Oktacron - Cyber Security RSS Feeds History

Ukrainian Government Systems Targeted With Backdoors Hidden in Cloud APIs and Docs

cyberexpress Jun 23, 2025 Cyber News

Russia-linked hackers are back at it again, this time with upgraded tools and a stealthier playbook targeting Ukrainian government systems. Ukraine’s national Computer Emergency Response Team has linked a recent cyberattack campaign against the information and communication system (ICS) of a government entity to show more ...

UAC-0001—also known as APT28 or Fancy Bear—the infamous hacking group believed to be operated by Russia’s GRU military intelligence service. Also read: Russian GRU Is Hacking IP Cameras and Logistics Firms to Spy on Aid Deliveries from Western Allies to Ukraine In an investigation conducted between March and May 2024, cybersecurity responders uncovered two previously unseen malware strains—BEARDSHELL and SLIMAGENT—lurking inside government systems. The attackers also deployed a component of the widely known COVENANT command-and-control framework, hidden inside a document titled “Act.doc” and sent via the encrypted messaging app Signal. While the initial infection vector wasn’t immediately clear, analysts later discovered the malware reached its target using a macro-laced Word document that installed multiple payloads—each designed to fly under the radar, exploit trusted services, and maintain persistence through registry hijacking and scheduled tasks. How the Intrusion Worked Against Ukrainian Government Systems The attackers disguised their malware inside a seemingly benign Word file delivered over Signal. [caption id="attachment_103328" align="aligncenter" width="650"] Sample of communication with an attacker in Signal (Source: CERT-UA)[/caption] If a user enabled macros, the document executed code that placed two files on the system and set up a COM-hijacking registry entry that hijacked explorer.exe to silently launch a malicious DLL. That DLL then decrypted another file (windows.png) containing shellcode that finally triggered the launch of the COVENANT malware framework—all without dropping anything directly visible to the user. COVENANT, a .NET-based red team tool popular in the post-exploitation phase of cyberattacks, was used here to download and execute PlaySndSrv.dll and a WAV file (sample-03.wav), which contained encoded instructions to ultimately launch BEARDSHELL—a custom-built backdoor. Persistence? Also covered. BEARDSHELL maintained access through a separate registry entry tied to a scheduled task under Microsoft’s SystemSoundsService. Classic APT28. What Do BEARDSHELL and SLIMAGENT Actually Do? Both malware tools were written in C++ and designed for stealth and data collection: BEARDSHELL connects to the attacker using the API of Icedrive, a legitimate cloud storage provider, allowing the malware to receive encrypted PowerShell scripts and exfiltrate data without triggering traditional security tools. Each infected system gets its own directory, named using a unique hash derived from hardware and system identifiers. SLIMAGENT takes periodic screenshots and encrypts them using AES + RSA, saving them locally in a time-stamped format. It’s the visual spy in the room, quietly recording the screen without alerting the user. What’s particularly clever—and dangerous—about both tools is their use of legitimate services (Koofr and Icedrive) as command-and-control (C2) infrastructure. This means they avoid sketchy IP addresses and domains, making traditional threat intel blacklists nearly useless. Why It Matters This latest campaign isn’t just another cyberattack—it’s part of an escalating pattern of hybrid warfare tactics employed by Russia since the start of its war in Ukraine. APT28, which has been tied to the DNC email leaks in 2016, Olympic Destroyer in 2018, and countless attacks on NATO and EU institutions, is one of the Kremlin’s most active cyber units. Also read: ‘I’m not a Robot’ reCAPTCHA Trojanized by Russian Hackers to Target Local Ukrainian Government Their tactics have evolved. Instead of brute-forcing their way into systems, they now leverage phishing documents, encrypted messaging apps like Signal for payload delivery, and trusted APIs for communication. And they’re still targeting the same kind of critical government infrastructure they’ve always sought to undermine. According to CERT-UA, the malware was identified inside a central government executive body’s information systems—a clear sign that the group is targeting the upper echelons of Ukraine’s state apparatus. Defense, Detection, and the Cloud API Problem CERT-UA is urging security teams—particularly within governments and critical infrastructure—to closely monitor traffic to app.koofr.net and api.icedrive.net, as these are being used as C2 endpoints. The advisory also noted that success of the attack hinged on: Users enabling macros in Office documents Host security tools failing to monitor Signal-based delivery The abuse of trusted services like Icedrive and Koofr as “invisible” control channels It’s another wake-up call: endpoint defenses can’t rely on static indicators. Malware is now using your everyday apps, cloud platforms, and registry entries to hide in plain sight. The Bigger Picture APT28 has always stayed ahead of the curve—and this campaign is no exception. By chaining together macro payloads, registry hijacking, cloud C2, and multi-stage execution, the group isn’t just adapting. It’s evolving. And while these attacks may seem targeted at Ukraine, the tactics, techniques, and procedures (TTPs) on display should concern every government and enterprise organization in the West. Because if a Word doc, a PNG, and a WAV file can bypass your defenses, what else is already lurking inside?

