A new ransomware strain called 'Blue Locker' is targeting Pakistan's oil and gas sector, particularly affecting Pakistan Petroleum Limited. The National Cyber Emergency Response Team (NCERT) has issued warnings to 39 key ministries and institutions about this severe threat. The ransomware, which shares similarities with the Shinra malware family, encrypts files and demands ransom payments. It uses a combination of AES and RSA encryption algorithms and is distributed through phishing emails and malicious attachments. The attack coincided with Pakistan's Independence Day, suggesting possible nation-state involvement rather than traditional cybercriminal activity. NCERT has recommended strengthening cybersecurity measures, including multi-factor authentication, email filtering, and employee training. The incident highlights vulnerabilities in Pakistan's government IT infrastructure and the need for a more proactive cybersecurity approach.
From September to December 2024, incidents involving CrossC2, an extension tool for Cobalt Strike Beacon on Linux, were confirmed. The attacker used CrossC2 along with other tools like PsExec, Plink, and Cobalt Strike to penetrate AD. A custom malware called ReadNimeLoader was used as a loader for Cobalt Strike. The campaign may have affected multiple countries. CrossC2 is an unofficial Beacon and builder compatible with Cobalt Strike 4.1+, designed for Linux and macOS. It contains anti-analysis features and encrypted configuration data. The attack flow involved java.exe, ReadNimeLoader, and OdinLdr to execute Cobalt Strike Beacon. Other tools used include SystemBC, GetNPUsers, and privilege escalation tools. The campaign shows potential connections to BlackBasta based on similar characteristics.
The complete source code for ERMAC V3.0, an advanced banking trojan, was discovered and analyzed, providing rare insight into this active Malware-as-a-Service platform. ERMAC has evolved to target over 700 financial and cryptocurrency apps, employing sophisticated form injection techniques and encrypted communications. The analysis revealed critical vulnerabilities, including hardcoded credentials and default tokens, which could be exploited to disrupt operations. The malware's infrastructure consists of a Laravel-based C2 backend, React control panel, Golang exfiltration service, and an obfuscated Android backdoor. This comprehensive examination exposes the operational risks of the MaaS model and equips defenders with concrete methods to track, detect, and disrupt active ERMAC campaigns.
Booking.com phishing campaign uses sneaky 'ん' character to trick you
Source: https://www.bleepingcomputer.com/news/security/bookingcom-phishing-campaign-uses-sneaky-character-to-trick-you/
Hacked Law Enforcement and Government Email Accounts Sold on Dark Web
Source: https://www.infosecurity-magazine.com/news/law-enforcement-government-emails/
Canada’s House of Commons investigating data breach after cyberattack
Source: https://www.bleepingcomputer.com/news/security/canadas-house-of-commons-investigating-data-breach-after-cyberattack/
# Summer cybersecurity news catch up
Paris Natural History Museum and hosting provider Francelink paralyzed, Google victim of an attack documented by their own services, urgent CISA directive for Exchange and 5 new KEV vulnerabilities, Microsoft Patch Tuesday with 111 vulnerabilities patched, Alltricks and Manpower compromised, Dell laptops hacked with vegetables 🤯, etc.
There are also some cool articles and cool tools.
Content in french but most of the articles are in english.
U.S. CISA adds Microsoft Internet Explorer, Microsoft Office Excel, and WinRAR flaws to its Known Exploited Vulnerabilities catalog
Source: https://securityaffairs.com/181110/hacking/u-s-cisa-adds-microsoft-internet-explorer-microsoft-office-excel-and-winrar-flaws-to-its-known-exploited-vulnerabilities-catalog.html
Google Requires Crypto App Licenses in 15 Regions as FBI Warns of $9.9M Scam Losses
Source: https://thehackernews.com/2025/08/google-requires-crypto-app-licenses-in.html
Kudos to Axis for patching their stuff. Looks like someone in MiTM could have leveraged their protocol to hit their server and camera feeds/client. This was a Black Hat talk too.
How "helpful" AI assistants are accidentally destroying production systems - and what we're doing about it.
Source: https://profero.io/blog/new-attack-vector--ai-induced-destruction
A VBS-based infostealer called Cmimai Stealer has emerged, targeting Windows systems since June 2025. It collects system information, browser metadata, and screenshots, exfiltrating data via Discord webhooks. The malware uses PowerShell scripts for browser data collection and screen capture, running in a persistent loop every hour. It leverages WMI for system information gathering and employs JSON formatting for data exfiltration. While lacking advanced features like encrypted communication or credential theft, Cmimai Stealer serves as both an infostealer and a reconnaissance tool. Defensive considerations include monitoring high-risk process combinations, watching for specific PowerShell scripts and image files, and detecting Discord traffic with a unique User-Agent.
CastleLoader, a versatile malware loader, has infected 469 devices since May 2025 using Cloudflare-themed ClickFix phishing and fake GitHub repositories. It delivers information stealers and RATs, with a 28.7% infection rate. The malware employs sophisticated techniques, including PowerShell and AutoIT scripts, to load shellcode into memory and connect to C2 servers. CastleLoader's modular design allows deployment of multiple payloads, including StealC, RedLine, NetSupport RAT, DeerStealer, HijackLoader, and SectopRAT. Its campaigns target U.S.government entities and use legitimate file-sharing services and compromised websites for payload retrieval, enhancing resilience against takedowns.
Docker Hub still hosts dozens of Linux images with the XZ backdoor
Source: https://www.bleepingcomputer.com/news/security/docker-hub-still-hosts-dozens-of-linux-images-with-the-xz-backdoor/
