Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for FBI Warns about Sile ...

 Cyber News

The FBI is warning that a threat group is using IT-themed social engineering calls and callback phishing emails to gain remote access to systems and steal sensitive data. The Silent Ransom Group (SRG), also known as Luna Moth, Chatty Spider, and UNC3753, will then use the stolen data to extort the law firms, the   show more ...  

advisory from the FBI’s Cyber Division said. Silent Ransom Group Finds a Niche Targeting Law Firms While SRG has historically targeted other sectors such as medical and insurance organizations, beginning in Spring 2023, the group has consistently targeted U.S.-based law firms and organizations with “similar naming conventions,” the FBI said, “likely due to the highly sensitive nature of legal industry data.” The group has been operating since 2022 and is primarily known for callback phishing emails, aka reverse vishing, where the group pretends to be well-known companies purporting to charge small subscription fees. If the victim wishes to cancel the fake subscription, they must call the threat actor, who emails the victim a link to download remote access software to gain access to their device or system. Once they’ve established access, the threat group will search for sensitive data to exfiltrate and then send a ransom notice to the victim threatening to release the data if the ransom is not paid. Beginning in March 2025, the group changed tactics by calling individuals and claiming to be an employee from their organization’s IT department, known as social engineering calls or vishing, short for “voice phishing.” The threat actor then tries to get the employee to join a remote access session. If the employee grants access to their device, “they are told that work needs to be done overnight,” the FBI said. “Once in the victim’s device, a typical SRG attack involves minimal privilege escalation and quickly pivots to data exfiltration conducted through ‘WinSCP’ (Windows Secure Copy) or a hidden or renamed version of ‘Rclone,’” the FBI advisory said. In the short amount of time SRG has been pursuing the vishing tactic, “it has been highly effective and resulted in multiple compromises,” the FBI said. The group will also call victim organizations to pressure them into ransom negotiations. While SRG has a publicly available site to post victim data, “they are inconsistent in their use of the site, and do not always follow through on posting victim data,” the FBI said. SRG Vishing Attacks Difficult to Detect Because SRG uses legitimate management and remote access tools, attacks are unlikely to be detected by traditional antivirus tools. Organizations are advised to monitor for the following potential signs of compromise: New unauthorized downloads of system management or remote access tools such as Zoho Assist, Syncro, AnyDesk, Splashtop, or Atera WinSCP or Rclone connections made to an external IP address Emails from an unnamed group claiming data was stolen Voicemails or phone calls from an unnamed group claiming data was stolen Emails about subscription services that provide a phone number and require a call to remove pending charges Employees receiving unsolicited phone calls from individuals claiming to work in their IT department. Recommendations include: Conducting staff training on phishing Developing and communicating policies for authenticating IT staff with employees Implementing two-factor authentication for all employees. The FBI is seeking any information from SRG victims that can be legally shared, such as ransom notes, phone numbers used by the threat actor, communications such as voicemails, cryptocurrency wallet information, and more.  

image for New Russian Cyber Th ...

 Cyber News

Dutch intelligence officials and Microsoft warned today of a new Russian threat actor targeting Western organizations in what appears to be a military and high-tech espionage campaign. The new threat group – called Laundry Bear by the Dutch and Void Blizzard by Microsoft – was the subject of separate advisories   show more ...  

