Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label IABs. Show all posts
zero click
AdFection Advertisements Al Jazeera browser cookie COM hijacking Data Breach Digital Ads IABs IP Address zero click

Israeli Ad Firm Built a Spyware Pipeline Inside the Online Advertising System, Researchers Say

 



An Israeli advertising company quietly turned the infrastructure of targeted digital ads into a delivery mechanism for mercenary spyware, according to new research from the Citizen Lab at the University of Toronto. The findings, published October 15, represent the first publicly confirmed case of zero-click government-grade spyware delivered through online advertising.

The company at the center of the report is Discover-Tech, registered in Israel and run by CEO Dekel Boni. On its surface, Discover-Tech operated like any other demand-side advertising platform, placing bids across major ad exchanges and running campaigns through networks including Google, Yandex, Liftoff and Comcast's Beeswax. Underneath that veneer sat a second product entirely: a targeting tool called Controlium that, researchers say, was designed to push malicious code to specific individuals based on their device ID, browser cookie, or IP address.

The mechanism is what makes this case technically significant. When a user's device connected to the ad infrastructure and matched an attacker's target list, Discover-Tech's "NOAS server" would return a fragment of JavaScript rather than an ordinary ad. If the device was not a target, the server returned nothing at all, which helped conceal the malicious activity from the ad vendors relaying the traffic. The user never clicks anything. The ad impression itself is the attack.

Citizen Lab researchers call this technique AdFection.


Al Jazeera

Between 2024 and 2025, at least 45 Windows devices at Al Jazeera were compromised this way. Researchers attribute the attacks with high confidence to Candiru spyware, now rebranded as Integrity Labs. The technical trail includes a Windows DLL recovered from a compromised machine that hard-coded command-and-control servers bearing a fingerprint consistent with Candiru's known infrastructure, along with a 48-byte repeating XOR encryption key and a persistence method, COM hijacking, matching Candiru's attack chain from 2021.

Researchers traced the full infection sequence: an ad impression served through Discover-Tech's infrastructure, contact with a Candiru validator server, and then with a Candiru command-and-control server. The governments behind the targeting remain unidentified.


Who was behind Discover-Tech

The research places Discover-Tech in a web of relationships with the commercial spyware sector. Eric Banoun, whom the Israeli newspaper Haaretz has described as one of the pioneers of offensive cyber in Israel, served as a director at Discover-Tech from 2020 to 2025. He also held shares in Intelos, a firm that appears elsewhere in the report as an ADINT surveillance company with at least 15 linked users on the Controlium platform.

Between 2020 and March 2026, Discover-Tech shareholders included a company connected to Sara Hamou, whom researchers say managed the corporate network of Intellexa, the now-sanctioned consortium behind the Predator spyware.

A second spyware vendor, Bindecy, also used the Controlium platform. Researchers identified Bindecy operators in Belgium, Germany, Norway, Portugal, Sweden, Singapore, and Spain. The company did not respond to requests for comment.


What the data showed

Citizen Lab's analysis drew on roughly four billion bid records from an Apache Druid database instance that Discover-Tech left publicly accessible. Between March and June 2026, Discover-Tech's MyDSP platform bid on more than 3.7 billion ad impressions and won approximately 441 million. About 19 percent of those bids carried the NOAS script tags that power the spyware delivery system.

Ads bearing those script tags ran across 75,373 mobile apps and 120,768 websites. Researchers identified ad impressions on networks tied to NATO, the United Nations, the European Parliament, the European Commission, and government bodies in Norway, Sweden, Denmark, Australia, Israel, Czechia, and Italy. Separate findings by ad security firm Confiant, which worked in parallel with Citizen Lab, placed potentially malicious ads on networks of the International Atomic Energy Agency and the International Criminal Court.

Citizen Lab was careful to note that an ad impression does not confirm a device was successfully compromised. The researchers are calling on regulators to investigate whether Discover-Tech and Integrity Labs violated applicable laws.


