Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label Malwares. Show all posts
Malwares
CVE CVE exploits CVE vulnerability CVEs Cyber Attacks Cyber Threat Intelligence Google GSMA GTIG Hacker attack Malware Attack Malwares

Hackers Exploit End-of-Life SonicWall Devices Using Overstep Malware and Possible Zero-Day

 

Cybersecurity experts from Google’s Threat Intelligence Group (GTIG) have uncovered a series of attacks targeting outdated SonicWall Secure Mobile Access (SMA) devices, which are widely used to manage secure remote access in enterprise environments. 

These appliances, although no longer supported with updates, remain in operation at many organizations, making them attractive to cybercriminals. The hacking group behind these intrusions has been named UNC6148 by Google. Despite being end-of-life, the devices still sit on the edge of sensitive networks, and their continued use has led to increased risk exposure. 

GTIG is urging all organizations that rely on these SMA appliances to examine them for signs of compromise. They recommend that firms collect complete disk images for forensic analysis, as the attackers are believed to be using rootkit-level tools to hide their tracks, potentially tampering with system logs. Assistance from SonicWall may be necessary for acquiring these disk images from physical devices. There is currently limited clarity around the technical specifics of these breaches. 

The attackers are leveraging leaked administrator credentials to gain access, though it remains unknown how those credentials were originally obtained. It’s also unclear what software vulnerabilities are being exploited to establish deeper control. One major obstacle to understanding the attacks is a custom backdoor malware called Overstep, which is capable of selectively deleting system logs to obscure its presence and activity. 

Security researchers believe the attackers might be using a zero-day vulnerability, or possibly exploiting known flaws like CVE-2021-20038 (a memory corruption bug enabling remote code execution), CVE-2024-38475 (a path traversal issue in Apache that exposes sensitive database files), or CVE-2021-20035 and CVE-2021-20039 (authenticated RCE vulnerabilities previously seen in the wild). There’s also mention of CVE-2025-32819, which could allow credential reset attacks through file deletion. 

GTIG, along with Mandiant and SonicWall’s internal response team, has not confirmed exactly how the attackers managed to deploy a reverse shell—something that should not be technically possible under normal device configurations. This shell provides a web-based interface that facilitates the installation of Overstep and potentially gives attackers full control over the compromised appliance. 

The motivations behind these breaches are still unclear. Since Overstep deletes key logs, detecting an infection is particularly difficult. However, Google has shared indicators of compromise to help organizations determine if they have been affected. Security teams are strongly advised to investigate the presence of these indicators and consider retiring unsupported hardware from critical infrastructure as part of a proactive defense strategy.
Read more »
North Korea cyberattack
Apple Apple MacOS Blockchain Blockchain Technology Crypto Attack crypto community cryptocurrency Cyber Attacks data security Data Theft Mac Mac Malware Malware Attack Malwares North Korea cyberattack

North Korean Malware Targets Mac Users in Crypto Sector via Calendly and Telegram

 

Cybersecurity researchers have identified a sophisticated malware campaign targeting Mac users involved in blockchain technologies. According to SentinelLabs, the attack has been linked to North Korean threat actors, based on an investigation conducted by Huntabil.IT. 

The attack method is designed to appear as a legitimate interaction. Victims are contacted via Telegram, where the attacker impersonates a known associate or business contact. They are then sent a meeting invite using Calendly, a widely-used scheduling platform. The Calendly message includes a link that falsely claims to be a “Zoom SDK update script.” Instead, this link downloads malware specifically designed to infiltrate macOS systems. 

The malware uses a combination of AppleScript, C++, and the Nim programming language to evade detection. This mix is relatively novel, especially the use of Nim in macOS attacks. Once installed, the malware gathers a broad range of data from the infected device. This includes system information, browser activity, and chat logs from Telegram. It also attempts to extract login credentials, macOS Keychain passwords, and data stored in browsers like Arc, Brave, Firefox, Chrome, and Microsoft Edge. Interestingly, Safari does not appear to be among the targeted applications. 