today. The Netherlands General Intelligence and Security Service (AIVD) and the Netherlands Defense Intelligence and Security Service (MIVD) published a joint advisory, while Microsoft published a separate blog on the group. The threat group typically targets Microsoft email environments with attack techniques like stolen cookies and password spraying, then expands its attack from there while remaining difficult to detect. Military and High-Tech Espionage is Laundry Bear Objective In the Dutch advisory, the agencies said that Laundry Bear/Void Blizzard “has successfully gained access to sensitive information from a large number of government organisations, commercial entities and other organisations around the world, with a specific interest in European Union and NATO member states.” The threat group largely targets cloud-based email environments, in particular Exchange servers, engaging in “large-scale theft of email messages and other information relating to an organisation's email contacts, such as a Global Address List (GAL),” the Dutch advisory said. In some cases the group has also managed to obtain files, including data stored on cloud servers. In 2024, Laundry Bear attacked defense contractors, aerospace firms and other high-tech businesses involved in military production, with the likely goal of obtaining “sensitive information relating to the procurement and production of military goods by Western governments, and weapons deliveries to Ukraine from Western countries,” the Dutch advisory said. The group appears “to have some degree of knowledge about the production and delivery of military goods and the corresponding dependencies.” Laundry Bear has also attacked businesses “producing advanced technologies which are difficult for Russia to obtain due to Western sanctions,” the advisory said. Civilian organizations and businesses have also been targeted, typically in the IT and high tech sectors, including digital service providers to enterprise customers and government organizations, and some critical sectors. “Compared to some other Russian threat actors under investigation by the services, LAUNDRY BEAR has a high success rate,” the Dutch advisory said. Laundry Bear/Void Blizzard Attack Techniques The Dutch report detailed attack techniques such as pass-the-cookie attacks (likely stolen by infostealer malware and bought by Laundry Bear on a criminal marketplace) and password spraying. After obtaining access to an account, the group “is capable of stealing email messages from compromised systems at scale. In some cases, the Dutch services have established that LAUNDRY BEAR has stolen data from compromised SharePoint environments, where the group exploits known vulnerabilities to collect login credentials for later operations.” Because the group restricts its actions to existing access to Microsoft accounts without attempting to expand its access to underlying networks or systems, “it appears to have flown under the radar of network and system administrators relatively easily and for an extended period,” the advisory said. The Dutch advisory noted similarities between Laundry Bear and the APT28 Russian state-sponsored threat actor, but said the groups “are two distinct threat actors.” Microsoft Details NGO Campaign Microsoft detailed an April 2025 adversary-in-the-middle (AitM) spear phishing campaign that targeted more than 20 non-governmental organizations (NGOs) in Europe and the U.S. The group used a typosquatted domain to spoof the Microsoft Entra authentication portal in emails with a PDF attachment that lured targets with a fake invitation to the European Defense and Security Summit. “The attachment contained a malicious QR code that redirected to Void Blizzard infrastructure micsrosoftonline[.]com, which hosts a credential phishing page spoofing the Microsoft Entra authentication page,” Microsoft said. “We assess that Void Blizzard is using the open-source attack framework Evilginx to conduct the AitM phishing campaign and steal authentication data, including the input username and password and any cookies generated by the server.” Microsoft has also observed the threat actor accessing Microsoft Teams conversations and messages via the Teams web client application. The threat actor has also enumerated a compromised organization’s Microsoft Entra ID configuration using the publicly available AzureHound tool to gain information about the tenant’s users, roles, groups, applications, and devices. Protecting Against Laundry Bear/Void Blizzard The Dutch and Microsoft advisories contain extensive guidance for protecting against the threat group, including implementing automated responses to risky sign-ins, multi-factor authentication, centralized identity management with single sign-on, zero trust principles, cookie expiration and rebinding, and auditing and anomaly detection.

image for The ChoiceJacking at ...

 Threats

Can your photos and other data be downloaded or erased from your smartphone while its charging from a public charging port — on public transport, in a clinic, at the airport, and so on? Despite manufacturers safety measures, its sometimes possible. Hackers first came up with such attacks way back in 2011: if an   show more ...  

