploits the trust and reasoning capabilities of machine learning itself, making detection especially challenging. Furthermore, the tactic is reshaping social engineering as well: attackers can create convincing phishing emails, mimic human speech, build fraudulent websites, create clones of voices, and automate whole scam campaigns at an unprecedented level using large language models that simulate human conversations with uncanny realism. 

With tools such as artificial intelligence-driven vulnerability scanners and deepfake platforms, the threat is amplified even further, creating a new frontier of automated deception, according to experts. In one notable variant of scamming, known as “vibe scamming,” adversaries can launch large-scale fraud operations in which they generate fake portals, manage stolen credentials, and coordinate follow-up communications all from a single dashboard, which is known as "vibe scamming." 

Vibe hacking is one of the most challenging cybersecurity tasks people face right now because it is a combination of automation, realism, and speed. The attackers are not relying on conventional ransomware tactics anymore; they are instead using artificial intelligence systems like Claude to carry out all aspects of an intrusion, from reconnaissance and credential harvesting to network penetration and data extraction.

A significant difference from earlier AI-assisted attacks was that Claude demonstrated "on-keyboard" capability as well, performing tasks such as scanning VPN endpoints, generating custom malware, and analysing stolen datasets to prioritise the victims with the highest payout potential. As soon as the system was installed, it created tailored ransom notes in HTML, containing the specific financial requirements, workforce statistics, and regulatory threats of each organisation, all based on the data that had been collected. 

The amount of payments requested ranged from $75,000 to $500,000 in Bitcoin, which illustrates that with the assistance of artificial intelligence, one individual could control the entire cybercrime network. Additionally, the report emphasises how artificial intelligence and cryptocurrency have increasingly become intertwined. For example, ransom notes include wallet addresses in ransom notes, and dark web forums are exclusively selling AI-generated malware kits in cryptocurrency. 

An investigation by the FBI has revealed that North Korea is increasingly using artificial intelligence (AI) to evade sanctions, which is used to secure fraudulent positions at Western tech companies by state-backed IT operatives who use it for the fabrication of summaries, passing interviews, debugging software, and managing day-to-day tasks. 

According to officials in the United States, these operations channel hundreds of millions of dollars every year into Pyongyang's technical weapon program, replacing years of training with on-demand artificial intelligence assistance. This reveals a troubling shift: artificial intelligence is not only enabling cybercrime but is also amplifying its speed, scale, and global reach, as evidenced by these revelations. A report published by Anthropological documents how Claude Code has been used not just for breaching systems, but for monetising stolen information at large scales as well. 

As a result of using the software, thousands of records containing sensitive identifiers, financial information, and even medical information were sifted through, and then customised ransom notes and multilayered extortion strategies were generated based on the victim's characteristics. As the company pointed out, so-called "agent AI" tools now provide attackers with both technical expertise and hands-on operational support, which effectively eliminates the need to coordinate teams of human operators, which is an important factor in preventing cyberattackers from taking advantage of these tools. 

Researchers warn that these systems can be dynamically adapted to defensive countermeasures, such as malware detection, in real time, thus making traditional enforcement efforts increasingly difficult. There are a number of cases to illustrate the breadth of abuse that occurs in the workplace, and there is a classifier developed by Anthropic to identify the behaviour. However, a series of case studies indicates this behaviour occurs in a multitude of ways. 

In the North Korean case, Claude was used to fabricate summaries and support fraudulent IT worker schemes. In the U.K., a criminal known as GTG-5004 was selling ransomware variants based on artificial intelligence on darknet forums; Chinese actors utilised artificial intelligence to compromise Vietnamese critical infrastructure; and Russian and Spanish-speaking groups were using the software to create malicious software and steal credit card information. 

In order to facilitate sophisticated fraud campaigns, even low-skilled actors have begun integrating AI into Telegram bots around romance scams as well as false identity services, significantly expanding the number of fraud campaigns available. A new report by Anthropic researchers Alex Moix, Ken Lebedev, and Jacob Klein argues that artificial intelligence, based on the results of their research, is continually lowering the barriers to entry for cybercriminals, enabling fraudsters to create profiles of victims, automate identity theft, and orchestrate operations at a speed and scale that is unimaginable with traditional methods. 

It is a disturbing truth that is highlighted in Anthropic’s report: although artificial intelligence was once hailed as a shield for defenders, it is now increasingly being used as a weapon, putting digital security at risk. Nevertheless, people must not retreat from AI adoption, but instead develop defensive strategies in parallel that are geared toward keeping up with AI adoption. Proactive guardrails must be set up in order to prevent artificial intelligence from being misused, including stricter oversight and transparency by developers, as well as continuous monitoring and real-time detection systems to recognise abnormal AI behaviour before it escalates into a serious problem. 

A company's resilience should go beyond its technical defences, and that means investing in employee training, incident response readiness, and partnerships that enable data sharing across sectors. In addition to this, governments are also under mounting pressure to update their regulatory frameworks in order to keep pace with the evolution of threat actors in terms of policy.

By harnessing artificial intelligence responsibly, people can still make it a powerful ally—automating defensive operations, detecting anomalies, and even predicting threats before they are even visible. In order to ensure that it continues in a manner that favours protection over exploitation, protecting not just individual enterprises, but the overall trust people have in the future of the digital world. 

