This roundup covers recent developments in cybersecurity, including international treaties, malware threats, and industry innovations. Key stories include the signing of the UN cybercrime treaty, surge in NFC relay malware, and new threat intelligence solutions from Mastercard. #UNCybercrimeTreaty #NFCRelayMalware #ClearviewAI #GhostGrab #Herodotus…
Tag: SPYWARE
A former L3 Harris executive pleaded guilty to selling national security software and cyber exploits to a Russian broker. This case highlights the risks posed by insider threats and international cyber espionage activities. #L3Harris #SpywareExploits…
A former official at a cybersecurity firm pleaded guilty to stealing and selling sensitive trade secrets to a Russian cyber-tools broker, risking U.S. national security. The stolen trade secrets, valued at $35 million, were intended for government use but were sold on the black market, highlighting ongoing espionage risks. #L3HarrisTrenchant #RussianCyberThreats…
![Cybersecurity News | Daily Recap [28 Oct 2025]](https://www.hendryadrian.com/tweet/image/DailyRecap.png "Cybersecurity News | Daily Recap [28 Oct 2025]")
Daily Recap, The week highlights new Android malware like Herodotus and Baohuo, a Chrome zero-day delivering Memento Labs/LeetAgent spyware, and SideWinder shifting to a PDF/ClickOnce chain targeting South Asian diplomacy with StealerBot. These items underscore evolving threat techniques across APTs, ransomware, and supply-chain incidents—watch for updates on Xortec, Dublin Airport data, and Oracle-related vulnerabilities. #Herodotus #Baohuo #MementoLabs #LeetAgent #SideWinder #StealerBot #Xortec #DublinAirport #OracleHack
QNAP Systems has revealed that its NetBak PC Agent is vulnerable to a high-severity ASP.NET Core security flaw, CVE-2025-55315, which could allow attackers to hijack credentials and access sensitive backup data. Users are urged to promptly update their systems with the latest patches to mitigate potential exploitation risks. #CVE-2025-55315 #AspNetCoreVulnerability…
A recently patched Google Chrome vulnerability (CVE-2025-2783) was exploited to distribute espionage tools by Italian firm Memento Labs, targeting organizations in Russia and Belarus. This campaign involved spear-phishing emails and the deployment of sophisticated malware like LeetAgent and Dante spyware, linked to known threat clusters such as Operation ForumTroll and TaxOff….
Daily Recap, Ransomware Payments show shifting attacker economics in Q3 2025 as payments declined, signaling changing payout dynamics across the threat landscape. The Qilin Ransomware combines a Linux payload with a BYOVD exploit for hybrid attacks, broadening its cross-environment impact. #Qilin Ransomware #BYOVD
Kaspersky uncovered a sophisticated espionage campaign called Operation ForumTroll, exploiting a zero-day vulnerability in Google Chrome to deliver commercial spyware linked to Memento Labs. The campaign involved personalized phishing emails targeting Russian organizations, leveraging advanced exploits and stealth techniques to infect victims. #OperationForumTroll #LeetAgent #Dante #MementoLabs #ChromeZeroDay…
A zero-day vulnerability in Google Chrome was exploited in Operation ForumTroll, delivering malware linked to the Italian spyware firm Memento Labs, which originated from Hacking Team. The campaign targeted Russian organizations with phishing emails, using the exploit CVE-2025-2783 to deploy sophisticated spyware such as LeetAgent and Dante. #CVE-2025-2783 #MementoLabs #HackingTeam #OperationForumTroll
A Russian cybersecurity firm, Kaspersky, detected the use of Italy’s Memento Labs’ spyware, Dante, in attacks on organizations in Russia and Belarus. The report highlights the indirect involvement of the spyware in espionage campaigns, linked to the hacking group ForumTroll, and sheds light on the ongoing legacy of Hacking Team’s surveillance…
A large-scale smishing campaign launched since April 2024 involves impersonation of various services, including healthcare, banking, and government agencies, primarily targeting US users but also affecting numerous other countries. The campaign is highly decentralized, utilizing over 194,000 malicious domains, and is linked to the Chinese-speaking threat group known as the Smishing…
The first Chrome zero-day vulnerability of 2025, CVE-2025-2783, has been exploited in a state-sponsored cyberespionage campaign called Operation ForumTroll, which targeted organizations in Russia. The campaign utilized sophisticated malware such as LeetAgent and potentially Memento Labs’ Dante, employing phishing and sandbox escape techniques. #CVE-2025-2783 #OperationForumTroll #LeetAgent #MementoLabs #HackingTeam…
Kaspersky discovered Operation ForumTroll, a targeted espionage campaign that used personalized short-lived phishing links to deliver a Chrome sandbox escape zero-day (CVE-2025-2783) and deploy loaders and spyware including LeetAgent and the commercial Dante spyware. The campaign targeted Russian institutions and used techniques like WebGPU-based validation, COM hijacking persistence, and Fastly-hosted C2s. #CVE-2025-2783 #LeetAgent #Dante
Daily Recap, Microsoft patches critical WSUS RCE (CVE-2025-59287) and blocks NTLM hash theft via Preview, while multiple product flaws and active exploits raise supply chain and server risk. The broader landscape covers state and non-state actors deploying drone malware, DeskRAT variants, and ransomware waves, with notable incidents in healthcare, government, and e‑commerce sectors. #CVE-2025-59287 #NTLM #DeskRAT #Medusa #Genesis
North Korean group Lazarus has launched new attacks targeting European companies in the UAV sector through Operation Dream Job, using fake job offers and remote access malware. The campaign aims to steal proprietary drone technology and military intelligence, highlighting North Korea’s growing focus on domestic drone manufacturing, potentially aided by Russia….