While the campaign focuses primarily on a niche audience—Mac users engaged in crypto-related work who use Calendly and Telegram—SentinelLabs warns that the tactics employed could signal broader threats on the horizon. The use of obscure programming combinations to bypass security measures is a red flag for potential future campaigns targeting a wider user base. 

To safeguard against such malware, users are advised to avoid downloading software from public code repositories or unofficial websites. While the Mac App Store is considered the safest source for macOS applications, software downloaded directly from reputable developers’ websites is generally secure. Users who rely on pirated or cracked applications remain at significantly higher risk of infection. 

Cyber hygiene remains essential. Never click on suspicious links received via email, text, or social platforms, especially from unknown or unverified sources. Always verify URLs by copying and pasting them into a text editor to see their true destination before visiting. It’s also crucial to install macOS security updates promptly, as these patches address known vulnerabilities.  

For additional protection, consider using trusted antivirus software. Guides from Macworld suggest that while macOS has built-in security, third-party tools like Intego can offer enhanced protection. As malware campaigns evolve in complexity and scope, staying vigilant is the best defense.
Read more »
Online Security
Cyber Scammers Cyber Security Dark Web Dark web malware Dark web marketplace Dark Web Monitoring Illegal Sites Malwares Online Security

Why Exploring the Dark Web Can Lead to Legal Trouble, Malware, and Emotional Harm

 

Venturing into the dark web may seem intriguing to some, but even well-intentioned users are exposed to significant risks. While many people associate the dark web with illegal activity, they may not realize that just browsing these hidden spaces can lead to serious consequences, both legal and emotional. Unlike the regulated surface web, the dark web operates with little to no oversight, which makes stumbling across disturbing or illicit content dangerously easy.

A simple click on an unfamiliar link can redirect users to graphic or illegal material. This content is not always clearly labeled, and visitors may not realize what they’re seeing until it’s too late. In several jurisdictions, merely viewing certain types of content—whether or not you meant to—can have legal repercussions. Users may also experience lasting psychological impact after encountering explicit or violent media. Reports of anxiety, stress, and trauma are not uncommon, even among casual users who were simply exploring out of curiosity.  

Malware, spyware, and keyloggers are often disguised as legitimate downloads or hidden in popular tools. Many websites host dangerous files designed to infect your device as soon as they are opened. Even privacy-focused platforms like Tor can’t fully shield users from malicious code or phishing attempts, especially when browsers are misconfigured or when users interact with suspicious content. 

Technical errors—like enabling JavaScript, resizing your browser window, or leaking DNS requests—can also expose your identity, even if you’re using encrypted tools. Cybersecurity professionals warn that mistakes like these are common and can be exploited by attackers or even government agencies. Law enforcement agencies actively monitor known dark web nodes and can use advanced techniques to track user behavior, collect metadata, and build profiles for surveillance. 

Additionally, scammers thrive in the anonymous environment of the dark web. Fake login portals, spoofed forums, and crypto wallet traps are rampant. And if you’re scammed, there’s little you can do—there are no refund options or customer service teams to help you recover lost funds or data. 

The dark web is often underestimated, constant exposure to unsettling content and the need to stay hyper-aware of threats can wear down a person’s sense of safety and trust. In many cases, the psychological damage can linger far longer than the browsing session itself. 

In short, exploring the dark web without a thorough understanding of the dangers can backfire. It’s a space where curiosity offers no protection, and the consequences—ranging from infections and identity loss to legal charges and emotional distress—can affect even the most cautious users.
Read more »
Russian Hackers
COLDRIVER Coldriver hacker group Cyber Attacks cyber espionage data security espionage Hacker attack Malware Attack Malwares Russian Hackers

Lostkeys Malware: Russian Group Coldriver Targets Western Officials in Espionage Campaign

 

A new wave of cyber espionage has emerged, with Russian hackers deploying a sophisticated malware strain known as “Lostkeys” to infiltrate the systems of Western officials, journalists, and NGOs. According to researchers from Google’s Threat Intelligence Group, the malware is linked to Coldriver, also known as UNC4057, Star Blizzard, or Callisto—a threat actor believed to be part of Russia’s Federal Security Service (FSB), the successor to the KGB. 