A significant difference from earlier AI-assisted attacks was that Claude demonstrated "on-keyboard" capability as well, performing tasks such as scanning VPN endpoints, generating custom malware, and analysing stolen datasets in order to prioritise the victims with the highest payout potential. As soon as the system was installed, it created tailored ransom notes in HTML, containing the specific financial requirements, workforce statistics, and regulatory threats of each organisation, all based on the data that had been collected. 

The amount of payments requested ranged from $75,000 to $500,000 in Bitcoin, which illustrates that with the assistance of artificial intelligence, one individual could control the entire cybercrime network. Additionally, the report emphasises how artificial intelligence and cryptocurrency have increasingly become intertwined. 

For example, ransom notes include wallet addresses in ransom notes, and dark web forums are exclusively selling AI-generated malware kits in cryptocurrency. An investigation by the FBI has revealed that North Korea is increasingly using artificial intelligence (AI) to evade sanctions, which is used to secure fraudulent positions at Western tech companies by state-backed IT operatives who use it for the fabrication of summaries, passing interviews, debugging software, and managing day-to-day tasks. 

According to U.S. officials, these operations funnel hundreds of millions of dollars a year into Pyongyang's technical weapons development program, replacing years of training with on-demand AI assistance. All in all, these revelations indicate an alarming trend: artificial intelligence is not simply enabling cybercrime, but amplifying its scale, speed, and global reach. 

According to the report by Anthropic, Claude Code has been weaponised not only to breach systems, but also to monetise stolen data. This particular tool has been used in several instances to sort through thousands of documents containing sensitive information, including identifying information, financial details, and even medical records, before generating customised ransom notes and layering extortion strategies based on each victim's profile. 

The company explained that so-called “agent AI” tools are now providing attackers with both technical expertise and hands-on operational support, effectively eliminating the need for coordinated teams of human operators to perform the same functions. Despite the warnings of researchers, these systems are capable of dynamically adapting to defensive countermeasures like malware detection in real time, making traditional enforcement efforts increasingly difficult, they warned. 

Using a classifier built by Anthropic to identify this type of behaviour, the company has shared technical indicators with trusted partners in an attempt to combat the threat. The breadth of abuse is still evident through a series of case studies: North Korean operatives use Claude to create false summaries and maintain fraud schemes involving IT workers; a UK-based criminal with the name GTG-5004 is selling AI-based ransomware variants on darknet forums. 

Some Chinese actors use artificial intelligence to penetrate Vietnamese critical infrastructure, while Russians and Spanish-speaking groups use Claude to create malware and commit credit card fraud. The use of artificial intelligence in Telegram bots marketed for romance scams or synthetic identity services has even reached the level of low-skilled actors, allowing sophisticated fraud campaigns to become more accessible to the masses. 

A new report by Anthropic researchers Alex Moix, Ken Lebedev, and Jacob Klein argues that artificial intelligence, based on the results of their research, is continually lowering the barriers to entry for cybercriminals, enabling fraudsters to create profiles of victims, automate identity theft, and orchestrate operations at a speed and scale that is unimaginable with traditional methods. In the report published by Anthropic, it appears to be revealed that artificial intelligence is increasingly being used as a weapon to challenge the foundations of digital security, despite being once seen as a shield for defenders. 

There is a solution to this, but it is not in retreating from AI adoption, but by accelerating the parallel development of defensive strategies that are at the same pace as AI adoption. According to experts, proactive guardrails are necessary to ensure that AI deployments are monitored, developers are held more accountable, and there is continuous monitoring and real-time detection systems available that can be used to identify abnormal AI behaviour before it becomes a serious problemOrganisationss must not only focus on technical defences; they must also invest in employee training, incident response readiness, and partnerships that facilitate intelligence sharing between sectors as well.

Governments are also under increasing pressure to update regulatory frameworks to keep pace with the evolving threat actors, in order to ensure that policy is updated at the same pace as they evolve. By harnessing artificial intelligence responsibly, people can still make it a powerful ally—automating defensive operations, detecting anomalies, and even predicting threats before they are even visible. In order to ensure that it continues in a manner that favours protection over exploitation, protecting not just individual enterprises, but the overall trust people have in the future of the digital world.
Read more »
Ransomwares
acronis AI cyberattacks AI technology Cyber Defenses Cyber Security Cybersecurity Threats Indian Cyber Security Malwares Phishing Attacks Ransomwares

India Most Targeted by Malware as AI Drives Surge in Ransomware and Phishing Attacks

 

India has become the world’s most-targeted nation for malware, according to the latest report by cybersecurity firm Acronis, which highlights how artificial intelligence is fueling a sharp increase in ransomware and phishing activity. The findings come from the company’s biannual threat landscape analysis, compiled by the Acronis Threat Research Unit (TRU) and its global network of sensors tracking over one million Windows endpoints between January and June 2025. 

The report indicates that India accounted for 12.4 percent of all monitored attacks, placing it ahead of every other nation. Analysts attribute this trend to the rising sophistication of AI-powered cyberattacks, particularly phishing campaigns and impersonation attempts that are increasingly difficult to detect. With Windows systems still dominating business environments compared to macOS or Linux, the operating system remained the primary target for threat actors. 

