Reverse engineers must have a good understanding of the environment where malware are executed (read: the operating system). In a previous diary, I talked about malicious code that could be executed when loading a DLL[1]. Today, I'll show you how a malware can hide suspicious information related to created processes.
ASEC discovered Guloader malware being distributed through phishing emails masquerading as employee performance reports. The emails, claiming to be about October 2025 performance, contain a RAR file with an NSIS executable named 'staff record pdf.exe'. This file is actually Guloader malware, which downloads and executes shellcode from a Google Drive URL. The final payload is Remcos RAT, enabling threat actors to perform various malicious remote control activities, including keylogging, screenshot capture, webcam and microphone control, and browser data extraction. The attackers are increasingly using legitimate platforms as C2 servers, making detection more challenging. Users are advised to exercise caution when opening emails from unknown sources and to change passwords regularly to prevent secondary damage.
MuddyWater APT group has launched a spearphishing campaign targeting various sectors in the Middle East, including diplomatic, maritime, financial, and telecom entities. The campaign employs icon spoofing and malicious Word documents to deliver a Rust-based implant dubbed 'RustyWater'. This new tool represents a significant upgrade from their traditional PowerShell and VBS loaders, offering capabilities such as asynchronous C2, anti-analysis features, registry persistence, and modular post-compromise expansion. The attack chain involves a malicious email with an attached document that triggers a multi-stage process, ultimately leading to the deployment of the RustyWater implant. This evolution in MuddyWater's toolkit demonstrates their adaptation to more sophisticated, structured, and stealthy attack methods.
This analysis examines a sophisticated malware delivery chain that begins with a phishing email impersonating DocuSign. The attack employs multiple evasion techniques, including an access-code gate, time-based checks, and packing. The initial payload is a single-file .NET bundle with a valid code signing certificate. Static analysis revealed a second-stage native binary with additional obfuscation. The final payload is identified as Vidar malware. The investigation showcases the effectiveness of combining static and dynamic analysis tools to overcome advanced evasion tactics and reconstruct the full attack chain, from the initial phishing email to the final payload.
CISA advisory warns that unauthenticated Bluetooth access in WHILL devices allows for unauthorized movement. The post Researchers Expose WHILL Wheelchair Safety Risks via Remote Hacking appeared first on SecurityWeek .
Between February and September 2025, BlueDelta, a Russian state-sponsored threat group linked to the GRU, conducted multiple credential-harvesting campaigns. The group targeted individuals associated with energy research, defense cooperation, and government communication networks in Turkey, Europe, North Macedonia, and Uzbekistan. BlueDelta impersonated legitimate webmail and VPN services, using free hosting and tunneling services to host phishing content and capture user data. The campaigns incorporated PDF lures and customized JavaScript to increase authenticity and operational efficiency. This activity demonstrates BlueDelta's continued focus on low-cost, high-yield methods for collecting information supporting Russian intelligence objectives.
Threat actors are leveraging complex routing scenarios and misconfigured spoof protections to send phishing emails that appear to be internal communications. These attacks, which have increased since May 2025, use various lures like voicemails, shared documents, and password resets to conduct credential phishing and financial scams. The campaigns, often using PhaaS platforms like Tycoon2FA, are opportunistic and target multiple industries. While Microsoft detects most attempts, organizations can further mitigate risks by properly configuring spoof protections and third-party connectors. The attacks do not affect customers whose Microsoft Exchange MX records point to Office 365, as they are protected by built-in spoofing detections.
Malicious use of QR codes has long been ubiquitous, both in the real world as well as in electronic communication. This is hardly surprising given that a scan of a QR code can lead one to a phishing page as easily as clicking a link in an e-mail.
Recently, a new "breed" of IP-based KVM devices has been released. In the past, IP-based KVM devices required dedicated "server-grade" hardware using IPMI. They often cost several $100 per server, and are only available for specific systems that support the respective add-on cards. These cards are usually used to provide "Lights Out" access to servers, allowing a complete reboot and interaction with the pre-boot environment via simple web-based tools. In some cases, these IPMI tools can also be used via various enterprise/data center management tools.
Hackers have compromised a file transfer system at Sedgwick’s subsidiary that serves government agencies. The post Sedgwick Confirms Cyberattack on Government Subsidiary appeared first on SecurityWeek .
For the latest discoveries in cyber research for the week of 5th January, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Two US banks, Artisans’ Bank and VeraBank, disclosed that customer data was exposed in an August ransomware attack on their vendor, Marquis Software. The vendor was breached via SonicWall vulnerability, and while […] The post 5th January – Threat Intelligence Report appeared first on Check Point Research .
WhatsApp device fingerprinting can be useful in the delivery of sophisticated spyware, but impact is very limited without a zero-day. The post Researcher Spotlights WhatsApp Metadata Leak as Meta Begins Rolling Out Fixes appeared first on SecurityWeek .
The RondoDox botnet is actively exploiting the React2Shell vulnerability to compromise thousands of unpatched devices. This threat leverages a known code execution flaw to hijack vulnerable systems, primarily targeting those that have not applied available patches. While exploitation in the wild is not yet widely confirmed, the botnet's activity indicates a growing risk of large-scale device compromise. European organizations with unpatched infrastructure are at risk of device hijacking, leading to potential service disruption and data integrity issues. The threat is medium severity but could escalate if exploitation becomes widespread. Mitigation requires immediate patching of affected systems and enhanced network monitoring for unusual botnet-related traffic. Countries with high IoT and enterprise device usage, especially those with historically targeted sectors, are more likely to be affected. The threat does not require user interaction but targets unpatched systems, increasing its potential impact. Defenders should prioritize vulnerability management and incident response readiness to mitigate this evolving botnet threat.