innocent-looking USB charging port doesnt just supply electricity but contains a hidden computer, it can connect to your smartphone in data-transfer mode using the Media Transfer Protocol (MTP) or Picture Transfer Protocol (PTP) and extract data from the device. This attack became known as juice-jacking, and both Google and Apple quickly came up with a safeguard: when a smartphone is connected to a device supporting MTP/PTP, it asks the user whether to allow data transfer or just charge. For many years, this simple precaution seemed to solve the problem… until 2025 — when researchers from Graz University of Technology in Styria, Austria, discovered a way to bypass it. ChoiceJacking attack In the new attacks — dubbed ChoiceJacking attacks — a malicious device disguised as a charging station confirms on its own that the victim supposedly wants to connect in data-transfer mode. Depending on the manufacturer and OS version, there are three variants of the attack. Each variant finds a different way to bypass a certain limitation in the USB protocol: a device cannot operate in both host mode (as a computer) and peripheral mode (e.g., as a mouse or keyboard) at the same time. The first method is the most complex but works on both iOS and Android. A microcomputer is disguised as a charging station. This microcomputer can connect to a smartphone as a USB keyboard, USB host (computer), and Bluetooth keyboard. When the smartphone is plugged in, the malicious station emulates a USB keyboard and sends commands to turn on Bluetooth and connect to a Bluetooth device — the very same malicious computer, now impersonating a Bluetooth keyboard. After that, the system reconnects via USB, now posing as a computer. The smartphone asks the user whether to allow data transfer — and the malicious device confirms the request via a Bluetooth keystroke. The second method only works on Android and doesnt require Bluetooth. The malicious charger pretends to be a USB keyboard and floods the smartphone with keystrokes — overwhelming the input buffer. While the OS is busy processing this meaningless input, the charger disconnects and reconnects — this time as a computer. A prompt appears on screen asking which mode to connect in, and right at that moment the tail end of the keyboard input buffer plays out, containing a keystroke sequence that confirms connection in data-transfer mode (MTP, PTP, or even ADB debug mode). The third method — also Android-only — exploits the fact that all tested smartphones incorrectly implement the Android Open Access Protocol (AOAP). The malicious device connects as a computer right away, and when the confirmation screen appears, it sends the necessary keystroke events through AOAP. According to the protocol, simultaneous operation in both USB-host and AOAP modes is prohibited — but in practice, this restriction is often ignored. Which devices are protected from USB ChoiceJacking? Both Apple and Google blocked these attack methods in iOS/iPadOS 18.4, and Android 15, respectively. Now, in order to confirm USB data transfer, its not enough to simply press Yes — you need to pass biometric authentication or enter a password. Unfortunately, on Android, the OS version alone doesnt guarantee your smartphones safety. For example, Samsung devices running the One UI 7 shell dont request authentication — even after updating to Android 15. Thats why Android users who have updated to Android 15 are advised to connect their smartphone to a known safe computer via a cable and check whether a password or biometric confirmation is required. If not — avoid public charging stations. How serious is this, and how to protect yourself? While law enforcement agencies have occasionally warned about USB data-theft attacks (1, 2), no real-world attacks have ever been publicly documented. This doesnt mean theyve never occurred, but it clearly isnt a widespread threat. If youre concerned about such attacks, you should only charge you devices using your own trusted charger or power bank, or use a USB data blocker — an adapter that allows only power to flow through the cable while preventing data transmission. These adapters, also called USB Condoms, are quite effective, but can slow down charging on newer smartphones since they also block the data signals required for Quick Charge mode. Alternatively, you could use a cheap charge-only USB cable (which cant transmit data), but you should test it first with a trusted computer to ensure no data-transfer prompt appears on the screen; then youll need to carry it around with you everywhere — and keep in mind that it also rules out Quick Charge. The most crucial and widely available protection is updating to the latest versions of Android or iOS. If you ever find yourself in a bind — with an outdated OS, no blocker, and an urgent need to use the nearest USB charger — just remain vigilant while charging. When you connect the phone, watch the screen: if it doesnt just start charging but prompts you to choose the connection type, select Charging only. If youre really worried about your data, its better to unplug and look for a less smart port. For more on other unusual smartphone hacks — check these out: Trojan embedded in fake Android smartphones Hacking Android, macOS, iOS, and Linux through a Bluetooth vulnerability The hidden risks of cheap Android devices Infected Android app store Triangulation Trojan for Apple devices

image for How the New Hacker M ...

 Feed

Once dismissed as Internet miscreants in hoodies, ethical hackers have hit the big time, earning millions from blue-chip firms. And they say it's their diverse backgrounds that make them top-tier bug hunters.

image for Danabot Takedown Dea ...

