Oktacron - Cyber Security RSS Feeds History

New Android Banking Trojan Targets More Than 750 Financial and Crypto Apps

cyberexpress Mar 31, 2025 Cyber News

Cyble researchers have discovered a new Android banking trojan that uses overlay attacks and other techniques to target more than 750 applications, including banking, finance, cryptocurrency, payment, social media, and e-commerce applications. Dubbed “TsarBot” because of the threat actor’s suspected Russian show more ...

origin, the malware uses overlay attacks to steal credentials and can also record and control the screen. Other attack techniques used by the malware include lock-grabbing, keylogging, and intercepting SMS messages. Abusing Accessibility services and WebSocket communications helps the malware maintain a low profile. TsarBot Spread Through Phishing Sites TsarBot was observed spreading through a phishing site that impersonates the official Photon Sol token discovery and trading site. “The phishing site deceptively offers a download option for an application to start trading, whereas the legitimate website lacks such an option,” Cyble noted in a blog post detailing the findings. Three phishing sites deploying TsarBot were identified by the researchers, including solphoton[.]io, solphoton[.]app, and cashraven[.]online. The phishing sites deliver a dropper application that stores the TsarBot APK file, implant.apk, in the “res/raw” folder, and uses a session-based package installer to deploy the TsarBot malware on the device. After deployment, TsarBot presents a fake Google Play Service update page that prompts the user to enable Accessibility services, which establishes a socket connection with the command and control (C&C) server using ports 9001, 9002, 9004 and 9030. “By abusing Accessibility services and WebSocket communication, it enables on-device fraud while maintaining a low profile,” the Cyble researchers wrote. TsarBot Actions Include Fraud, Password Theft Cyble identified about 30 commands that TsarBot can receive from the server, primarily focused on on-screen control to carry out on-device fraud. The “REQUEST_CAPTURE” command, for example, prompts the user to enable screen capture permissions. “Once granted, the malware initiates the screen capture service, transmitting the captured screen content to the C&C server via a WebSocket connection on port 9002,” the researchers wrote. “By capturing screen content and executing server-issued screen control commands, TsarBot can carry out fraudulent transactions on the targeted device by concealing this fraud activity with a black overlay screen.” TsarBot’s LockTypeDetector feature determines the device’s lock type using the Accessibility service. “Once identified, it saves the lock type status for future use in lock-grabbing operations,” Cyble said. When TsarBot receives the “USER_PRESENT” action for the first time, it loads a fake lock screen based on the lock type and captures the user’s lock password, PIN, or pattern. Mimicking Applications TsarBot retrieves a list of targeted application package names, most of which belong to regional banking apps from countries such as France, Poland, the UK, India, the UAE, and Australia. Other package names are associated with e-commerce, social media, messaging, cryptocurrency, and other apps. TsarBot collects the installed applications on the device and compares them against the package names, “maintaining a target list for overlay attacks,” Cyble said. “The injection page mimics a legitimate application, tricking users into entering sensitive information such as net banking credentials, log in details, and credit card information,” Cyble said. “After transmitting the stolen sensitive information, TsarBot removes the targeted application’s package name from the list to prevent the overlay from being triggered again for the same app.” Cyble said the malware drives home the importance of best practices such as only downloading software from official application stores, such as the Google Play Store or the iOS App Store; using strong passwords, multi-factor authentication and biometric security; enabling Google Play Protect; and exercising caution while opening links that have been sent via SMS or emails. The full Cyble blog includes additional details, such as indicators of compromise (IoC) and MITRE ATT&CK technoques.