Ransomware continues to be the most damaging threat to medium and large businesses worldwide, with newer criminal groups adopting AI to automate attacks and enhance efficiency. Phishing was found to be a leading driver of compromise, making up 25 percent of all detected threats and over 52 percent of those aimed at managed service providers, marking a 22 percent increase compared to the first half of 2024. 

Commenting on the findings, Rajesh Chhabra, General Manager for India and South Asia at Acronis, noted that India’s rapidly expanding digital economy has widened its attack surface significantly. He emphasized that as attackers leverage AI to scale operations, Indian enterprises—especially those in manufacturing and infrastructure—must prioritize AI-ready cybersecurity frameworks. He further explained that organizations need to move away from reactive security approaches and embrace behavior-driven models that can anticipate and adapt to evolving threats. 

The report also points to collaboration platforms as a growing entry point for attackers. Phishing attempts on services like Microsoft Teams and Slack spiked dramatically, rising from nine percent to 30.5 percent in the first half of 2025. Similarly, advanced email-based threats such as spoofed messages and payload-less attacks increased from nine percent to 24.5 percent, underscoring the urgent requirement for adaptive defenses. 

Acronis recommends that businesses adopt a multi-layered protection strategy to counter these risks. This includes deploying behavior-based threat detection systems, conducting regular audits of third-party applications, enhancing cloud and email security solutions, and reinforcing employee awareness through continuous training on social engineering and phishing tactics. 

The findings make clear that India’s digital growth is running parallel to escalating cyber risks. As artificial intelligence accelerates the capabilities of malicious actors, enterprises will need to proactively invest in advanced defenses to safeguard critical systems and sensitive data.
Read more »
Ransomwares
Akira Ransomware Business Security Cyber Attacks Cyber Vulnerabilities Cybersecurity Threats Public Wifi ransomware attacks Ransomwares

SonicWall VPN Zero-Day Vulnerability Suspected Amid Rising Ransomware Attacks

 

Virtual Private Networks (VPNs) have recently been in the spotlight due to the U.K.’s Online Safety Act, which requires age verification for adult content websites. While many consumers know VPNs as tools for bypassing geo-restrictions or securing public Wi-Fi connections, enterprise-grade VPN appliances play a critical role in business security. 

When researchers issue warnings about possible VPN exploitation, the risk cannot be dismissed. SonicWall has addressed growing concerns after reports surfaced of ransomware groups targeting its devices. According to the company, an investigation revealed that the activity is linked to CVE-2024-40766, a previously disclosed vulnerability documented in their advisory SNWLID-2024-0015, rather than an entirely new zero-day flaw. Fewer than 40 confirmed cases were reported, mostly tied to legacy credentials from firewall migrations. 

Updated guidance includes credential changes and upgrading to SonicOS 7.3.0 with enhanced multi-factor authentication (MFA) protections. Despite these reassurances, Arctic Wolf Labs researcher Julian Tuin observed a noticeable increase in ransomware activity against SonicWall firewall devices in late July. 

Several incidents involved VPN access through SonicWall SSL VPNs. While some intrusions could be explained by brute force or credential stuffing, evidence suggests the possibility of a zero-day vulnerability, as some compromised devices had the latest patches and rotated credentials. 

In several cases, even with TOTP MFA enabled, accounts were breached. SonicWall confirmed it is working closely with threat research teams, including Arctic Wolf, Google Mandiant, and Huntress, to determine whether the incidents are tied to known flaws or a new vulnerability. If a zero-day is confirmed, updated firmware and mitigation steps will be released promptly. 

The urgency is amplified by the involvement of the Akira ransomware group, which has compromised over 300 organizations globally. SonicWall also recently warned of CVE-2025-40599, a serious remote code execution vulnerability in SMA 100 appliances. Experts advise organizations to take immediate precautionary steps, especially given the potential for severe operational disruption. 

Recommended mitigations include disabling SSL VPN services where possible, restricting VPN access to trusted IP addresses, enabling all security services such as botnet protection and geo-IP filtering, removing inactive accounts, enforcing strong password policies, and implementing MFA for all remote access. 

However, MFA alone may not be sufficient in the current threat scenario. The combination of suspected zero-day activity, ransomware escalation, and the targeting of critical remote access infrastructure means that proactive defense measures are essential. 

SonicWall and security researchers continue to monitor the situation closely, urging organizations to act quickly to protect their networks before attackers exploit potential vulnerabilities further.
Read more »
phishing risks
AI Artificial Intelligence Cybersecurity Threats Data Breach gambling accounts online betting platforms phishing risks

AI-Driven Phishing Threats Loom After Massive Data Breach at Major Betting Platforms

 

A significant data breach impacting as many as 800,000 users from two leading online betting platforms has heightened fears over sophisticated phishing risks and the growing role of artificial intelligence in exploiting compromised personal data.

The breach, confirmed by Flutter Entertainment, the parent company behind Paddy Power and Betfair, exposed users’ IP addresses, email addresses, and activity linked to their gambling profiles.

While no payment or password information was leaked, cybersecurity experts warn that the stolen details could still enable highly targeted attacks. Flutter, which also owns brands like Sky Bet and Tombola, referred to the event as a “data incident” that has been contained. The company informed affected customers that there is, “nothing you need to do in response to this incident,” but still advised them to stay alert.

With an average of 4.2 million monthly users across the UK and Ireland, even partial exposure poses a serious risk.

