Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label ransomware. Show all posts
Technology
Counterfeit SSDs CPU Credential Theft Cyber Attacks GPU processors ransomware Technology

How Computers Can Leak Secrets Without Being Hacked

 



When people think about a cyberattack, they usually picture stolen passwords, malware, ransomware or someone exploiting a vulnerability to break into a system.

Side-channel attacks work differently. Instead of directly stealing a secret, an attacker studies the traces a computer produces while carrying out normal operations. Tiny differences in processing time, electricity consumption, electromagnetic signals, sounds or hardware activity can reveal clues about what is happening inside the machine.

Think of a locked safe. A thief may not know its combination or be able to break the lock, but if turning the dial produces different clicks or pauses, listening closely could reveal information about the combination. The safe is not deliberately revealing anything. Its physical behavior is simply giving away clues.

Computers can do much the same thing.


A problem that is decades old

Side-channel attacks are not a new phenomenon.

In 1985, Dutch researcher Wim van Eck demonstrated that electromagnetic emissions from video display units could be captured and decoded, potentially revealing what was being displayed. The screen was not intentionally broadcasting its contents, but its normal operation produced signals that could be observed externally.

The technique became particularly important in cryptography during the 1990s. In 1996, researcher Paul Kocher showed that measuring tiny differences in the time taken by cryptographic operations could reveal information about private keys. In 1999, Kocher, Joshua Jaffe and Benjamin Jun demonstrated that measuring power consumption could similarly expose information from cryptographic devices.

Researchers later showed that sound could become another source of leakage. Experiments demonstrated that acoustic emissions from laptops performing cryptographic operations could be analyzed to recover a 4,096-bit RSA key under controlled conditions.

These discoveries changed the way security engineers evaluated systems. A cryptographic algorithm could be mathematically secure while its implementation still leaked information through timing, power, sound or electromagnetic radiation.


When processor performance became a security problem

The rise of modern CPUs created another class of side channels.

Processors use speculative execution to predict which instructions a program will need and execute them ahead of time, improving performance. In 2018, researchers disclosed Meltdown and Spectre, demonstrating that traces left by speculative execution could allow malicious code to infer information that should have remained protected.

The attacks challenged an important assumption in computing: that programs running on the same machine can be reliably isolated from one another. They also demonstrated that security problems could originate from performance features built deep inside the processor rather than from conventional software bugs.

Researchers have continued finding similar problems in newer hardware.

In 2022, Hertzbleed showed that dynamic voltage and frequency scaling, a feature used to manage processor power and performance, could become a timing side channel. Because processor frequency can vary with the computation being performed, an attacker could potentially infer information remotely without directly measuring power consumption. The researchers demonstrated implications for cryptographic key extraction on modern Intel and AMD processors.

In 2023, Downfall exposed another weakness in certain Intel processors through the Gather instruction, while Zenbleed affected AMD's Zen 2 architecture and could expose information from another execution context under particular conditions.

The pattern is becoming difficult to ignore: features designed to make computers faster or more efficient can also create unexpected paths for information leakage.


Side channels are spreading beyond CPUs

Researchers are now finding these channels in other parts of the computing stack.

GPU.zip demonstrated how hardware-based graphics compression could create a side channel capable of exposing visual information processed by graphics processors. The research showed that the problem could extend beyond the CPU and into the way GPUs handle graphical data.

In 2024, GoFetch exposed another hardware-level problem in Apple processors. The attack targeted a feature called a data memory-dependent prefetcher, which predicts future memory requirements to improve performance. Researchers demonstrated that this behavior could undermine protections in cryptographic software and help extract secret keys.

These attacks illustrate why simply securing software is not always enough. Hardware underneath the software can produce information that applications never intended to expose.


The SSD can become a side channel too

The latest research pushes the idea even further.

In 2026, researchers at Graz University of Technology introduced FROST, short for "Fingerprinting Remotely using OPFS-based SSD Timing." The attack targets the browser's Origin Private File System, or OPFS, a feature that allows websites to store and access files within their own sandboxed storage area.

FROST does not give a malicious website direct access to another application's files.

Instead, it measures delays caused when multiple programs compete for the same SSD.

The concept is similar to traffic on a shared road. A driver does not need to see another vehicle to know that it is there. If traffic suddenly makes the journey slower, the delay itself provides information.

FROST applies the same principle to storage. A malicious webpage can repeatedly perform storage operations through OPFS and measure tiny changes in how long they take. Those changes can reveal patterns in other activity occurring on the same computer.

The researchers found that the technique could be used to fingerprint websites and applications. In their evaluation, FROST achieved an F1 score of 88.95% for website fingerprinting and 95.83% for application fingerprinting on tested systems. It can also operate remotely through JavaScript without requiring native code execution.

That does not mean websites can simply read a user's files or see everything happening on a computer. FROST is an inference attack. It identifies activity from the timing patterns produced by shared hardware resources.


A specialised threat, but an important warning

Side-channel attacks are not currently the everyday attack method most users are likely to encounter. Cybercriminals generally have easier options, including phishing, credential theft, malware, ransomware and exploiting vulnerable software.

But their importance extends beyond how frequently criminals use them.

Side-channel research repeatedly reveals that security boundaries can be weaker than they appear. A processor, GPU, browser or storage device may never intentionally disclose sensitive information, yet its normal operation can leave behind measurable clues.

From electromagnetic emissions and cryptographic timing to speculative execution, processor frequency, GPU compression and SSD activity, the side channel keeps changing as computing technology evolves.

Computers do not always need to be hacked for them to leak secrets.

Sometimes, all an attacker needs is to listen to what the machine reveals while it is doing its job.

Read more »
VPNs
compromised credentials Cyber Security Emails MFA Phishing ransomware software Sophos VPNs

Phishing and Compromised Identities Replace Software Exploits as Leading Ransomware Entry Ooint, Sophos Reports





Phishing campaigns, malicious emails and compromised credentials have overtaken software vulnerability exploitation as the leading entry points for ransomware attacks, according to Sophos' State of Ransomware 2026 report, signalling that threat actors are placing greater focus on stealing identities than breaking into unpatched systems.