CISA Details New Malware Used in Ivanti Attacks

cyberexpress Mar 31, 2025 Cyber News

The U.S. Cybersecurity and Information Security Agency (CISA) has issued an advisory detailing a new malware variant detected in attacks on an Ivanti vulnerability. The CISA advisory says the agency recovered three files from a critical infrastructure environment’s Ivanti Connect Secure device after threat actors show more ...

exploited Ivanti vulnerability CVE-2025-0282 for initial access. One of the files contained a new malware variant that CISA is calling RESURGE, which is similar to SPAWNCHIMERA in that it creates a Secure Shell (SSH) tunnel for command and control activities. The new variant adds important new capabilities, however. RESURGE Malware Adds New Capabilities RESURGE malware goes well beyond SPAWNCHIMERA with its ability to modify files, manipulate integrity checks, and create a web shell that is copied to the running Ivanti boot disk. The RESURGE file, 'libdsupgrade.so,' is a malicious 32-bit Linux Shared Object file, CISA said. The file contains a rootkit, dropper, backdoor, bootkit, proxy, and tunneler. A second file (‘liblogblock.so’) is a variant of the SPAWNSLOTH log tampering utility that was contained within the RESURGE sample. The third file (‘dsmain’) is a custom embedded binary containing an open-source shell script and applets from the open-source tool BusyBox, CISA said. The shell script can extract an uncompressed kernel image (vmlinux) from a compromised kernel image, while BusyBox lets threat actors “perform various functions such as download and execute payloads on compromised devices,” the agency said. CISA included file hashes and YARA detection rules based on the SHA-256 hashes. For RESURGE, the SHA-256 hash is 52bbc44eb451cb5e16bf98bc5b1823d2f47a18d71f14543b460395a1c1b1aeda. The SPAWNSLOTH hash is 3526af9189533470bc0e90d54bafb0db7bda784be82a372ce112e361f7c7b104, and the dsmain hash is b1221000f43734436ec8022caaa34b133f4581ca3ae8eccd8d57ea62573f301d. CISA Recommendations CISA recommended a number of controls in the advisory, such as: Disabling file and printer sharing services if possible, or at least using strong passwords or Active Directory authentication. Restricting users' ability to install and run unwanted software applications. Exercising caution when opening e-mail attachments “even if the attachment is expected and the sender appears to be known.” Enabling a personal firewall on workstations and configuring it to deny unsolicited connection requests. Disabling unnecessary services on workstations and servers. Scanning for and removing suspicious e-mail attachments, and ensuring that the attachment extension matches the file header. Maintaining awareness of the latest threats and implementing appropriate Access Control Lists (ACLs).

How IP cameras can help attackers | Kaspersky official blog

kaspersky Mar 31, 2025 Business

Cybersecurity professionals will likely draw upon the Akira ransomware attack as a key learning example for years to come. The attackers encrypted an organizations computers by hacking a surveillance camera. While counterintuitive at first glance, the sequence of events follows a logic that can be easily applied to a show more ...

