Oktacron - Cyber Security RSS Feeds History

Weirdest Threat Group Names: The Funny, Scary and Just Plain Weird

cyberexpress Mar 17, 2025 Cyber News

With thousands of threat groups trying to make a name for themselves and new ones cropping up every day, it can take some work to come up with a name for a new threat group. Which may help explain all the misspellings and odd threat group names out there. Looking just at threat groups active in 2025 that have been show more ...

investigated by Cyble dark web researchers, here are some of the more interesting and humorous names of hackers and threat groups that are currently active. We opted for PG-rated names; there are quite a few threat groups with names that would make a security writer uncomfortable just typing them out, so we took a more family-friendly approach here. Weird Threat Group Names: The Menacing Quite a few threat group names are taken from fantasy characters, typically the menacing ones. Here are a few of those, and you could probably guess which fictional characters have been used for threat group names. LordVoldemort: The problem with using The Dark Lord’s name is people expect you to be a real badass. With a couple of recent attacks on Indonesian telecom and automotive targets, LordVoldemort may not quite live up to the group’s storied name just yet, but we’re fine with that; we wouldn’t want to see them reach that level of potential. VanHelsing: Is a Ransomware-as-a-Service (RaaS) group really the equivalent of a vampire slayer? This group just launched on March 7, so we’ll need to wait and see what their targets and methods look like. Morpheus: Another new group, with two victims so far – a pharmaceutical company and a time-tracking systems company. So far they seem to be engaged in standard ransomware group activity; no red or blue pills reported as of yet. Satanic: We’ll include the OG Dark Lord in this category. With a couple dozen attacks on organizations around the globe, the Satanic threat group is doing a pretty good job living up to its name. Cute and Funny Threat Group Names Some groups don’t seem to want to be seen as fearsome, at least in their choice of name. Easier to escape the notice of law enforcement, perhaps? Here are several such names. Space Bears: Cute like Care Bears but in a hackery way, with a pretty odd slogan too: “bears conquer space” (image below). [caption id="attachment_101421" align="aligncenter" width="529"] Space Bears threat group logo[/caption] Rabbit Cyber Team: With apologies to Monty Python, bunnies just aren’t that scary. Meow: Okay, maybe the cute names are going a little too far. OX THIEF: Do they steal animals, or Ox cables? crocs: Does the name refer to the scary reptile, or the fashion-disaster footwear? Sadly, the threat actor’s logo (image left) provides an answer; we were kind of hoping for the footwear. Maybe they could puts a pair of Crocs on the croc, just for us. Loser: We found ourselves wishing those guys better self-esteem. swag: At least we know what they’re after. Skillz: Anyone else hear Napoleon Dynamite in that one? Bow hunting skills, computer hacking skills. BFF: It’s always heartwarming when lifelong friends embark on a life of cybercrime together. Weird Threat Group Names: Compound Names Threat actors often favor compound names, borrowing a branding technique from corporate branding teams. These can create some odd pairings, like “StableFish,” “CanyonGod,” “FlipperZero” and “Devil.God” – we’re sensing some internal conflict on that last one, unlike with “Ddarknotevil,” who want you to know they’re not bad people at heart. Some other examples of the compound threat group name genre: BreadPirateLoler: Does anyone else hear “Dread Pirate Roberts” in that one? Bumblebeef: Do they have a beef with Bumble? So far their only target has been a U.S. financial services firm. Funksec: Assuming “sec” is short for security, this name conjures up images of a bunch of hackers dressed like Parliament Funkadelic. SyntheticEmotions: Kind of deep when you think about it. SafePay: We can imagine the slogan for this ransomware group – “Our decryption keys actually work!” TrapHouseMob: Not sure if a more unsavory name is possible, at least in a PG-rated article. Hacktivist Group Names: Ghosts and Dragons Hacktivists often choose names that blend their regional loyalties with fearsome creatures. Moroccan Dragons is one such example. This pro-Palestine group has been involved in attacks on Israeli and other targets, and has also been part of the odd alliance of pro-Islamic and pro-Russian groups known as the “Holy League.” “Ghosts” are another popular name for hacktivist groups. One such group – Arabian Ghosts – is a pro-Syrian group claiming recent attacks on U.S. and Israel critical infrastructure. Other hacktivist names are, well, kind of fun. Mysterious Team Bangladesh is a fun name for a group that has been anything but fun. Cyble has recorded 30 attacks by the group involving Indian, Middle Eastern, European and African targets. Mr Hamza is another somewhat entertaining name for a hacktivist group, in this case a pro-Palestinian group that has attacked targets in Israel, the U.S., and elsewhere. Cyber Partisans seems like a really polite way for this anti-Russian group to say they’re hacktivists.

