Emerging Threats in Cybersecurity

Welcome to our biweekly cybersecurity roundup. In these blog posts, we feature curated articles and insights from experts, providing you with valuable information on the latest cybersecurity threats, technologies, and best practices to keep yourself and your organization safe. Whether you’re a cybersecurity professional or a concerned individual, our biweekly blog post is designed to keep you informed and empowered.

For more articles, check out our #onpatrol4malware blog.

Rising Ransomware and Nation-State Attacks

Dark Web Profile: FunkSec

Source: SOCRadar

A new ransomware group, FunkSec, has gained attention after taking responsibility for attacks on numerous victims in December 2024. By January 2025, the group continued to target new victims, with the total number surpassing 100. FunkSec seems to be engaged in both hacktivism and ransomware/extortion. Read more.

GamaCopy targets Russia mimicking Russia-linked Gamaredon APT

Source: Security Affairs

The Knownsec 404 Advanced Threat Intelligence team recently analyzed attacks on Russian-speaking targets using military-themed bait, 7z SFX for payloads, and UltraVNC, mimicking Gamaredon’s TTPs. The researchers linked the activity to the APT Core Werewolf (aka Awaken Likho, PseudoGamaredon), it mimics Gamaredon and for this reason, researchers called it GamaCopy. Read more.

HellCat and Morpheus | Two Brands, One Payload as Ransomware Affiliates Drop Identical Code

Source: Sentinel One

Within this period of accelerated activity, the Ransomware-as-a-Service offerings HellCat and Morpheus have gained additional momentum and notoriety. Operators behind HellCat, in particular, have been vocal in their efforts to establish the RaaS as a ‘reputable’ brand and service within the crimeware economy. Read more.

Advanced Phishing and MFA Bypass Techniques

Cybersecurity Stop of the Month: E-Signature Phishing Nearly Sparks Disaster for an Electric Company

Source: Proofpoint

In an e-signature phishing attack, bad actors will spoof a trusted brand and send malicious content through legitimate digital channels. Often, they use advanced methods like AitM to bypass MFA in an effort to further extend their access. And when bad actors use combined tactics, such as Adversary-in-the-Middle plus geofencing, they can be extremely successful in evading detection. Read more.

Threat Spotlight: Tycoon 2FA phishing kit updated to evade inspection

Source: Barracuda

Tycoon became Tycoon 2FA when it evolved to bypass multifactor authentication — in this case 2FA — by collecting and using Microsoft 365 session cookies. The latest version of Tycoon 2FA was first seen in November 2024, and it features advanced tactics designed to obstruct, derail, and otherwise thwart attempts by security tools to confirm its malicious intent and inspect its web pages. Read more.

Sophos MDR tracks two ransomware campaigns using “email bombing,” Microsoft Teams “vishing”

Source: SOPHOS

Sophos is tracking these threats as STAC5143 and STAC5777. Both threat actors operated their own Microsoft Office 365 service tenants as part of their attacks and took advantage of a default Microsoft Teams configuration that permits users on external domains to initiate chats or meetings with internal users. Read more.

Vulnerabilities and Systemic Risks to Watch

Change Healthcare Breach Almost Doubles in Size to 190 Million Victims

Source: Infosecurity Magazine

The largest healthcare data breach on record just got even bigger, after UnitedHealth Group (UHG) confirmed that 90 million additional customers were impacted by a ransomware attack on Change Healthcare last year. Read more.

RANsacked: Over 100 Security Flaws Found in LTE and 5G Network Implementations

Source: The Hacker News

A group of academics has disclosed details of over 100 security vulnerabilities impacting LTE and 5G implementations that could be exploited by an attacker to disrupt access to service and even gain a foothold into the cellular core network. Read more.

7-Zip bug could allow a bypass of a Windows security feature. Update now

Source: Malwarebytes LABS

A patch is available for a vulnerability in 7-Zip that could have allowed attackers to bypass the Mark-of-the-Web (MotW) security feature in Windows. The MotW is an attribute added to files by Windows when they have been sourced from an untrusted location, like the internet or a restricted zone. Read more.

