A new malware loader named CountLoader has been identified, strongly associated with Russian ransomware gangs. It comes in three versions: .NET, PowerShell, and JScript. The threat is believed to be part of an Initial Access Broker's toolset or used by a ransomware affiliate linked to LockBit, BlackBasta, and Qilin groups. CountLoader was recently employed in a phishing campaign targeting Ukrainian citizens, impersonating the Ukrainian police. The loader attempts to connect to multiple C2 servers, downloads and executes various malware payloads, and uses advanced techniques to evade detection. It has been observed dropping CobaltStrike and AdaptixC2, among other malicious tools. The malware's functionality includes system information gathering, persistence mechanisms, and multiple download methods.
Microsoft Office 2016/2019 End of Life
Source: https://www.lansweeper.com/blog/eol/microsoft-office-end-of-life/?utm_source=reddit&utm_medium=social&utm_campaign=ls-global-end-of-life-2025&utm_content=microsoft-office
40% of Corporate Client Devices Still Run Windows 10
Source: https://www.lansweeper.com/blog/eol/are-you-prepared-for-windows-10-end-of-life/?utm_source=reddit&utm_medium=social&utm_campaign=ls-global-end-of-life-2025&utm_content=windows10
SonicWall warns customers to reset credentials after breach
Source: https://www.bleepingcomputer.com/news/security/sonicwall-warns-customers-to-reset-credentials-after-MySonicWall-breach/
New Raven Stealer Malware Hits Browsers for Cookies, Passwords and Payment Data
Source: https://hackread.com/raven-stealer-malware-browsers-passwords-payment-data/
A few months ago Dutch newspaper de Volkskrant published a very interesting article describing how, according to secret Iranian documents obtained by the newspaper, the Islamic Revolutionary Guard Corps (IRGC) was attempting to procure encrypted, Chinese Tiantong-1 satellite phones due to increasing distrust of Iranian communications infrastructure in the light of the Iran-Israel war. In this first blogpost of a 2-part series, the previously unexplored Tiantong-1 satellite system and its security aspects are illuminated.
RaccoonO365 Phishing Network Dismantled as Microsoft, Cloudflare Take Down 338 Domains
Source: https://thehackernews.com/2025/09/raccoono365-phishing-network-shut-down.html
Throughout July and August 2025, TA415, a Chinese state-sponsored threat actor, conducted spearphishing campaigns targeting U.S.government, think tank, and academic organizations focused on U.S.-China relations. The group impersonated high-profile individuals and organizations to deliver an infection chain establishing Visual Studio Code Remote Tunnels for persistent remote access. This activity, likely aimed at gathering intelligence on U.S.-China economic ties, utilized legitimate services like Google Sheets and VS Code for command and control. TA415 employed a Python loader called WhirlCoil to set up the remote tunnels and exfiltrate system information. The targeting pattern and timing suggest evolving priorities shaped by the complex U.S.-China economic relationship.
This analysis examines Infostealer trends in August 2025, focusing on distribution volume, methods, and disguises. AhnLab's automated systems collect and analyze malware, providing real-time IOC services. Infostealers, often disguised as cracks, are distributed through SEO poisoning. Notable variants include LummaC2, ACRStealer, and Rhadamanthys. Distribution methods evolved from personal blogs to legitimate websites, bypassing search engine restrictions. Malware is primarily distributed as EXE files (89.7%) or through DLL-SideLoading (10.3%). Two significant trends emerged: mass distribution via Slack Marketplace and ACRStealer's domain masquerading technique, which now targets security company domains to evade detection.
LockerGoga Ransomware Admin on EU Most Wanted List With $10M DOJ Reward
Source: https://hackread.com/lockergoga-ransomware-eu-most-wanted-list-doj-reward/
40 npm Packages Compromised in Supply Chain Attack Using bundle.js to Steal Credentials
Source: https://thehackernews.com/2025/09/40-npm-packages-compromised-in-supply.html
Google confirms fraudulent account created in law enforcement portal
Source: https://www.bleepingcomputer.com/news/security/google-confirms-hackers-gained-access-to-law-enforcement-portal/