different organization and different devices within its infrastructure. Anatomy of the attack Attackers exploited a vulnerability in a public-facing application to penetrate the network and execute commands on an infected host. Following the initial breach, they launched the popular remote access tool AnyDesk and initiated an RDP session with the organizations file server. Accessing the server, they attempted to run ransomware, but the companys EDR system detected and quarantined it. Alas, this didnt stop the attackers. Unable to deploy the ransomware on servers or workstations, which were protected by EDR, the attackers ran a LAN scan and found a network video camera. Despite repeated references to a webcam in the incident investigation report, we believe it wasnt the built-in camera of a laptop or smartphone, but a standalone networked device for video surveillance. There were several reasons why the camera was an ideal target for the attackers: Due to its severely outdated firmware, the device was vulnerable to remote exploitation, which granted attackers shell access and the ability to execute commands. The camera ran a lightweight Linux build capable of executing standard binaries for this operating system. Coincidentally, Akiras arsenal contained a Linux-based encryption tool. This specialized device lacked — and likely was incapable of supporting — an EDR agent or any other security controls to detect malicious activity. The attackers were able to install their malware on the camera, and used the device as the foothold for encrypting the organizations servers. How to avoid being next victim The IP camera incident vividly illustrates certain principles of targeted cyberattacks, and provides insight into effective countermeasures. Heres a ranking of the countermeasures, from the easiest to the most complex: Limit access to specialized network devices and their permissions. A major factor in this attack was the IP cameras overly permissive access to the file servers. These devices should reside within an isolated subnet. If thats not feasible, they should be given the fewest possible permissions to communicate with other computers. For example, write-access should be restricted to a single folder on a single specific server where video recordings are stored. And access to the camera and this folder should be restricted to workstations used only by security and other authorized personnel. While implementing these restrictions may be more challenging for other specialized devices (such as printers), its readily achievable with cameras. Deactivate non-essential services and default accounts on smart devices, and change default passwords. Use an EDR solution across all servers, workstations, and other compatible devices. The selected solution must be capable of detecting anomalous server activity, such as remote encryption attempts via SMB. Extend vulnerability and patch management programs to include all smart devices and server software. Start by conducting a detailed inventory of such devices. Where feasible, implement monitoring, such as telemetry forwarding to a SIEM system, even on specialized devices where EDR deployment isnt possible: routers, firewalls, printers, video surveillance cameras, and similar devices. Consider transition to XDR-class solution, which combines network and host monitoring with anomaly-detection technologies, and tools for manual and automatic incident response.

How Each Pillar of the 1st Amendment is Under Attack

krebsonsecurity Mar 31, 2025 A Little Sunshine

“Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances.” -U.S. Constitution, First show more ...