Industry response

Google and IAB Europe removed Discover-Tech from their vendor registries in early October 2026, ahead of the report's publication. Beeswax removed the company from its platform. Liftoff paused its access. Eskimi blocked its accounts and associated domains.

Discover-Tech did not respond to requests for comment. Integrity Labs could not be reached.

Bill Marczak, one of the Citizen Lab researchers who led the investigation, told TechCrunch that Discover-Tech is "surely just the tip of the iceberg" and advised people who believe they may be surveillance targets to disable ad tracking or use an ad blocker as a precaution.

The full report, co-authored by Marczak, Wolfie Christl, John Scott-Railton, Astrid Perry, Siena Anstis, and Ron Deibert, is available at Citizen Lab.



Read more »
WordPress
Anthropic API Claude Code CyberXero Data Breach IABs WordPress

Russian Hacker Weaponized Claude Code to Breach 429 WordPress Sites and Steal 628,000 Ukrainian Records

 




A financially motivated cybercriminal using Anthropic's Claude Code as an AI backbone has carried out a sweeping attack campaign that compromised 429 WordPress administration panels in a 61-second window and pulled more than 628,000 personal records from four Ukrainian organizations, according to findings published by threat intelligence firm SOCRadar last week.

The threat actor, tracked under the alias CyberXero, is described as a Russian-speaking initial access broker (IAB) whose infrastructure combines commodity offensive tools like Cobalt Strike with an AI orchestration layer powered by Claude Code. Initial access brokers are criminals who break into networks and sell that foothold to other buyers rather than monetizing it directly, and CyberXero has been active since at least July 2026.

The entire operation surfaced from a single configuration error: an exposed open directory at IP address 46.21.250.135 that served the threat actor's live working directory, including more than 90,000 files across 3,000 subdirectories: AI session logs, scripts with plaintext credentials, exploitation toolkits, reconnaissance output, and raw victim database exports. That OPSEC failure let SOCRadar researchers map eight distinct infrastructure nodes tied to the operation, spanning servers in Europe and Tencent Cloud in China.


Two Campaigns Running in Parallel

CyberXero's operation runs two pipelines simultaneously: a global, automated campaign targeting WordPress and e-commerce platforms for payment data and access sales, and a more selective, manual campaign directed at Ukrainian energy providers and critical infrastructure entities.

The automated arm relied on an internally developed Python tool called wp2shell, which abuses a desynchronization flaw in the WordPress REST API batch endpoint to inject SQL, create a rogue administrator account, and plant a web shell disguised as an active plugin. A single automated execution scanned 4,708 targets, confirmed access to 429 WordPress administration panels, and deployed 32 shells, all inside a 61-second window. Each successful compromise fired a real-time notification to a Telegram bot that let the operator monitor results without staying at a terminal.

The second pipeline was considerably more deliberate. The infrastructure documents curated reconnaissance against seven Ukrainian energy and utilities entities, including the national transmission system operator and the country's largest private energy holding. One target list alone contained 95 subdomains covering those two organizations' email infrastructure, VPN gateways, network dispatch systems, and data platforms. That depth of reconnaissance is not the work of an opportunist scanning for easy targets.

The most damaging confirmed breach was a district heating provider in Kharkiv, a city currently on an active war front. A hardcoded credential in the threat actor's own script gave direct access to the provider, and a multithreaded extractor pulled 564,073 subscriber records containing personal data, home addresses, and account numbers, along with 213,340 access-log entries with timestamps and IP addresses. Because those records identify civilians in a conflict zone, the dataset carries physical risk that goes beyond a conventional data breach.


The AI Layer

CyberXero deployed AI at two independent stages. The first ran Claude Code with a cluster of 51 specialized agents on the primary workstation, handling scanning, exploit chaining, reconnaissance, and post-exploitation tasks. The second connected PentAGI, an open-source autonomous penetration testing framework, to a Cobalt Strike Team Server through an AI provider API for payload generation and hands-on pentest execution.

