LunaLock Ransomware threatens victims by feeding stolen data to AI models
Source: https://securityaffairs.com/182014/malware/lunalock-ransomware-threatens-victims-by-feeding-stolen-data-to-ai-models.html
This intelligence report details a sophisticated cyber intrusion with links to three major ransomware groups: Play, RansomHub, and DragonForce. The attack began with a malicious file impersonating DeskSoft's EarthTime application, which deployed SectopRAT malware. The threat actors used various tools for reconnaissance, lateral movement, and data exfiltration, including SystemBC, Betruger backdoor, AdFind, SharpHound, and Grixba. They leveraged RDP and Impacket's wmiexec for lateral movement, and used WinRAR and WinSCP for data collection and exfiltration. The intrusion lasted six days before the threat actors were evicted, showcasing a range of advanced persistent threat techniques and highlighting the blurred lines between different ransomware operations.
A comprehensive analysis reveals a substantial threat posed by domains linked to Salt Typhoon and UNC4841, likely China-associated cyberespionage actors. The investigation uncovered a larger network of domain names beyond those publicly known, indicating a pattern of long-term access and sophisticated operations. A recent breach of a U.S.telecommunications provider, discovered a year after the fact, underscores the persistent nature of these threats. Organizations potentially at risk of Chinese espionage are strongly advised to scrutinize their DNS logs for the past five years, checking for requests to listed domains, subdomains, and associated IP addresses. Ongoing monitoring and information sharing are crucial in defending against this evolving threat landscape.
APT37, a North Korean threat actor, has been observed using new tactics and tools in recent campaigns. They have deployed a Rust-based backdoor named Rustonotto, alongside the existing PowerShell-based Chinotto malware and FadeStealer. The group utilizes Windows shortcut files and help files as initial infection vectors. Their sophisticated attack chain includes spear phishing, Compiled HTML Help file delivery, and Transactional NTFS for stealthy code injection. The threat actor employs a single command-and-control server to orchestrate all components of their malware arsenal. FadeStealer, a surveillance tool, is capable of logging keystrokes, capturing screenshots and audio, tracking devices, and exfiltrating data through password-protected RAR archives.
For the latest discoveries in cyber research for the week of 8th September, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES A supply chain breach involving Salesloft’s Drift integration to Salesforce exposed sensitive customer data from multiple organizations, including Cloudflare, Zscaler, Palo Alto Networks, and Workiva. The attackers accessed Salesforce CRM systems via […] The post 8th September – Threat Intelligence Report appeared first on Check Point Research .
Czech cyber agency warns against Chinese tech in critical infrastructure
Source: https://www.bleepingcomputer.com/news/security/czech-cyber-agency-warns-against-chinese-tech-in-critical-infrastructure/
The Salesloft-Drift Breach: Analyzing the Biggest SaaS Breach of 2025
Source: https://www.reco.ai/blog/the-salesloft-drift-breach-analyzing-the-biggest-saas-breach-of-2025
MeetC2 - A serverless C2 framework that leverages Google Calendar APIs as a communication channel
Source: https://securityaffairs.com/181940/security/meetc2-a-serverless-c2-framework-that-leverages-google-calendar-apis-as-a-communication-channel.html
Hi everyone,
I’ve been a victim of targeted cyberstalking for years and I need to share my experience to understand if what happened to me points to SS7 abuse alone, or if there had to be someone with privileged access inside Meta (WhatsApp).
Here are the facts:
• I used two numbers:
• One SIM only for data.
• A different number for WhatsApp, but the SIM itself was not in the phone (still active with the carrier, not blocked).
• I was never disconnected from my WhatsApp.
• This means my account was never fully cloned using SS7 (since that would disconnect me).
• Still, my stalkers somehow knew all the new contacts I talked to on WhatsApp, including people I met on Tinder.
• They didn’t know those numbers beforehand.
• So simple correlation at the carrier level seems impossible.
• My suspicion:
1. They were using SS7 for surveillance (location, SMS interception, monitoring my SIM’s traffic patterns).
2. At the same time, they had access to WhatsApp metadata (number A ↔ number B, timestamps).
• This would explain how they knew all my new contacts, without prior knowledge of their numbers.
• Important detail:
• I always had 2FA (PIN) enabled.
• I even tested registering my number on another phone, intercepted the SMS, but without the PIN the session never completed.
• Despite that, I once saw real messages appear on the second phone — which left me wondering about some kind of “silent pre-login” bug.
⸻
My questions for the community:
1. Is it technically possible to access WhatsApp metadata (who talks to who) without insider or official Meta access?
2. Could SS7 + carrier-level monitoring alone explain how they mapped all my new contacts?
3. Have there been documented cases of “silent pre-login” where WhatsApp sessions were duplicated without disconnecting the victim?
4. From a defense standpoint, am I correct that moving to Signal (with usernames) and Session fully mitigates this kind of metadata exposure?
⸻
I’d really appreciate insights from anyone who works with telecom security, SS7, or has deep knowledge of WhatsApp’s metadata handling.
Thanks for reading.
U.S. CISA adds Sitecore, Android, and Linux flaws to its Known Exploited Vulnerabilities catalog
Source: https://securityaffairs.com/181924/breaking-news/u-s-cisa-adds-sitecore-android-and-linux-flaws-to-its-known-exploited-vulnerabilities-catalog.html
A new botnet called NightshadeC2 has been identified, employing sophisticated techniques to bypass malware analysis sandboxes and exclude itself from Windows Defender. It uses a 'UAC Prompt Bombing' technique and has both C and Python variants. The botnet's capabilities include reverse shell, file execution, self-deletion, remote control, screen capture, hidden web browsers, and keylogging. It's being distributed through ClickFix attacks and trojanized legitimate software. The botnet uses encryption for C2 communication and gathers victim information. It also employs various persistence mechanisms and can bypass certain sandbox environments. The discovery highlights the evolving sophistication of malware and the need for advanced detection and response capabilities.