Amendment. Image: Shutterstock, zimmytws. In an address to Congress this month, President Trump claimed he had “brought free speech back to America.” But barely two months into his second term, the president has waged an unprecedented attack on the First Amendment rights of journalists, students, universities, government workers, lawyers and judges. This story explores a slew of recent actions by the Trump administration that threaten to undermine all five pillars of the First Amendment to the U.S. Constitution, which guarantees freedoms concerning speech, religion, the media, the right to assembly, and the right to petition the government and seek redress for wrongs. THE RIGHT TO PETITION The right to petition allows citizens to communicate with the government, whether to complain, request action, or share viewpoints — without fear of reprisal. But that right is being assaulted by this administration on multiple levels. For starters, many GOP lawmakers are now heeding their leadership’s advice to stay away from local town hall meetings and avoid the wrath of constituents affected by the administration’s many federal budget and workforce cuts. Another example: President Trump recently fired most of the people involved in processing Freedom of Information Act (FOIA) requests for government agencies. FOIA is an indispensable tool used by journalists and the public to request government records, and to hold leaders accountable. The biggest story by far this week was the bombshell from The Atlantic editor Jeffrey Goldberg, who recounted how he was inadvertently added to a Signal group chat with National Security Advisor Michael Waltz and 16 other Trump administration officials discussing plans for an upcoming attack on Yemen. One overlooked aspect of Goldberg’s incredible account is that by planning and coordinating the attack on Signal — which features messages that can auto-delete after a short time — administration officials were evidently seeking a way to avoid creating a lasting (and potentially FOIA-able) record of their deliberations. “Intentional or not, use of Signal in this context was an act of erasure—because without Jeffrey Goldberg being accidentally added to the list, the general public would never have any record of these communications or any way to know they even occurred,” Tony Bradley wrote this week at Forbes. Petitioning the government, particularly when it ignores your requests, often requires challenging federal agencies in court. But that becomes far more difficult if the most competent law firms start to shy away from cases that may involve crossing the president and his administration. On March 22, the president issued a memorandum that directs heads of the Justice and Homeland Security Departments to “seek sanctions against attorneys and law firms who engage in frivolous, unreasonable and vexatious litigation against the United States,” or in matters that come before federal agencies. The POTUS recently issued several executive orders railing against specific law firms with attorneys who worked legal cases against him. On Friday, the president announced that the law firm of Skadden, Arps, Slate, Meager & Flom had agreed to provide $100 million in pro bono work on issues that he supports. Trump issued another order naming the firm Paul, Weiss, Rifkind, Wharton & Garrison, which ultimately agreed to pledge $40 million in pro bono legal services to the president’s causes. Other Trump executive orders targeted law firms Jenner & Block and WilmerHale, both of which have attorneys that worked with special counsel Robert Mueller on the investigation into Russian interference in the 2016 election. But this week, two federal judges in separate rulings froze parts of those orders. “There is no doubt this retaliatory action chills speech and legal advocacy, and that is qualified as a constitutional harm,” wrote Judge Richard Leon, who ruled against the executive order targeting WilmerHale. President Trump recently took the extraordinary step of calling for the impeachment of federal judges who rule against the administration. Trump called U.S. District Judge James Boasberg a “Radical Left Lunatic” and urged he be removed from office for blocking deportation of Venezuelan alleged gang members under a rarely invoked wartime legal authority. In a rare public rebuke to a sitting president, U.S. Supreme Court Justice John Roberts issued a statement on March 18 pointing out that “For more than two centuries, it has been established that impeachment is not an appropriate response to disagreement concerning a judicial decision.” The U.S. Constitution provides that judges can be removed from office only through impeachment by the House of Representatives and conviction by the Senate. The Constitution also states that judges’ salaries cannot be reduced while they are in office. Undeterred, House Speaker Mike Johnson this week suggested the administration could still use the power of its purse to keep courts in line, and even floated the idea of wholesale eliminating federal courts. “We do have authority over the federal courts as you know,” Johnson said. “We can eliminate an entire district court. We have power of funding over the courts, and all these other things. But desperate times call for desperate measures, and Congress is going to act, so stay tuned for that.” FREEDOM OF ASSEMBLY President Trump has taken a number of actions to discourage lawful demonstrations at universities and colleges across the country, threatening to cut federal funding for any college that supports protests he deems “illegal.” A Trump executive order in January outlined a broad federal crackdown on what he called “the explosion of antisemitism” on U.S. college campuses. This administration has asserted that foreign students who are lawfully in the United States on visas do not enjoy the same free speech or due process rights as citizens. Reuters reports that the acting civil rights director at the Department of Education (DOE) on March 10 sent letters to 60 educational institutions warning they could lose federal funding if they don’t do more to combat anti-semitism. On March 20, Trump issued an order calling for the closure of the DOE. Meanwhile, U.S. Immigration and Customs Enforcement (ICE) agents have been detaining and trying to deport pro-Palestinian students who are legally in the United States. The administration is targeting students and academics who spoke out against Israel’s attacks on