SparkKitty: a new stealer in the App Store and Google Play | Kaspersky official blog

kaspersky Jun 23, 2025 News

Your snapshots are, quite literally, the keys to your private life. Your gallery holds your future plans, financial secrets, cat pictures, and sometimes even things youd never share with anyone. But how often do you truly think about protecting those images? We hope that ever since you heard about the SparkCat show more ...

cross-platform stealer, youve been pondering it more often than usual. Now weve discovered that Trojans little sibling, which weve affectionately named SparkKitty. But dont let the cute name fool you — behind it lies a spy that, like its older brother, aims to steal photos from its victims smartphones. What makes this threat unique, and why should both Android and iPhone users prick up their ears? How SparkKitty makes its way onto devices The stealer spreads in two ways: (i) in the wild — that is, across the untamed parts of the internet; and (ii) through official app stores like the App Store and Google Play. Lets break this down. Official app stores In Apples App Store, the malware was lurking inside the ?coin app — designed for tracking cryptocurrency rates and trading signals. Were not sure exactly how this suspicious spy activity ended up in the app. Its possible there was a supply-chain compromise, and the developers themselves werent aware of SparkKitty until we notified them. But theres also a second possibility: the developers deliberately embedded the stealer into the app. Regardless, this is the second time weve seen a Trojan sneak into the App Store, and weve alerted Apple about it. SparkCat was the first instance. Infected application in the App Store Its a different story with Google Play: malicious apps pop up on a regular basis, and we frequently cover these threats on Kaspersky Daily. This time, we detected malicious activity in a messaging app that includes crypto-exchange features. This is a popular app thats been installed more than 10 000 times, and was removed from Google Play at the time of the study. Suspicious links in the wild That said, the attackers have been much more creative this time in spreading the malware out in the wild. Once, during a routine review of suspicious links (we click them so you dont have to!) our experts uncovered several similar pages distributing a TikTok mod for Android. One of the main things this mod did was call additional code. That looks suspicious, we thought. And we were right. The code contained links displayed as buttons within the app, all directing users to an online store called TikToki Mall, which sold a variety of items. Unfortunately, we couldnt determine if the store was legitimate or just a big trap — but one interesting fact stood out: TikToki Mall accepts cryptocurrency payments, and you need an invitation code to sign up and pay for any item. We didnt find any further suspicious activity at this stage, and no traces of SparkKitty or other malware. So we decided to take a different approach and see what happened when we tapped these same suspicious links from an iPhone. This led us to a page that vaguely resembled the App Store, which immediately prompted us to download the TikTok app. iOS doesnt allow users to download and run applications from third-party sources. However, Apple provides so-called provisioning profiles to every member of the Apple Developer Program. These allow installing custom applications not available in the App Store on user devices, such as beta versions or apps developed for internal corporate use. Attackers exploit these profiles to distribute apps that contain malware. The installation process differed slightly from the usual procedure. Typically, in the App Store, you only need to tap Install once, but in this case, installing the fake TikTok required additional steps: downloading and installing a developer provisioning profile. Installing an app from an unknown source on an iPhone Naturally, this version of TikTok didnt have any funny videos; it was just another store, similar to the Android version. While seemingly harmless, the iOS version requested access to the users gallery every time it launched — and that was the catch. This led us to discover a malicious module that sent images from the infected phones gallery, along with device information, to the attackers. We also found its traces in other Android applications. For the technical details of the story, check out our full report on Securelist. Whos at risk? Our data shows that this campaign primarily targets users in Southeast Asia and China. That doesnt mean, however, that other countries are beyond the reach of SparkKittys claws. The malware has been spreading since at least early 2024, and over the past year and a half attackers have likely considered upscaling their operation to other countries and continents. Theres nothing stopping them. Whats more, its not just the TikTok mod you should worry about; weve also found malicious activity inside various gambling and adult games, and even crypto-related apps. If you think these attackers are just interested in admiring your vacation photos, think again. SparkKitty uploads each and every one of your snapshots to its command-and-control server. Those images could easily include screenshots of sensitive information like crypto wallet seed phrases, allowing these bad actors to steal your cryptocurrency. How to protect yourself from SparkKitty This Trojan spreads in many ways, and protecting yourself from every single one is a tough challenge. While the golden rule of download apps from official sources only still applies, weve found traces of this stealer in both Google Play and the App Store — places where apps are supposedly vetted and 100% safe. So what can you do about that? We recommend focusing on securing your smartphones gallery. Naturally, the most foolproof method would be to never take photos or screenshots of sensitive information, but thats virtually impossible nowadays. Theres a solution: store valuable photos in a secure vault. With Kaspersky Password Manager, you can only view and send protected, important photos after entering the main password, which only you know. Note that the protected content is not confined to just one device. The password manager can sync information between smartphones and computers. This includes bank-card data, two-factor authentication tokens, and anything else you choose to store in Kaspersky Password Manager – including your photos. Its also crucial to check your smartphone right now for any of the infected apps weve discovered; the extended list is available on Securelist. For Android, Kaspersky for Android can help with this — itll find and remove malware for you. On iPhone, due to the closed architecture of iOS, our security solution cant scan for and delete previously installed infected apps, but it will prevent any attempts to send data to the attackers servers and warn you about them. And if you opt for a Kaspersky Premium or Kaspersky Plus subscription, you get Kaspersky Password Manager along with your security solution. Follow our Telegram channel to stay up to date on the latest cyberthreats, and make sure youre storing your photos safely. Learn about other malware you need to watch out for to keep your smartphone safe: How the Necro Trojan attacked 11 million Android users Beware of stealers disguised as… wedding invitations Trojan embedded in fake Android smartphones SparkCat trojan stealer infiltrates App Store and Google Play, steals data from photos LianSpy: new mobile spyware for Android

