Welcome to our biweekly cybersecurity roundup. In these blog posts, we feature curated articles and insights from experts, providing you with valuable information on the latest cybersecurity threats, technologies, and best practices to keep yourself and your organization safe. Whether you’re a cybersecurity professional or a concerned individual, our biweekly blog post is designed to keep you informed and empowered.

For more articles, check out our #onpatrol4malware blog.

Windows Remote Desktop Protocol: Remote to Rogue

Source: Google Cloud

Evidence suggests this campaign may have involved the use of an RDP proxy tool like PyRDP to automate malicious activities like file exfiltration and clipboard capture. This technique has been previously dubbed as “Rogue RDP.” Read more.

Malicious VSCode extensions infect Windows with cryptominers

Source: BLEEPINGCOMPUTER

Nine VSCode extensions on Microsoft’s Visual Studio Code Marketplace pose as legitimate development tools while infecting users with the XMRig cryptominer to mine Ethereum and Monero. Read more.

How ToddyCat tried to hide behind AV software

Source: SECURELIST

Attackers get round this protection mechanism by using legitimate drivers that have the right signature, but contain vulnerable functions that allow malicious actions in the context of the kernel. Monitoring tools track the installation of such drivers and check applications that perform it. But what if a security solution performs unsafe activity? Read more.

Someone hacked ransomware gang Everest’s leak site

Source: TechCrunch

The leak site, which the ransomware gang uses to publish stolen files to extort its victims into paying a ransom demand, was replaced with a brief text note: “Don’t do crime CRIME IS BAD xoxo from Prague.” Read more.

OH-MY-DC: OIDC Misconfigurations in CI/CD

Source: Unit 42

In the course of investigating the use of OpenID Connect (OIDC) within continuous integration and continuous deployment (CI/CD) environments, Unit 42 researchers discovered problematic patterns and implementations that could be leveraged by threat actors to gain access to restricted resources. One instance of such an implementation was identified in CircleCI’s OIDC. Read more.

The Rising Threat of Cyberwarfare: Extreme Cyber Weapons and Their Potential to Disrupt Critical Infrastructure

Source: IDST

Cyber warfare is the use of technology to launch covert attacks on nations, governments, and even citizens, causing harm comparable to that of conventional warfare. This new battleground allows adversaries to disrupt or destroy critical infrastructure—power grids, telecommunications, banking systems—by targeting the computer networks that control them. Read more.

Same Russian-Speaking Threat Actor, New Tactics: Abuse of Cloudflare Services for Phishing and Telegram to Filter Victim IPs

Source: Hunt.io

The lure abuses the ms-search protocol to download a malicious LNK file disguised as a PDF via a double extension. Once executed, the malware checks in with an attacker-operated Telegram bot-sending the victim’s IP address-before transitioning to Pyramid C2 to control the infected host. Read more.

Qilin affiliates spear-phish MSP ScreenConnect admin, targeting customers downstream

Source: Sophos News

Late in January 2025, a Managed Service Provider (MSP) administrator received a well-crafted phishing email containing what appeared to be an authentication alert for their ScreenConnect RMM tool. That email resulted in Qilin ransomware actors gaining access to the administrator’s credentials—and launching ransomware attacks on the MSP’s customers. Read more.

RolandSkimmer: Silent Credit Card Thief Uncovered

Source: Fortinet

FortiGuard Labs recently observed a sophisticated campaign dubbed “RolandSkimmer,” named after the unique string “Rol@and4You” found embedded in its payload. This threat actor targets users in Bulgaria and represents a new wave of credit card skimming attacks leveraging malicious browser extensions across Chrome, Edge, and Firefox. Read more.

Emulating the Sophisticated Russian Adversary Seashell Blizzard

Source: ATTACKIQ

The BadPilot campaign is a sophisticated, long-running operation primarily focused on gaining initial access to targeted networks. The campaign is attributed to a Seashell Blizzard subgroup and is known for its strategic use of spear-phishing emails and exploiting vulnerabilities in software to breach networks. Read more.