The report is based on responses from 2,158 IT and cybersecurity leaders across 17 countries whose organisations experienced ransomware attacks during the previous year. While ransomware groups continue to encrypt data in a large share of incidents, the findings point to a clear change in how attackers gain their initial foothold inside enterprise networks.

Malicious email accounted for 26% of ransomware attacks, making it the most common root cause identified by respondents. Phishing followed closely at 24%, while compromised credentials were responsible for another 23% of incidents. In comparison, exploited vulnerabilities accounted for 18% of attacks, a sharp decline from 32% reported in the previous edition of the survey.

Taken together, email-based attacks and stolen credentials were responsible for nearly three-quarters of reported ransomware intrusions, showing that attackers are increasingly relying on social engineering and identity compromise instead of searching for vulnerable internet-facing systems.

Sophos also found that 67% of organisations described the ransomware incident as the most serious identity-related attack they encountered during the past 12 months. Across the surveyed organisations, almost four out of five ransomware attacks originated through compromised identities, placing user accounts and authentication systems at the centre of modern ransomware operations.

The findings also challenge a common assumption about multifactor authentication. Sophos reported that MFA had already been deployed in 97% of attacks where compromised credentials were identified as the root cause, yet attackers still succeeded in gaining access.

According to the company, the figures do not mean MFA has become ineffective. Instead, they point to weaknesses in deployment and the growing sophistication of credential theft techniques. Some organisations may have protected only part of their infrastructure, leaving legacy systems, remote access services or administrative interfaces outside MFA coverage. Those gaps can provide attackers with alternative routes into corporate environments.

Attackers have also refined methods for bypassing authentication protections. Adversary-in-the-middle phishing kits can intercept authentication sessions, while stolen browser cookies and authenticated session tokens allow attackers to access accounts without repeatedly triggering MFA challenges. MFA fatigue attacks, where users are bombarded with repeated authentication requests until one is approved, continue to be used against organisations relying on push-based authentication.

Among organisations using MFA, one-time passwords, push notification applications and passkeys were the most widely deployed authentication methods. FIDO2 security keys ranked behind those options despite offering one of the strongest defences against phishing because authentication is tied to legitimate websites and cannot be replayed through fake login pages.

Although software vulnerabilities no longer ranked as the leading ransomware entry point, Sophos cautioned that organisations should not reduce their focus on patch management. Instead, the report recommends pairing vulnerability remediation with stronger identity security controls to reduce opportunities for attackers to obtain valid credentials.

To reduce the risk of email-driven intrusions, Sophos recommends deploying advanced email filtering alongside domain authentication technologies including DMARC, DKIM and SPF. These controls help organisations verify legitimate senders, detect spoofed domains and prevent fraudulent emails from reaching employees. The company also recommends regular phishing awareness training to help users identify increasingly convincing social engineering campaigns.

Beyond email security, Sophos advises organisations to strengthen identity protection through Identity Threat Detection and Response (ITDR), enforce MFA across every access point and routinely review both human and machine identities to remove unnecessary privileges, dormant accounts and outdated credentials that could be abused during an attack.

Chet Wisniewski, director and global field chief information security officer at Sophos, said organisations with stronger ransomware resilience typically rely on multiple defensive layers rather than a single security control. Network segmentation can slow lateral movement after an initial breach, Zero Trust Network Access (ZTNA) reduces dependence on traditional VPNs, and continuous threat detection gives security teams more opportunities to identify malicious activity before ransomware spreads across the network.

The report also found that ransomware operators successfully encrypted data in 56% of reported attacks. Although median ransom demands and payments have fallen compared with previous years, the findings show that attackers continue to achieve their primary objective once they obtain access. For defenders, protecting identities has become just as important as patching software, with user accounts, credentials and authentication systems now representing the most frequently targeted path into enterprise environments. 

Read more »
US Treasury
Cyber Security Cybersecurity DomainME First VPN Service OFAC sanctions Pavel Durov ransomware t.me Telegram US Treasury

US Sanctions on VPN Service Briefly Disrupt Telegram’s t.me Link Shortener Due to Compliance Action

 

iTelegram's t.me link-shortening domain briefly went offline earlier this week after a compliance action linked to US sanctions inadvertently affected the entire domain instead of a specific Telegram link.

Users began reporting on Monday that t.me short links were inaccessible after the domain was placed under a "serverHold" status, effectively making it unavailable across the internet. The registry status suggested that the action had been initiated by the domain's registry operator, causing widespread disruption to Telegram's link-sharing functionality.

Following the outage, Telegram CEO Pavel Durov reached out to DomainME, the registry responsible for managing the .me top-level domain, requesting an investigation into the issue.

On Tuesday, DomainME clarified the reason behind the disruption, stating, "t.me was on hold due to the OFAC compliance, but it is back online now."

The reference to OFAC points to the US Treasury Department's Office of Foreign Assets Control, which oversees and enforces US economic and trade sanctions. The same day the domain became unavailable, OFAC announced sanctions against First VPN Service, alleging that the platform had been used by multiple ransomware groups to conceal malicious activities targeting US businesses, hospitals, and government organizations.

As part of the sanctions, OFAC designated the VPN service's alleged administrator, Ukrainian national Dmytro Rashevskyi, along with associated infrastructure, including the domains 1vpns.com and 1vpns.net, as well as cryptocurrency wallet addresses. The sanctions are intended to prevent US individuals and businesses from engaging with the VPN provider.

According to reports, the sanctions documentation specifically referenced the Telegram support link t.me/FirstVPNService. This appears to have led to an unintended compliance action in which the entire t.me domain was placed on hold instead of only the sanctioned Telegram link.

In a subsequent statement, DomainME said, "the .ME Registry works closely with law enforcement to monitor and mitigate issues across the .ME domain in accordance with applicable laws, including sanctions requirements." The company suggested that the suspension was part of its sanctions compliance process rather than a simple technical error.

The t.me domain has since been restored and now redirects users to Telegram's primary website.

Meanwhile, the FBI has warned that First VPN Service, operational since 2014, has been widely used by cybercriminals. Investigators say at least 25 ransomware groups have relied on the VPN platform. While the service promoted itself as a privacy-focused VPN, authorities allege it has also been connected to botnet operations, distributed denial-of-service (DDoS) attacks, online scams, and hacking campaigns.