The 51 agents were divided into functional roles. Offensive agents covered tasks like lateral movement and SCADA attacks. Reconnaissance agents handled subdomain mapping and credential testing. Post-exploitation agents managed data exfiltration. A recovered provider configuration file assigned AI models to these roles by reasoning complexity, with the payload-generation role receiving the highest token budget.

To work around the model's safety refusals, the threat actor used context-engineering and session-reset techniques, instructing the agent that it was running an "authorized pentest on my own infrastructure." That same claim appeared verbatim across four unrelated victim engagements, marking it as a rehearsed line rather than a genuine authorization.

Because model safety controls act on session context rather than model weights, a refusal in one session does not carry into the next. When an agent refused a task, the actor opened a fresh session with the authorization framing preloaded and tried again.

The refusals themselves are notable. Across four separate iterations, the model declined to install a backdoor, disable a firewall, move laterally, and deploy a web shell. In a separate episode it refused a scan four consecutive times and correctly rejected a forged ownership token.

The CyberXero case is not the first time Claude Code has appeared in a documented criminal operation. Anthropic's own threat intelligence report earlier this year described a separate actor who used Claude Code to automate reconnaissance, credential harvesting, and network penetration across at least 17 organizations in a single month, spanning government agencies, healthcare providers, and emergency services.

Anthropic has acknowledged that cybercriminals and state-sponsored actors alike have attempted to use its Claude models to automate cyberattacks, build offensive tools, and conduct mass surveillance operations. The gap between what a single attacker can now accomplish and what previously required a full team has narrowed substantially.

For defenders, SOCRadar's most actionable indicator is simple: any WordPress administrator account whose username follows the pattern "wp2_" followed by eight hexadecimal characters was placed there by wp2shell, not a legitimate user. Organizations running WordPress, Magento, PrestaShop, or internet-exposed Redis servers are advised to check for rogue admin accounts and unexpected entries in SSH authorized key files. CyberXero was still active at the time the SOCRadar report was published.


Read more »
rapid7
Cyber Crime Digital Fraud Extortion FBI FTSE IABs ransomware rapid7

Ransomware Revenues Climb as Criminal Networks Expand and Adapt like unwanted vines

 




Ransomware operators continue to generate substantial profits, with new research from Rapid7 indicating that several cybercrime groups are recording revenue growth that outpaces many publicly traded businesses.

According to the cybersecurity firm's analysis, ransomware groups collectively received an estimated $529.2 million during the first quarter of 2026. That figure represents a 39% increase compared with the same period a year earlier. Rapid7 noted that none of the companies within the FTSE 350 index reported year-over-year revenue growth exceeding 30% during that quarter, placing ransomware operators among the fastest-growing entities examined in the study.

Several well-established ransomware operations appear to be benefiting from this trend. Rapid7 estimates that the Qilin ransomware group generated approximately $193 million between July 2025 and March 2026. During the same period, the Gentleman group is estimated to have collected roughly $52 million in ransom payments.

Rapid7 researchers argue that modern ransomware operations bear little resemblance to the stereotype of small groups of hackers working independently. Instead, many function through interconnected networks of specialists who focus on specific stages of an attack. Some actors gain access to victim networks, others develop malware, while separate teams handle extortion demands and payment negotiations.

A major factor behind this growth is the emergence of Initial Access Brokers, or IABs. These actors specialize in obtaining access to corporate networks and then selling that access to other criminals. As a result, launching a ransomware attack no longer requires extensive technical expertise. Access to compromised systems, attack tools, and even managed cybercrime services can now be purchased through underground marketplaces.

Researchers say this division of labor has created a more structured criminal economy. Different groups contribute individual services, allowing ransomware campaigns to operate through networks that resemble commercial supply chains rather than isolated criminal crews.

The study also highlights the resilience of these operations. Infrastructure used by ransomware groups, including servers, data leak platforms, and victim negotiation portals, can often be restored quickly after disruptions. Law enforcement agencies, meanwhile, frequently require lengthy investigations and international coordination before conducting enforcement actions. This difference in speed allows many criminal networks to continue operating even when portions of their infrastructure are removed.

