New malware strains, ransomware campaigns, botnet activity
RSS feed for this categoryThis article highlights several cybersecurity incidents and developments, including an ICS-Sniper attack, the hacking of XWorm malware operators, and a $250,000 Chrome exploit. It also briefly mentions other stories like Bank of America hiring patching contractors, a RAT named KGB RAT that combines data theft with jump scares, and an attack on a Langflow flaw.
Recent research indicates that while threat actors like Russia-linked APT29 (Midnight Blizzard) are using AI to autonomously rebuild malware for evasion, this process doesn't necessarily render the malware undetectable. Behavior-based analysis by ReversingLabs successfully flagged multiple iterations of the same AI-generated malware due to consistent behavioral patterns, despite code changes.
School staff reportedly resisted changing a password because it was already widely known, potentially making them vulnerable to a ransomware attack. This incident suggests a second ransomware attempt was being facilitated by the lax security practice.
A new memory-resident ARM64 malware called PEERSTITCH is being deployed by exploiting a path traversal vulnerability (CVE-2025-61624) in Fortinet's FortiOS. This vulnerability allows attackers to bypass security checks on tagged VPN sessions, granting them unauthorized access.
Russia has arrested members of the DataSuckers hacking group, while other news includes Al Jazeera employees being targeted with Candiru spyware and the US disrupting North Korean laptop farms. Additionally, an OpenAI employee was arrested for planting a spy device.
Researchers at The Citizen Lab have identified a zero-click mercenary spyware, dubbed "AdFection," that exploits the online advertising ecosystem to track, de-anonymize, and infect users' devices. The platform, run by Discover-Tech, successfully masqueraded as a legitimate ad company and leveraged major ad networks and GDPR consent frameworks to target victims globally.
A recent incident has confirmed the delivery of mercenary spyware through targeted advertisements, utilizing zero-click exploits. This marks the first documented instance of such an attack vector being used to deploy this type of malware.
This article highlights various cybersecurity threats, including a self-healing backdoor designed to scare victims, a tool that steals data, and vulnerabilities in Adobe products, DNS, and NVIDIA containers. It also touches upon the risks associated with seemingly minor permission issues and trusted logins being compromised.
Hackers have launched a proxyjacking campaign that has affected D-Link and Ubiquiti devices in 34 countries. The campaign hijacks victims' internet connections to resell their bandwidth through a commercial residential proxy network, effectively monetizing the stolen access.
A threat actor has uploaded malicious packages to the Arch User Repository (AUR), impersonating popular Arch Linux helper tools like `yay` and `paru`. These fake packages, when installed, have been observed pushing malware with root privileges, posing a significant risk to users.
Citizen Lab researchers have traced zero-click spyware infections at Al Jazeera to targeted online advertisements. The Candiru spyware, sold to governments, exploited devices the moment an ad loaded on screen, sometimes even when the ad loaded out of sight.
The threat actor Silent Lynx has been linked to attacks on CIS government entities, employing various infection methods. These include macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and specifically crafted WinRAR archives.
Israeli adtech company alleged to have facilitated spyware vendors in infecting mobile phones. This operation reportedly allowed spyware vendors to leverage Google's ad platform for malicious purposes.
A long-running Traffic Distribution System (TDS) named Help TDS, linked to the Russian-language affiliate program Hotejka, is reportedly directing over 20,000 Cloudflare Pages domains to host tech support scams. This operation has been active since at least 2017, distributing PHP code templates to affiliates for use on compromised websites.
A cyberattack targeting supermarket refrigeration systems in France has expanded to affect Copeland and Dixell controllers. Approximately 700 French supermarkets were impacted by these attacks, with no group yet claiming responsibility.
Attackers are impersonating popular AI products to distribute malware, steal browser sessions, and compromise business accounts. These fake AI campaigns have been linked to over 1,200 public sandbox analyses between April and October 2026. The campaigns are also increasing operational pressure on Managed Security Service Providers (MSSPs) serving US businesses.
Ransomware attackers are escalating their tactics by employing AI and targeting employees' families for intimidation to pressure organizations into paying ransoms. A recent report indicates a significant increase in AI involvement in attacks and a rise in direct threats to individuals connected to victim companies.
A new malware known as CikaBika Bot RAT has emerged, delivered through phishing attacks. This malware is designed to provide attackers with capabilities for reconnaissance, remote code execution, and data exfiltration.
US Air Force pilots in Afghanistan reportedly used malware-laden USB drives to plan missions. The article criticizes this practice, implying a lack of proper security protocols within the military.
A new Android malware named Hirudo has been identified, which functions as both a traditional banking trojan and a remote access trojan (RAT). This malware is capable of replacing legitimate banking applications with its own trojanized versions.
A credential-theft campaign dubbed GhostAction has significantly increased its activity, targeting over 30,000 repositories belonging to approximately 3,000 users and organizations. This surge is attributed to the compromise of around 1,900 GitHub accounts, from which attackers attempted to exfiltrate secrets from CI/CD pipelines within public repositories.
Ahsay Backup has released updated security patches for two critical vulnerabilities (CVE-2026-105133 and CVE-2026-105134) in its AhsayCBS software. These flaws were exploited by attackers to deploy web shells and XMRig cryptocurrency miners, allowing for arbitrary command execution after bypassing authentication.
Microsoft, in collaboration with international authorities and tech companies, has dismantled "Yam Store," a criminal marketplace facilitating phishing-as-a-service (PhaaS). This operation led to the takedown of a network responsible for over 1 billion malicious messages and the theft of credentials and data.
