Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label cyberattacks trending news. Show all posts
Microsoft
cyberattacks trending news cybercrime news FBI malware Microsoft

U.S. Shuts Down LummaC2 Malware Network in Major Takedown

 

In a major crackdown on cybercrime, the U.S. Department of Justice (DOJ), in coordination with the FBI and Microsoft, has dismantled a global malware operation known as LummaC2 by seizing five internet domains used to deploy the infostealer malware. LummaC2, notorious for stealing personal and financial data such as browser history, login credentials, and cryptocurrency wallet information, had compromised at least 1.7 million systems worldwide. 

The takedown occurred over three days in May 2025, with two domains seized on May 19, followed by the rapid seizure of three additional domains after the malware operators attempted to restore access. These domains acted as user panels for cybercriminals leasing or buying access to the malware, allowing them to deploy it across networks and extract stolen data. 

FBI Assistant Director Bryan Vorndran said, “We took action against the most popular infostealer service available in online criminal markets. Thanks to partnerships with the private sector, we were able to disrupt the LummaC2 infrastructure and seize user panels.” 

DOJ Criminal Division head Matthew R. Galeotti added, “This type of malware is used to steal personal data from millions, facilitating crimes such as fraudulent bank transfers and cryptocurrency theft.” In a parallel move, Microsoft launched a civil legal action to take down 2,300 more domains believed to be linked to LummaC2 actors or their proxies. 

Emphasising the value of collaboration, Sue J. Bai, chief of the DOJ’s National Security Division, said, “Today’s disruption is another instance where our prosecutors, agents, and private sector partners came together to protect us from the persistent cybersecurity threats targeting our country.” 

The operation, led by the FBI’s Dallas Field Office and supported by several DOJ divisions, forms part of a broader U.S. strategy to counter cyber threats, including a State Department programme offering up to $10 million for information on individuals targeting U.S. critical infrastructure.
Read more »
PDF malware
cyberattacks trending news malware News PDF malware

Multiplatform Malware Campaign Uses PDF Invoices to Deploy Java-Based RAT

 

A new wave of cyberattacks is sweeping across digital infrastructures globally, leveraging weaponised PDF invoices to infiltrate systems with a sophisticated Java-based Remote Access Trojan (RAT). Security researchers from Fortinet have identified a multi-stage, evasive malware campaign targeting Windows, Linux, and macOS devices, exploiting the cross-platform capabilities of Java to establish remote control over compromised machines. 

The attack chain begins with phishing emails that appear to contain legitimate invoice attachments. These emails pass domain authentication checks—such as SPF validation—by misusing the serviciodecorreo.es mail service, which is permitted to send messages on behalf of numerous domains. The attached PDF lures recipients with urgent invoice-related messaging, prompting them to click embedded buttons that lead to the next stage of infection. 

Once a user interacts with the PDF, they are redirected to a Dropbox-hosted HTML file titled “Fattura”—the Italian word for “invoice.” This file prompts a basic CAPTCHA check before further redirecting the victim to a URL generated by Ngrok, a legitimate tunneling service often abused to conceal malicious activity. 

What makes this campaign particularly difficult to detect is its use of geolocation filtering. Depending on the user’s IP address, the final content differs: users located in Italy receive a Java Archive (JAR) file camouflaged under generic filenames such as “FA-43-03-2025.jar,” while users from other regions are shown an innocuous Google Drive document containing a non-malicious invoice from an entity named Medinova Health Group. This strategy effectively thwarts email security platforms that scan links from centralised cloud environments, which often lack region-specific browsing behaviour. 

If the user downloads and runs the JAR file, a Java-based Remote Access Trojan known as RATty is deployed. This malware allows attackers to execute remote commands, log keystrokes, capture screenshots, access files, and even control webcams and microphones. By exploiting the Java Runtime Environment (JRE), the RAT functions across operating systems, significantly broadening its potential victim base. To further evade detection, the campaign uses trusted platforms like Dropbox and MediaFire to host malicious components. Additionally, Ngrok’s dynamic tunneling service helps the attackers disguise their infrastructure, making attribution and blocking more difficult. 

The attackers have also conducted reconnaissance to identify vulnerable domains, optimising their strategy for maximum penetration and persistence. Security experts warn that the use of such multilayered and cross-platform infection techniques reflects the growing sophistication of threat actors. The campaign not only highlights the critical need for advanced threat detection systems but also reinforces the importance of user awareness, particularly around email-based social engineering tactics. 