Coldriver has traditionally been involved in phishing operations to steal credentials, but the emergence of Lostkeys demonstrates a significant leap in their cyber capabilities. Lostkeys appears to mark a shift in strategy for the group, moving beyond phishing and into deeper system infiltration. The malware is deployed in a targeted manner, reserved for high-value individuals such as political advisors, think tank members, journalists, and people with known connections to Ukraine.

Activity related to Lostkeys was observed by Google in the early months of 2024—specifically January, March, and April—with evidence suggesting its use might have started as far back as December 2023. The attack begins with a deceptive Captcha page, tricking victims into copying a malicious PowerShell script into the Windows Run dialog. This method, known as “ClickFix,” bypasses typical security filters and exploits user behavior rather than software vulnerabilities. 

Once executed, the script connects to a command-and-control server, downloading a series of payloads uniquely tailored to each victim. In an effort to avoid detection, the malware includes anti-sandbox measures. During the second stage of infection, the script checks the screen resolution of the host machine and halts if it matches known virtual machine environments used by analysts and cybersecurity researchers. If the device passes this check, the malware proceeds to the final stage—a Visual Basic Script that steals data, including specific file types, system details, and active processes. These are exfiltrated back to the attackers using an encoded system that applies a unique two-key substitution cipher for each infected machine. 

Lostkeys appears to be a more refined successor to a previous malware strain known as Spica, which Coldriver also deployed in 2024. While both strains focus on data exfiltration, Lostkeys features a more intricate delivery system and improved obfuscation techniques. Some earlier samples of Lostkeys mimicked legitimate software like Maltego and used executable files instead of PowerShell, though Google has not confirmed if these instances were part of the same campaign or the work of a different threat actor reusing Coldriver’s tactics. 

This development highlights an alarming evolution in state-backed cyber operations, where advanced social engineering and stealth techniques are being increasingly used to infiltrate high-profile targets. As geopolitical tensions persist, the risks posed by such targeted cyber espionage campaigns are expected to grow.
Read more »
Phishing Scams
counterfeit Cyber Security Cyber Squatting Domain Fake Accounts Fake Domains fake websites imposter frauds Malwares Phishing Scams

Understanding Cybersquatting: How Malicious Domains Threaten Brands and Individuals

 

Cybersquatting remains a persistent threat in the digital landscape, targeting businesses, individuals, and public figures alike. This deceptive practice involves registering domain names that closely resemble those of legitimate brands or individuals, often with malicious intent. Despite rising awareness and improved security measures, cybersquatting continues to flourish. According to the World Intellectual Property Organization (WIPO), nearly 6,200 domain disputes related to cybersquatting were filed with its Arbitration and Mediation Center in 2024, indicating the scale of the problem. 

Typically, cybersquatters aim to exploit the reputation of an existing brand by acquiring a domain that looks similar to the original. They might register a domain before a business secures it, or take advantage of minor spelling variations that are easily overlooked by users. This allows them to mislead consumers, drive traffic to fraudulent websites, or sell the domain back to the rightful owner at a premium. In more dangerous scenarios, these domains are used to host phishing scams, distribute malware, or promote counterfeit products. One common technique employed by cybersquatters is typosquatting, where domains are registered with intentional misspellings or typographical errors. Unsuspecting users who mistype a URL may unknowingly land on malicious sites. 

A notable example occurred in 2006 when a domain resembling “Google.com” was used to trick visitors into installing fake antivirus software. Another tactic involves registering domains tied to celebrities or public figures, often with the intent to damage reputations or spread spam. A high-profile case involved Madonna, who successfully reclaimed a domain bearing her name that was being used to host adult content. Some cybersquatters engage in identity-based attacks, closely imitating official company domains to carry out fraud or data theft. For example, Dell once had to legally pursue entities that had registered over 1,100 domains using names resembling its brand. Others use a tactic called reverse cybersquatting, where they first register a business and then secure the corresponding domain, falsely claiming legitimacy to obstruct the actual brand’s efforts to recover it.