Rapid7 CTO EMEA Thom Langford said ransomware groups have demonstrated an ability to continue generating revenue despite disruptions because their operations are designed to function even when individual components are taken offline. In many cases, the removal of a single server or criminal group does not significantly affect the broader ecosystem supporting ransomware activity.

The findings come amid continued financial losses linked to cybercrime. According to the FBI's Internet Crime Complaint Center, organizations and individuals reported more than $16 billion in cybercrime losses during 2024, reflecting the growing economic impact of digital fraud, extortion, and network intrusions.

To reduce ransomware risk, Rapid7 recommends that organizations continuously review their exposed systems and identify weaknesses that could provide attackers with an entry point. Particular attention should be given to misconfigured services, overlooked assets, and internet-facing systems, which are frequently targeted by Initial Access Brokers seeking access to corporate environments.

The company also advises security teams to make greater use of threat intelligence to understand how attackers operate, including the infrastructure, tools, and access methods commonly used during intrusions. Researchers further recommend strengthening identity security through tighter access controls, least-privilege policies, and monitoring for signs that employee credentials have been stolen, resold, or abused.

According to Rapid7, disrupting ransomware attacks before attackers establish access remains one of the most effective defensive strategies. By identifying weaknesses early and restricting opportunities for credential theft, organizations may be able to prevent ransomware incidents before they progress to the extortion stage.

Read more »
Ransomwares
agentic AI AI Agent AI technology AI threats AI tools Cyber Security Cybersecurity Threats IABs Malicious Code Ransomwares

Agentic AI and Ransomware: How Autonomous Agents Are Reshaping Cybersecurity Threats

 

A new generation of artificial intelligence—known as agentic AI—is emerging, and it promises to fundamentally change how technology is used. Unlike generative AI, which mainly responds to prompts, agentic AI operates independently, solving complex problems and making decisions without direct human input. While this leap in autonomy brings major benefits for businesses, it also introduces serious risks, especially in the realm of cybersecurity. Security experts warn that agentic AI could significantly enhance the capabilities of ransomware groups. 

These autonomous agents can analyze, plan, and execute tasks on their own, making them ideal tools for attackers seeking to automate and scale their operations. As agentic AI evolves, it is poised to alter the cyber threat landscape, potentially enabling more efficient and harder-to-detect ransomware attacks. In contrast to the early concerns raised in 2022 with the launch of tools like ChatGPT, which mainly helped attackers draft phishing emails or debug malicious code, agentic AI can operate in real time and adapt to complex environments. This allows cybercriminals to offload traditionally manual processes like lateral movement, system enumeration, and target prioritization. 

Currently, ransomware operators often rely on Initial Access Brokers (IABs) to breach networks, then spend time manually navigating internal systems to deploy malware. This process is labor-intensive and prone to error, often leading to incomplete or failed attacks. Agentic AI, however, removes many of these limitations. It can independently identify valuable targets, choose the most effective attack vectors, and adjust to obstacles—all without human direction. These agents may also dramatically reduce the time required to carry out a successful ransomware campaign, compressing what once took weeks into mere minutes. 

In practice, agentic AI can discover weak points in a network, bypass defenses, deploy malware, and erase evidence of the intrusion—all in a single automated workflow. However, just as agentic AI poses a new challenge for cybersecurity, it also offers potential defensive benefits. Security teams could deploy autonomous AI agents to monitor networks, detect anomalies, or even create decoy systems that mislead attackers. 