Organisations are urged to ensure their endpoint protection tools are updated and to consider restricting the execution of Java applications from unknown sources. Furthermore, robust geofencing-aware email filtering and sandboxing solutions could help in flagging such targeted, region-specific attacks before they escalate.
Read more »
News
Bitdefender cyber attack cyberattacks trending news News

Bitdefender Warns of Surge in Subscription Scams Disguised as Online Stores and Mystery Boxes

 

Cybersecurity researchers at Bitdefender have uncovered a sharp increase in deceptive online subscription scams, with fraudsters disguising themselves as legitimate e-commerce platforms and mystery box vendors. These sophisticated schemes are luring unsuspecting users into handing over sensitive credit card details under the guise of low-cost purchases. 

Unlike older, more obvious fraud attempts, this new wave of scams involves meticulously crafted fake websites that mimic real online shops. Bitdefender’s investigation revealed over 200 fraudulent sites offering goods such as footwear, apparel, and electronic gadgets. 

The catch? Victims unknowingly agree to recurring subscription charges cleverly hidden in the fine print. One tactic gaining traction is the so-called “mystery box” scam. These scams entice consumers with a small upfront fee in exchange for a surprise package, often marketed as unclaimed luggage or packages left behind at airports or post offices. 
However, the real goal is to harvest personal and payment information, often enrolling victims in recurring payment plans before the transaction is even finalized. The scams are widely advertised on social media platforms, including Facebook, through sponsored posts. 

In many cases, scammers pose as content creators or use fake influencer pages to build trust. Bitdefender researchers found more than 140 websites pushing these scams, with many traced back to a recurring address in Limassol, Cyprus—an address also linked to entities named in the Paradise Papers by the ICIJ Offshore Leaks Database. 

Some websites go further, advertising discounted “member prices” that require account top-ups, like a charge of €44 every two weeks, often concealed in promotional offers. These scams frequently promote multiple membership levels, using store credits and promises of steep discounts to mask overpriced or outdated products. 

Bitdefender warns that the evolving nature of these scams—complete with high-quality websites, paid advertising, and fake brand endorsements—makes them harder to detect. With the profitability of subscription fraud rising, scammers are scaling their operations, expanding beyond mystery boxes into bogus product sales and investment offers. 

Researchers caution users to stay vigilant while shopping online, especially when prompted to enter payment information for deals that seem too good to be true. As these tactics grow more elaborate, consumers are urged to read the fine print and verify the authenticity of online shops before completing any transactions.
Read more »
Phishing Attacks
Cyber Attacks cyberattacks trending news Netflix cybersecurity News phishing Phishing Attacks

Netflix Users Warned About AI-Powered Phishing Scam

 

Netflix subscribers are being warned about a sophisticated phishing scam circulating via email, designed to steal personal and financial information. 

The deceptive email mimics an official Netflix communication, falsely claiming that the recipient’s account has been put on hold. It urges users to click a link to resolve the issue, which redirects them to a fraudulent login page that closely resembles Netflix’s official site. 

Unsuspecting users are then prompted to enter sensitive details, including their Netflix credentials, home address, and payment information. Cybersecurity experts caution that phishing scams have become more advanced with the rise of AI-driven tactics. 

According to Jake Moore, Global Cybersecurity Advisor at ESET, artificial intelligence has enabled cybercriminals to launch phishing campaigns at an unprecedented scale, making them appear more legitimate while targeting a larger number of users. 

“Despite these advancements, many scams still rely on urgency to pressure recipients into acting quickly without verifying the sender’s authenticity,” Moore explained. 

Users are advised to remain vigilant, double-check email sources, and avoid clicking on suspicious links. Instead, they should visit Netflix directly through its official website or app to verify any account-related issues.
Read more »
Ransomware
cyberattacks trending news Cybersecurity Attack malware News Ransomware

Cisco Talos Uncovers Lotus Blossom’s Multi-Campaign Cyber Espionage Operations

Cisco Talos has uncovered a series of cyber espionage campaigns attributed to the advanced persistent threat (APT) group Lotus Blossom, also known as Spring Dragon, Billbug, and Thrip. 

The group has been active since at least 2012, targeting government, manufacturing, telecommunications, and media sectors in regions such as the Philippines, Vietnam, Hong Kong, and Taiwan. Talos identified Sagerunex, a backdoor tool used exclusively by Lotus Blossom, as the core malware in these campaigns. 

The investigation revealed multiple variants of Sagerunex, evolving from its original form to leverage third-party cloud services such as Dropbox, Twitter, and Zimbra webmail as command-and-control (C2) tunnels, instead of traditional Virtual Private Servers (VPS). This shift helps the group evade detection while maintaining control over infected endpoints. 

The group has been observed gaining persistence on compromised systems by embedding Sagerunex into the system registry and configuring it to run as a service. The malware operates as a dynamic link library (DLL), executed directly in memory to avoid detection. The campaigns also showcase long-term persistence strategies, allowing attackers to remain undetected for months. 

Beyond Sagerunex, Lotus Blossom employs an arsenal of hacking tools to facilitate credential theft, privilege escalation, and data exfiltration. These include a Chrome cookie stealer from GitHub, a customized Venom proxy tool, a privilege adjustment tool, and an archiving tool for encrypting and stealing data. 