Welcome to our biweekly cybersecurity roundup. In these blog posts, we feature curated articles and insights from experts, providing you with valuable information on the latest cybersecurity threats, technologies, and best practices to keep yourself and your organization safe. Whether you’re a cybersecurity professional or a concerned individual, our biweekly blog post is designed to keep you informed and empowered.

For more articles, check out our #onpatrol4malware blog.

Clickbait to Catastrophe: How a Fake Meta Email Leads to Password Plunder

Source: Cofense

The Cofense Phishing Defense Center (PDC) has discovered a new phishing campaign that tricks users into giving out access to their Meta Business accounts. While social media phishing attempts are prevalent, this one went above and beyond by employing fake chat support, providing detailed instructions, and attempting to add itself as a secure login method. Read more.

Nuxt Users Beware: CVE-2025-27415 Opens the Door to Cache Poisoning Attacks

Source: Cybersecurity News

A newly discovered vulnerability in the popular Nuxt framework could allow attackers to poison CDN caches and disrupt access to full-stack Vue.js applications. Tracked as CVE-2025-27415 and scored 7.5 on the CVSS scale. The issue lies in how Nuxt handles certain HTTP requests, particularly ones that resemble: https://yoursite.com/?/_payload.json Read more.

Unboxing Anubis: Exploring the Stealthy Tactics of FIN7’s Latest Backdoor

Source: G Data

In the ever-evolving landscape of advanced persistent threats (APTs), the notorious financial cybercrime group FIN7 has added another sophisticated tool to their arsenal. We have recently discovered a new Python-based backdoor, called “AnubisBackdoor”, being deployed in their latest campaigns. Read more.

Weaver Ant, the Web Shell Whisperer: Tracking a Live China-nexus Operation

Source: Sygnia

Sygnia details Weaver Ant, a China-nexus threat actor infiltrating a major telecom provider. Using web shells and tunneling, the attackers maintained persistence and facilitated cyber espionage. Read more.

Over 150 US Government Database Servers Vulnerable to Internet Exposure

Source: GB Hackers

The investigation, conducted using data from Shodan, a tool often referred to as the “Google of internet-connected devices,” identified over 2,000 instances of exposed government database servers since early 2025. Read more.

Albabat Ransomware Group Potentially Expands Targets to Multiple OS, Uses GitHub to Streamline Operations

Source: Trend Micro

Trend Research uncovered new versions of the Albabat ransomware. The development of these versions signifies the ransomware operators’ potential expansion of their targets from Windows to Linux and macOS. Research also reveals the group’s use of GitHub to streamline operations. Read more.

AI-Generated Zoom Impersonation Attack Exploits Tax Season to Deploy Remote Desktop Tool

Source: Abnormal

Disguised as a routine Zoom meeting invitation related to the 2024 tax season, a campaign recently stopped by Abnormal leveraged generative AI to construct a highly convincing phishing page. However, unlike traditional credential-harvesting scams, these attacks attempted to deceive targets into downloading a RMM tool—granting threat actors full control over their devices. Read more.

UAT-5918 Targets Taiwan’s Critical Infrastructure Using Web Shells and Open-Source Tools

Source: The Hacker News

“UAT-5918, a threat actor believed to be motivated by establishing long-term access for information theft, uses a combination of web shells and open-sourced tooling to conduct post-compromise activities to establish persistence in victim environments for information theft and credential harvesting,” Cisco Talos researchers Jungsoo An, Asheer Malhotra, Brandon White, and Vitor Ventura said. Read more.

VanHelsing Ransomware

Source: Cyfirma

This new ransomware strain encrypts files and demands payment for decryption. It also employs double extortion tactics, threatening to leak stolen data to pressure victims into paying. Once executed, VanHelsing appends the “.vanhelsing” extension to encrypted files, modifies the desktop wallpaper, and drops a ransom note named “README.txt” on the victim’s system. Read more.

Operation FishMedley

Source: Welivesecurity

Verticals targeted during Operation FishMedley include governments, NGOs, and think tanks, across Asia, Europe, and the United States. Operators used implants – such as ShadowPad, SodaMaster, and Spyder – that are common or exclusive to China-aligned threat actors. We assess with high confidence that Operation FishMedley was conducted by the FishMonger APT group. Read more.