Are the Android SafetyCore and Android System Key Verifier apps safe? | Kaspersky official blog

kaspersky Mar 17, 2025 Privacy

Since February, many users have been complaining about the Android System SafetyCore app suddenly appearing on their Android phones. It has neither UI nor settings, but Google Play says the developer is Google itself, the number of installations exceeds a billion, and the average rating is a dismal 2.4 stars. The show more ...

purpose of the app is described vaguely: It provides the underlying technology for features like the upcoming Sensitive Content Warnings feature in Google Messages. Its not hard to guess what sensitive content stands for, but how and why is Google going to be warning us about it? And how is it going to find out whether the content is indeed sensitive in nature? First, some reassurance regarding privacy: neither Google nor independent experts have reported any privacy concerns. SafetyCore runs locally — without sending photos or associated information to external servers. When the user receives an image in Google Messages, a machine-learning model that runs locally on the phone analyzes it and blurs it if it detects anything saucy. To remove the blur, the user has to tap the image and confirm that they really want to view the content. A similar thing happens when sending: if the user tries to send an image with nudity, the phone double-checks if it really needs to be sent. Google stresses that it doesnt send scan results anywhere. The SafetyCore app handles the image analysis — but its not designed for standalone use. Other apps call on SafetyCore when receiving or sending pictures, but its up to them how to use the output. So far, AI analysis can only be used in Google Messages: images recognized as sensitive will be blurred. In the future, Google promises to make SafetyCore features available to other developers, enabling apps like WhatsApp and Telegram to detect nudes as well. Other apps could be configured to, for example, block adult content or immediately filter such images into spam. Unlike previous attempts by Google and Apple to protect children from unwanted content, SafetyCore avoids external server analysis, which enhances privacy but strains hardware. Google anticipates that SafetyCore will eventually be installed on all sufficiently powerful (2GB RAM, Android 9+) phones. The feature will be disabled by default for adult users but enabled for minors. If you dont need this kind of hand-holding, or dont like having extra apps, you can simply remove SafetyCore from your phone. Unlike numerous other Google services, this app can easily be uninstalled through both Google Play and the Apps subsection of the phone settings. However, bear in mind that Google might reinstall the app with a future update. SafetyCore is the most sophisticated, though not the only, on-device (meaning no cloud usage and no user-data sharing) AI-powered protection system that Google is developing. Alongside SafetyCore, in October 2024 Google announced language models designed to analyze messages from strangers in Google Messages and suggest ending the conversation if the message text resembles a typical scam scheme. Besides SafetyCore, another app is spawning on devices with no warning — Android System Key Verifier. It also has no UI, can easily be uninstalled, and is designed for secure communication. However, it features no AI-driven analysis. This app enables two users to verify their keys during end-to-end encrypted messaging. WhatsApp and Signal have their own ways of doing this (users scan each others QR codes when meeting in person, or they compare long strings of numbers that show up on the screen). Google wants to make this easier for all messaging apps by putting a standard interface into Android. Users main issue with Google, and the reason for the poor ratings, isnt what the apps do, but how theyre installed: with no warnings, no explanations, and no user choice. A new app just appears on their phones. Many Google Play reviewers worry if its a virus, and some claim their phones or specific apps see reduced performance. There were no widespread issues connected to installing these Google apps, but if youve any doubts, you can manually delete the app and see if your phone indeed works better.

Apache Tomcat RCE Vulnerability Under Fire With 2-Step Exploit

darkreading Mar 17, 2025 Feed

The researchers who discovered the initial assault warned that the simple, staged attack is just the beginning for advanced exploit sequences that will test cyber defenses in new and more difficult ways.

OAuth Attacks Target Microsoft 365, GitHub

darkreading Mar 17, 2025 Feed

In a cyber twist, attackers behind two of the campaigns are using the apps to redirect users to phishing and malware distribution sites.

How Economic Headwinds Influence the Ransomware Ecosystem

darkreading Mar 17, 2025 Feed

Inflation, cryptocurrency market volatility, and the ability to invest in defenses all influence the impact and severity of a ransomware attack, according to incident response efforts and ransomware negotiators.

RansomHub Taps FakeUpdates to Target US Government Sector

darkreading Mar 17, 2025 Feed

A ransomware activity wave using the SocGholish MaaS framework for initial access also has affected banking and consulting firms in the US, Taiwan, and Japan since the beginning of the year.

Lexmark Expands Print Security Services Worldwide

darkreading Mar 17, 2025 Feed

Varonis Acquires Cyral to Reinvent Database Activity Monitoring

darkreading Mar 17, 2025 Feed

Denmark Warns of Increased Cyber Espionage Against Telecom Sector

darkreading Mar 17, 2025 Feed

A new threat assessment from the Danish Civil Protection Authority (SAMSIK) warned of cyberattacks targeting the telecommunications sector after citing a wave of incidents hitting European organizations the past few years.