In another method, known as domain name warehousing, attackers monitor expiring domains and quickly register them if the original owner forgets to renew. In one case, a former campaign domain linked to politician Nigel Farage was redirected to an opponent’s site as a form of protest. While legal frameworks exist to combat cybersquatting, enforcement can be complex. In the United States, the Anti-Cybersquatting Consumer Protection Act (ACPA) empowers victims to take legal action and potentially reclaim their domains along with financial damages. 

The European Union Intellectual Property Office (EUIPO) also provides mechanisms to enforce trademark rights in domain disputes. Additionally, WIPO can facilitate domain transfers when bad faith registration is proven. Despite these protections, prevention remains key. Organizations are encouraged to register not only their primary domains but also common misspellings, different extensions, and regional variations to minimize the risk of cybersquatters exploiting their identity.
Read more »
Routers Threat
Cyber Security FBI FBI cybersecurity advisory FBI warning Malware Threat Malwares Router Hacking Router vulnerability Routers Routers Threat

FBI Warns Consumers to Replace Outdated Routers Hijacked by TheMoon Malware

 

The FBI has issued an urgent warning to American consumers and businesses: replace outdated internet routers immediately or risk becoming an unwitting accomplice in cybercrime. According to the agency, cybercriminals are actively targeting “end-of-life” routers—older models that no longer receive security updates from manufacturers—and infecting them with a sophisticated variant of TheMoon malware. Once compromised, these routers are hijacked and repurposed as proxy servers that enable criminals to mask their identities while conducting illegal activities online. 

These include financial fraud, dark web transactions, and cyberattacks, all executed through unsuspecting users’ networks. Because these routers lack updated firmware and security patches, they are especially vulnerable to remote infiltration and control. TheMoon malware, which first emerged in 2014, has evolved into a more potent threat. It now scans for open ports and installs itself without requiring a password. Once embedded, it silently operates in the background, routing illicit activity and potentially spreading to other devices within the network. The malware’s stealthy behavior often leaves users unaware that their home or business network has become part of a criminal infrastructure. 

The FBI specifically warned that routers manufactured in 2010 or earlier are particularly at risk—especially if features like remote administration are still enabled. Older Linksys models such as E1200, E2500, E1000, E4200, E1500, E300, E3200, WRT320N, E1550, WRT610N, E100, M10, and WRT310N are listed among the most vulnerable devices. Signs of a compromised router may include overheating, unexplained changes to settings, or erratic internet connectivity. In many cases, users may not even realize their equipment is outdated, making them easy targets for attackers seeking anonymous access to the web. 

To defend against these threats, the FBI strongly advises replacing unsupported routers with modern, secure models. Users should also disable remote access functions, install the latest security patches, and use complex, unique passwords to further protect their networks. If anyone suspects their router has been hijacked or detects suspicious activity, they are encouraged to file a report with the FBI’s Internet Crime Complaint Center (IC3). 

As cybercriminals become more innovative, relying on outdated technology increases exposure to serious digital threats. This latest alert is a stark reminder that cybersecurity begins at home—and that even something as common as a router can become a gateway for criminal exploitation if not properly secured.
Read more »
Remote Access Trojan
Data Breach data security Data Theft Fake Documents Fake PDF Info Stealer Malware Attack Malware Trojan Malwares Remote Access Trojan

Malware Hides in Fake PDF to DOCX Converters to Target Crypto Wallets and Steal Data

 

Cybercriminals have launched a deceptive malware campaign that disguises itself as online file converters, specifically targeting users searching for PDF to DOCX tools. This scheme uses convincing replicas of popular converter sites to execute hidden PowerShell scripts and deploy a Remote Access Trojan designed to steal sensitive data, including cryptocurrency wallets and browser credentials. 