While agentic AI is not yet widely deployed by threat actors, its rapid development signals an urgent need for organizations to prepare. To stay ahead, companies should begin exploring how agentic AI can be integrated into their defense strategies. Being proactive now could mean the difference between falling behind or successfully countering the next wave of ransomware threats.
Read more »
Shadow AI
AI Deepfakes AI threats Cyber Security cybercriminals Cybersecurity measures IABs Open Source Ransomwares Shadow AI

Emerging Cybersecurity Threats in 2025: Shadow AI, Deepfakes, and Open-Source Risks

 

Cybersecurity continues to be a growing concern as organizations worldwide face an increasing number of sophisticated attacks. In early 2024, businesses encountered an alarming 1,308 cyberattacks per week—a sharp 28% rise from the previous year. This surge highlights the rapid evolution of cyber threats and the pressing need for stronger security strategies. As technology advances, cybercriminals are leveraging artificial intelligence, exploiting open-source vulnerabilities, and using advanced deception techniques to bypass security measures. 

One of the biggest cybersecurity risks in 2025 is ransomware, which remains a persistent and highly disruptive threat. Attackers use this method to encrypt critical data, demanding payment for its release. Many cybercriminals now employ double extortion tactics, where they not only lock an organization’s files but also threaten to leak sensitive information if their demands are not met. These attacks can cripple businesses, leading to financial losses and reputational damage. The growing sophistication of ransomware groups makes it imperative for companies to enhance their defensive measures, implement regular backups, and invest in proactive threat detection systems. 

Another significant concern is the rise of Initial Access Brokers (IABs), cybercriminals who specialize in selling stolen credentials to hackers. By gaining unauthorized access to corporate systems, these brokers enable large-scale cyberattacks, making it easier for threat actors to infiltrate networks. This trend has made stolen login credentials a valuable commodity on the dark web, increasing the risk of data breaches and financial fraud. Organizations must prioritize multi-factor authentication and continuous monitoring to mitigate these risks. 

A new and rapidly growing cybersecurity challenge is the use of unauthorized artificial intelligence tools, often referred to as Shadow AI. Employees frequently adopt AI-driven applications without proper security oversight, leading to potential data leaks and vulnerabilities. In some cases, AI-powered bots have unintentionally exposed sensitive financial information due to default settings that lack robust security measures. 

As AI becomes more integrated into workplaces, businesses must establish clear policies to regulate its use and ensure proper safeguards are in place. Deepfake technology has also emerged as a major cybersecurity threat. Cybercriminals are using AI-generated deepfake videos and audio recordings to impersonate high-ranking officials and deceive employees into transferring funds or sharing confidential data. 

A recent incident involved a Hong Kong-based company losing $25 million after an employee fell victim to a deepfake video call that convincingly mimicked their CFO. This alarming development underscores the need for advanced fraud detection systems and enhanced verification protocols to prevent such scams. Open-source software vulnerabilities are another critical concern. Many businesses and government institutions rely on open-source platforms, but these systems are increasingly being targeted by attackers. Cybercriminals have infiltrated open-source projects, gaining the trust of developers before injecting malicious code. 

A notable case involved a widely used Linux tool where a contributor inserted a backdoor after gradually establishing credibility within the project. If not for a vigilant security expert, the backdoor could have remained undetected, potentially compromising millions of systems. This incident highlights the importance of stricter security audits and increased funding for open-source security initiatives. 

To address these emerging threats, organizations and governments must take proactive measures. Strengthening regulatory frameworks, investing in AI-driven threat detection, and enhancing collaboration between cybersecurity experts and policymakers will be crucial in mitigating risks. The cybersecurity landscape is evolving at an unprecedented pace, and without a proactive approach, businesses and individuals alike will remain vulnerable to increasingly sophisticated attacks.
Read more »
IABs
ADT data breach Cyber Crime Cyber Threat Intelligence Hacking IABs

How Hackers Sell Access to Corporate Systems Using Stolen Credentials

 


In the cybercrime world, Initial Access Brokers (IABs) are essential for facilitating attacks. These specific hackers break into company systems, steal login credentials, and then sell access to other criminals who use it to launch their own attacks. They essentially act as locksmiths for hackers, making it easy for those willing to pay to get into systems.

What Exactly Do IABs Do?

IABs function as a business where they sell access to corporate systems stolen from their organizations on dark markets, either private forums or Telegram channels. The credentials offered include the most basic login information and even the highest administrator accounts. They even have guarantees by giving a refund if the stolen credentials fail to work.