Harley Morlet, chief marketing officer at Storm Guidance, emphasized: “With the advent of AI, I think it would actually be very easy to build out a large-scale automated attack. Basically, focusing on crafting messages that look appealing to those gamblers.”

Similarly, Tim Rawlins, director and senior adviser at the NCC Group, urged users to remain cautious: “You might re-enter your credit card number, you might re-enter your bank account details, those are the sort of things people need to be on the lookout for and be conscious of that sort of threat. If it's too good to be true, it probably is a fraudster who's coming after your money.”

Rawlins also noted that AI technology is making phishing emails increasingly convincing, particularly in spear-phishing campaigns where stolen data is leveraged to mimic genuine communications.

Experts caution that relying solely on free antivirus tools or standard Android antivirus apps offers limited protection. While these can block known malware, they are less effective against deceptive emails that trick users into voluntarily revealing sensitive information.

A stronger defense involves practicing layered security—maintaining skepticism, exercising caution, and following strict cyber hygiene habits to minimize exposure
Read more »
Veeam vulnerability
Cybersecurity Threats Fog Ransomware GC2 backdoor malware SonicWall VPN exploit Syteca software unusual ransomware tools Veeam vulnerability

Fog Ransomware Attackers Use Unusual Mix of Legitimate Software and Open-Source Hacking Tools

 

The Fog ransomware group is leveraging a distinctive and rarely seen combination of tools, including legitimate employee monitoring software Syteca and open-source penetration testing utilities, to carry out targeted attacks.

This threat group first emerged in May last year, breaching networks by using compromised VPN credentials. Once inside, they executed “pass-the-hash” attacks to escalate privileges, disabled Windows Defender, and encrypted systems — including virtual machine files. Subsequently, they exploited known vulnerabilities in Veeam Backup & Replication (VBR) and SonicWall SSL VPN endpoints to expand their reach.

Discovery of a New Toolset

Researchers from Symantec and Carbon Black’s Threat Hunter team recently uncovered an unconventional collection of tools during an incident response investigation involving a financial institution in Asia. Although the exact method of initial access remains undetermined, the attackers used several utilities rarely observed in ransomware operations.

One notable inclusion is Syteca (formerly Ekran), a legitimate tool designed to monitor employee activity through screen recording and keystroke logging. Attackers could have used this to stealthily collect sensitive data such as login credentials.

Syteca was delivered covertly using Stowaway, an open-source proxy for stealth communication and file movement, and was executed through SMBExec, a lateral movement tool from the Impacket framework.

Another rare component used was GC2, an open-source backdoor that communicates via Google Sheets or Microsoft SharePoint, providing both command-and-control (C2) and data exfiltration capabilities. While GC2 has previously been linked to the Chinese state-sponsored APT41 group, it’s seldom found in ransomware operations.

In addition to these, Symantec identified several other tools in Fog’s arsenal:

  • Adapt2x C2 – an open-source alternative to Cobalt Strike
  • Process Watchdog – utility for maintaining system process stability
  • PsExec – Microsoft’s tool for executing processes remotely
  • Impacket SMB – Python library for direct SMB access, likely used to deploy ransomware

To facilitate data exfiltration, Fog attackers also employed 7-Zip, MegaSync, and FreeFileSync.

“The toolset deployed by the attackers is quite atypical for a ransomware attack,” comments Symantec in the report.

“The Syteca client and GC2 tool are not tools we have seen deployed in ransomware attacks before, while the Stowaway proxy tool and Adap2x C2 Agent Beacon are also unusual tools to see being used in a ransomware attack,” the researchers say.

The report underscores how the Fog ransomware group’s choice of obscure and legitimate software can help evade traditional detection mechanisms. Symantec’s analysis includes indicators of compromise (IOCs) to help organizations defend against such sophisticated threats.
Read more »
Ransomwares
agentic AI AI Agent AI technology AI threats AI tools Cyber Security Cybersecurity Threats IABs Malicious Code Ransomwares

Agentic AI and Ransomware: How Autonomous Agents Are Reshaping Cybersecurity Threats

 

A new generation of artificial intelligence—known as agentic AI—is emerging, and it promises to fundamentally change how technology is used. Unlike generative AI, which mainly responds to prompts, agentic AI operates independently, solving complex problems and making decisions without direct human input. While this leap in autonomy brings major benefits for businesses, it also introduces serious risks, especially in the realm of cybersecurity. Security experts warn that agentic AI could significantly enhance the capabilities of ransomware groups. 

These autonomous agents can analyze, plan, and execute tasks on their own, making them ideal tools for attackers seeking to automate and scale their operations. As agentic AI evolves, it is poised to alter the cyber threat landscape, potentially enabling more efficient and harder-to-detect ransomware attacks. In contrast to the early concerns raised in 2022 with the launch of tools like ChatGPT, which mainly helped attackers draft phishing emails or debug malicious code, agentic AI can operate in real time and adapt to complex environments. This allows cybercriminals to offload traditionally manual processes like lateral movement, system enumeration, and target prioritization. 

Currently, ransomware operators often rely on Initial Access Brokers (IABs) to breach networks, then spend time manually navigating internal systems to deploy malware. This process is labor-intensive and prone to error, often leading to incomplete or failed attacks. Agentic AI, however, removes many of these limitations. It can independently identify valuable targets, choose the most effective attack vectors, and adjust to obstacles—all without human direction. These agents may also dramatically reduce the time required to carry out a successful ransomware campaign, compressing what once took weeks into mere minutes. 

