Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Infrastructure Security. Show all posts
Infrastructure Security
Critical Infrastructure Security Cyber Attacks Cyber Security Ransomware Attacks Cyber Threats Hypervisor Infrastructure Security

Hypervisor Ransomware Attacks Surge as Threat Actors Shift Focus to Virtual Infrastructure

 

Hypervisors have emerged as a highly important, yet insecure, component in modern infrastructural networks, and attackers have understood this to expand the reach of their ransomware attacks. It has been observed by the security community that the modes of attack have changed, where attackers have abandoned heavily fortified devices in favor of the hypervisor, the platform through which they have the capability to regulate hundreds of devices at one time. In other words, a compromised hypervisor forms a force multiplier in a ransomware attack. 

Data from Huntress on threat hunting indicates the speed at which this trend is gathering pace. Initially in the early part of 2025, hypervisors were involved in just a few percent of ransomware attacks. However, towards the latter part of the year, this number had risen substantially, with hypervisor-level encryption now contributing towards a quarter of these attacks. This is largely because the Akira ransomware group is specifically leveraging vulnerabilities within virtualized infrastructure.  

Hypervisors provide attackers the opportunity by typically residing outside the sight of traditional security software. For this reason, bare-metal hypervisors are of particular interest to attackers since traditional security software cannot be set up on these environments. Attacks begin after gaining root access, and the attackers will be able to encrypt the disks on the virtual machines. Furthermore, attackers will be able to use the built-in functions to execute the encryption process without necessarily setting up the ransomware. 

In this case, security software would be rendered unable to detect the attacks. These attacks often begin with loopholes in credentials and network segmentation. With the availability of Hypervisor Management Interfaces on the larger internets inside organizations, attackers can launch lateral attacks when they gain entry and gain control of the virtualization layer. Misuse of native management tools has also been discovered by Huntress for adjusting Machine Settings, degrading defenses, and preparing the environment for massive Ransomware attacks. 

Additionally, the increased interest in hypervisors has emphasized that this layer must be afforded the equivalent security emphasis on it as for servers and end-points. Refined access controls and proper segmentation of management networks are required to remediate this. So too is having current and properly maintained patches on this infrastructure, as it has been shown to have regularly exploited vulnerabilities for full administrative control and rapid encryption of virtualized environments. While having comprehensive methods in place for prevention, recovery planning is essential in this scenario as well. 

A hypervisor-based ransomware is meant for environments, which could very well go down, hence the need for reliable backups, ideally immutables. This is especially true for organizations that do not have a recovery plan in place. As ransomware threats continue to evolve and become more sophisticated, the role of hypervisors has stepped up to become a focal point on the battlefield of business security. 

This is because by not securing and protecting the hypervisor level against cyber threats, what a business will essentially present to the cyber attackers is what they have always wanted: control of their whole operation with a mere click of their fingers.
Read more »
MaaS model
Critical Infrastructure Cyber Attacks Cyberattack threats Cybersecurity measures Infrastructure Security MaaS MaaS model

CastleLoader Widens Its Reach as GrayBravo’s MaaS Infrastructure Fuels Multiple Threat Clusters

 

Researchers have now identified four distinct threat activity clusters associated with the malware loader CastleLoader, bolstering previous estimates that the tool was being supplied to multiple cybercriminal groups through a malware-as-a-service model. In this, the operator of this ecosystem has been dubbed GrayBravo by Recorded Future's Insikt Group, which had previously tracked the same actor under the identifier TAG-150. 

CastleLoader emerged in early 2025 and has since evolved into a dynamically developing malware distribution apparatus. Recorded Future's latest analysis underscores GrayBravo's technical sophistication, the ability to promptly adapt operations after public reporting, and the growing infrastructure currently supporting multiple threat campaigns. 

GrayBravo's toolkit consists of several components, including a remote access trojan dubbed CastleRAT and a modular malware framework named CastleBot. CastleBot is composed of three interconnected main elements: a shellcode stager, a loader, and a core backdoor. The loader injects the backdoor into memory, following which the malware communicates with command-and-control servers to receive instructions. These further enable downloading and executing a variety of payloads in the form of DLL, EXE, and PE files. CastleLoader has been used to distribute various well-known malware families, including RedLine Stealer, StealC, DeerStealer, NetSupport RAT, SectopRAT, MonsterV2, WARMCOOKIE, and other loaders, such as Hijack Loader, which demonstrates how well the CastleBot and CastleLoader combo serves as a widely useful tool.  

Recorded Future's new discoveries uncover four separate operational clusters, each using CastleLoader for its purposes. One cluster, attributed to TAG-160, has been operational since March 2025, targeting the logistics industry by leveraging phishing lures and ClickFix for CastleLoader delivery. Another one, referred to as TAG-161, started its operations in June 2025 and has used Booking.com-themed ClickFix campaigns for spreading CastleLoader and Matanbuchus 3.0. One more cluster has utilized infrastructure that spoofs Booking.com, complementing the spoofing with ClickFix and leveraging Steam Community pages as dead-drop resolvers to distribute CastleRAT via CastleLoader. A fourth cluster, which has been active since April 2025, leverages malvertising and fake update notices posing as Zabbix and RVTools for delivering CastleLoader together with NetSupport RAT. 

The actor's infrastructure spans from victim-facing command-and-control servers attributed to CastleLoader, CastleRAT, SectopRAT, and WARMCOOKIE to several other VPS servers, presumably held as spares. Of special interest are the TAG-160 operations, which feature the use of hijacked or fake accounts on freight-matching platforms, including DAT Freight & Analytics and Loadlink Technologies, to create rather plausible phishing messages. The customised lures suggest that the operators have extensive domain knowledge of logistics processes and related communication practices in the industry. 