Welcome to our biweekly cybersecurity roundup. In these blog posts, we feature curated articles and insights from experts, providing you with valuable information on the latest cybersecurity threats, technologies, and best practices to keep yourself and your organization safe. Whether you’re a cybersecurity professional or a concerned individual, our biweekly blog post is designed to keep you informed and empowered.

For more articles, check out our #onpatrol4malware blog.

The Growing Danger of Blind Eagle: One of Latin America’s Most Dangerous Cyber Criminal Groups Targets Colombia

Source: CHECK POINT

Check Point Research (CPR) has uncovered a series of ongoing, targeted cyber campaigns by Blind Eagle (APT-C-36)—one of Latin America’s most dangerous threat actors. Days after Microsoft released a fix for CVE-2024-43451, the group began employing a comparable technique involving harmful .url files, showing how attackers can turn security updates into weapons against their victims. Read more.

SideWinder targets the maritime and nuclear sectors with an updated toolset

Source: SECURE LIST

It is worth noting that SideWinder constantly works to improve its toolsets, stay ahead of security software detections, extend persistence on compromised networks, and hide its presence on infected systems. Based on our observation of the group’s activities, we presume they are constantly monitoring detections of their toolset by security solutions. Read more.

Desert Dexter Targets 900 Victims Using Facebook Ads and Telegram Malware Links

Source: The Hacker News

The Middle East and North Africa have become the target of a new campaign that delivers a modified version of a known malware called AsyncRAT since September 2024. The campaign is estimated to have claimed approximately 900 victims since the fall 2024, the Russian cybersecurity company added, indicating its widespread nature. Read more.

Malware of the Day – IPv6 Address Aliasing

Source: Active Counter Measures

The introduction of IPv6 brought with it a wealth of new features over its predecessor, IPv4. One of the most interesting of these features is its flexibility in address assignment, which allows for a concept known as IPv6 aliasing. Aliasing is essentially the ability for a host to assign multiple IPv6 addresses to itself, all of which can then be used interchangeably. Read more.

The Next Level: Typo DGAs Used in Malicious Redirection Chains

Source: UNIT 42

We have uncovered a new campaign in which an attacker leverages newly registered domains (NRDs) and introduces a new variant of DGAs potentially designed to avoid detection. We found this through our novel graph-intelligence based pipeline. The system infers attack campaigns by correlating domain registrations with hosting infrastructure, passive DNS and WHOIS data. Read more.

Zen and the Art of Microcode Hacking

Source: Bug Hunters

We are releasing the full details of EntrySign, the AMD Zen microcode signature validation vulnerability which we initially disclosed last month. In this post, we first discuss the background of what microcode is, why microcode patches exist, why the integrity of microcode is important for security, and how AMD attempts to prevent tampering with microcode. Read more.

Satori Threat Intelligence Disruption: BADBOX 2.0 Targets Consumer Devices with Multiple Fraud Schemes

Source: Human Security

BADBOX 2.0, like its predecessor, begins with backdoors on low-cost consumer devices that enable threat actors to load fraud modules remotely. These devices communicate with command-and-control (C2) servers owned and operated by a series of distinct but cooperative threat actors. Read more.

Silk Typhoon targeting IT supply chain

Source: Microsoft

Microsoft Threat Intelligence identified a shift in tactics by Silk Typhoon, a Chinese espionage group, now targeting common IT solutions like remote management tools and cloud applications to gain initial access. Read more.

Android zero-day vulnerabilities actively abused. Update as soon as you can

Source: Malwarebytes Labs

Google has issued updates to fix 43 vulnerabilities in Android, including two zero-days that are being actively exploited in targeted attacks. The updates are available for Android 12, 12L, 13, 14, and 15. Android vendors are notified of all issues at least a month before publication, however, this doesn’t always mean that the patches are available for all devices immediately. Read more.

Qilin ransomware gang boasts of cyberattacks on cancer clinic, Ob-Gyn facility

Source: The Register

Qilin – the “no regrets” ransomware crew wreaking havoc on the global healthcare industry – just claimed responsibility for fresh attacks on a cancer treatment clinic in Japan and a women’s healthcare facility in the US. Read more.