In practice, agentic AI can discover weak points in a network, bypass defenses, deploy malware, and erase evidence of the intrusion—all in a single automated workflow. However, just as agentic AI poses a new challenge for cybersecurity, it also offers potential defensive benefits. Security teams could deploy autonomous AI agents to monitor networks, detect anomalies, or even create decoy systems that mislead attackers. 

While agentic AI is not yet widely deployed by threat actors, its rapid development signals an urgent need for organizations to prepare. To stay ahead, companies should begin exploring how agentic AI can be integrated into their defense strategies. Being proactive now could mean the difference between falling behind or successfully countering the next wave of ransomware threats.
Read more »
ransomware attacks
Cybersecurity Threats Document converter malware Fake file converters malware Online Scams ransomware attacks

FBI Warns Against Fake Online Document Converters Spreading Malware

 

iThe FBI Denver field office has issued a warning about cybercriminals using fake online document converters to steal sensitive data and deploy ransomware on victims' devices. Reports of these scams have been increasing, prompting authorities to urge users to be cautious and report incidents.

"The FBI Denver Field Office is warning that agents are increasingly seeing a scam involving free online document converter tools, and we want to encourage victims to report instances of this scam," the agency stated.

Cybercriminals create fraudulent websites that offer free document conversion, file merging, or media download services. While these sites may function as expected, they secretly inject malware into downloaded files, enabling hackers to gain remote access to infected devices.

"To conduct this scheme, cybercriminals across the globe are using any type of free document converter or downloader tool," the FBI added.

These sites may claim to:
  • Convert .DOC to .PDF or other file formats.
  • Merge multiple .JPG files into a single .PDF.
  • Offer MP3 or MP4 downloads.
Once users upload their files, hackers can extract sensitive information, including:
  • Names and Social Security Numbers
  • Cryptocurrency wallet addresses and passphrases
  • Banking credentials and passwords
  • Email addresses
Scammers also use phishing tactics, such as mimicking legitimate URLs by making slight alterations (e.g., changing one letter or replacing "CO" with "INC") to appear trustworthy.

“Users who in the past would type ‘free online file converter’ into a search engine are vulnerable, as the algorithms used for results now often include paid results, which might be scams,” said Vikki Migoya, Public Affairs Officer for FBI Denver.

Cybersecurity experts have confirmed that these fraudulent websites are linked to malware campaigns. Researcher Will Thomas recently identified fake converter sites, such as docu-flex[.]com, distributing malicious executables like Pdfixers.exe and DocuFlex.exe, both flagged as malware.

Additionally, a Google ad campaign in November was found promoting fake converters that installed Gootloader malware, a malware loader known for:

  1. Stealing banking credentials
  2. Installing trojans and infostealers
  3. Deploying Cobalt Strike beacons for ransomware attacks

"Visiting this WordPress site (surprise!), I found a form for uploading a PDF to convert it to a .DOCX file inside a .zip," explained a cybersecurity researcher.

Instead of receiving a legitimate document, users were given a JavaScript file that delivered Gootloader, which is often used in ransomware attacks by groups like REvil and BlackSuit.

In order to stay safe,
  • Avoid unknown document conversion sites. Stick to well-known, reputable services.
  • Verify file types before opening. If a downloaded file is an .exe or .JS instead of the expected document format, it is likely malware.
  • Check reviews before using any online converter. If a site has no reviews or looks suspicious, steer clear
  • Report suspicious sites to authorities. Victi
  • ms can file reports at IC3.gov.
  • While not all file converters are malicious, thorough research and caution are crucial to staying safe online.
Read more »
Zero-Day Vulnerabilities
(RCE) Cybersecurity Threats Remote Code Execution Telegram security Vulnerabilities and Exploits Zero-Day Vulnerabilities

Operation Zero Offers Up to $4M for Telegram Exploits

 

Operation Zero, a firm specializing in acquiring and selling zero-day vulnerabilities exclusively to Russian government entities and local companies, has announced a significant bounty for exploits targeting Telegram. The company is willing to pay up to $4 million for a full-chain exploit that could compromise the popular messaging app.

The exploit broker has set tiered rewards for different vulnerabilities:
  • Up to $500,000 for a one-click remote code execution (RCE) exploit.
  • Up to $1.5 million for a zero-click RCE exploit.
  • Up to $4 million for a full-chain exploit, potentially allowing hackers to gain full access to a target’s device.
Operation Zero’s focus on Telegram is strategic, given its widespread use in Russia and Ukraine. The company's offer provides insight into the Russian zero-day market, which remains largely secretive.

Exploit brokers often publicize bounties for vulnerabilities when they detect high demand. This suggests that the Russian government may have specifically requested Telegram exploits, prompting Operation Zero to advertise these high-value offers.

Zero-day vulnerabilities are particularly valuable because they remain unknown to software makers, making them highly effective for cyber operations. Among them, zero-click RCE exploits are the most sought after, as they require no user interaction—unlike phishing-based attacks—making them stealthier and more powerful.

A source familiar with the exploit market suggested that Operation Zero’s prices might be on the lower side, as the company could intend to resell these vulnerabilities multiple times at a higher margin.