The FBI further stated, “First VPN Service was almost exclusively advertised in known criminal dark web forums such as Exploit[.]in and XSS[.]is, two of the most prominent Russian-language online forums which provide marketplaces for cyber criminals to buy and sell unauthorized access to computer systems, stolen personal identifying information, hacking tools, and contraband,” the agency added.
Read more »
USA
Cyber Crime First VPN ransomware Sanctions USA

US Sanctions VPN Provider and Malware Service Operator Accused of Supporting Ransomware Campaigns

 



The US Department of the Treasury's Office of Foreign Assets Control (OFAC) has imposed sanctions on a virtual private network (VPN) provider, its administrator and a Belarusian malware service operator, accusing them of supplying infrastructure and tools that helped ransomware groups carry out attacks against organisations across the United States.

The sanctions target First VPN Service (1VPNS), its administrator Dmytro Rashevskyi, and Belarusian national Yegeniy Vladimirovich Silayev. US officials say the three played key roles in supporting the wider ransomware ecosystem by providing services that allowed threat actors to conceal their identities, evade security tools and sustain cybercriminal operations.

According to the Treasury Department, 1VPNS has been operating since 2014 and openly marketed its services on cybercrime forums frequented by ransomware operators and other malicious actors. The VPN provider reportedly promoted a strict no-logs policy, claiming it did not retain records of users' online activity or identities and would not cooperate with law enforcement requests. Investigators allege these assurances made the service particularly attractive to cybercriminals seeking to obscure their activities.

Authorities also accuse Rashevskyi of using fraudulent identities, including the aliases "Maksim Sorin" and "Roman Chabanenko," to obtain internet infrastructure from service providers that would otherwise have declined to host the operation because of repeated abuse complaints. Officials say the use of false identities enabled the VPN service to continue operating despite growing scrutiny from infrastructure providers.

The sanctions follow a multinational law enforcement operation that dismantled 1VPNS earlier this year. In May, European authorities, working alongside the FBI's Boston Field Office, seized the service's website and infrastructure as part of Operation Saffron, a coordinated investigation led by French and Dutch law enforcement agencies.

The investigation into 1VPNS began in December 2021, when authorities successfully infiltrated the VPN provider's infrastructure. Investigators quietly gathered intelligence, including access to the service's customer database, before ultimately dismantling the operation after several years of surveillance and evidence collection.

During the coordinated enforcement action, authorities seized 33 servers spread across 27 countries, arrested the service's administrator and identified thousands of users allegedly linked to ransomware operations, online fraud and other forms of cybercrime. Europol previously stated that 1VPNS had appeared in nearly every major cybercrime investigation it supported, underscoring the service's alleged role within the broader cybercriminal ecosystem.

US officials said organisations affected by ransomware attacks involving infrastructure provided by 1VPNS included businesses, hospitals, financial institutions and municipal governments. These sectors have increasingly become frequent targets of ransomware campaigns because operational disruption often places significant pressure on victims to pay extortion demands.

In a separate but related action, OFAC also sanctioned Silayev for allegedly developing and selling cryptors, also known as crypters, to cybercriminals. Cryptors are specialised software tools designed to modify malware so that it appears different to security products, making malicious code significantly harder for antivirus software and endpoint detection systems to identify. While cryptors do not carry out attacks themselves, they are widely used to help ransomware and other malware bypass detection during deployment.

The Treasury Department estimates that ransomware operations using services provided by 1VPNS and malware protected by Silayev's cryptors have collectively contributed to billions of dollars in losses suffered by US businesses and operators of critical infrastructure.

In announcing the sanctions, State Department spokesperson Thomas Pigott said the designated individuals supplied ransomware groups with services that concealed their identities, disguised malicious software and helped attackers avoid detection, ultimately enabling campaigns responsible for billions of dollars in damages. Pigott added that the United States and its international partners are increasingly focusing not only on ransomware operators themselves but also on the infrastructure providers and service suppliers that make these attacks possible.

The sanctions were coordinated with the United Kingdom's Foreign, Commonwealth and Development Office as part of a broader international effort to disrupt cybercriminal networks. Under OFAC sanctions, any property or financial interests belonging to the designated individuals or entities that fall under US jurisdiction are blocked. In addition, US individuals and organisations are generally prohibited from engaging in transactions involving the sanctioned parties.

The action forms part of a wider strategy aimed at disrupting the ransomware supply chain by targeting the businesses and technical service providers that support cybercriminal operations. Rather than focusing exclusively on the attackers who deploy ransomware, governments are increasingly using financial sanctions, infrastructure seizures and international law enforcement cooperation to dismantle the broader ecosystem that enables these campaigns.

The sanctions were announced as the European Union and the United Kingdom also introduced coordinated sanctions against dozens of Russian individuals and entities accused of supporting a network of hacking groups responsible for cyberattacks across Europe, reflecting continued international efforts to increase pressure on organisations and individuals believed to facilitate malicious cyber activity.

Read more »
software
Cybersecurity Hyadina Microsoft PoisonX RaaS ransomware software

Microsoft-Signed Driver Used to Disable Security Software in GodDamn Ransomware Attacks

 


A ransomware group known as Hyadina has been observed using a Microsoft-signed Windows kernel driver to disable endpoint security software before deploying its latest ransomware variant, GodDamn, according to researchers at Symantec. The campaign combines trusted administrative software, publicly available offensive security tools and a signed kernel driver to establish control over victim environments before encrypting systems.

Hyadina has operated as a ransomware-as-a-service (RaaS) group for approximately four years, evolving its malware from earlier variants known as Beast and Monster to its current GodDamn locker. The group primarily targets organizations in the United States while reportedly avoiding victims in former Soviet countries. Previous attacks have affected organizations across healthcare, manufacturing, education and several other industries.

Symantec was unable to determine how the attackers initially gained access to the compromised environment. The first confirmed activity appeared on May 29, when an unauthorized copy of AnyDesk was discovered inside the Music folder of an infected system. Although AnyDesk is legitimate remote access software widely used for IT support, threat actors frequently abuse remote monitoring and management applications because they provide persistent access while blending into normal administrative activity.