Want more articles? Check out the previous edition of Security Signals. Want to dive deeper into DGA’s, visit the Malware Patrol Blog Post: Role of DGAs (Domain Generation Algorithms) in Malware and Ransomware Campaigns to learn more.

Welcome to our biweekly cybersecurity roundup. In these blog posts, we feature curated articles and insights from experts, providing you with valuable information on the latest cybersecurity threats, technologies, and best practices to keep yourself and your organization safe. Whether you’re a cybersecurity professional or a concerned individual, our biweekly blog post is designed to keep you informed and empowered.

For more articles, check out our #onpatrol4malware blog.

Predatory app downloaded 100,000 times from Google Play Store steals data, uses it for blackmail

Source: Malwarebytes LABS

A malicious app claiming to be a financial management tool has been downloaded 100,000 times from the Google Play Store. The app— known as “Finance Simplified”—belongs to the SpyLoan family which specializes in predatory lending. Read more.

Android trojan TgToxic updates its capabilities

Source: Intel471

This new version of the trojan abused 25 community forums to host encrypted malware configurations. The actors created user accounts on these forums and embedded specific encrypted strings within the user profiles, serving as dead drop locations from which malware bots could retrieve the final command-and-control (C2) URL. Read more.

Phishing Campaigns Targeting Higher Education Institutions

Source: Google Cloud

These attacks exploit trust within academic institutions to deceive students, faculty, and staff, and have been timed to coincide with key dates in the academic calendar. The beginning of the school year, with its influx of new and returning students combined with a barrage of administrative tasks, as well as financial aid deadlines, can create opportunities for attackers to carry out phishing attacks. Read more.

Auto-Color: An Emerging and Evasive Linux Backdoor

Source: Unit42

Between early November and December 2024, Palo Alto Networks researchers discovered new Linux malware called Auto-color. We chose this name based on the file name the initial payload renames itself after installation. Once installed, Auto-color allows threat actors full remote access to compromised machines, making it very difficult to remove without specialized software. Read more.

The Bybit Incident: When Research Meets Reality

Source: CHECKPOINT

The log indicated that the AI engine identify anomality change with this transaction and categorize it as critical attack in real time. It was indicated that ByBit cold wallet got hacked, resulting in the theft of approximately $1.5 billion worth of digital assets, primarily in Ethereum tokens. This incident marks one of the largest thefts in the history of the digital asset industry. Read more.

Beware: PayPal “New Address” feature abused to send phishing emails

Source: BLEEPING COMPUTER

An ongoing PayPal email scam exploits the platform’s address settings to send fake purchase notifications, tricking users into granting remote access to scammers. The email includes the new address that was allegedly added to your PayPal account, a message claiming to be a purchase confirmation for a MacBook M4, and to call the enclosed PayPal number if you did not authorize the purchase. Read more.

Angry Likho: Old beasts in a new forest

Source: SECURE LIST

Angry Likho (referred to as Sticky Werewolf by some vendors) is an APT group we’ve been monitoring since 2023. It bears a strong resemblance to Awaken Likho, which we’ve analyzed before, so we classified it within the Likho malicious activity cluster. Read more.

FBI and CISA Warn of Ghost Ransomware: A Threat to Firms Worldwide

Source: HACK READ

FBI and CISA warn of Ghost ransomware, a China-based cyber threat targeting businesses, schools, and healthcare worldwide by exploiting software vulnerabilities. Read more.

LummaC2 malware distributed disguised as Total Commander Crack

Source: ASEC

ASEC discovered LummaC2 malware that is being distributed disguised as a tool called Total Commander. Total Commander is a file manager for Windows that supports various file formats and provides convenient overall file management, including copy and move functions, advanced search functions using strings within files, folder synchronization, and FTP/SFTP functions. Read more.

Updated Shadowpad Malware Leads to Ransomware Deployment

Source: TREND MICRO

Two recent incident response cases in Europe involved Shadowpad, a malware family connected to various Chinese threat actors. Our research suggested that this malware family had targeted at least 21 companies across 15 countries in Europe, the Middle East, Asia, and South America. Read more.