Additionally, the group utilizes mtrain V1.01, a modified HTran proxy relay tool, to route connections between compromised machines and external networks. The attack chain follows a structured multi-stage approach, starting with reconnaissance commands such as “net,” “tasklist,” “ipconfig,” and “netstat” to gather system details. 

If an infected machine lacks direct internet access, the attackers leverage proxy settings or the Venom tool to establish connectivity. A notable tactic involves storing malicious tools in the “public\pictures” subfolder, a non-restricted directory, to avoid detection.

Talos’ research underscores the growing sophistication of Lotus Blossom, which continues to refine its techniques and expand its capabilities. With high confidence, Cisco attributes these campaigns to Lotus Blossom, highlighting its sustained cyber espionage operations against high-value targets.
Read more »
News
Chinese Hackers cyber attack Cyber-Espionage cyberattacks trending news cybersecurity news News

Chinese Hackers Exploit SSH Daemon to Maintain Persistent Access in Cyber-Espionage Operations

 

A sophisticated cyber-espionage campaign attributed to the Chinese hacking group Evasive Panda, also known as DaggerFly, has been uncovered, targeting network appliances through a newly identified attack suite. According to cybersecurity researchers at Fortinet’s FortiGuard Labs, the attackers are leveraging a malicious toolkit named ELF/Sshdinjector.A!tr, injecting malware into the SSH daemon (SSHD) to establish long-term access and execute covert operations. 

Active since at least mid-November 2024, this attack method enables unauthorized control over compromised systems. While the initial entry point remains unclear, once infiltrated, a dropper module determines whether the device is already infected and assesses its privilege level. If running under root permissions, the malware deploys multiple binaries, including libssdh.so, which serves as the primary backdoor responsible for command-and-control (C2) communication and data exfiltration. 

Additional components such as “mainpasteheader” and “selfrecoverheader” are used to maintain persistence. The injected SSH library covertly monitors and executes commands received from a remote C2 server, allowing the attackers to conduct system reconnaissance, steal credentials, manipulate files, and execute arbitrary commands. 

The malware supports fifteen different functions, ranging from collecting system details and listing active processes to reading sensitive user data and gaining remote shell access. It can also upload and download files, delete specific records, rename files, and notify the attacker when the malware is active. 

Despite previous detections of similar threats, FortiGuard’s research is the first to provide a detailed analysis of how ELF/Sshdinjector.A!tr operates. The group behind this attack, Evasive Panda, has been active since 2012 and has previously conducted cyber-espionage campaigns, including supply chain attacks via ISPs in Asia and targeted intelligence collection from U.S. organizations. 

The group was also recently linked to deploying a novel macOS backdoor. Notably, Fortinet researchers leveraged AI-assisted tools to aid in the malware’s reverse engineering process. While challenges such as hallucinations, extrapolation errors, and omissions were encountered, the experiment demonstrated AI’s growing potential in cybersecurity research. 

Fortinet assures that its customers are already protected against this threat through its FortiGuard AntiVirus service, which detects the malware as ELF/Sshdinjector.A!tr and Linux/Agent.ACQ!tr. The company has also provided hashes of identified samples on VirusTotal for further investigation by the security community.
Read more »
Supply-Chain Attack
Breach attack cyberattacks trending news Data Breach News Supply-Chain Attack

Hackers Breach Cyberhaven’s Chrome Extension in Supply-Chain Attack, Exfiltrating Sensitive Data

Hackers compromised Cyberhaven’s Chrome extension in a suspected supply-chain attack, publishing a malicious update capable of stealing customer passwords and session tokens. The attack raised serious concerns about the security of widely-used browser extensions. Cyberhaven, a data-loss prevention startup, confirmed the incident but withheld specific technical details about the breach.

According to an email sent to affected customers and later shared by security researcher Matt Johansen, the attack occurred during the early hours of December 25. Hackers reportedly gained access to a company account and used it to push a malicious update (version 24.10.4) to unsuspecting users. This update potentially allowed attackers to exfiltrate sensitive information, such as authenticated session tokens, cookies, and customer credentials.

The breach was detected later that day by Cyberhaven's internal security team, who immediately removed the compromised extension from the Chrome Web Store. A secure version (24.10.5) was released shortly afterward to mitigate the impact and restore user confidence. However, the rapid timeline of the attack highlights the challenges companies face in responding to supply-chain breaches.