The following day, the attackers deployed an executable named symantec.exe, which installed a kernel-mode driver called PoisonX. Running in the Windows kernel gives a driver the highest level of system privileges, allowing it to interact directly with core operating system functions. According to Symantec, PoisonX carried a valid Microsoft Hardware Compatibility signature, enabling Windows to load the driver as trusted.

Once active, PoisonX terminated security-related processes and removed user-mode API hooks commonly used by endpoint detection and response (EDR) solutions to monitor application behavior. By disabling those monitoring mechanisms, the attackers reduced the visibility of security software before carrying out the remaining stages of the intrusion.

With endpoint protections weakened, Hyadina expanded its operation using a collection of credential theft and reconnaissance utilities. Investigators observed fourteen open-source tools designed to recover credentials from web browsers, email clients and instant messaging applications, as well as utilities capable of extracting Wi-Fi credentials and capturing live network traffic. All but one of those tools originated from NirSoft, which publishes legitimate Windows administration utilities. The remaining tool, Mimikatz, is widely known for extracting credentials and authentication material from Windows systems and is frequently abused during post-compromise activity.

The attackers also relied on PsExec, Microsoft's remote administration utility, to move laterally across the victim's network. Combined with legitimate remote management software, credential theft utilities and the signed kernel driver, the attackers were able to strengthen their foothold across multiple systems before deploying the GodDamn ransomware payload.

Symantec also examined the origins of PoisonX. The driver was uploaded to GitHub on April 7 by a developer using the name oxfemale, who described it as a research tool. The developer regularly publishes offensive security projects, including exploit proof-of-concepts, credential stealers and software designed to disable antivirus products, while identifying themselves on LinkedIn as a Russian security researcher specializing in reverse engineering and penetration testing. Symantec, however, considers PoisonX to be malware because its primary function is to disable security protections rather than support legitimate defensive research. Researchers said it remains unclear how the driver obtained Microsoft's Hardware Compatibility signature or whether the signing process was manipulated.

Microsoft maintains a Vulnerable Driver Blocklist to prevent known malicious or exploitable drivers from loading, even when they possess valid signatures. However, Symantec noted that newly identified drivers are not added to the blocklist immediately. Updates can take days or, in some cases, weeks to reach enterprise systems, leaving a window during which attackers can continue using newly signed or newly discovered drivers before defensive protections are updated.

Commenting on the broader use of legitimate software during ransomware intrusions, Symantec's Brigid O Gorman noted that nearly any administrative or security tool can become malicious when misused. She said this makes behavioral and adaptive security controls particularly important because they focus on suspicious activity rather than relying solely on known malicious files or applications. In the case of Hyadina, that combination of trusted software, publicly available offensive tools and a signed kernel driver enabled the attackers to disable security protections, steal credentials, move laterally through the environment and ultimately deploy ransomware.

Read more »
US
Coca-Cola dairy products Data Breach Data Theft Fairlife ransomware US

Coca-Cola says ransomware attack disrupts Fairlife operations, temporarily suspends U.S. dairy production

 


The Coca-Cola Company has revealed that a ransomware attack targeting its Fairlife dairy business has temporarily disrupted production across the United States after threat actors gained unauthorized access to company systems, including those supporting manufacturing operations.

The incident was disclosed in a Form 8-K filing with the U.S. Securities and Exchange Commission (SEC), a regulatory filing used by publicly traded companies to report significant corporate events. According to Coca-Cola, the cyberattack affected certain Fairlife systems, including production-related infrastructure, prompting the company to temporarily suspend manufacturing at its U.S. facilities while recovery efforts are underway.

Upon detecting the unauthorized activity, Coca-Cola said it immediately activated its incident response and business continuity protocols to contain the incident and minimize operational disruption. The company has engaged external cybersecurity advisors and experts to support its investigation and recovery efforts, while law enforcement has also been notified.

Although manufacturing operations have been interrupted, Coca-Cola emphasized that the ransomware attack has not affected the quality or safety of Fairlife products. The temporary production halt is part of the company's response as it works to restore impacted systems and verify operational readiness before resuming normal manufacturing activities. Fairlife's Canadian production facilities continue to operate normally and have not been affected by the incident.

The company said its investigation remains ongoing and that it is continuing to assess both the nature of the attack and its potential business impact. At this stage, Coca-Cola has not determined whether the incident is reasonably likely to have a material effect on the company's financial condition or overall operations.

Fairlife is one of Coca-Cola's dairy brands and manufactures a range of ultra-filtered milk products, protein shakes and nutrition beverages sold across the United States. Its product portfolio includes Ultra-Filtered Milk, Core Power Protein Shakes and Nutrition Plan.

Several aspects of the incident remain undisclosed. Coca-Cola has not confirmed whether attackers exfiltrated any data during the intrusion, whether the company has received an extortion demand or which ransomware operation may be responsible for the attack. As of publication, no known ransomware group has publicly claimed responsibility for the incident.

Ransomware attacks increasingly target organizations' operational environments in addition to traditional corporate networks, as disrupting production can exponentially multiply pressure on victims during recovery efforts. Many modern ransomware operations also employ double-extortion tactics by stealing sensitive information before encrypting systems and later threatening to publish the stolen data unless a ransom is paid. However, Coca-Cola has not indicated that any data theft occurred in this incident, and there is currently no public evidence confirming that attackers exfiltrated information from Fairlife's systems.

When asked whether data had been stolen, whether the company had received an extortion demand or which ransomware group may have been behind the attack, a Coca-Cola spokesperson declined to provide additional details beyond the company's public statement.

Coca-Cola continues to restore affected systems while its investigation remains ongoing, with U.S. Fairlife production expected to resume once recovery efforts are completed and manufacturing systems have been safely brought back online.

Read more »
RDP
Cryptographic Dark Web Data Theft malware Prinz Eugen RAAS ransomware RDP

New Prinz Eugen Ransomware Targets Recently Modified Files First, Researchers Find

 



Security researchers have revealed a ransomware operation known as Prinz Eugen that employs an unusual file-encryption strategy designed to increase pressure on victims. According to an investigation by ThreatDown, Malwarebytes' enterprise security division, the malware gives priority to files that have been modified most recently, focusing its efforts on data that organizations are most likely to rely on for day-to-day operations.