AI Prompt Injection and the Future of Infosec

Invisible Prompt Injection: A Threat to AI Security

Source: TREND MICRO

LLMs can interpret hidden texts that are not visible on the UI; thus, these hidden texts may be used for prompt injection. To protect your AI application, verify if the LLM can respond to invisible text. If it can, do not allow such invisible text to be input. Read more.

Welcome to our biweekly cybersecurity roundup. In these blog posts, we feature curated articles and insights from experts, providing you with valuable information on the latest cybersecurity threats, technologies, and best practices to keep yourself and your organization safe. Whether you’re a cybersecurity professional or a concerned individual, our biweekly blog post is designed to keep you informed and empowered.

For more articles, check out our #onpatrol4malware blog.

CISA Warns of Second BeyondTrust Vulnerability Exploited in Attacks

Source: SECURITY WEEK

Tracked as CVE-2024-12686, the flaw is a medium-severity command injection issue that was discovered during BeyondTrust’s investigation into the compromise of a limited number of customer RS SaaS instances, including one associated with the US Department of Treasury. Read more.

Double-Tap Campaign: Russia-nexus APT possibly related to APT28 conducts cyber espionage on Central Asia and Kazakhstan diplomatic relations

Source: Sekoia

Later, in July 2024, CERT-UA published another report exposing UAC-0063 activities targeting Ukrainian scientific research institutions with new malware (dubbed HATVIBE and CHERRYSPY). The report associates the intrusion set UAC-0063 with APT28 with medium confidence. Read more.

HexaLocker V2: Skuld Stealer Paving the Way prior to Encryption

Source: CYBLE

HexaLocker V2 includes a persistence mechanism that modifies registry keys to ensure continued execution after the affected system reboots. The updated version downloads Skuld Stealer, which extracts sensitive information from the victim’s system before encryption. Read more.

Banshee: The Stealer That “Stole Code” From MacOS XProtect

Source: CHECK POINT RESEARCH

One notable difference between the leaked source code and the version discovered by Check Point Research is the use of a string encryption algorithm. This algorithm is the same as Apple uses in its Xprotect antivirus engine for MacOS. Read more.

Phish-free PayPal Phishing

Source: FORTINET

The scammer appears to have simply registered an MS365 test domain, which is free for three months, and then created a Distribution List (Billingdepartments1[@]gkjyryfjy876.onmicrosoft.com) containing victim emails. On the PayPal web portal, they simply request the money and add the distribution list as the address. Read more.

APT32 Poisoning GitHub, Targeting Chinese Cybersecurity Professionals and Specific Large Enterprises

Source: ThreatBook CTI

In this attack, the attackers used a novel and concealed method for the first time by embedding a malicious .suo file into a Visual Studio project. When the victim compiles the Visual Studio project, the Trojan will execute automatically. Read more.

Gayfemboy: A botnet that spreads using Four-Faith Industrial Routers 0DAY

Source: Qianxin X Lab

Gayfemboy used more than 20 vulnerabilities and Telnet weak passwords to spread samples, including the 0day vulnerability of Four-Faith Industrial Routers, and some unknown vulnerabilities involving Neterbit and vimar devices. Read more.

Cybersecurity firm’s Chrome extension hijacked to steal users’ data

Source: BLEEPING COMPUTER

At least five Chrome extensions were compromised in a coordinated attack where a threat actor injected code that steals sensitive information from users. One attack was disclosed by Cyberhaven, a data loss prevention company that alerted its customers of a breach on December 24 after a successful phishing attack on an administrator account for the Google Chrome store. Read more.

Threat actors breached the Argentina’s airport security police (PSA) payroll

Source: Security Affairs

Threat actors have breached Argentina’s airport security police (PSA) and compromised the personal and financial data of its officers and civilian personnel. Threat actors deducted from 2,000 to 5,000 pesos under false charges like “DD mayor” and “DD seguros.” Read more.