 Feed

A multiyear investigation by a public-private partnership has resulted in the seizure of the botnet's US-based infrastructure and indictments for its key players, significantly disrupting a vast cybercriminal enterprise.

 Feed

The U.S. Federal Bureau of Investigation (FBI) has warned of social engineering attacks mounted by a criminal extortion actor known as Luna Moth targeting law firms over the past two years. The campaign leverages "information technology (IT) themed social engineering calls, and callback phishing emails, to gain remote access to systems or devices and steal sensitive data to extort the victims,"

 Feed

The Russia-aligned threat actor known as TAG-110 has been observed conducting a spear-phishing campaign targeting Tajikistan using macro-enabled Word templates as an initial payload. The attack chain is a departure from the threat actor's previously documented use of an HTML Application (.HTA) loader dubbed HATVIBE, Recorded Future's Insikt Group said in an analysis. "Given TAG-110's historical

 Feed

Microsoft has shed light on a previously undocumented cluster of threat activity originating from a Russia-affiliated threat actor dubbed Void Blizzard (aka Laundry Bear) that it said is attributed to "worldwide cloud abuse." Active since at least April 2024, the hacking group is linked to espionage operations mainly targeting organizations that are important to Russian government objectives,

 Feed

Artificial intelligence is driving a massive shift in enterprise productivity, from GitHub Copilot’s code completions to chatbots that mine internal knowledge bases for instant answers. Each new agent must authenticate to other services, quietly swelling the population of non‑human identities (NHIs) across corporate clouds. That population is already overwhelming the enterprise: many companies

 Feed

Threat hunters have exposed a novel campaign that makes use of search engine optimization (SEO) poisoning techniques to target employee mobile devices and facilitate payroll fraud. The activity, first detected by ReliaQuest in May 2025 targeting an unnamed customer in the manufacturing sector, is characterized by the use of fake login pages to access the employee payroll portal and redirect

 Feed

Misconfigured Docker API instances have become the target of a new malware campaign that transforms them into a cryptocurrency mining botnet. The attacks, designed to mine for Dero currency, is notable for its worm-like capabilities to propagate the malware to other exposed Docker instances and rope them into an ever-growing horde of mining bots. Kaspersky said it observed an unidentified threat

 Feed

Cybersecurity researchers have disclosed a new malicious campaign that uses a fake website advertising antivirus software from Bitdefender to dupe victims into downloading a remote access trojan called Venom RAT. The campaign indicates a "clear intent to target individuals for financial gain by compromising their credentials, crypto wallets, and potentially selling access to their systems," the

 AI

In episode 52 of The AI Fix, our hosts watch a non-existent musical about garlic bread, Graham shares a summer reading list of books that don't exist, Mark feels nauseous after watching a video of Sam Altman and Jony Ive waffling about products that don't exist, some non-existent robots stack empty crates in a   show more ...  

factory that doesn't exist, and OpenAI releases Codex, an AI agent destined to make your software engineering job not exist. Graham reveals how an AI called "Thy" has ruined his childhood dream of becoming a late night radio DJ, and Mark looks at an experiment that showed groups of AI agents spontaneously create social norms—the building blocks of a society. All this and much more is discussed in the latest edition of "The AI Fix" podcast by Graham Cluley and Mark Stockley.

 Cyber Security News

Source: www.securityweek.com – Author: Eduard Kovacs Nearly one month after it informed customers that it had been targeted in a cyberattack, Canadian electric utility Nova Scotia Power admitted on Friday that it has been dealing with a ransomware attack. The breach was disclosed by Nova Scotia Power and its   show more ...  

parent company Emera on April 28, […] La entrada Nova Scotia Power Confirms Ransomware Attack, 280k Notified of Data Breach – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.securityweek.com – Author: SecurityWeek News SecurityWeek’s cybersecurity news roundup provides a concise compilation of noteworthy stories that might have slipped under the radar. We provide a valuable summary of stories that may not warrant an entire article, but are nonetheless important for a   show more ...  