Gaza, or who were active in campus protests against U.S. support for the attacks. Secretary of State Marco Rubio told reporters Thursday that at least 300 foreign students have seen their visas revoked under President Trump, a far higher number than was previously known. In his first term, Trump threatened to use the national guard or the U.S. military to deal with protesters, and in campaigning for re-election he promised to revisit the idea. “I think the bigger problem is the enemy from within,” Trump told Fox News in October 2024. “We have some very bad people. We have some sick people, radical left lunatics. And I think they’re the big — and it should be very easily handled by, if necessary, by National Guard, or if really necessary, by the military, because they can’t let that happen.” This term, Trump acted swiftly to remove the top judicial advocates in the armed forces who would almost certainly push back on any request by the president to use U.S. soldiers in an effort to quell public protests, or to arrest and detain immigrants. In late February, the president and Defense Secretary Pete Hegseth fired the top legal officers for the military services — those responsible for ensuring the Uniform Code of Military Justice is followed by commanders. Military.com warns that the purge “sets an alarming precedent for a crucial job in the military, as President Donald Trump has mused about using the military in unorthodox and potentially illegal ways.” Hegseth told reporters the removals were necessary because he didn’t want them to pose any “roadblocks to orders that are given by a commander in chief.” FREEDOM OF THE PRESS President Trump has sued a number of U.S. news outlets, including 60 Minutes, CNN, The Washington Post, The New York Times and other smaller media organizations for unflattering coverage. In a $10 billion lawsuit against 60 Minutes and its parent Paramount, Trump claims they selectively edited an interview with former Vice President Kamala Harris prior to the 2024 election. The TV news show last month published transcripts of the interview at the heart of the dispute, but Paramount is reportedly considering a settlement to avoid potentially damaging its chances of winning the administration’s approval for a pending multibillion-dollar merger. The president sued The Des Moines Register and its parent company, Gannett, for publishing a poll showing Trump trailing Harris in the 2024 presidential election in Iowa (a state that went for Trump). The POTUS also is suing the Pulitzer Prize board over 2018 awards given to The New York Times and The Washington Post for their coverage of purported Russian interference in the 2016 election. Whether or not any of the president’s lawsuits against news organizations have merit or succeed is almost beside the point. The strategy behind suing the media is to make reporters and newsrooms think twice about criticizing or challenging the president and his administration. The president also knows some media outlets will find it more expedient to settle. Trump also sued ABC News and George Stephanopoulos for stating that the president had been found liable for “rape” in a civil case [Trump was found liable of sexually abusing and defaming E. Jean Carroll]. ABC parent Disney settled that claim by agreeing to donate $15 million to the Trump Presidential Library. Following the attack on the U.S. Capitol on Jan. 6, 2021, Facebook blocked President Trump’s account. Trump sued Meta, and after the president’s victory in 2024 Meta settled and agreed to pay Trump $25 million: $22 million would go to his presidential library, and the rest to legal fees. Meta CEO Mark Zuckerberg also announced Facebook and Instagram would get rid of fact-checkers and rely instead on reader-submitted “community notes” to debunk disinformation on the social media platform. Brendan Carr, the president’s pick to run the Federal Communications Commission (FCC), has pledged to “dismantle the censorship cartel and restore free speech rights for everyday Americans.” But on January 22, 2025, the FCC reopened complaints against ABC, CBS and NBC over their coverage of the 2024 election. The previous FCC chair had dismissed the complaints as attacks on the First Amendment and an attempt to weaponize the agency for political purposes. According to Reuters, the complaints call for an investigation into how ABC News moderated the pre-election TV debate between Trump and Biden, and appearances of then-Vice President Harris on 60 Minutes and on NBC’s “Saturday Night Live.” Since then, the FCC has opened investigations into NPR and PBS, alleging that they are breaking sponsorship rules. The Center for Democracy & Technology (CDT), a think tank based in Washington, D.C., noted that the FCC is also investigating KCBS in San Francisco for reporting on the location of federal immigration authorities. “Even if these investigations are ultimately closed without action, the mere fact of opening them – and the implicit threat to the news stations’ license to operate – can have the effect of deterring the press from news coverage that the Administration dislikes,” the CDT’s Kate Ruane observed. Trump has repeatedly threatened to “open up” libel laws, with the goal of making it easier to sue media organizations for unfavorable coverage. But this week, the U.S. Supreme Court declined to hear a challenge brought by Trump donor and Las Vegas casino magnate Steve Wynn to overturn the landmark 1964 decision in New York Times v. Sullivan, which insulates the press from libel suits over good-faith criticism of public figures. The president also has insisted on picking which reporters and news outlets should be allowed to cover White House events and participate in the press pool that trails the president. He barred the Associated Press from the White House and Air Force One over their refusal to call the Gulf of Mexico by another name. And the Defense Department has ordered a number of top media outlets to vacate their spots at the Pentagon, including CNN, The Hill, The Washington Post, The New York Times, NBC News, Politico and National Public Radio. “Incoming media outlets include the New York Post, Breitbart, the Washington Examiner, the Free Press, the Daily Caller, Newsmax, the Huffington Post and One America News Network, most of whom are seen as conservative or favoring Republican President Donald Trump,” Reuters reported. FREEDOM OF SPEECH Shortly after Trump took office again in January 