A malicious SMS spoofing campaign is spreading a fake version of Israel's 'Red Alert' emergency app amid ongoing conflict. The trojanized Android app, disguised as a trusted warning platform, can steal SMS, contacts, and location data while appearing legitimate. The campaign exploits public fear during crises to deploy mobile spyware. The malware uses sophisticated techniques to bypass security checks, including package manager hooking and dynamic payload loading. It mirrors the official app's interface but requests high-risk permissions. The malware continuously tracks GPS coordinates and exfiltrates data to attacker-controlled infrastructure, posing severe strategic and physical security risks. This campaign erodes trust in emergency response systems and could potentially be used for targeted attacks or to optimize missile targeting.
A newly announced quantum algorithm suggests that the practical decryption of RSA encryption using quantum computers could occur much sooner than previously anticipated. Traditionally, the threat to RSA and ECC encryption from quantum computing was linked to Shor’s algorithm, which requires million-qubit quantum computers, a technology not expected in the near term. This new development challenges that assumption, indicating that the quantum breaking point for widely used public key cryptography may be closer. Although no known exploits exist in the wild yet, this advancement raises significant concerns for the security of current cryptographic systems. Organizations relying on RSA and ECC for confidentiality and integrity should begin preparing for a post-quantum cryptographic transition. The threat impacts global communications, financial transactions, and data protection mechanisms. Immediate mitigation involves accelerating the adoption of quantum-resistant algorithms and increasing cryptographic agility. Countries with advanced technological infrastructure and heavy reliance on RSA/ECC encryption are at higher risk. The overall severity is assessed as high due to the potential widespread impact and the fundamental nature of the cryptographic break, despite the current lack of active exploitation.
The cybersecurity industry is monitoring the landscape and says many of the big claims made by hacktivist groups remain unverified. The post Iran Cyber Front: Hacktivist Activity Rises, but State-Sponsored Attacks Stay Low appeared first on SecurityWeek .
A significant joint offensive by the US and Israel has triggered a multi-vector retaliatory campaign from Iran, leading to an escalation in cyberattacks. Iran's limited internet connectivity is likely hindering state-aligned threat actors' ability to coordinate sophisticated attacks. Hacktivist groups are targeting perceived adversaries, while other nation-state actors may exploit the situation. Observed activities include phishing campaigns, DDoS attacks, data exfiltration, and wiper attacks. Multiple Iranian state-aligned personas and collectives have claimed responsibility for various disruptive operations. Pro-Russian hacktivist groups have also been active, targeting Israeli systems and infrastructure. The situation remains fluid, and organizations are advised to implement multi-layered defenses and focus on foundational security hygiene.
A suspected Iran-nexus threat actor, dubbed Dust Specter, targeted Iraqi government officials in January 2026. The campaign involved impersonating Iraq's Ministry of Foreign Affairs and using compromised government infrastructure to host malicious payloads. Two attack chains were identified, utilizing previously undocumented malware including SPLITDROP, TWINTASK, TWINTALK, and GHOSTFORM. The malware employed creative evasion techniques, leveraged generative AI for development, and used file-based polling mechanisms for command execution. The campaign also incorporated ClickFix-style attacks and social engineering lures. Attribution to an Iran-nexus group is based on code similarities, victimology, and overlapping tactics with known Iranian APT groups.
For the latest discoveries in cyber research for the week of 2nd March, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Wynn Resorts, a United States-based casino and hotel operator, has confirmed that employee data was accessed following an extortion threat linked to ShinyHunters. The company said operations were not disrupted. Reports indicate […] The post 2nd March – Threat Intelligence Report appeared first on Check Point Research .
Using Windows shortcut files, the APT deployed a new implant, a loader, a propagation tool, and two backdoors. The post North Korean APT Targets Air-Gapped Systems in Recent Campaign appeared first on SecurityWeek .
