Tag: WINDOWS

YouTube Game Cheats Spread Arcane Stealer Malware to Russian-Speaking Users
Summary: A new stealer malware called Arcane is being distributed through YouTube videos promoting game cheats, targeting Russian-speaking users. This malware gathers a wide range of sensitive information from various applications, including VPNs, messaging apps, and gaming clients. It utilizes various techniques, including a batch file that activates PowerShell to initiate its malicious activities, while also evading security measures like Windows SmartScreen.…
Read More
VanHelsing Ransomware
The CYFIRMA Research and Advisory Team has discovered the VanHelsing Ransomware, which targets Windows systems and uses advanced encryption methods, making it challenging to detect and remove. It employs double extortion tactics, threatening to leak sensitive data, and stresses the importance of proactive cybersecurity measures and incident response strategies.…
Read More
The NYPD is sending more drones to 911 calls, but privacy advocates don’t like the view
Summary: New York City’s police department has significantly expanded its use of drones, branded as “first responders” to enhance public safety. However, this has raised serious concerns regarding privacy, surveillance, and civil liberties, as the drones are capable of extensive monitoring and their footage can be retained for legal purposes.…
Read More
SideWinder Threat Group: Maritime and Nuclear Sectors at Risk with Updated Toolset
SideWinder, also known as Rattlesnake or T-APT-04, is an advanced persistent threat group from India that has expanded its operations to target maritime and nuclear sectors across Asia, the Middle East, and Africa since 2012. Known for quickly adapting to security measures, SideWinder employs various tactics, techniques, and procedures (TTPs) to execute sophisticated cyber-attacks, primarily through phishing and malware.…
Read More
PoC Exploit Released for Windows Explorer Vulnerability Exposing NTLM Hashes
Summary: A security vulnerability identified as CVE-2025-24071 enables NTLM hash leakage from Windows systems when extracting maliciously crafted .library-ms files from RAR/ZIP archives. This flaw, which has a CVSS score of 7.5, arises from Windows Explorer’s automatic handling of these files, leading to unintentional NTLM authentication handshakes with attacker-controlled SMB servers.…
Read More
CVE-2025-21333 Windows heap-based buffer overflow analysis
CVE-2025–21333 is a heap-based buffer overflow vulnerability in the Windows 11 kernel-mode driver vkrnlintvsp.sys, actively exploited by threat actors. Microsoft released a patch (KB5050021) on January 14, 2024. The vulnerability can lead to privilege escalation and arbitrary read/write access in kernel space. The article details the vulnerability analysis, exploitation techniques, and recommendations for detection.…
Read More
A Deep Dive into Strela Stealer and How It Targets European Countries
The Strela Stealer is a targeted infostealer malware that primarily focuses on extracting email credentials from users of Mozilla Thunderbird and Microsoft Outlook in select European countries. Delivered through phishing campaigns, it employs sophisticated social engineering techniques to trick victims into executing its payload. The malware’s infrastructure is linked to Russian hosting services, and it utilizes complex obfuscation methods to evade detection.…
Read More
GrassCall Campaign: The Hackers Behind Job Recruitment Cyber Scams
The “GrassCall” malware campaign is an advanced social engineering attack targeting job seekers in the cryptocurrency and Web3 sectors, orchestrated by the Russian cybercriminal organization “Crazy Evil.” Utilizing fake job interviews, the attackers compromise systems to steal cryptocurrency assets, resulting in hundreds of victims. Affected: cryptocurrency sector, job seekers

Keypoints :

The GrassCall malware campaign is led by the Russian-speaking cyber-criminal organization “Crazy Evil.”…
Read More
Fake Cloudflare Verification Results in LummaStealer Trojan Infections
This article describes an ongoing malware campaign utilizing malicious WordPress plugins to spread the LummaStealer trojan. The malware trick users into running harmful PowerShell commands, thus collecting sensitive data from infected PCs. The campaign exploits fake human verification prompts primarily targeting Windows users. Affected: WordPress websites, Windows operating system users

Keypoints :

LummaStealer is an infostealer malware designed to collect sensitive data.…
Read More
Emulating the Sophisticated Chinese Adversary Salt Typhoon
Salt Typhoon, a Chinese APT group active since 2019, targets critical sectors, including Telecommunications and Government entities across multiple regions. Known for its advanced cyberespionage tactics, the group utilizes various tools and techniques to maintain access while evading detection. This includes exploiting Microsoft Exchange vulnerabilities and employing a range of persistence and privilege escalation techniques.…
Read More
FIN7’s New Stealth Weapon, Anubis Backdoor, Emerges in the Wild
Summary: PRODAFT has identified a new Python-based backdoor called AnubisBackdoor, associated with the FIN7 group, which allows for complete control over infected computers. The malware is adept at evading traditional security defenses, remaining undetected by most antivirus solutions. Delivered via malspam campaigns and compromised SharePoint instances, AnubisBackdoor demonstrates adaptability in its execution methods, posing a significant threat to enterprise environments.…
Read More

Summary: The video discusses Microsoft’s announcement to discontinue support for the remote desktop app on May 27th, which will be replaced by a new Windows app. This change will block connections to Windows 365 and Dev Box via the existing remote desktop app, and the video addresses concerns regarding the limitations and issues of the new app.…
Read More