comprehensive understanding of the cybersecurity landscape. Each week, we curate and […] La entrada In Other News: Volkswagen App Hacked, DR32 Sentenced, New OT Security Solution – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Alert

Source: www.securityweek.com – Author: Ionut Arghire The ongoing exploitation of a Commvault vulnerability that was targeted as a zero-day is likely part of a broader campaign against software-as-a-service (SaaS) solutions, the US cybersecurity agency CISA says. Tracked as CVE-2025-3928 (CVSS score of 8.7), the   show more ...  

unspecified security defect allows remote attackers to create and execute webshells, […] La entrada Companies Warned of Commvault Vulnerability Exploitation – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: hackread.com – Author: Waqas. The full source code of SilverRAT, a notorious remote access trojan (RAT), has been leaked online briefly appearing on GitHub under the repository “SilverRAT-FULL-Source-Code” before being swiftly taken down. A snapshot of the repository, captured by Hackread.com via   show more ...  

the Wayback Machine, reveals the entire project, its features, build instructions, and […] La entrada SilverRAT Source Code Leaked Online: Here’s What You Need to Know – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Devin Partida Nonprofits do vital work in their communities, which may create a tempting target for criminals. Increasingly sophisticated cybersecurity threats make incident response plans more relevant than ever. Nonprofit employees should strategically recognize and   show more ...  

prevent attacks to protect their sensitive data from cybercriminals.  Nonprofits are Becoming More Vulnerable  Many charitable […] La entrada Understanding the Importance of Incident Response Plans for Nonprofits – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Ahona Rudra “PowerDMARC has been a game-changer for our IT team!” Sebastián Valero Márquez  (IT Manager at HispaColex Tech Consulting) Overview Company: HispaColex Tech Consulting Customer Type: MSP Partner Country: Spain  HispaColex Tech Consulting, a leading   show more ...  

managed service provider (MSP) in the IT industry, has built a reputation for delivering innovative […] La entrada MSP Case Study: How PowerDMARC Became a Game-Changer for HispaColex Tech Consulting – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Alison Mack How Secure Are Your Non-Human Identities From Cyber Threats? Are you confident that your non-human identities (NHIs) are free from cyber threats? If your initial reaction is uncertainty or hesitation, don’t worry, you are not alone. Many organizations face   show more ...  

challenges in securing their NHIs, regardless of the industry they […] La entrada How Free Are Your NHIs from Cyber Threats? – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cloud Security

Source: securityboulevard.com – Author: Alison Mack Why Does NHI Value Matter To Your Security Architecture? For many businesses embarking on digital transformation journeys, the role of Non-Human Identities (NHIs) in their cybersecurity strategies is often understated. Yet, the management of NHIs and their   show more ...  

Secrets can be a game-changer, providing robust control over cloud security and […] La entrada How NHIs Deliver Value to Your Security Architecture – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cloud Security

Source: securityboulevard.com – Author: Alison Mack Is Your Cybersecurity Strategy Ready for Non-Human Identities? Non-Human Identities (NHIs) and Secrets Security Management have emerged as crucial components of a comprehensive cybersecurity strategy. These powerful tools, once adequately managed, can   show more ...  

significantly decrease the risk of security breaches and data leaks. Professionals in various sectors, including financial services, […] La entrada Feel Relieved by Perfecting Your NHI Tactics – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Blog

Source: securityboulevard.com – Author: Laura Bruck Executive Team’s Digital Footprint Exposure Is Real Executives, board members, and other high-profile users carry more than just influence – they carry risk. With access to strategic assets, critical systems, and high-trust communications, these   show more ...  

individuals are prime targets for threat actors. And in the age of oversharing, infostealers, and […] La entrada The Hidden Cyber Risks in Your Executive Team’s Digital Footprint – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Analytics & Intelligence