A CISO's AI Playbook

darkreading Jun 23, 2025 Feed

In a market where security budgets flatten while threats accelerate, improving analyst throughput is fiscal stewardship.

SparkKitty Swipes Pics From iOS, Android Devices

darkreading Jun 23, 2025 Feed

Like its predecessor, SparkCat, the new malware appears to be going after sensitive data — such as seed phrases for cryptocurrency wallets — in device photo galleries.

DHS Warns of Rise in Cyberattacks in Light of US-Iran Conflict

darkreading Jun 23, 2025 Feed

After President's Trump decision to enter the US into the conflict in the Middle East, the Department of Homeland Security expects there to be an uptick in Iranian hacktivists and state-sponsored actors targeting US systems.

'Echo Chamber' Attack Blows Past AI Guardrails

darkreading Jun 23, 2025 Feed

An AI security researcher has developed a proof of concept that uses subtle, seemingly benign prompts to get GPT and Gemini to generate inappropriate content.

Attackers Use Docker APIs, Tor Anonymity in Stealthy Crypto Heist

darkreading Jun 23, 2025 Feed

The attack is similar to previous campaigns by an actor called Commando Cat to use misconfigured APIs to compromise containers and deploy cryptocurrency miners.

Citrix Patches Critical Vulns in NetScaler ADC and Gateway

darkreading Jun 23, 2025 Feed

Citrix is recommending its customers upgrade their appliances to mitigate potential exploitation of the vulnerabilities.

Amazon’s Schmidt talks China, cyber traps and the battle in the cloud

cyware Jun 23, 2025 Technology

Amazon CSO Steve Schmidt talks with the Click Here podcast about how a digital decoy called MadPot helped expose Volt Typhoon — and why, in the age of AI, the real vulnerability isn’t software. It’s people.

Iran-linked cyberattack reportedly disrupts public services in Albania’s capital

cyware Jun 23, 2025 Government

A group associated with Iran's Islamic Revolutionary Guard Corps (IRGC) claimed an attack on the municipal website of Tirana, Albania's capital. It's the latest in a string of incidents attributed to the hackers.

Israeli officials say Iran exploiting security cameras to guide missile strikes

cyware Jun 23, 2025 Technology

Similarly to reports from the war in Ukraine, Israel wants owners of surveillance cameras to be aware that Iran is trying to hack the devices to aid in missile targeting.

Data of more than 740,000 stolen in ransomware attack on Michigan hospital network

cyware Jun 23, 2025 Cybercrime

McLaren Health Care told regulators that a ransomware attack initially reported in August 2024 breached the data of hundreds of thousands of people.

Researchers say cybercriminals are using jailbroken AI tools from Mistral and xAI

cyware Jun 23, 2025 Technology

"Uncensored" versions of two mainstream AI tools are the latest examples of how cybercriminals are repurposing the technology for illicit means.