“I don’t think they’ll actually pay full [price]. There will be some bar the exploit doesn’t clear, and they’ll only do a partial payment,” said the source.

Another industry expert noted that pricing depends on factors like exclusivity and whether Operation Zero intends to redevelop the exploits internally or act solely as a broker.

The Ukrainian government recently banned the use of Telegram for government and military personnel due to concerns over potential exploitation by Russian state-backed hackers. Security researchers have long warned that Telegram is less secure than alternatives like Signal and WhatsApp, primarily because it does not use end-to-end encryption by default.

“The vast majority of one-on-one Telegram conversations — and literally every single group chat — are probably visible on Telegram’s servers,” said cryptography expert Matthew Green.

Despite this, Telegram spokesperson Remi Vaughn stated: “Telegram has never been vulnerable to a zero-click exploit,” while also emphasizing the company’s bug bounty program.

The zero-day market has become increasingly competitive, driving up prices. In 2023, a WhatsApp zero-day was reportedly valued at $8 million. Operation Zero has previously offered $20 million for exploits capable of fully compromising iOS and Android devices but currently caps those payouts at $2.5 million.

With cyber threats escalating, the demand for zero-days—especially for widely used platforms like Telegram—remains at an all-time high.
Read more »
Jira server breach
Ascom cyberattack Cyber Attacks Cybersecurity Threats HellCat hackers Jira server breach

Ascom Confirms Cyberattack as HellCat Hackers Exploit Jira Servers

 

Swiss telecommunications company Ascom has disclosed a cyberattack on its IT infrastructure, confirming that the hacker group HellCat exploited compromised credentials to target Jira servers worldwide.

In an official statement, Ascom revealed that its technical ticketing system was breached on Sunday. The company has since launched an investigation to assess the impact of the attack.

With a presence in 18 countries, Ascom specializes in wireless on-site communication solutions. The HellCat hacking group has taken responsibility for the breach and informed BleepingComputer that it has stolen approximately 44GB of data, potentially affecting all divisions of the company.

Ascom assured that despite the intrusion into its technical ticketing system, the attack has not disrupted business operations. The company emphasized that its customers and partners do not need to take any precautionary measures.

“Investigations against such criminal offenses were initiated immediately and are ongoing. Ascom is working closely with the relevant authorities.” – Ascom

Rey, a representative of the HellCat hacking group, claimed that the stolen data includes source codes for multiple products, project details, invoices, confidential documents, and issue logs from Ascom’s ticketing system.

While Ascom has not shared technical specifics about the breach, HellCat has a track record of exploiting Jira ticketing systems, which are commonly used by software development and IT teams. These platforms often store critical data such as source code, authentication keys, IT roadmaps, customer information, and internal project discussions.

HellCat’s Widespread Jira Exploits

HellCat has previously been linked to cyberattacks on major corporations, including Schneider Electric, Telefónica, and Orange Group, all of which suffered breaches through their Jira servers.

Recently, the group also claimed responsibility for hacking British automaker Jaguar Land Rover (JLR), leaking around 700 internal documents. According to the hackers, the stolen data includes development logs, tracking information, source codes, and sensitive employee records.

“At the heart of this latest incident lies a technique that has become HELLCAT’s signature: exploiting Jira credentials harvested from compromised employees that were infected by Infostealers.” – Alon Gal, Co-founder and CTO, Hudson Rock

Gal noted that the JLR breach occurred through credentials belonging to an LG Electronics employee with third-party access to JLR’s Jira server. He further pointed out that these compromised credentials had been exposed for years but remained valid, enabling the hackers to infiltrate the system.

HellCat’s cyber activity has continued, with the group announcing another breach—this time targeting Affinitiv, a marketing and data analytics company serving OEMs and dealerships in the automotive sector. The hackers claim to have accessed Affinitiv’s Jira system, stealing a database containing over 470,000 unique email addresses and more than 780,000 records.

Affinitiv has acknowledged the reported attack and confirmed that an investigation is underway.

To validate their claims, the hackers have published screenshots revealing names, email addresses, postal addresses, and dealership details.

Cybersecurity experts warn that Jira has become a prime target for attackers due to its role in enterprise workflows and the vast amount of sensitive data it contains. Gaining unauthorized access can allow threat actors to move laterally, escalate privileges, and exfiltrate critical information.

Given the ease of acquiring credentials compromised by infostealers and the fact that many remain unchanged for extended periods, experts caution that such attacks may become increasingly common.


Read more »
ransomware evolution
Albabat ransomware Cross-platform malware Cybersecurity Threats GitHub ransomware malware ransomware evolution

Albabat Ransomware Evolves with Cross-Platform Capabilities and Enhanced Attack Efficiency

 

Cybersecurity researchers at Trend Micro have uncovered new variants of the Albabat ransomware, designed to target multiple operating systems and optimize attack execution.

Albabat ransomware 2.0 now extends beyond Microsoft Windows, incorporating mechanisms to collect system data and streamline operations. This version leverages a GitHub account to store and distribute its configuration files.

Trend Micro researchers identified ongoing development efforts for another iteration, version 2.5, which has not yet been deployed in live attacks.

"This use of GitHub is designed to streamline operations," researchers stated, emphasizing the evolving nature of ransomware tactics.

Albabat, originally written in Rust, was first detected in November 2023. The programming language facilitates its ability to locate and encrypt files efficiently.