2025, the administration began circulating lists of hundreds of words that government staff and agencies shall not use in their reports and communications. The Brookings Institution notes that in moving to comply with this anti-speech directive, federal agencies have purged countless taxpayer-funded data sets from a swathe of government websites, including data on crime, sexual orientation, gender, education, climate, and global development. The New York Times reports that in the past two months, hundreds of terabytes of digital resources analyzing data have been taken off government websites. “While in many cases the underlying data still exists, the tools that make it possible for the public and researchers to use that data have been removed,” The Times wrote. On Jan. 27, Trump issued a memo (PDF) that paused all federally funded programs pending a review of those programs for alignment with the administration’s priorities. Among those was ensuring that no funding goes toward advancing “Marxist equity, transgenderism, and green new deal social engineering policies.” According to the CDT, this order is a blatant attempt to force government grantees to cease engaging in speech that the current administration dislikes, including speech about the benefits of diversity, climate change, and LGBTQ issues. “The First Amendment does not permit the government to discriminate against grantees because it does not like some of the viewpoints they espouse,” the CDT’s Ruane wrote. “Indeed, those groups that are challenging the constitutionality of the order argued as much in their complaint, and have won an injunction blocking its implementation.” On January 20, the same day Trump issued an executive order on free speech, the president also issued an executive order titled “Reevaluating and Realigning United States Foreign Aid,” which froze funding for programs run by the U.S. Agency for International Development (USAID). Among those were programs designed to empower civil society and human rights groups, journalists and others responding to digital repression and Internet shutdowns. According to the Electronic Frontier Foundation (EFF), this includes many freedom technologies that use cryptography, fight censorship, protect freedom of speech, privacy and anonymity for millions of people around the world. “While the State Department has issued some limited waivers, so far those waivers do not seem to cover the open source internet freedom technologies,” the EFF wrote about the USAID disruptions. “As a result, many of these projects have to stop or severely curtail their work, lay off talented workers, and stop or slow further development.” On March 14, the president signed another executive order that effectively gutted the U.S. Agency for Global Media (USAGM), which oversees or funds media outlets including Radio Free Europe/Radio Liberty and Voice of America (VOA). The USAGM also oversees Radio Free Asia, which supporters say has been one of the most reliable tools used by the government to combat Chinese propaganda. But this week, U.S. District Court Judge Royce Lamberth, a Reagan appointee, temporarily blocked USAGM’s closure by the administration. “RFE/RL has, for decades, operated as one of the organizations that Congress has statutorily designated to carry out this policy,” Lamberth wrote in a 10-page opinion. “The leadership of USAGM cannot, with one sentence of reasoning offering virtually no explanation, force RFE/RL to shut down — even if the President has told them to do so.” FREEDOM OF RELIGION The Trump administration rescinded a decades-old policy that instructed officers not to take immigration enforcement actions in or near “sensitive” or “protected” places, such as churches, schools, and hospitals. That directive was immediately challenged in a case brought by a group of Quakers, Baptists and Sikhs, who argued the policy reversal was keeping people from attending services for fear of being arrested on civil immigration violations. On Feb. 24, a federal judge agreed and blocked ICE agents from entering churches or targeting migrants nearby. The president’s executive order allegedly addressing antisemitism came with a fact sheet that described college campuses as “infested” with “terrorists” and “jihadists.” Multiple faith groups expressed alarm over the order, saying it attempts to weaponize antisemitism and promote “dehumanizing anti-immigrant policies.” The president also announced the creation of a “Task Force to Eradicate Anti-Christian Bias,” to be led by Attorney General Pam Bondi. Never mind that Christianity is easily the largest faith in America and that Christians are well-represented in Congress. The Rev. Paul Brandeis Raushenbush, a Baptist minister and head of the progressive Interfaith Alliance, issued a statement accusing Trump of hypocrisy in claiming to champion religion by creating the task force. “From allowing immigration raids in churches, to targeting faith-based charities, to suppressing religious diversity, the Trump Administration’s aggressive government overreach is infringing on religious freedom in a way we haven’t seen for generations,” Raushenbush said. A statement from Americans United for Separation of Church and State said the task force could lead to religious persecution of those with other faiths. “Rather than protecting religious beliefs, this task force will misuse religious freedom to justify bigotry, discrimination, and the subversion of our civil rights laws,” said Rachel Laser, the group’s president and CEO. Where is President Trump going with all these blatant attacks on the First Amendment? The president has made no secret of his affection for autocratic leaders and “strongmen” around the world, and he is particularly enamored with Hungary’s far-right Prime Minister Viktor Orbán, who has visited Trump’s Mar-a-Lago resort twice in the past year. A March 15 essay in The Atlantic by Hungarian investigative journalist András Pethő recounts how Orbán rose to power by consolidating control over the courts, and by building his own media universe while simultaneously placing a stranglehold on the independent press. “As I watch from afar what’s happening to the free press in the United States during the first weeks of Trump’s second presidency — the verbal bullying, the legal harassment, the buckling by media owners in the face of threats — it all looks very familiar,” Pethő wrote. “The MAGA authorities have learned Orbán’s lessons well.”

