Alleged Chinese hacker tied to Silk Typhoon arrested for cyberespionage
Source: https://www.bleepingcomputer.com/news/security/alleged-chinese-hacker-tied-to-silk-typhoon-arrested-for-cyberespionage/
CISA Adds Four Critical Vulnerabilities to KEV Catalog Due to Active Exploitation
Source: https://thehackernews.com/2025/07/cisa-adds-four-critical-vulnerabilities.html
New Bert Ransomware Group Strikes Globally with Multiple Variants
Source: https://www.infosecurity-magazine.com/news/bert-ransomware-globally-multiple/
Just found [zorrochain.foundation](https://zorrochain.foundation), and it’s building a governance infrastructure that’s fully airgap-compatible.
No token, no speculation — just a system using entropy harvesting, offline ID, QR/USB syncing, and vault-based consensus.
No idea if it’s being audited, but conceptually it’s interesting for people thinking about zero-trust systems in collapse conditions.
Applocker bypass on Lenovo machines – The curious case of MFGSTAT.zip
Source: https://oddvar.moe/2025/07/03/applocker-bypass-on-lenovo-machines-the-curious-case-of-mfgstat-zip/
Finnish hacker Harri Hursti hacks U.S.voting machine on live podcast
Source: https://techstartups.com/2024/09/25/finnish-hacker-harri-hursti-hacks-u-s-voting-machine-on-live-podcast/
N Korean Hackers Drop NimDoor macOS Malware Via Fake Zoom Updates
Source: https://hackread.com/n-korean-hackers-nimdoor-macos-malware-fake-zoom-updates/
The Kimsuky group has adopted a deceptive tactic called 'ClickFix' to trick users into unknowingly participating in attack chains. This method involves disguising malicious instructions as troubleshooting guides or security document verification procedures. The campaign is believed to be an extension of Kimsuky's ongoing 'BabyShark' threat activity. The tactic has evolved from VBS-based attacks to more sophisticated email-based and website-delivered methods. Attackers impersonate legitimate entities and use multilingual manuals to guide victims through seemingly harmless steps that actually execute malicious code. The group's infrastructure and linguistic patterns point to North Korean origin. To counter such threats, EDR-based defense strategies are crucial for detecting obfuscated malware and identifying abnormal behaviors.
A newly emerged ransomware group called Dire Wolf has been observed since May 2025, targeting multiple sectors globally with a focus on manufacturing and technology. The group employs double extortion tactics, encrypting files and threatening to publish stolen data. Analysis of a Dire Wolf ransomware sample revealed it was written in Golang and uses a combination of Curve25519 and ChaCha20 algorithms for encryption. The malware disables event logging, terminates specific processes and services, and deletes backups and recovery options. Victims are given personalized ransom notes with login details for negotiation. As of writing, 16 victims across 11 nations have been listed on the group's leak site, with the US and Thailand being the most affected.
Abusing Chrome Remote Desktop on Red Team Operations
Source: https://trustedsec.com/blog/abusing-chrome-remote-desktop-on-red-team-operations-a-practical-guide
We broke Chrome’s AppBound cookie encryption used in enterprise environments. Using timing-based attacks against the WebView lifecycle, we were able to recover encryption keys and decrypt secure cookies — no root or sandbox escape required. This affects managed Android profiles using MDM and AppBound mode.
Bluetooth flaws could let hackers spy through your microphone
Source: https://www.bleepingcomputer.com/news/security/bluetooth-flaws-could-let-hackers-spy-through-your-microphone/