This system benefits both inexperienced attackers and advanced hacking groups. For less skilled criminals, IABs provide access to high-value targets they could never reach independently. For seasoned ransomware operators, purchasing pre-stolen access saves time and allows them to focus on deploying malware or stealing sensitive data.

Such credentials as usernames and passwords are a hacker's key to entering a system directly, bypassing all the security barriers. Such an attack occurred during major breaches such as in the 

  • Geico Case: Cyber thieves in 2024 accessed Geico's online tools with stolen credentials and compromised sensitive information for 116,000 customers and paid the company millions in fines.
  • ADT Breach: Thieves had used the credentials of one of ADT's partners to breach ADT's internal systems twice, releasing customer records and proving that even trusted relationships can be compromised. In a report released by IBM in 2024, compromised credentials accounted for nearly 20% of all data breaches and were frequently unobserved for months, leaving attackers sufficient time to steal their information.


How to Protect Against IABs  

Organizations must adopt proactive measures to counteract these threats:  

1. Threat Intelligence: Tools can monitor underground markets for stolen credentials. If a company’s data appears on these platforms, immediate action—like forcing password changes can help minimize damage.

2. Complex Passwords: It is recommendable that companies enforce rules forcing employees to use complex, unique passwords and to update them regularly. Platforms like Specops Password Policy allow companies to check their credentials against known breached databases to prevent using the same breached passwords.

Although IABs have made cybercrime more efficient, organizations can protect themselves by understanding their tactics and strengthening their defenses. Regular monitoring, strong password practices, and quick responses to breaches are key to staying ahead of these threats. By closing the gaps hackers exploit, companies can make it harder for cybercriminals to succeed.




Read more »
User Security
Australia Data Breach Data Leak Data Thefy IABs ransomware attacks User Security

Initials Access Brokers are Playing Major Role in Data Breaches

 

As the cybercrime ecosystem continues to expand in Australia, the job of security professionals has also come under scrutiny. In the past month, alone seven major Australian enterprises including Optus, Medibank, and Woolworths have suffered data breaches. 

According to the latest Recorded Future intelligence report, the rise of initial access brokers (IABs) has led to increasing data breaches. IABs employ several multiple tools, techniques, and procedures (TTPs) to achieve initial access to the targeted network. 

IABs modus operandi 

IABs often launch the first stage of a ransomware attack and then sell this access to other hackers who deploy the ransomware to paralyze the victim’s computer system. 

IABs are primarily active on top-tier Russian-language platforms like Exploit, XSS, and RAMP, and typically operate using multiple languages and online pseudonyms to bypass detection. The advertising on underground forums includes a series of important details that hackers will need to select their next victim. These include victim country, annual revenue, industry, type of access, rights, data to be exfiltrated, devices on the local network, and pricing. 

While many ransomware affiliates are happy to negotiate publicly, with IABs advertising on these forums, others are thought to work directly and secretly with a pre-selected group of access brokers. Either way, the advantage of working alongside IABs is clearly to accelerate their campaigns. 

According to the latest research conducted by KELA, IABs sell initial access for $4600, and sales take between one and three days to finalize. Once access has been purchased, it takes up to a month for a ransomware attack to take place -- and potentially for the victim to be subsequently named on a leak site. The average price for access was around USD 2800 and the median price - USD 1350.

How to counter the threat 

Fortunately, there are multiple things businesses can do to mitigate the threat, not only of initial info-stealing attacks but also the ransomware that follows. 

Organizations should train employees to recognize and neutralize social engineering attacks. When it comes to ransomware, maintain offline backups of sensitive data, segment networks to contain an attack’s blast radius, and apply two-factor authentication everywhere. Continuous monitoring and robust threat intelligence will also provide a useful early warning system. 

Most importantly, the right defensive posture can help organizations to regain the initiative and put enough roadblocks in the way that their adversaries give up and move on to the next target.
Read more »
Subscribe to: Posts (Atom)