Researchers describe the actors behind Prinz Eugen as highly interactive intruders who rely on direct involvement throughout the attack process rather than fully automated deployment methods. Instead of depending on large-scale ransomware affiliate networks, the group appears to conduct attacks manually, using legitimate administration tools and built-in system utilities to move through victim environments and maintain access.

Evidence collected during incident response investigations suggests that attackers may initially gain entry through compromised Remote Desktop Protocol (RDP) credentials. After securing access, operators manually retrieve and launch the ransomware payload, identified as servertool.exe. In one investigated intrusion, researchers observed the use of the RemotePC remote management platform, alongside the creation of a backdoor administrator account that allowed the attackers to retain access to the compromised environment.

ThreatDown noted that Prinz Eugen does not currently appear to operate under the ransomware-as-a-service model that has become common across the cybercriminal ecosystem. Researchers found no indication that the group's operators are actively recruiting affiliates or distributing their malware to external partners. Instead, available evidence points to a more centralized operation in which attacks are carried out directly by the threat actors themselves.

Although the group's data-leak platform presently displays only three victims, researchers believe the actual number of affected organizations is higher. Information gathered during investigations indicates that multiple organizations have experienced incidents linked to the ransomware. Depending on the attack, victims may face file encryption, data theft, or a combination of both. Security researchers have identified at least five organizations impacted by the operation, including an incident involving Standard Bank, where attackers reportedly demanded a ransom payment of one Bitcoin. The demand was ultimately rejected.

One of the most distinctive characteristics of Prinz Eugen is its approach to selecting files for encryption. Analysis of the malware revealed that it processes files according to modification time, encrypting the most recently changed data before moving to older content. When several files share the same timestamp, the malware follows alphabetical order to determine which file is processed next.

Researchers believe this strategy is intended to maximize operational disruption. Files that have been edited recently are often associated with ongoing business activities, active projects, financial records, or other information that employees depend on regularly. By rendering this data inaccessible first, attackers can create immediate pressure on organizations to engage with extortion demands.

Technical analysis further showed that the ransomware scans directories recursively without imposing depth restrictions. Unlike some ransomware families that avoid certain locations or system folders, the examined Prinz Eugen sample applies very few limitations. The malware attempts to encrypt virtually every accessible file it encounters, excluding only files that already carry the .prinzeugen extension, which is added to data after encryption has been completed.

The encryption mechanism itself incorporates multiple modern cryptographic components. Researchers found that the ransomware uses the ChaCha20-Poly1305 algorithm together with a 32-byte master key. Each targeted file receives its own randomly generated initialization vector, while key generation and derivation processes rely on Argon2id, SHA-256, and HKDF-SHA256. Data is encrypted in 1 MB segments, and SHA-256 hashing is used to verify file integrity throughout the process.

Investigators also identified a safeguard built into the malware's deletion routine. When operators use the – delete option, the ransomware removes original files only after confirming that the encrypted version can be successfully decrypted. This verification step reduces the likelihood of accidental data destruction that could undermine the attackers' leverage over victims.

Beyond encrypting files, Prinz Eugen incorporates measures intended to frustrate forensic investigations. Researchers observed that the malware overwrites encryption keys with zero values once they are no longer needed, triggers garbage collection routines to remove remaining traces from memory, and then attempts to delete itself from disk. These actions are designed to make post-incident analysis and key recovery efforts more difficult.

Another noteworthy aspect of the ransomware is the absence of conventional extortion artifacts. The analyzed sample contains no functionality for dropping a ransom note onto infected systems, nor does it alter the victim's desktop wallpaper to display payment instructions. While such techniques have historically been common among ransomware groups, ThreatDown researchers noted that some organized operations are increasingly shifting away from visible on-system communications.

Instead, attackers may conduct negotiations through external channels such as email correspondence, direct phone contact, or dedicated dark-web portals. By moving communications outside the compromised environment, threat actors leave behind fewer artifacts that investigators can collect and reduce opportunities for automated security tools to identify the extortion phase of an attack.

To assist defenders, ThreatDown has published a collection of indicators of compromise associated with Prinz Eugen activity. These indicators can help security teams, incident responders, and researchers identify potential infections, investigate suspicious activity, and strengthen defenses against future attacks involving the ransomware. 

Read more »
rapid7
Cyber Crime Digital Fraud Extortion FBI FTSE IABs ransomware rapid7

Ransomware Revenues Climb as Criminal Networks Expand and Adapt like unwanted vines

 




Ransomware operators continue to generate substantial profits, with new research from Rapid7 indicating that several cybercrime groups are recording revenue growth that outpaces many publicly traded businesses.

According to the cybersecurity firm's analysis, ransomware groups collectively received an estimated $529.2 million during the first quarter of 2026. That figure represents a 39% increase compared with the same period a year earlier. Rapid7 noted that none of the companies within the FTSE 350 index reported year-over-year revenue growth exceeding 30% during that quarter, placing ransomware operators among the fastest-growing entities examined in the study.

Several well-established ransomware operations appear to be benefiting from this trend. Rapid7 estimates that the Qilin ransomware group generated approximately $193 million between July 2025 and March 2026. During the same period, the Gentleman group is estimated to have collected roughly $52 million in ransom payments.

Rapid7 researchers argue that modern ransomware operations bear little resemblance to the stereotype of small groups of hackers working independently. Instead, many function through interconnected networks of specialists who focus on specific stages of an attack. Some actors gain access to victim networks, others develop malware, while separate teams handle extortion demands and payment negotiations.

A major factor behind this growth is the emergence of Initial Access Brokers, or IABs. These actors specialize in obtaining access to corporate networks and then selling that access to other criminals. As a result, launching a ransomware attack no longer requires extensive technical expertise. Access to compromised systems, attack tools, and even managed cybercrime services can now be purchased through underground marketplaces.

Researchers say this division of labor has created a more structured criminal economy. Different groups contribute individual services, allowing ransomware campaigns to operate through networks that resemble commercial supply chains rather than isolated criminal crews.

The study also highlights the resilience of these operations. Infrastructure used by ransomware groups, including servers, data leak platforms, and victim negotiation portals, can often be restored quickly after disruptions. Law enforcement agencies, meanwhile, frequently require lengthy investigations and international coordination before conducting enforcement actions. This difference in speed allows many criminal networks to continue operating even when portions of their infrastructure are removed.

