A threat actor has purportedly leaked data that has affected ECB.co.uk, the online platform of the England and Wales Cricket Board (ECB). This breach has had significant repercussions, leading to the unauthorized access and exposure of sensitive personal information belonging to an estimated 43,000…
A newly observed Windows PE32 encryptor, named “HelloFire,” performs volume and network share enumeration, deletes shadow copies, stops services/processes, and encrypts files by appending the .afire extension using Curve25519-based cryptography. The sample als…
AhnLab ASEC found attackers abusing Google Ads tracking templates to deliver fake installers (Notion/Slack/Trello/GoodNotes) that fetch and run a Rhadamanthys infostealer. The installers (Inno Setup/NSIS) query text-hosting/URL-shortener pages for payload URLs…
Article Summary: 🕵️♂️ Police in Romania and Spain busted a cyber-fraud gang involved in fake ads and BEC scams. 💰 They seized cash, gold, electronic devices, and SIM cards from the gang’s locations in Romania. 🌍 The gang operated internationally, with most victims in Spain. 💻 The gang made millions…
Article Summary: 🔍 A United Nations panel is investigating 58 cyberattacks by North Korean hackers, resulting in $3 billion in revenue over six years. 🕵️ The cyberthreat actors targeted defense companies, software supply chains, and cryptocurrency hacks. 💰 Stolen funds were used for technological ad…
A threat actor has claimed responsibility for leaking a database purportedly sourced from Russian CityMed Medical Centers, accessible through the domain medcentr-sitimed.ru. The leak, dated March 17, 2024, is reported to be in CSV format and comprises approximately 826,000 lines of data. Among the l…
A Latrodectus JavaScript loader heavily obfuscates its payload with thousands of junk comments and embeds a secondary script inside comment lines that, when extracted, maps a network share and runs a remote upd.msi via msiexec. Deobfuscation is done with regex…
A supply-chain campaign abused a typosquatted Python package mirror and compromised GitHub accounts to distribute a poisoned copy of the popular package colorama and other malicious packages. The multi-stage payload fetched and executed remote Python code, est…
This article is a step-by-step reverse-engineering walkthrough of a multi-stage .NET Snake Keylogger that uses embedded resources, steganography, sorting/reassembly, and heavy obfuscation to load and execute its payload. The author documents deobfuscation, con…
Article Summary: 🔒 Another major airline company, Air Europa, has suffered a cyberattack resulting in sensitive customer data leaking to hackers. 📅 The incident was discovered in October 2023 and confirmed by International Consolidated Airlines Group (IAG). 📧 Affected individuals were notified that…
Article Summary : 🔹 APT29, a Russian hacking group linked to SVR, is targeting political parties in Germany with phishing attacks. 🔹 The group is using a backdoor malware named WineLoader to gain remote access to compromised devices. 🔹 WineLoader has been used in previous attacks by APT29 and featur…
Unknowns group has announced its intention to launch cyber attacks against Ukraine, initiating a campaign called “Tsunami” and citing it as retaliation for the terrorist attack in Moscow. The group allegedly conducted DDoS attacks on hosts in Ukraine, as well as on websites of Ukrainian hospitals an…
Article Summary: 🔍 Discover how cybersecurity researchers uncover vulnerabilities in Zephyr OS, a real-time operating system used in IoT and embedded devices. 🛡️ Learn about the risks of IP address spoofing and denial-of-service attacks and the importance of maintaining strong security measures in c…
Article Summary : 🔹 BlueFlag Security platform redefines software development lifecycle security with a focus on identity security. 🔹 $11.5 million seed funding round announced to develop BlueFlag’s SDLC security and governance platform. 🔹 BlueFlag addresses the critical threat vector of developer i…
Article Summary: 🔒 The CISA One Industrial Control Systems Advisory highlights concerns regarding the WebAccess/SCADA system vulnerability. 🛡️ SQL Injection, a popular cyberattack technique, poses risks of unauthorized access and data manipulation. 🌐 The advisory offers crucial updates on security i…