A sophisticated cyber espionage campaign attributed to the PRC-nexus threat actor UNC6384 targeted diplomats in Southeast Asia and other global entities. The attack chain involved hijacking web traffic through a captive portal redirect to deliver malware disguised as software updates. The multi-stage attack utilized advanced social engineering, adversary-in-the-middle techniques, and evasion tactics. The malware payload, SOGU.SEC backdoor, was deployed through a digitally signed downloader (STATICPLUGIN) and a side-loaded DLL (CANONSTAGER). The campaign demonstrated the evolving capabilities of PRC-nexus threat actors, employing stealthy tactics to avoid detection and leveraging legitimate Windows features for malicious purposes.
Auchan retailer data breach impacts hundreds of thousands of customers
Source: https://www.bleepingcomputer.com/news/security/auchan-retailer-data-breach-impacts-hundreds-of-thousands-of-customers/
Transparent Tribe Targets Indian Govt With Weaponized Desktop Shortcuts via Phishing
Source: https://thehackernews.com/2025/08/transparent-tribe-targets-indian-govt.html
DaVita confirms ransomware attack compromised data of 2.7M people
Source: https://securityaffairs.com/181458/data-breach/kidney-dialysis-firm-davita-confirms-ransomware-attack-compromised-data-of-2-7m-people.html
Hackers Could Take Over Apple Devices Via Malicious Images – Patch Now!
Source: https://hackread.com/hackers-take-over-apple-devices-malicious-images-patch/
Anatsa, an Android banking malware first discovered in 2020, has evolved with new capabilities and targets. The latest variant now affects over 831 financial institutions worldwide, including new countries and cryptocurrency platforms. Anatsa has streamlined its payload delivery, implemented DES runtime decryption, and added device-specific restrictions. The malware uses decoy applications in the Google Play Store, some exceeding 50,000 downloads. Alongside Anatsa, 77 other malicious apps from various families were identified, totaling over 19 million installs. Anatsa's evasion techniques include emulation checks, device model verification, and the use of malformed archives to hide malicious code. The malware primarily steals credentials through fake banking login pages tailored to detected financial apps on the user's device.
U.S. CISA adds Apple iOS, iPadOS, and macOS flaw to its Known Exploited Vulnerabilities catalog
Source: https://securityaffairs.com/181406/security/u-s-cisa-adds-apple-ios-ipados-and-macos-flaw-to-its-known-exploited-vulnerabilities-catalog.html
AI can be used to create working exploits for published CVEs in a few minutes and for a few dollars
Source: https://valmarelox.substack.com/p/can-ai-weaponize-new-cves-in-under
Weak Passwords and Compromised Accounts: Key Findings from the Blue Report 2025
Source: https://thehackernews.com/2025/08/weak-passwords-and-compromised-accounts.html
US CERT/CC warns of flaws in Workhorse Software accounting software used by hundreds of municipalities in Wisconsin
Source: https://securityaffairs.com/181363/security/us-cert-cc-warns-of-flaws-in-workhorse-software-accounting-software-used-by-hundreds-of-municipalities-in-wisconsin.html
A sophisticated spear-phishing campaign, likely linked to APT MuddyWater, is targeting CFOs and finance executives across multiple continents. The attackers use Firebase-hosted phishing pages with custom CAPTCHA challenges, malicious VBS scripts, and multi-stage payload delivery to deploy NetBird, a legitimate remote-access tool, for persistent system control. The campaign employs social engineering tactics, impersonating a Rothschild & Co recruiter to lure victims. Analysis revealed evolving infrastructure, updated payload paths, and overlaps with known MuddyWater activities. The attackers abuse legitimate tools like NetBird and AteraAgent for remote access and monitoring, while using sophisticated techniques such as AES encryption and math-based CAPTCHA lures to evade detection.