CISA Warns of Resurge Malware Connected to Ivanti Vuln

darkreading Mar 31, 2025 Feed

Threat actors are exploiting a vulnerability in Ivanti Connect Secure first disclosed by the vendor in January.

CoffeeLoader Malware Is Stacked With Vicious Evasion Tricks

darkreading Mar 31, 2025 Feed

Next-level malware represents a new era of malicious code developed specifically to get around modern security software like digital forensics tools and EDR, new research warns.

Bridging the Gap Between the CISO & the Board of Directors

darkreading Mar 31, 2025 Feed

Positioning security leaders as more than risk managers turns them into business enablers, trusted advisers, and, eventually, integral members of the C-suite.

Qakbot Resurfaces in Fresh Wave of ClickFix Attacks

darkreading Mar 31, 2025 Feed

Attackers post links to fake websites on LinkedIn to ask people to complete malicious CAPTCHA challenges that install malware.

Oracle Cloud Users Urged to Take Action

darkreading Mar 31, 2025 Feed

Although Oracle has denied its cloud infrastructure services were breached, security experts recommend Oracle customers independently verify if they were affected and take measures to reduce exposure to potential fallout.

DoJ Seizes Over $8M from Sprawling Pig Butchering Scheme

darkreading Mar 31, 2025 Feed

The department was able to trace the stolen funds to three main cryptocurrency accounts after being routed through a series of other platforms.

Top 10 Most Used RDP Passwords Are Not Complex Enough

darkreading Mar 31, 2025 Feed

New research from Specops Software shows attackers successfully attack and gain access to RDP with the most basic passwords.

Trend Micro Open Sources AI Tool Cybertron

darkreading Mar 31, 2025 Feed

The cybersecurity artificial intelligence (AI) model and agent will help organizations improve threat detection and incident response.

FTC says 23andMe purchaser must uphold existing privacy policy for data handling

cyware Mar 31, 2025 Government

Federal Trade Commission Chair Andrew Fergsuon on Monday sent a letter to Department of Justice bankruptcy regulators warning that any purchaser of 23andMe must adhere to the company’s current privacy policies for protecting consumers’ genetic and other data.

British intel intern pleads guilty to smuggling top secret data out of protected facility

cyware Mar 31, 2025 News Briefs

Hassan Arshad, 25, admitted to transferring sensitive material from an agency computer at GCHQ headquarters.