Source: securityboulevard.com – Author: Andy Rea As organisations begin to adopt LLMs internally, security and control become non-negotiable. This post is a proof of concept that shows just how straightforward it is to integrate GitGuardian’s Secrets Detection API into an LLM workflow. We’ll start with a   show more ...  

simple HTTP-based API and, through progressive enhancements, arrive at […] La entrada Building a Secure LLM Gateway (and an MCP Server) with GitGuardian & AWS Lambda – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 api

Source: securityboulevard.com – Author: Deepak Gupta – Tech Entrepreneur, Cybersecurity Author Securing your API endpoints isn’t just good practice—it’s essential survival. As cyber threats grow increasingly sophisticated, understanding the authentication mechanisms that protect your digital   show more ...  

assets becomes a critical skill for developers and architects alike. Having built authentication systems that protect millions of user accounts, […] La entrada Unlocking the Gates: REST API Authentication Methods for Modern Security – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Blog

Source: securityboulevard.com – Author: Rebecca Kappel What is EASA? EASA has long been synonymous with excellence in aviation safety. As the regulatory authority for the European Union, EASA sets the standards that govern everything from aircraft design to operational protocols. Its mission is clear: to ensure   show more ...  

that every aspect of aviation is as safe and […] La entrada Decoding EASA Regulation Part-IS: A Comprehensive Guide to Strengthening Aviation Cybersecurity – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: The US government has begun an audit of its National Vulnerability Database (NVD) to ensure its team can catch up with the vulnerability backlog. In a May 20 memo, the US Department of Commerce’s Office (DoC) of Inspector General announced plans to conduct an   show more ...  

audit of the National Institute of Standards […] La entrada US Government Launches Audit of NIST’s National Vulnerability Database – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: A new joint government advisory has urged organizations to prioritize the implementation of Security Information and Event Management (SIEM) and Security Orchestration, Automation and Response (SOAR) platforms. The guidance, issued by government agencies in the   show more ...  

US, UK, Australia, Canada and others, is designed to help business executives and cybersecurity practitioners navigate […] La entrada Governments Urge Organizations to Prioritize SIEM/SOAR Adoption – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Chinese

Source: www.infosecurity-magazine.com – Author: Chinese hackers are targeting local government organizations in the US by exploiting a vulnerability in Cityworks, a popular asset management system. Cisco Talos said it has observed a threat actor tracked as UAT-6382 successfully conduct intrusions in the   show more ...  

enterprise networks of municipal entities, beginning in January 2025. Following initial access, the […] La entrada Chinese Hackers Exploit Cityworks Flaw to Target US Local Governments – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 All things Heimdal

Source: heimdalsecurity.com – Author: Madalina Popovici , Heimdal launches a new podcast, The MSP Security Playbook – a show for managed service providers ready to scale smarter, boost profitability, and lead with next-gen cybersecurity solutions. The first episode features Nigel Moore, founder of The   show more ...  

Tech Tribe, who discusses how MSPs can move beyond reactive IT support models and embrace […] La entrada Heimdal Launches New Podcast: The MSP Security Playbook – Source: heimdalsecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . The U.S. Federal Bureau of Investigation (FBI) has warned of social engineering attacks mounted by a criminal extortion actor known as Luna Moth targeting law firms over the past two years. The campaign leverages “information technology (IT) themed social engineering   show more ...  

calls, and callback phishing emails, to gain remote access to […] La entrada Hackers Are Calling Your Office: FBI Alerts Law Firms to Luna Moth’s Stealth Phishing Campaign – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . The Russia-aligned threat actor known as TAG-110 has been observed conducting a spear-phishing campaign targeting Tajikistan using macro-enabled Word templates as an initial payload. The attack chain is a departure from the threat actor’s previously documented use of   show more ...  

an HTML Application (.HTA) loader dubbed HATVIBE, Recorded Future’s Insikt Group said […] La entrada Russia-Linked Hackers Target Tajikistan Government with Weaponized Word Documents – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2025-05
Aggregator history
Tuesday, May 27
THU
FRI
SAT
SUN
MON
TUE
WED
MayJuneJuly