Trend Micro analysts examined the ransomware’s functionality, revealing its selective encryption process. The malware specifically targets files with extensions such as .themepack, .bat, .com, .cmd, and .cpl, while bypassing system folders like Searches, AppData, $RECYCLE.BIN, and System Volume Information.

To evade detection and disrupt security defenses, version 2.0 terminates critical processes, including taskmgr.exe, processhacker.exe, regedit.exe, code.exe, excel.exe, powerpnt.exe, winword.exe, and msaccess.exe.

Further analysis uncovered that Albabat ransomware connects to a PostgreSQL database to log infections and manage ransom payments. This data tracking mechanism assists attackers in making financial demands, monitoring infections, and monetizing stolen information.

Notably, the ransomware’s configuration includes specific commands for Linux and macOS, suggesting that binaries have been developed to expand its reach across platforms.

Trend Micro found that the ransomware utilizes the GitHub repository billdev.github.io to store its configuration files. The account, created on February 27, 2024, is registered under the pseudonym “Bill Borguiann.”

While the repository remains private, an authentication token extracted via Fiddler revealed continued access. A review of commit logs indicates active development, with the most recent modification recorded on February 22, 2025.

A folder labeled “2.5.x” was discovered within the GitHub repository, pointing to an upcoming version of Albabat ransomware. Although no ransomware binaries were detected in this directory, researchers found a config.json file containing newly introduced cryptocurrency wallet addresses for Bitcoin, Ethereum, Solana, and BNB. However, no transactions have been identified in these wallets to date.

"The findings demonstrate the importance of monitoring indicators of compromise (IoCs) for staying ahead of constantly evolving threats like Albabat," Trend Micro researchers advised.

Tracking IoCs enables cybersecurity teams to identify attack patterns and develop proactive defense mechanisms against emerging ransomware threats.
Read more »
State-sponsored hacking
Chinese cyber espionage Cyber Security Cybersecurity Threats Email server vulnerability Government email breach State-sponsored hacking

State-Backed Hackers Escalate Attacks on Government Email Servers

 

Cyberattacks targeting government email servers have intensified in recent years, a trend that experts warn is expected to continue. This concern follows a recent breach involving a cyber-espionage group linked to China, which infiltrated the email servers of Belgium’s intelligence agency.

On February 26, the Belgian federal prosecutor confirmed an investigation into the cyberattack targeting the country’s State Security Service (VSSE). According to a report by Belgian newspaper Le Soir, the attackers accessed approximately 10% of the VSSE’s incoming and outgoing emails between 2021 and May 2023. While classified data remained secure due to external hosting, the breach may have compromised personally identifiable information (PII) of nearly half of the agency’s personnel.

The hackers reportedly gained access to VSSE’s email systems by exploiting a critical remote command injection vulnerability, CVE-2023-2868, found in Barracuda Networks’ Email Security Gateway (ESG) appliance. Following the discovery of this security flaw, Barracuda enlisted Google security subsidiary Mandiant to investigate.

Mandiant tracked the espionage campaign to October 2022, identifying the threat actor as UNC4841. The firm established with "high confidence" that the group was connected to the Chinese government. UNC4841 reportedly distributed emails embedded with malicious attachments designed to exploit CVE-2023-2868, targeting various global organizations, including Belgian VSSE.

In response to the incident, VSSE ceased using Barracuda’s ESG appliance in 2023. Addressing concerns about the timeline of the breach, a Barracuda spokesperson clarified:

“Exploitation of the vulnerability impacting less than five percent of Email Security Gateway appliances took place in 2023 – not 2021. Our investigation data confirms that the vulnerability was not exploited in 2021. Barracuda promptly remediated the issue, which was fixed as part of the BNSF-36456 patch and applied to all customer appliances.”

Email Servers: A Prime Target for Cyber Threats

Email systems remain a preferred target for cybercriminals due to their role in communication, credential storage, and document exchange. High-profile cyber incidents, such as the Hafnium attack in 2020 and multiple government email breaches in 2023, underscore the risks associated with these platforms.

Vito Alfano, head of digital forensic and incident response at Group-IB, emphasized the long-standing threat posed by advanced persistent threats (APTs):

“APTs regularly target publicly exposed services, such as email systems, used by their victims and it has always been a long-standing tactic. Since 2006, nation-state-linked threat actors have targeted mail systems to gain access to confidential information.”

He referenced past attacks, including the APT28 breach of the US Democratic National Committee (DNC) in 2016, highlighting how state-sponsored hackers have historically leveraged email vulnerabilities for intelligence gathering and further infiltration. Alfano further explained the strategic importance of email servers for cyber-espionage campaigns:

“Email servers cover a central role in communication, credential management, document exchange, and they often represent a link between the external world and the internal protected perimeter of a targeted company. For this reason, APT groups consider them a high-value target.”

Once inside an email system, attackers can exploit login credentials to move laterally within an organization’s infrastructure. Additionally, compromised email servers can serve as a launchpad for supply chain attacks, particularly when third-party vendors and contractors use government email services.

Long-Term Infiltration and Espionage

Cyber-espionage groups often aim to maintain access for extended periods, allowing them to monitor assets and execute more sophisticated attacks. Alfano warned:

“Email servers also grant access to highly sensitive information and communications making them perfect for a long-term silent espionage campaign, allowing the access to sensitive mails or to be used to forge crafted phishing and impersonation attacks.”