Rapid7 CTO EMEA Thom Langford said ransomware groups have demonstrated an ability to continue generating revenue despite disruptions because their operations are designed to function even when individual components are taken offline. In many cases, the removal of a single server or criminal group does not significantly affect the broader ecosystem supporting ransomware activity.

The findings come amid continued financial losses linked to cybercrime. According to the FBI's Internet Crime Complaint Center, organizations and individuals reported more than $16 billion in cybercrime losses during 2024, reflecting the growing economic impact of digital fraud, extortion, and network intrusions.

To reduce ransomware risk, Rapid7 recommends that organizations continuously review their exposed systems and identify weaknesses that could provide attackers with an entry point. Particular attention should be given to misconfigured services, overlooked assets, and internet-facing systems, which are frequently targeted by Initial Access Brokers seeking access to corporate environments.

The company also advises security teams to make greater use of threat intelligence to understand how attackers operate, including the infrastructure, tools, and access methods commonly used during intrusions. Researchers further recommend strengthening identity security through tighter access controls, least-privilege policies, and monitoring for signs that employee credentials have been stolen, resold, or abused.

According to Rapid7, disrupting ransomware attacks before attackers establish access remains one of the most effective defensive strategies. By identifying weaknesses early and restricting opportunities for credential theft, organizations may be able to prevent ransomware incidents before they progress to the extortion stage.

Read more »
sophos
Artificial Intelligence Claude malware MITRE ATT&CK ransomware sophos

AI-Assisted Malware Lab Found Testing Ways to Evade Security Tools, Sophos Reports

 



Researchers at cybersecurity firm Sophos have uncovered a malware development framework that uses artificial intelligence tools to speed up the creation and testing of ransomware-related software designed to avoid detection by security products.

The investigation began after Sophos analysts discovered suspicious files on a customer system. What initially appeared to be a collection of penetration-testing tools soon revealed signs of criminal activity, including references to ransom notes and organizations listed on ransomware leak sites.

According to Sophos, the framework combines traditional attack tools with AI-assisted development workflows. Researchers found evidence that the operators used coding assistants such as Cursor and Claude Opus during different stages of development, including writing code, reviewing results, refining payloads, and researching techniques that could help malware evade security controls.

One of the framework's primary goals was to bypass Endpoint Detection and Response (EDR) platforms. These security products are designed to identify malicious activity on computers and servers, often detecting attacks that traditional antivirus software might miss.

The toolkit contained several components intended to reduce the chances of detection. Among them were customized Cobalt Strike profiles that made malicious network traffic resemble ordinary web browsing activity, communication channels that routed commands through Telegram, and malware development scripts capable of injecting malicious code into legitimate Windows applications while allowing those programs to continue functioning normally.

Researchers also identified the use of a Cloudflare Worker that acted as an intermediary between infected systems and attacker-controlled infrastructure. This setup can make it more difficult for defenders to identify the true location of command-and-control servers.

A particularly notable feature of the framework was an automated Active Directory discovery system. Active Directory is widely used in enterprise networks to manage users, computers, permissions, and other resources. Because it contains valuable information about an organization's internal structure, attackers frequently attempt to map Active Directory environments after gaining access to a network.

Sophos found that the discovery process relied on a series of AI-assisted agents that gathered information, assessed results, selected follow-up actions, and continued the investigation of the network. Rather than requiring a human operator to manually perform every step, parts of the reconnaissance process could be carried out through predefined automated workflows.

The framework itself appeared to operate through multiple specialized AI agents assigned to different tasks. Sophos reported that one agent coordinated the overall development process while others focused on testing, documentation, operational security improvements, virtual machine deployment, proxy testing, and malware evaluation.

Researchers also discovered that some agents had been tasked with examining publicly available security research. The system collected information from technical reports and research publications, extracted details about detection-evasion methods, mapped those techniques to the MITRE ATT&CK framework, recreated testing environments, and documented the results.

At the center of the operation was a Python-based payload generation tool. This component produced malware written primarily in Rust and Go while combining encryption, execution techniques, and anti-analysis measures intended to make detection more difficult. Sophos observed nearly 80 generated modules being tested against more than 70 separate evasion methods.

The malware was evaluated in laboratory environments against security products from Sophos, CrowdStrike, and Microsoft. Researchers noted that repeated testing and revision cycles appeared to improve the success rate of many payloads. However, they also observed inconsistencies between some reported results and actual testing outcomes, leaving questions about the accuracy of certain internal performance claims.

Despite the extensive use of artificial intelligence during development, Sophos found no indication that AI was embedded within deployed malware or operating independently on victim systems. The technology was primarily used to accelerate the research, testing, and refinement process while human operators remained responsible for directing the activity.

The findings provide another example of how threat actors are incorporating AI into existing workflows. Rather than introducing entirely new attack methods, these tools appear to be helping attackers shorten the time needed to transform publicly available security research into functioning malware capable of challenging modern security defenses.

Read more »
virus
Antivirus malware ransomware spyware trojans virus

Virus, Malware, or Spyware? Here’s What They Really Mean

 




Many people casually refer to every cyber threat as a “virus,” but cybersecurity professionals use a much broader classification system. A security program that only defended against traditional computer viruses would offer very limited protection today because viruses represent just one form of malicious software. Modern antivirus platforms are designed to detect and block many different categories of malware, including ransomware, spyware, trojans, credential stealers, rootkits, and bot-driven attacks.

Traditional computer viruses have also become less common than they once were. Most modern cybercriminal groups are financially motivated and prefer attacks that generate revenue rather than simple disruption or digital vandalism. Spyware operators profit from stolen personal information, banking trojans attempt to drain financial accounts directly, and ransomware gangs demand cryptocurrency payments from victims in exchange for restoring encrypted files. Because current security tools already defend against a wide range of malicious software, most users do not usually need to distinguish one malware family from another during day-to-day use.

At the same time, understanding these terms still matters. News reports about cyberattacks, data breaches, espionage campaigns, and ransomware incidents often contain technical language that can confuse readers unfamiliar with cybersecurity terminology. Knowing how different forms of malware behave makes it easier to understand how attacks spread, what damage they cause, and why security researchers classify them differently.