Cisco is facing an actively exploited zero-day vulnerability in its email software. The bug, dubbed 'make-me-root', allows attackers to gain root access to affected systems. Both Cisco and CISA have issued warnings about the ongoing exploitation.
A cybercrime marketplace known as Yam Store has been identified as the source of cloud infrastructure and phishing kits used to send over one billion phishing messages globally. This operation highlights a significant organized effort in facilitating phishing attacks.
Law enforcement agencies and international partners have disrupted a large cybercriminal network responsible for sending over one billion phishing messages. This operation targeted a significant ecosystem that enabled these malicious communications, impacting over 75,000 organizations globally.
Anthropic has warned that small AI models could potentially self-replicate by exploiting vulnerabilities in Internet of Things (IoT) devices. These 'small weight-based replicators' could evolve into a new form of computer worm, posing a significant threat to connected devices.
A new Android malware dubbed Hirudo has been discovered that replaces legitimate banking applications with modified versions. These altered apps disable security checks, allowing the malware to steal users' bank account credentials.
Cybersecurity researchers have discovered a new Android banking trojan named Hirudo. This malware bypasses security measures by replacing legitimate banking apps with specially crafted, patched versions that disable built-in security checks from within the application.
This article discusses the potential for malicious VBA code to be hidden within AutoCAD drawing files (.dwg). It references previous diary entries that explored how VBA macros could be extracted from these files, suggesting a continued relevance of this attack vector.
A global survey indicates that a significant portion of ransomware attacks now incorporate psychological or physical threats. This suggests a concerning trend where attackers are escalating their tactics beyond mere data encryption and financial demands.
Organizations are reporting an alarming trend where ransomware gangs are escalating their tactics to include physical threats, family stalking, and even abduction against employees. However, verifying the authenticity and prevalence of these extreme claims is proving difficult.
Ahsay AhsayCBS has a command injection vulnerability in its Replication Receiver component that allows remote attackers to execute OS commands by manipulating the 'random' parameter. This flaw can be chained with another vulnerability, CVE-2026-105133, and requires immediate mitigation according to vendor instructions and CISA guidance.
Anthropic warns that small AI models could soon be capable of creating self-replicating botnets on Internet of Things (IoT) devices. These autonomous botnets, potentially propagating through devices like smart ovens and Android TV boxes, would be difficult to dismantle due to their decentralized nature.
A cyberattack targeted the refrigeration systems of a French supermarket chain, causing temperatures to rise to 50°C and leading to spoiled stock in hundreds of stores. The manufacturer stated that the affected equipment was running outdated firmware.
The XWorm RAT malware has been updated with new plugins, significantly expanding its surveillance capabilities. These enhancements allow the malware to track user location, stream audio live, and manipulate authenticated browser sessions.
Attackers remotely compromised Danfoss controllers used in hundreds of French supermarkets, raising fridge and freezer temperatures to 50°C. This malicious act forced several retail chains to discard spoiled food.
A cyberattack has compromised refrigeration controllers in hundreds of European supermarkets, causing refrigerators and freezers to defrost. This incident led to the spoilage of food supplies across multiple locations.
Low-cost Android smartphones, particularly those built on MediaTek platforms and across various brands, are being shipped with preinstalled malware. This malicious software, tracked by Bitdefender as Midnight Mimosa, enables attackers to covertly install apps, commit ad fraud, and transform devices into residential proxies.
A cyberattack targeted French supermarket chains by remotely defrosting refrigerators overnight. The attack reportedly exploited vulnerabilities in Danfoss refrigeration controllers, causing significant disruption.
A new Windows malware loader named AvisLoader has been identified, designed to be resistant to disruption through encrypted peer-to-peer communication for its command-and-control infrastructure. Researchers detailed its methods, including ClickFix delivery, shortcut-based persistence, and remote command execution.
A vulnerability in the Bricksforge WordPress plugin, tracked as CVE-2026-85097, is actively being exploited by threat actors. This exploit allows attackers to gain control of compromised WordPress websites.
Oleg Korniev, a leader of the sophisticated money laundering network YMCO, has pleaded guilty in the US. YMCO facilitated the movement of funds for cybercriminals outside of the United States.
A critical vulnerability in the Bricksforge WordPress plugin, rated CVSS 10.0, is being actively exploited by attackers. This flaw allows unauthenticated users to upload and execute arbitrary PHP code on vulnerable websites, leading to remote code execution.
Daiichi Kosho, a Japanese entertainment system maker, reported a malware incident at its contractor, Nippon Columbia. The breach exposed over 8.7 million customer and employee records.
Hackers are exploiting Google Ads and Bing redirects to distribute malicious Claude installers that deliver ClickFix attacks. These attacks redirect unsuspecting users to compromised websites by abusing Bing's search result redirects as click URLs.
Cybersecurity researchers have uncovered a credential-stealing campaign that compromised two prominent open-source maintainer accounts. The attackers injected a malicious GitHub Actions workflow into over 340 repositories, including those associated with the author of the pyxel game engine.
Unpatched vulnerabilities in the AhsayCBS backup management platform are being exploited by threat actors. These exploits are used to deploy webshells and cryptocurrency miners on affected systems. The identified vulnerabilities have critical and medium severity ratings, indicating a significant risk to organizations using the software.
Researchers have identified a new variant of the DarkSword iOS exploit kit, dubbed P7 DarkSword. This variant is noted for its reduced on-device footprint and enhanced capabilities, including the theft of crypto wallet data and two-way command and control communication.
The owner of a ransomware remediation company, Zohar Pinhasi, faces wire fraud charges for allegedly defrauding clients. Pinhasi claimed to recover encrypted data without paying ransoms but is accused of actually paying cybercriminals and charging clients significantly more than the ransom amount.