Recorded Future concluded that the continued expansion in the use of CastleLoader by independent threat groups testifies to how rapidly such advanced and adaptive tools can diffuse in the cybercrime ecosystem once they get credit. Supporting this trend, the recent case documented by the researchers at Blackpoint involved a Python-based dropper chain in which the attackers used ClickFix to download an archive, stage files in the AppData directory, and execute a Python stager that rebuilt and launched a CastleLoader payload. Continued evolution of these delivery methods shows that the malware-as-a-service model behind CastleLoader is really enabling broader and more sophisticated operations through multiple threat actors.
Read more »
Third-Party Vulnerabilities
Banking Cyberattack Cyber Intrusion Investigation Data Breach Digital Supply Chain Risk Financial Security Infrastructure Security Mortgage Data Leak Third-Party Vulnerabilities

Growing Concern as Authorities Assess Cyber Incident at Real Estate Finance Firm

 


An extreme cyber intrusion which led to considerable concern among U.S. financial institutions over the weekend has been hailed by leading American banks and mortgage lenders as a major development that must be addressed urgently in order to reduce their exposure to various cyber threats. 

According to a statement issued by StatusAMC Group Holdings, LP on November 12, the back-office software provider for hundreds of mortgage origination, servicing, and payments operations for hundreds of institutions was breached. It was possible for unknown actors to gain access to sensitive client information, including accounting files, legal agreements, and possibly extensive personal data from loan applications, by hacking into their systems. 

However, while the company claims its operations remain fully operational, and that the incident has been contained without using any encryption malware, the extent to which the data was compromised has raised the alarm on Wall Street, since firms such as JPMorgan, Citi, and Morgan Stanley are highly reliant on the vendor's infrastructure for their daily operations. 

The company has been providing clients with near-daily updates while collaborating with federal law enforcement and outside forensic experts to determine exactly what was taken after the millions of records may have been stolen. This reflects a growing sense of unease within an industry where third-party vulnerabilities are posing some of the most significant cyber risks to date. 

New York-based StatusAMC provides mortgage services to more than 1,500 clients across residential and commercial markets. This breach has been discovered by the company on November 12, and it has confirmed that portions of the company's corporate data, including accounting records and legal agreements, have been accessed during this intrusion, which occurred on November 12. 

There are no clear indications as yet as to whether the attackers exfiltrated certain data tied to customers of the company's financial-sector clients, or if they simply viewed that information. However, it acknowledges that data tied to customers of its financial-sector clients may also have been compromised. 

There is no doubt that the company is a major processor of mortgage applications, and they handle highly sensitive personal information, ranging from Social Security numbers to passport information to employment histories. However, after recent reports suggested that certain information related to residential loan files was compromised, further concerns were raised. 

A report by the New York Times reported that JPMorgan Chase, Citi, and Morgan Stanley may have been affected by the breach; JPMorgan said that its own banking systems were not directly compromised, but Citi declined to comment and Morgan Stanley refused to answer questions. It has already been reported that the FBI has opened a probe, and SitusAMC has already begun contacting impacted customers as it continues the investigation. As a result, the federal investigators are now taking an increasingly active role in investigating the breach. 

The FBI announced in a press release that they are working closely with SitusAMC and the affected institutions to determine the full extent of the breach. According to Director Kash Patel, no operational disruptions have yet been identified to banking services. He added that the bureau continues to focus on tracing the perpetrators and strengthening security measures for critical infrastructure systems. 

A longstanding vulnerability in the financial sector despite its reputation for strong cybersecurity defenses has been heightened by the incident, as a result of systemic risks associated with third-party technology providers. Despite being essential to the banking industry, SitusAMC is often overlooked outside of industry circles, and the company receives far less oversight than the major banks it supports, which can lead to the exposure of millions of records. 

As the investigation continues, neither JPMorgan Chase nor Morgan Stanley indicated what they experienced regarding the investigation. Additionally, SitusAMC's chief executive officer, Michael Franco, declined to respond to inquiries regarding the investigation, leaving many questions unanswered. 

Despite the fact that large banks invest hundreds of millions of dollars in cybersecurity each year and are widely regarded as the best-protected institutions in the private sector, experts warn that even though the banking industry is under constant pressure from increasingly sophisticated cyber threats, it is still highly vulnerable to these threats. In spite of the fact that lenders, data processors, and software providers are connected through a dense network of relationships, it is quite possible for those institutions that appear the most secure to introduce weaknesses inadvertently. 

The breach has underscored the fact that deeply embedded vulnerabilities can emerge in the most unexpected places when they are deeply embedded, as Muish Walther-Puri, head of critical digital infrastructure at TPO Group, said. The failure of a single trusted vendor can be very detrimental to the entire financial ecosystem, exposing the "unseen" risks woven into its operations, he added. He emphasized that true resilience cannot just be achieved by internal defenses alone, but also through the collective vigilance of the entire supply chain as well. 

Several industry experts are predicting that as the investigation continues, the incident will serve as a catalyst for deeper scrutiny of digital supply chains as well as a more rigorous oversight of the vendors that power critical financial operations. 

The argument goes that even if banks and lenders have formidable defenses, they still need to set higher security expectations for third parties, demanding a greater level of transparency, continuous monitoring, and greater accountability as part of their security practices. 

Having been exposed to the security breach, many people in the sector have taken note that the development of resilience these days is reliant not only on advanced technology, but also on a shared commitment to safeguard the interconnected systems that are vital to keeping the nation's financial machinery afloat.
Read more »
Subscribe to: Comments (Atom)