A traditional virus spreads when a user unknowingly launches an infected application or boots a compromised storage device such as a USB drive. Viruses generally try to remain unnoticed because their ability to spread depends on avoiding detection long enough to infect additional files, programs, or devices. In many cases, the malicious payload activates only after a specific date, time, or triggering condition. Earlier generations of viruses often focused on deleting files, corrupting systems, or displaying disruptive messages for attention. Modern variants are more likely to steal information quietly or help conduct distributed denial-of-service attacks that overwhelm online services with massive volumes of internet traffic.

Worms share some similarities with viruses but spread differently because they do not necessarily require users to open infected files. Instead, worms automatically replicate themselves across connected systems and networks. One of the earliest examples, the Morris worm of 1988, was originally intended as an experiment to measure the size of the developing internet. However, its aggressive self-replication consumed enormous amounts of bandwidth and disrupted numerous systems despite not being intentionally designed to cause widespread destruction.

Trojan malware takes its name from the ancient Greek story of the Trojan Horse because it disguises malicious code inside software that appears safe or useful. A trojan may present itself as a game, utility, browser tool, mobile application, or software installer while secretly performing harmful actions in the background. These threats often spread when users unknowingly download, share, or install infected files. Banking trojans are particularly dangerous because they can manipulate online financial transactions or steal login credentials directly. Other trojans harvest personal information that can later be sold through underground cybercrime marketplaces.

Some malware categories are defined less by how they spread and more by what they are designed to do. Spyware, for example, focuses on monitoring victims and collecting sensitive information without consent. These programs may capture passwords, browsing histories, financial information, or login credentials. More invasive forms of spyware can activate webcams or microphones to observe victims directly. A related category known as stalkerware is frequently installed on smartphones to monitor calls, messages, locations, and online activity. Because surveillance-focused malware has become increasingly common, many modern security products now include dedicated spyware protection features.

Adware primarily generates unwanted advertisements on infected devices. In some cases, these advertisements are targeted using data gathered through spyware-related tracking techniques. Aggressive adware infections can become so intrusive that they interfere with normal computer use by flooding browsers, redirecting searches, or constantly displaying pop-up windows.

Rootkits are designed to hide malicious activity from operating systems and security software. They manipulate how the system reports files, processes, or registry information so infected components remain invisible during scans. When security software requests a list of files or registry entries, the rootkit can alter the response before it is displayed, effectively concealing the malware’s presence from the user and from defensive tools.

Bot malware usually operates silently in the background and may not visibly damage a computer at first. Instead, infected devices become part of remotely controlled botnets managed by attackers sometimes referred to as bot herders. Once connected to the botnet, systems can receive commands to send spam emails, participate in coordinated cyberattacks, or overwhelm websites with malicious traffic. This arrangement also helps attackers hide their own infrastructure behind thousands of compromised machines.

Cryptojacking malware secretly hijacks a device’s processing power to mine cryptocurrencies such as Bitcoin. Although these infections may not directly destroy data, they can severely slow systems, increase electricity usage, drain battery life, and contribute to overheating problems because of constant processor strain.

The malware ecosystem also includes droppers, which are small programs designed specifically to install additional malicious software onto infected systems. Droppers often operate quietly to avoid attracting attention while continuously delivering new malware payloads. Some receive instructions remotely from attackers regarding which malicious programs should be installed. Cybercriminal operators running these distribution systems may even receive payment from other malware developers for spreading their software.

Ransomware remains one of the most financially damaging forms of cybercrime. In most attacks, the malware encrypts documents, databases, or entire systems and demands payment in exchange for a decryption key. Security software is generally expected to detect ransomware alongside other malware categories, but many cybersecurity professionals still recommend additional dedicated ransomware defenses because the consequences of missing a single attack can be devastating. Hospitals, schools, businesses, and government organizations around the world have all experienced major operational disruptions linked to ransomware campaigns.

Not every program claiming to improve cybersecurity protection is legitimate. Fake antivirus products, commonly called scareware, are designed to frighten users with fabricated infection warnings and pressure them into paying for unnecessary or malicious software. At best, these programs provide no meaningful protection. At worst, they introduce additional security risks or steal financial information entered during payment. Many scareware campaigns rely on alarming pop-ups and fake scan results to manipulate victims psychologically.

Identifying fake security products has become increasingly difficult because many now imitate legitimate software convincingly. Cybersecurity experts generally recommend checking trusted reviews and downloading security tools only from reputable vendors or established sources. Fraudulent review websites also exist, making careful verification especially important before installing security software.

Modern malware rarely fits neatly into a single category. One malicious program may spread like a virus, steal information like spyware, and hide itself using rootkit techniques simultaneously. Likewise, modern security solutions rely on multiple defensive layers rather than antivirus scanning alone. Comprehensive security suites may include firewalls that block network-based attacks, spam filters that intercept malicious email attachments, phishing protection systems, and virtual private networks that help secure internet traffic. Some VPN services, however, restrict advanced features behind additional subscription payments.

The term “malware” ultimately serves as a broad label covering every type of software intentionally created to harm systems, steal information, spy on users, disrupt operations, or provide unauthorized access. Industry organizations such as Anti-Malware Testing Standards Organization often prefer the term “anti-malware” because it reflects the wider range of threats modern security tools must address. However, most consumers remain more familiar with the word “antivirus,” which continues to dominate the industry despite the changing nature of cyber threats.

Understanding these distinctions does not require becoming a cybersecurity specialist, but it does help people recognize how varied modern digital threats have become. From ransomware and spyware to botnets and credential-stealing trojans, malicious software now exists in many different forms, each designed for a specific purpose within the broader cybercrime economy.

Read more »
zero day
CISA EPMM IP Address Ivanti EPM ransomware security flaws vulnerabilities and Exploits zero day

Ivanti Patches New EPMM Vulnerability Linked to Active Zero-Day Exploitation

 



Software provider Ivanti has released security updates for a newly identified vulnerability in its Endpoint Manager Mobile (EPMM) platform after confirming that the flaw has already been used in limited zero-day attacks.