A ransomware attack on Covenant Health resulted in a data breach affecting over 478,000 individuals. The attack involved malware that encrypted or compromised sensitive health data, leading to significant exposure of personal information. Although no specific exploited vulnerabilities or affected software versions are detailed, the breach highlights the ongoing risk ransomware poses to healthcare organizations. There is no indication of known exploits in the wild beyond this incident. The breach underscores the importance of robust cybersecurity measures in protecting sensitive health data. European healthcare organizations face similar risks due to comparable threat landscapes and regulatory environments. Mitigation requires targeted strategies including network segmentation, advanced endpoint detection, and incident response readiness. Countries with large healthcare sectors and high adoption of similar IT infrastructure are most at risk. The severity is assessed as high due to the scale of data exposure, potential for patient harm, and operational disruption. Defenders should prioritize proactive ransomware defenses and comprehensive data protection protocols.
A critical security threat has emerged involving over 10,000 Fortinet firewalls that are vulnerable to an actively exploited two-factor authentication (2FA) bypass. This vulnerability allows attackers to circumvent the additional security layer provided by 2FA, potentially gaining unauthorized access to firewall management interfaces. The exploitation of this flaw can lead to severe consequences including network compromise, data breaches, and disruption of services. European organizations using Fortinet firewalls are at significant risk, especially those in sectors with high reliance on secure perimeter defenses. The threat is rated high severity due to the potential impact on confidentiality, integrity, and availability, combined with the ease of exploitation without requiring user interaction. Immediate mitigation steps include applying vendor patches once available, restricting administrative access via VPN or IP whitelisting, and enhancing network monitoring for suspicious activities. Countries with high Fortinet market penetration and critical infrastructure sectors, such as Germany, France, the UK, and the Netherlands, are likely to be most affected. Defenders must prioritize this threat to prevent widespread compromise and maintain network security.
The Kimwolf Botnet is a recently reported high-severity botnet threat that targets local networks. It is actively stalking local network environments to potentially compromise devices and expand its reach. While detailed technical specifics are limited, the botnet's presence on local networks suggests it may exploit network vulnerabilities or weak device security to propagate. There are no known exploits in the wild yet, but the threat is considered high priority due to its potential impact. European organizations could face risks including unauthorized access, data exfiltration, and disruption of network services. Mitigation requires enhanced local network monitoring, segmentation, and device hardening beyond generic advice. Countries with high IoT and networked device adoption, significant industrial infrastructure, or strategic geopolitical importance in Europe are more likely to be targeted. Given the botnet’s ability to infiltrate local networks without requiring user interaction or authentication, the suggested severity is high. Defenders should prioritize detection capabilities and proactive network hygiene to mitigate this emerging threat.
Flock, a provider of AI-enabled surveillance cameras, has exposed its devices, potentially allowing unauthorized access to video feeds and sensitive data. This exposure raises concerns about privacy violations and unauthorized surveillance. The threat involves AI-powered cameras that may be accessible due to misconfigurations or vulnerabilities. Although no known exploits are currently in the wild, the medium severity rating reflects the potential risks to confidentiality and privacy. European organizations using Flock cameras could face data breaches and compliance issues under GDPR. Mitigation requires immediate review of device configurations, network segmentation, and strict access controls. Countries with higher adoption of smart surveillance and strong privacy regulations, such as Germany, France, and the UK, are particularly at risk. Given the ease of exploitation through exposed devices and the sensitivity of surveillance data, the suggested severity is medium. Defenders should prioritize securing AI surveillance infrastructure to prevent unauthorized access and data leakage.
DeedRAT is a sophisticated backdoor associated with the Chinese APT group Salt Typhoon, targeting critical sectors globally. It infiltrates systems through phishing campaigns, utilizing DLL sideloading to evade detection. The malware establishes persistence via registry run keys and service creation, ensuring long-term access. DeedRAT's capabilities include file manipulation, system reconnaissance, and payload execution. The infection chain involves three files: a legitimate executable, a malicious DLL, and an encrypted file. Once installed, it attempts to connect to its command-and-control server. Defensive measures include monitoring email traffic, registry changes, and anomalous service creations.
A hacker claims to have breached the European Space Agency (ESA) and is selling 200GB of stolen data. The breach was disclosed via a Reddit post linking to an external news source, but technical details and verification remain minimal. The compromised data volume suggests a significant exfiltration of sensitive information, potentially impacting ESA's confidentiality and operational security. No known exploits or vulnerabilities have been publicly identified, and there is no evidence of active exploitation beyond the data sale claim. European organizations, especially those in aerospace and governmental sectors, could face increased risk from secondary attacks leveraging this breach. Mitigation requires immediate internal investigation, enhanced monitoring for data exfiltration, and tightening of access controls. Countries with strong aerospace sectors and ESA involvement, such as France, Germany, Italy, Spain, and the Netherlands, are most likely to be affected. Given the high potential impact on confidentiality and the strategic importance of ESA, the suggested severity is high. Defenders should prioritize verifying the breach, assessing data sensitivity, and preparing incident response plans accordingly.
The European Space Agency is conducting an investigation and says external science servers have been compromised. The post European Space Agency Confirms Breach After Hacker Offers to Sell Data appeared first on SecurityWeek .