Researchers Expose NonEuclid RAT Using UAC Bypass and AMSI Evasion Techniques

Source: The Hacker News

“The NonEuclid remote access trojan (RAT), developed in C#, is a highly sophisticated malware offering unauthorised remote access with advanced evasion techniques,” Cyfirma said in a technical analysis published. Read more.

Welcome to our biweekly cybersecurity roundup. In these blog posts, we feature curated articles and insights from experts, providing you with valuable information on the latest cybersecurity threats, technologies, and best practices to keep yourself and your organization safe. Whether you’re a cybersecurity professional or a concerned individual, our biweekly blog post is designed to keep you informed and empowered.

For more articles, check out our #onpatrol4malware blog.

Under the SADBRIDGE with GOSAR: QUASAR Gets a Golang Rewrite

Source: Elastic Security Labs

Infection chains employ injection and DLL side-loading using a custom loader (SADBRIDGE). SADBRIDGE deploys a newly-discovered variant of the QUASAR backdoor written in Golang (GOSAR). GOSAR is a multi-functional backdoor under active development with incomplete features and iterations of improved features observed over time. Read more.

Analysis of TIDRONE attackers’ attacks on domestic companies

Source: ASEC

AhnLab Security Intelligence Center (ASEC) has confirmed that the TIDRONE attacker has recently been conducting attacks against companies. The software exploited in these attacks is ERP, through which a backdoor malware called CLNTEND is installed. Read more.

Declawing PUMAKIT

Source: Elastic Security Labs

PUMAKIT is a sophisticated piece of malware, initially uncovered during routine threat hunting on VirusTotal and named after developer-embedded strings found within its binary. Its multi-stage architecture consists of a dropper (cron), two memory-resident executables (/memfd:tgt and /memfd:wpn), an LKM rootkit module and a shared object (SO) userland rootkit. Read more.

Gamaredon Deploys Android Spyware “BoneSpy” and “PlainGnome” in Former Soviet States

Source: The Hacker News

The Russia-linked state-sponsored threat actor tracked as Gamaredon has been attributed to two new Android spyware tools called BoneSpy and PlainGnome, marking the first time the adversary has been discovered using mobile-only malware families in its attack campaigns. Read more.

Iran-Linked IOCONTROL Malware Targets SCADA and Linux-Based IoT Platforms

Source: The Hacker News

The malware has been codenamed IOCONTROL by OT cybersecurity company Claroty, highlighting its ability to attack IoT and supervisory control and data acquisition (SCADA) devices such as IP cameras, routers, programmable logic controllers (PLCs), human-machine interfaces (HMIs), firewalls, and other Linux-based IoT/OT platforms. Read more.

Careto is back: what’s new after 10 years of silence?

Source: SECURE LIST

The persistence method used by the threat actor was based on WorldClient allowing loading of extensions that handle custom HTTP requests from clients to the email server. These extensions can be configured through the C:\MDaemon\WorldClient\WorldClient.ini file. Read more.

Malware Analysis: A Kernel Land Rootkit Loader for FK_Undead

Source: G Data

We discovered a Windows rootkit loader [F1] for the malware family FK_Undead. The malware family is known for intercepting user network traffic through manipulation of proxy configurations. Read more.

Law enforcement shuts down 27 DDoS booters ahead of annual Christmas attacks

Source: EUROPOL

Law enforcement agencies worldwide have disrupted a holiday tradition for cybercriminals: launching Distributed Denial-of-Service (DDoS) attacks to take websites offline. As part of an ongoing international crackdown known as PowerOFF, authorities have seized 27 of the most popular platforms used to carry out these attacks. Read more.

Inside Zloader’s Latest Trick: DNS Tunneling

Source: Zscaler

Zloader (a.k.a. Terdot, DELoader, or Silent Night) is a modular Trojan based on the leaked Zeus source code dating back to 2015. Zloader 2.9.4.0 adds notable improvements including a custom DNS tunnel protocol for C2 communications and an interactive shell that supports more than a dozen commands, which may be valuable for ransomware attacks. Read more.