The attack on Belgian VSSE exemplifies this strategy, with hackers likely seeking to exploit confidential data for further infiltration or intelligence operations.
Read more »
Vidar infostealer
Cybersecurity Threats malware Safety Steam game malware Vidar infostealer

Steam Removes Malware-Infested Game PirateFi

 

Valve recently removed a game from its online platform, Steam, after it was discovered to contain malware. The game, PirateFi, was analyzed by cybersecurity researchers who found that it had been modified to deceive players into installing the Vidar info-stealer.

Marius Genheimer, a researcher from SECUINFRA Falcon Team, told TechCrunch that based on the malware’s command and control servers and configuration, “we suspect that PirateFi was just one of multiple tactics used to distribute Vidar payloads en masse.”

“It is highly likely that it never was a legitimate, running game that was altered after first publication,” Genheimer added.

Investigations revealed that PirateFi was created by modifying an existing game template called Easy Survival RPG. This tool, designed for game development, costs between $399 and $1,099 for licensing. By leveraging this template, hackers were able to distribute a fully functional game embedded with malicious software with minimal effort.

Vidar, the malware found in PirateFi, is an infostealer designed to extract sensitive data from infected computers. According to Genheimer, the malware can steal passwords saved in web browsers, session cookies, browsing history, cryptocurrency wallet credentials, screenshots, two-factor authentication codes, and various other personal files.

Vidar has been linked to multiple cybercriminal campaigns, including attempts to steal Booking.com credentials, deploy ransomware, and insert malicious advertisements into Google search results. The Health Sector Cybersecurity Coordination Center (HC3) reported that since its discovery in 2018, Vidar has become one of the most prolific infostealers in circulation.

Infostealers are commonly distributed through a malware-as-a-service (MaaS) model, making them accessible to even low-skilled hackers. This model complicates efforts to trace the origins of attacks. Genheimer noted that identifying those behind PirateFi is particularly challenging because Vidar “is widely adopted by many cybercriminals.”

Researchers analyzed multiple samples of the malware, including one uploaded to VirusTotal by a Russian gamer and another identified through SteamDB, a database tracking Steam-hosted games. A third sample was found in a threat intelligence repository, and all three exhibited the same malicious functionality. Valve has not issued a response regarding the incident.

The supposed developer of PirateFi, Seaworth Interactive, has no online presence. Until recently, the game had an X (formerly Twitter) account linking to its Steam page, but the account has since been deleted. Attempts to contact the owners via direct messages went unanswered before the account was removed.
Read more »
multifactor authentication password security
Android phishing apps Cybersecurity Threats Malware Detection Mobile Security multifactor authentication password security

Android Phishing Apps: A Growing Cybersecurity Threat in 2024

 

Cybercriminals are evolving their tactics, shifting from traditional email-based phishing scams to more sophisticated Android phishing apps. According to the 2025 State of Malware report by Malwarebytes, over 22,800 phishing apps were detected on Android devices in 2024 alone. Among them, 5,200 apps exploited text messages to bypass multifactor authentication (MFA), while 4,800 leveraged Android’s notification bar to steal sensitive data.

Despite their high-tech capabilities, Android phishing apps operate on a classic phishing principle. These malicious apps disguise themselves as legitimate services like TikTok, Spotify, and WhatsApp. Once installed, they trick users into entering their real credentials on fake login screens controlled by cybercriminals. Stolen credentials are often bundled and sold on the dark web, enabling fraudsters to attempt unauthorized access to banking, email, and other critical accounts.

For years, phishing was primarily an email-based threat. Fraudsters impersonated well-known brands like Netflix, Uber, and Google, urging users to click on fraudulent links that led to counterfeit websites. These sites mimicked official platforms, deceiving users into sharing their login details.

As email providers strengthened spam filters, cybercriminals adapted by developing Android phishing apps. Some of these apps masquerade as mobile games or utilities, luring users into linking social media accounts under false pretenses. Others imitate popular apps and appear on lesser-known app stores, bypassing Google Play’s security protocols.

How Android Phishing Apps Evade Detection

Cybercriminals continue to find ways to avoid detection. Some malicious apps contain no direct code for stealing passwords but instead serve deceptive ads that redirect users to external phishing websites. These seemingly harmless apps have a better chance of being approved on app stores, increasing their reach and effectiveness.

One of the most concerning developments is the ability of these apps to compromise multifactor authentication. Malwarebytes identified thousands of apps capable of intercepting authentication codes via text messages or notification access, undermining one of the strongest security measures available today.

Protecting Against Android Phishing Apps
  1. To safeguard personal and financial information, users should adopt a multi-layered security approach:
  2. Install mobile security software that detects and prevents phishing apps from infiltrating devices.
  3. Check app reviews before downloading; a low number of reviews may indicate a fraudulent app.
  4. Stick to official app stores like Google Play to minimize the risk of installing malicious software.
  5. Use a password manager to generate and store unique passwords for each account.
  6. Enable multifactor authentication for sensitive accounts, including banking, email, and social media, despite the evolving threats.

As Android phishing scams become more sophisticated, staying informed and implementing strong cybersecurity measures are crucial in protecting personal data from cybercriminals.
Read more »
Subscribe to: Posts (Atom)