How 'Open Innovation' Can Help Solve Problems Faster, Better & Cheaper

darkreading Mar 17, 2025 Feed

Cybersecurity is not just a technical challenge but also a very human one. The more humans that organizations can get involved, the more diverse perspectives and experiences that can be tapped into.

ClickFix Attack Compromises 100+ Car Dealership Sites

darkreading Mar 17, 2025 Feed

The ClickFix attack tactic seems to be gaining traction among threat actors.

Telegram CEO confirms leaving France amid criminal probe

cyware Mar 17, 2025 Government

The Russian-born founder and owner of the messaging app Telegram said he returned to Dubai after spending several months in France due to a criminal investigation related to activity on the app.

'Mora_001' ransomware gang exploiting Fortinet bug spotlighted by CISA in January

cyware Mar 17, 2025 Cybercrime

Two vulnerabilities impacting Fortinet products are being exploited by a new ransomware operation with ties to the LockBit ransomware group.

GitHub restores code following malicious changes to tj-actions tool

cyware Mar 17, 2025 Cybercrime

GitHub was forced to take action this weekend to help users after a threat actor compromised a popular open source package used by more than 23,000 organizations.

GitHub Action Compromise Puts CI/CD Secrets at Risk in Over 23,000 Repositories

thehackernews Mar 17, 2025 Feed

Cybersecurity researchers are calling attention to an incident in which the popular GitHub Action tj-actions/changed-files was compromised to leak secrets from repositories using the continuous integration and continuous delivery (CI/CD) workflow. The incident involved the tj-actions/changed-files GitHub Action, which is used in over 23,000 repositories. It's used to track and retrieve all

Unpatched Edimax Camera Flaw Exploited for Mirai Botnet Attacks Since Last Year

thehackernews Mar 17, 2025 Feed

An unpatched security flaw impacting the Edimax IC-7100 network camera is being exploited by threat actors to deliver Mirat botnet malware variants since at least May 2024. The vulnerability in question is CVE-2025-1316 (CVSS v4 score: 9.3), a critical operating system command injection flaw that an attacker could exploit to achieve remote code execution on susceptible devices by means of a

Cybercriminals Exploit CSS to Evade Spam Filters and Track Email Users' Actions

thehackernews Mar 17, 2025 Feed

Malicious actors are exploiting Cascading Style Sheets (CSS), which are used to style and format the layout of web pages, to bypass spam filters and track users' actions. That's according to new findings from Cisco Talos, which said such malicious activities can compromise a victim's security and privacy. "The features available in CSS allow attackers and spammers to track users' actions and

⚡ THN Weekly Recap: Router Hacks, PyPI Attacks, New Ransomware Decryptor, and More

thehackernews Mar 17, 2025 Feed

From sophisticated nation-state campaigns to stealthy malware lurking in unexpected places, this week’s cybersecurity landscape is a reminder that attackers are always evolving. Advanced threat groups are exploiting outdated hardware, abusing legitimate tools for financial fraud, and finding new ways to bypass security defenses. Meanwhile, supply chain threats are on the rise, with open-source

SANS Institute Warns of Novel Cloud-Native Ransomware Attacks

thehackernews Mar 17, 2025 Feed

The latest Palo Alto Networks Unit 42 Cloud Threat Report found that sensitive data is found in 66% of cloud storage buckets. This data is vulnerable to ransomware attacks. The SANS Institute recently reported that these attacks can be performed by abusing the cloud provider’s storage security controls and default settings. “In just the past few months, I have witnessed two different methods for

Apache Tomcat Vulnerability Actively Exploited Just 30 Hours After Public Disclosure

thehackernews Mar 17, 2025 Feed

A recently disclosed security flaw impacting Apache Tomcat has come under active exploitation in the wild following the release of a public proof-of-concept (PoC) a mere 30 hours after public disclosure. The vulnerability, tracked as CVE-2025-24813, affects the below versions - Apache Tomcat 11.0.0-M1 to 11.0.2 Apache Tomcat 10.1.0-M1 to 10.1.34 Apache Tomcat 9.0.0-M1 to 9.0.98 It concerns a

Free file converter malware scam “rampant” claims FBI

grahamcluley Mar 17, 2025 Guest blog

Whether you're downloading a video from YouTube or converting a Word document into a PDF file, there's a chance that you might be unwittingly handing control of your PC straight into the hands of cybercriminals. Read more in my article on the Hot for Security blog.

Borked Chromecasts are beginning to receive their update – just hope you didn’t do a factory reset

grahamcluley Mar 17, 2025 Google

The news can't have come too soon for the many Chromecast users who have found themselves unable to stream their favourite TV shows, movies, and other media. Read more in my article on the Hot for Security blog.

AI's biggest surprises of 2024 | Unlocked 403 cybersecurity podcast (S2E1)

welivesecurity Mar 17, 2025 Feed

Here's what's been hot on the AI scene over the past 12 months, how it's changing the face of warfare, and how you can fight AI-powered scams