Meeten Malware: A Cross-Platform Threat to Crypto Wallets on macOS and Windows

Source: CADO

“Meeten” is the application that is attempting to scam users into downloading an information stealer. The company regularly changes names, and is currently going by the name Meetio. The threat actors set up full company websites, with AI-generated blog and product content and social media accounts including Twitter and Medium. Read more.

Welcome to our biweekly cybersecurity roundup. In these blog posts, we feature curated articles and insights from experts, providing you with valuable information on the latest cybersecurity threats, technologies, and best practices to keep yourself and your organization safe. Whether you’re a cybersecurity professional or a concerned individual, our biweekly blog post is designed to keep you informed and empowered.

For more articles, check out our #onpatrol4malware blog.

Russia sentences Hydra dark web market leader to life in prison

Source: BLEEPING COMPUTER

Russian authorities have sentenced the leader of the criminal group behind the now-closed dark web platform Hydra Market to life in prison. Additionally, more than a dozen accomplices have been convicted for their involvement in the production and sale of nearly a ton of drugs. Read more.

Threat Assessment: Howling Scorpius (Akira Ransomware)

Source: Unit 42

Akira is a RaaS group we track as Howling Scorpius. This group employs a double extortion strategy, exfiltrating critical data from a network before executing its encryption process. This double extortion tactic allows the group to leak stolen data even if victims recover their systems without paying, maximizing the pressure to comply. Read more.

North Korean Kimsuky Hackers Use Russian Email Addresses for Credential Theft Attacks

Source: The Hacker News

The North Korea-aligned threat actor known as Kimsuky has been linked to a series of phishing attacks that involve sending email messages that originate from Russian sender addresses to ultimately conduct credential theft. Read more.

Horns&Hooves campaign delivers NetSupport RAT and BurnsRAT

Source: SECURELIST

According to our telemetry, the campaign began around March 2023 and hit more than a thousand private users, retailers and service businesses located primarily in Russia. We dubbed this campaign Horns&Hooves, after a fictitious organization set up by swindlers in the Soviet comedy novel The Golden Calf. Read more.

Guess Who’s Back – The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024

Source: TREND MICRO

The spear-phishing emails used in this campaign were sent either from free email accounts or from compromised accounts. The emails contained a URL link to a OneDrive. They included a message in Japanese encouraging the recipient to download a ZIP file. Read more.

Hearts Stolen, Wallets Emptied: Insights into CryptoLove Traffer’s Team

Source: TRAC Labs

CryptoLove is a traffer’s group specializing in crypto scams for over two years, recruiting workers to spread stealers through custom launchers and loaders that can track every stage of payload delivery. Read more.

Ransom gang claims attack on NHS Alder Hey Children’s Hospital

Source: The Register

INC Ransom, the group that claimed responsibility for an attack on NHS Scotland in June this year, now claims to have stolen data from Liverpool’s Alder Hey Children’s Hospital and Liverpool Heart and Chest Hospital NHS Foundation Trust. Read more.

Gaming Engines: An Undetected Playground for Malware Loaders

Source: CHECK POINT

The malicious GodLoader is distributed by the Stargazers Ghost Network, a GitHub network that distributes malware as a service. Throughout September and October, approximately 200 repositories and over 225 Stargazers were used to legitimize the repositories distributing the malware. Read more.

Police bust pirate streaming service making €250 million per month

Source: BLEEPING COMPUTER

Italy’s Postal and Cybersecurity Police Service announced the action, codenamed “Taken Down,” stating they worked with Eurojust, Europol, and many other European countries, making this the largest takedown of its kind in Italy and internationally. Read more.

Rockstar 2FA: A Driving Force in Phishing-as-a-Service (PaaS)

Source: Trustwave

We have associated this campaign with a phishing kit called Rockstar 2FA, which is an updated version of the DadSec/Phoenix phishing kit. Microsoft tracks the threat actor behind this as Storm-1575, where ‘Storm-####’ is a temporary label for emerging or unidentified threat clusters. Read more.