The vulnerability, tracked as CVE-2026-6973, has been classified as high severity. According to Ivanti, the issue is caused by improper input validation, which refers to a weakness in how an application processes and checks incoming data before handling a request. If exploited successfully, the flaw could allow a remote attacker with administrator-level access to run arbitrary code on vulnerable systems.

Ivanti stated that the vulnerability affects EPMM version 12.8.0.0 and earlier releases. To reduce exposure, the company has issued patched versions including EPMM 12.6.1.1, 12.7.0.1, and 12.8.0.1. The company is also advising customers to review accounts with administrative privileges and rotate credentials where necessary, particularly in environments where earlier compromise activity may have occurred.

In its advisory, Ivanti said the exploitation activity observed so far appears to be limited in scope and requires valid administrator authentication in order to succeed. The company added that it has not identified active exploitation involving the additional vulnerabilities disclosed alongside CVE-2026-6973.

Ivanti also clarified that the issue impacts only the on-premises version of Endpoint Manager Mobile. The company said the flaw does not affect Ivanti Neurons for MDM, which is its cloud-based endpoint management platform. Other products, including Ivanti EPM and Ivanti Sentry, were also listed as unaffected.

Data published by internet monitoring organization Shadowserver Foundation currently shows more than 850 internet-accessible IP addresses associated with Ivanti EPMM deployments. Most of the exposed systems appear to be located in Europe, followed by North America. However, there is still no public visibility into how many of those servers have already installed the latest patches.

Alongside the actively exploited flaw, Ivanti disclosed fixes for four additional high-severity vulnerabilities identified as CVE-2026-5786, CVE-2026-5787, CVE-2026-5788, and CVE-2026-7821. According to the company, these flaws could potentially be used to obtain administrator access, impersonate registered Sentry hosts to receive valid certificate authority-signed client certificates, invoke unauthorized methods, or gain access to restricted information stored within affected environments.

The company stated that it currently has no evidence showing these four vulnerabilities have been exploited in real-world attacks. Ivanti also noted that CVE-2026-7821 affects only organizations using Apple Device Enrollment configurations.

The latest disclosure follows earlier security incidents involving Ivanti EPMM earlier this year. In January, the company disclosed two separate code-injection vulnerabilities, tracked as CVE-2026-1281 and CVE-2026-1340, which were also exploited as zero-days against what Ivanti described at the time as a very limited number of customers.

Ivanti now says customers who followed its earlier recommendation to rotate credentials after the January incidents are likely to face a significantly lower risk of exploitation from CVE-2026-6973. The guidance reflects a growing concern within the cybersecurity industry that attackers often attempt to reuse stolen administrative credentials across multiple intrusion campaigns.

The issue also drew attention from the U.S. Cybersecurity and Infrastructure Security Agency earlier this year. In April, the agency instructed federal civilian agencies to secure vulnerable systems against attacks involving CVE-2026-1340 within four days after adding the flaw to its Known Exploited Vulnerabilities catalog.

Ivanti products have repeatedly appeared in incident response investigations over the last several years, particularly because endpoint and device management platforms typically operate with elevated privileges across enterprise networks. Security agencies and researchers have warned that these systems remain attractive targets for threat actors seeking broad administrative control over organizational infrastructure.

According to data previously published by CISA, 33 Ivanti vulnerabilities have been publicly identified as exploited in the wild, including 12 that were also linked to ransomware-related activity.

Ivanti says it currently serves more than 40,000 customers worldwide through a partner network consisting of over 7,000 organizations.

Read more »
website
Cyber Attacks DDOS Attack ransomware website

Ubuntu Services Remain Disrupted After DDoS Attack Targets Canonical Infrastructure

 



Several Ubuntu users reported problems installing updates and downloading packages after parts of Canonical’s infrastructure were disrupted during a Distributed Denial of Service (DDoS) attack. Canonical, the company behind the Ubuntu Linux distribution, confirmed that its online systems had been targeted.

In a statement released during the outage, Canonical said its web infrastructure was facing what it described as a sustained cross-border cyberattack and that teams were working to restore affected services. The company added that further updates would be shared through official channels once more information became available.

Discussions across Ubuntu community forums suggested that multiple services were affected during the incident, including Ubuntu’s security API and several Canonical-operated websites. Users also stated that software installations and system updates were temporarily unavailable or failing to complete properly.

Responsibility for the attack was later claimed by a group calling itself “The Islamic Cyber Resistance in Iraq 313 Team.” In Telegram posts attributed to the group, the attackers allegedly said they used a DDoS-for-hire platform known as “Beamed” to carry out the operation.

Beamed is described as a “booter” or “stresser” service, which are platforms that allow customers to pay for DDoS attacks. These services are often advertised as tools for testing website traffic capacity, although security researchers have repeatedly linked them to disruptive cyber operations. According to claims associated with the platform, Beamed is capable of generating attacks reaching 3.5 terabits per second, enough traffic to overwhelm major online infrastructure.

A DDoS attack works by flooding a server or network with enormous volumes of internet traffic from large numbers of connected devices at the same time. Once systems become overloaded, legitimate users may no longer be able to access websites, applications, or online services. Unlike ransomware campaigns or data breaches, the primary goal of most DDoS attacks is to interrupt availability rather than steal information directly.

To create these attack networks, threat actors typically compromise internet-connected devices using malware. Weak passwords, exposed systems, outdated software, and poorly secured smart devices are commonly targeted. Once infected, the devices become part of a botnet that can be remotely controlled through centralized management panels.

Access to these botnets is frequently sold through underground marketplaces and subscription-based services. Depending on the size and duration of the attack, prices can range from as little as $10 for lower-powered services to hundreds of dollars per month for larger and more persistent attacks.

The disruption drew attention within the open-source community because Ubuntu infrastructure is widely used across enterprise servers, development environments, cloud systems, and research institutions worldwide. Problems affecting package repositories or security update services can delay software deployments and patch management for organizations that rely on Ubuntu systems daily.

The incident also reflects how accessible DDoS-for-hire services have become over the past few years. Platforms offering attack infrastructure continue to reduce the technical barrier required to launch disruptive cyberattacks, allowing even low-skilled actors to rent large-scale attack capabilities for relatively small amounts of money.

Read more »
Subscribe to: Posts (Atom)