Security researchers at CloudSEK investigated the threat following an FBI warning issued last month. They discovered that attackers are using a malware variant called Arechclient2, derived from the known info-stealing family SectopRAT. The campaign works by luring unsuspecting users to malicious websites that impersonate legitimate services like PDFCandy. These fake platforms feature realistic user interfaces, including loading indicators and CAPTCHA forms, to establish trust before delivering the malware. When a user attempts to convert a file, they are redirected multiple times before receiving a ZIP archive named “adobe.zip.” Inside the archive is the malicious payload, which installs the Arechclient2 Remote Access Trojan. 

This malware, active since 2019, is capable of scanning for browser-saved credentials, cryptocurrency wallet seed phrases, and even tapping into decentralized finance tools via Web3 APIs. Stephen Ajayi, Technical Lead at Hacken’s Dapp Audit division, explained that the malware not only lifts crypto wallet details but also enables attackers to “ghost-drain” assets after a transaction approval—making it especially dangerous for Web3 users. CloudSEK advises users to avoid downloading tools from unofficial or unverified sites, particularly free online file converters. Instead, they recommend trusted offline software or tools from official sources. 

They also warn that malicious files often disguise themselves using harmless-looking extensions, so users should inspect file types carefully and use reliable antivirus or endpoint detection software. Ajayi emphasized the importance of a proactive security mindset. “In cybersecurity, trust should be earned. Assume nothing is safe by default,” he said. He advised crypto users and general web users alike to adopt a zero-trust approach, keep their security tools updated, and monitor systems for unusual activity such as rogue msbuild.exe processes. 

As threats like these evolve, staying vigilant, maintaining strong security protocols, and preparing for worst-case scenarios are critical steps for avoiding compromise. Regular training and a well-tested incident response plan remain key defenses against such deceptive but damaging attacks.
Read more »
Mobile Cyber Attacks
Cyber Attacks Data Safety User Data data security Information Security Malware Attack Malwares Mobile Cyber Attacks

SK Telecom Malware Attack Exposes USIM Data in South Korea

 

SK Telecom, South Korea’s top mobile carrier, has disclosed a security incident involving a malware infection that exposed sensitive information tied to users’ Universal Subscriber Identity Modules (USIMs). The breach was detected on the night of April 19, 2025, during the weekend when many companies operate with reduced cybersecurity staffing. 

With nearly half of South Korea’s mobile market share and around 34 million subscribers, SK Telecom holds a crucial position in the country’s telecommunications sector. In an official statement, the company explained that malware had infiltrated parts of its network, prompting immediate action to contain the threat. 

The affected systems were isolated swiftly, and the malicious software was removed. So far, SK Telecom has stated there is no confirmed misuse of customer data linked to this breach. This was reported to the Korea Internet & Security Agency (KISA) on April 20, and to the Personal Information Protection Commission. 
Investigations are ongoing to determine how the attackers gained access and the extent of the data exposed. USIM cards store essential data such as International Mobile Subscriber Identity (IMSI) numbers, phone numbers (MSISDN), encryption keys for network authentication, and sometimes even stored contacts or text messages. Unauthorized access to this information could enable cybercriminals to conduct targeted surveillance, track users’ locations, or perform SIM-swapping attacks that could compromise online accounts and digital assets. 

In response, SK Telecom has strengthened security around USIM card management, increasing checks on SIM card replacement activities and monitoring authentication processes for suspicious behavior. Accounts showing irregular activities could face automatic suspension to prevent potential fraud. Additionally, the carrier is advising customers to activate their USIM protection service, a preventive measure that restricts unauthorized SIM swaps, adding extra protection to user accounts. 

A hacking group is yet to claim responsibility for the breach. SK Telecom emphasized that while the malware was neutralized quickly, they remain vigilant and are working closely with cybersecurity authorities to uncover more details about the intrusion and enhance future protections. 

This breach highlights ongoing risks faced by large mobile operators, especially during periods when cyber defenses might be less robust. It also underscores the critical need for mobile carriers to adopt continuous security monitoring and proactive measures to protect customer data from emerging threats. 

As investigations continue, SK Telecom has committed to updating customers and regulators about any new findings or developments related to the incident.
Read more »
Subscribe to: Posts (Atom)