Impact on Corporate Users

Cyberhaven’s products are widely used by over 400,000 corporate customers to monitor for data exfiltration and cyber threats. Affected organizations include a mix of prominent enterprises and technology leaders, such as:

  • Snowflake: Cloud data platform provider
  • Canon: Imaging and optical solutions company
  • Motorola: Telecommunications and consumer electronics firm
  • Reddit: Social media and online forum giant
  • AmeriHealth: Healthcare insurance provider
  • Cooley: International law firm
  • IVP: Investment management company
  • DBS: Leading banking group in Asia
  • Kirkland & Ellis: Prestigious global law firm
  • Upstart: AI-powered lending platform

Although Cyberhaven has refrained from disclosing the exact number of customers impacted, the company strongly advised all users to take immediate precautionary steps. These included revoking and rotating passwords, regenerating API tokens, and thoroughly reviewing system logs for any signs of malicious activity.

Security Weaknesses Exploited

The attack shed light on a critical security lapse. Cyberhaven disclosed that the compromised account was the sole administrator for the Google Chrome Store, granting attackers full control over extension updates. However, the exact method used to breach this account remains unclear. The incident has prompted the company to launch a comprehensive security review, with plans to implement stricter safeguards for its account management and extension distribution processes.

To aid in the investigation, Cyberhaven has engaged Mandiant, a leading incident response firm, and is collaborating with federal law enforcement agencies. Early findings suggest the breach was part of a broader campaign targeting multiple Chrome extension developers, affecting extensions with tens of thousands of users.

Insights from Experts

Jaime Blasco, CTO of Nudge Security, emphasized that the attack appeared opportunistic rather than targeted specifically at Cyberhaven. "It seems it wasn’t targeted against Cyberhaven, but rather opportunistically targeting extension developers. I think they went after the extensions that they could based on the developers’ credentials that they had," Blasco explained.

Cyberhaven echoed this assessment, pointing to public reports that suggest the attack extended across multiple organizations. While the full scope of the campaign and the identity of the perpetrators remains unclear, the incident underscores the importance of securing developer credentials and implementing rigorous monitoring processes for software supply chains.

As supply-chain attacks continue to evolve, this breach serves as a stark reminder for organizations to remain vigilant and proactive in securing their digital ecosystems.

Read more »
USA
Cyber Security cyberattacks trending news foreign cyber espionage News USA

U.S. Officials Sound Alarm Over Salt Typhoon Hack as Cybersecurity Becomes Political Flashpoint

 

U.S. Officials Urge Encryption Adoption Amid "Salt Typhoon" Cyberattack In an unprecedented response to the "Salt Typhoon" cyber intrusion, top cybersecurity and law enforcement officials in the U.S. are urging citizens to adopt encrypted messaging platforms. The attack, attributed to Chinese government-linked hackers, has infiltrated critical U.S. telecom systems, enabling monitoring of metadata and communications in Washington, D.C. Scope of the Salt Typhoon Attack Described as "the worst hack in our nation’s history" by Sen. Mark Warner of Virginia, the Salt Typhoon cyberattack has compromised various U.S. systems. Key details include:
  • The breach targeted telecom infrastructure, including systems handling court-ordered wiretaps.
  • While access to classified data remains unconfirmed, the intrusion has caused widespread alarm.
  • Hackers accessed metadata such as call times and locations, though encrypted platforms like Signal and Apple’s iMessage reportedly remained secure.
Global Advisory from Five Eyes Alliance In response, the Five Eyes intelligence alliance—which includes the U.S., UK, Canada, Australia, and New Zealand—has issued a joint advisory. Recommendations include:
  • Strengthening system defenses to mitigate similar threats.
  • Encouraging widespread adoption of encrypted communication platforms.
Political Context Complicates Encryption Discussions Domestically, political developments are influencing the discourse on encryption:
  • Former President Donald Trump is set to return to office in January 2025.
  • Concerns have emerged over potential misuse of federal surveillance tools.
  • Trump's nomination of Kash Patel to head the FBI has amplified fears due to Patel’s controversial statements about targeting political adversaries.
These dynamics have heightened calls for encrypted communication as a safeguard against both foreign and domestic surveillance. 
 
Historically, the FBI has opposed widespread encryption, citing its impact on investigations. However:
  • The FBI now advocates for "responsibly managed encryption," signaling a shift in approach.
  • The Salt Typhoon breach has underscored the vulnerabilities of unencrypted systems.
  • Even intercepted encrypted data is rendered unusable, highlighting encryption’s critical role in security.
The Growing Need for Encryption Salt Typhoon’s success in breaching non-encrypted communication systems serves as a wake-up call:
  • Hackers struggled with encrypted platforms, showcasing their effectiveness in protecting data.
  • Experts warn of more frequent and sophisticated cyberattacks amid rising geopolitical tensions.
For individuals, adopting encryption for personal communications has become indispensable. 

The dual threats of foreign cyber espionage and potential domestic overreach have aligned cybersecurity officials and privacy advocates on the importance of encryption. As the U.S. navigates these challenges, securing digital communications is essential for both national security and personal privacy.
Read more »
Subscribe to: Posts (Atom)