Moscow subway app and website disrupted in possible retaliation for Ukraine railway hack

cyware Mar 31, 2025 News

During an outage of the Moscow subway system's app and website, the site displayed a message purportedly from Ukraine’s national railway operator, which was recently hit by a large-scale cyberattack.

French regulator fines Apple $162 million for anticompetitive use of privacy tool

cyware Mar 31, 2025 News

The French Competition Authority found that Apple exploited its dominance in the mobile app advertising market through a tool that allows iPhone and iPad users to determine when apps can monitor their online activity.

Canadian hacker arrested for allegedly stealing data from Texas Republican Party

cyware Mar 31, 2025 News

The prominent hacker Aubrey Cottle is accused of hacking into a third-party hosting company for the websites for the Texas Republican Party and the Texas Right to Life anti-abortion group.

Latest gambit for Gamaredon: Fake Ukraine troop movement documents with malicious links

cyware Mar 31, 2025 Malware

The Kremlin-linked hacking group Gamaredon appears to be behind a recent campaign that aims to install a malicious version of the Remcos tool on Ukrainian computers.

Hackers Exploit WordPress mu-Plugins to Inject Spam and Hijack Site Images

thehackernews Mar 31, 2025 Feed

Threat actors are using the "mu-plugins" directory in WordPress sites to conceal malicious code with the goal of maintaining persistent remote access and redirecting site visitors to bogus sites. mu-plugins, short for must-use plugins, refers to plugins in a special directory ("wp-content/mu-plugins") that are automatically executed by WordPress without the need to enable them explicitly via the

⚡ Weekly Recap: Chrome 0-Day, IngressNightmare, Solar Bugs, DNS Tactics, and More

thehackernews Mar 31, 2025 Feed

Every week, someone somewhere slips up—and threat actors slip in. A misconfigured setting, an overlooked vulnerability, or a too-convenient cloud tool becomes the perfect entry point. But what happens when the hunters become the hunted? Or when old malware resurfaces with new tricks? Step behind the curtain with us this week as we explore breaches born from routine oversights—and the unexpected

5 Impactful AWS Vulnerabilities You're Responsible For

thehackernews Mar 31, 2025 Feed

If you're using AWS, it's easy to assume your cloud security is handled - but that's a dangerous misconception. AWS secures its own infrastructure, but security within a cloud environment remains the customer’s responsibility. Think of AWS security like protecting a building: AWS provides strong walls and a solid roof, but it's up to the customer to handle the locks, install the alarm systems,

Russia-Linked Gamaredon Uses Troop-Related Lures to Deploy Remcos RAT in Ukraine

thehackernews Mar 31, 2025 Feed

Entities in Ukraine have been targeted as part of a phishing campaign designed to distribute a remote access trojan called Remcos RAT. "The file names use Russian words related to the movement of troops in Ukraine as a lure," Cisco Talos researcher Guilherme Venere said in a report published last week. "The PowerShell downloader contacts geo-fenced servers located in Russia and Germany to

Russian Hackers Exploit CVE-2025-26633 via MSC EvilTwin to Deploy SilentPrism and DarkWisp

thehackernews Mar 31, 2025 Feed

The threat actors behind the zero-day exploitation of a recently-patched security vulnerability in Microsoft Windows have been found to deliver two new backdoors called SilentPrism and DarkWisp. The activity has been attributed to a suspected Russian hacking group called Water Gamayun, which is also known as EncryptHub and LARVA-208. "The threat actor deploys payloads primarily by means of

This month in security with Tony Anscombe – March 2025 edition

welivesecurity Mar 31, 2025 Feed

From an exploited vulnerability in a third-party ChatGPT tool to a bizarre twist on ransomware demands, it's a wrap on another month filled with impactful cybersecurity news

Resilience in the face of ransomware: A key to business survival

welivesecurity Mar 31, 2025 Feed

Your company’s ability to tackle the ransomware threat head-on can ultimately be a competitive advantage