Welcome to our biweekly cybersecurity roundup. In these blog posts, we feature curated articles and insights from experts, providing you with valuable information on the latest cybersecurity threats, technologies, and best practices to keep yourself and your organization safe. Whether you’re a cybersecurity professional or a concerned individual, our biweekly blog post is designed to keep you informed and empowered.

For more articles, check out our #onpatrol4malware blog.

Sandworm APT Targets Ukrainian Users with Trojanized Microsoft KMS Activation Tools in Cyber Espionage Campaigns

Source: EclecticIQ

Multiple pieces of evidence strongly link this campaign to Sandworm, also tracked by CERT-UA as UAC-0145 [4], based on recurring use of ProtonMail accounts in WHOIS records, overlapping infrastructure, and consistent Tactics, Techniques and Procedures (TTPs). Read more.

Crooks use Google Tag Manager skimmer to steal credit card data from a Magento-based e-stores

Source: Security Affairs

Google Tag Manager (GTM) is a free tool that lets website owners manage marketing tags without modifying site code, simplifying analytics and ad tracking. Sucuri inspected the website and discovered the malicious code hidden in a website’s database (cms_block.content), disguised as a Google Tag Manager and Google Analytics script to evade detection. Read more.

Operation Phobos Aetor: Police dismantled 8Base ransomware gang

Source: Security Affairs

An international law enforcement operation, codenamed Operation Phobos Aetor, dismantled the 8Base ransomware gang. The police took down the dark web data leak and negotiation sites. The police has yet to disclose the names of the suspects. Read more.

SparkCat trojan stealer infiltrates App Store and Google Play, steals data from photos

Source: Kaspersky

This malware is currently configured to steal crypto wallet data, but it could easily be repurposed to steal any other valuable information. The worst part is that this malware has made its way into official app stores, with almost 250,000 downloads of infected apps from Google Play alone. Read more.

Scalable Vector Graphics files pose a novel phishing threat

Source: Sophos

But because SVG images can load and render natively inside a browser, they can also contain anchor tags, scripting, and other kinds of active web content. In this way, threat actors have been abusing the file format. The SVG files used in the attacks include some instructions to draw very simple shapes, such as rectangles, but also contain an anchor tag that links to a web page hosted elsewhere. Read more.

Google Cloud Platform Data Destruction via Cloud Build

Source: Cisco Talos

Google Cloud Platform (GCP) Cloud Build is a Continuous Integration/Continuous Deployment (CI/CD) service offered by Google that is utilized to automate the building, testing and deployment of applications. Orca Security published an article describing certain aspects of the threat surface posed by this service, including a supply chain attack vector they have termed “Bad.Build”. Read more.

Not-so-SimpleHelp exploits enabling deployment of Sliver backdoor

Source: Field Effect

The attack involved the quick and deliberate execution of several post-compromise tactics, techniques and procedures (TTPs) including network and system discovery, administrator account creation, and the establishment of persistence mechanisms, which could have led to the deployment of ransomware had Field Effect MDR not prevented the attack. Read more.

macOS FlexibleFerret | Further Variants of DPRK Malware Family Unearthed

Source: SentinelOne

In this post, we briefly recap previous research for context, including Apple’s contribution through its malware signatures, before describing newly discovered samples that we have labelled ‘FlexibleFerret’ and which remain undetected by XProtect at the time of writing. Read more.

Threat Actors Still Leveraging Legit RMM Tool ScreenConnect for Persistence in Cyberattacks

Source: Silent Push

Our discovery of a suspicious domain, filessauploaderchecker[.]com, in the Silent Push Web Scanner, led us to further explore for malicious intent. As we continue investigating, we believe potential attackers have been using social engineering to lure victims into installing legitimate software copies configured to operate under the threat actor’s control. Read more.

Flesh Stealer: Unmasking the Blue Masked Thief

Source: CYFIRMA

This report examines Flesh Stealer, a .NET executable written in C#. The malware does not target CIS countries and is capable of bypassing app-bound encryption employed by Chrome. Developed by a Russian-speaking individual, Flesh Stealer includes various features such as anti-debugging and anti-VM capabilities. Read more.