Welcome to our biweekly cybersecurity roundup. In these blog posts, we feature curated articles and insights from experts, providing you with valuable information on the latest cybersecurity threats, technologies, and best practices to keep yourself and your organization safe. Whether you’re a cybersecurity professional or a concerned individual, our biweekly blog post is designed to keep you informed and empowered.

For more articles, check out our #onpatrol4malware blog.

When AI Moderation Blocks Cybersecurity: Challenges of Producing Threat Actor Videos

Source: Malware Patrol

While we fully support preventing #AI from facilitating misinformation, this was clearly not the case here. Cyber threat actors engage in harmful activities, and videos about them will inevitably address such topics. Nevertheless, it is necessary to educate cybersecurity practitioners and the general public about these malicious actions. Read more.

New Stealthy BabbleLoader Malware Spotted Delivering WhiteSnake and Meduza Stealers

Source: The Hacker News

Cybersecurity researchers have shed light on a new stealthy malware loader called BabbleLoader that has been observed in the wild delivering information stealer families such as WhiteSnake and Meduza. Read more.

QuickBooks popup scam still being delivered via Google ads

Source: Malwarebytes LABS

Researchers have seen two main lures, both via Google ads: the first one is simply a website promoting online support for QuickBooks and shows a phone number, while the latter requires victims to download and install a program that will generate a popup, also showing a phone number. In both instances, that number is fraudulent. Read more.

Fake North Korean IT Worker Linked to BeaverTail Video Conference App Phishing Attack

Source: UNIT 42

Unit 42 researchers identified a North Korean IT worker activity cluster tracked as CL-STA-0237. This cluster was involved in recent phishing attacks using malware-infected video conference apps. It likely operates from Laos, using Lao IP addresses and identities. Read more.

Malware Spotlight: A Deep-Dive Analysis of WezRat

Source: CHECK POINT RESEARCH

The latest version of WezRat was recently distributed to multiple Israeli organizations in a wave of emails impersonating the Israeli National Cyber Directorate (INCD). WezRat can execute commands, take screenshots, upload files, perform keylogging, and steal clipboard content and cookie files. Read more.

New Glove infostealer malware bypasses Chrome’s cookie encryption

Source: BLEEPING COMPUTER

During their attacks, the threat actors used social engineering tactics similar to those used in the ClickFix infection chain, where potential victims get tricked into installing malware using fake error windows displayed within HTML files attached to the phishing emails. Read more.

New PXA Stealer targets government and education sectors for sensitive information

Source: CISCO TALOS

Researchers discovered a new Python program called PXA Stealer that targets victims’ sensitive information, including credentials for various online accounts, VPN and FTP clients, financial information, browser cookies, and data from gaming software. PXA Stealer has the capability to decrypt the victim’s browser master password and uses it to steal the stored credentials of various online accounts. Read more.

Strela Stealer: Today’s invoice is tomorrow’s phish

Source: Security Intelligence

The phishing emails used in these campaigns are real invoice notifications, which have been stolen through previously exfiltrated email credentials. Strela Stealer is designed to extract user credentials stored in Microsoft Outlook and Mozilla Thunderbird. Read more.

Volt Typhoon rebuilds malware botnet following FBI disruption

Source: BLEEPING COMPUTER

In this campaign, the malicious .RDP attachment contained several sensitive settings that would lead to significant information exposure. Once the target system was compromised, it connected to the actor-controlled server and bidirectionally mapped the targeted user’s local device’s resources to the server. Read more.

LightSpy: APT41 Deploys Advanced DeepData Framework In Targeted Southern Asia Espionage Campaign

Source: BlackBerry

The threat actor behind LightSpy, who is believed with a high level of confidence is associated with Chinese cyber-espionage group APT41, has now expanded their toolset with the introduction of DeepData, a modular Windows-based surveillance framework that significantly broadens their espionage capabilities. Read more.