Both sides conduct hacking and other attacks, including the deployment of wiper malware, DDoS, and disruptions to critical infrastructure. The post US-Israel and Iran Trade Cyberattacks: Pro-West Hacks Cause Disruption as Tehran Retaliates appeared first on SecurityWeek .
OpenAI and Google, along with Elon Musk’s xAI, also have contracts to supply their AI models to the military. The post Trump Orders All Federal Agencies to Phase Out Use of Anthropic Technology appeared first on SecurityWeek .
Anthropic said it sought narrow assurances from the Pentagon that Claude won’t be used for mass surveillance of Americans or in fully autonomous weapons. The post Anthropic Refuses to Bend to Pentagon on AI Safeguards as Dispute Nears Deadline appeared first on SecurityWeek .
APT37, a DPRK-backed threat group, has launched a new campaign called Ruby Jumper, utilizing Windows shortcut files to initiate attacks with newly discovered tools. These tools include RESTLEAF, SNAKEDROPPER, THUMBSBD, and VIRUSTASK, which work together to deliver surveillance payloads like FOOTWINE and BLUELIGHT. The campaign leverages removable media to infect and communicate with air-gapped systems. Key features include the use of Ruby for shellcode-based payloads, abuse of cloud storage services for command and control, and sophisticated techniques for bypassing network isolation. The malware demonstrates advanced capabilities in system reconnaissance, data exfiltration, and persistent surveillance.
Operation Zero is a Russian exploit broker operation sanctioned by the US government after acquiring eight zero-day exploits from a jailed US defense contractor executive. These zero-days represent previously unknown vulnerabilities that could be weaponized for cyberattacks. Although no known exploits are currently observed in the wild, the potential for future exploitation remains significant. The broker's access to multiple zero-days increases the risk of targeted attacks against critical infrastructure and government entities. This threat highlights insider risks and the illicit trade of advanced cyber capabilities. Organizations should be vigilant for suspicious activity and prioritize threat intelligence sharing. The medium severity reflects the current absence of active exploitation but acknowledges the high potential impact if weaponized. Countries with strategic interests in US-Russia relations and high technology adoption are most at risk. Immediate mitigation involves enhancing monitoring, patch management, and insider threat detection. Defenders must prepare for possible future exploitation campaigns leveraging these zero-days.
A former US defense contractor executive, Peter Williams, was sentenced to 87 months in prison for selling cyber exploits to a Russian broker. These exploits represent vulnerabilities or attack techniques that could be used to compromise targeted systems. Although no specific affected software versions or exploits in the wild are identified, the unauthorized transfer of such capabilities to a foreign adversary poses a significant national security risk. The threat involves the potential use of advanced cyber tools by hostile actors to conduct espionage or sabotage. Organizations with sensitive defense or critical infrastructure assets could be indirectly impacted if these exploits are weaponized. Mitigation focuses on strengthening insider threat programs, securing exploit development environments, and enhancing international cooperation to prevent similar incidents. Countries with advanced defense sectors and geopolitical tensions involving Russia are most at risk. Given the medium severity rating and lack of direct exploitation evidence, the threat is assessed as medium severity overall.
North Korean state-backed attackers are utilizing Medusa ransomware in their ongoing extortion attacks against the U.S.healthcare sector. The Symantec and Carbon Black Threat Hunter Team discovered evidence of North Korean actors employing Medusa in an attack on a Middle Eastern target and an unsuccessful attempt on a U.S.healthcare organization. Medusa, launched in 2023, operates as a ransomware-as-a-service. The Lazarus sub-group Stonefly has been a key player in North Korean ransomware attacks, using proceeds to fund espionage activities. Despite indictments and rewards, the attacks continue unabated. The current campaign employs various tools, including Comebacker, Blindingcan, ChromeStealer, and RP_Proxy. While the attacks bear similarities to previous Stonefly operations, the exact sub-group responsible remains unclear.
An active supply chain worm campaign, dubbed SANDWORM_MODE, is spreading through typosquatting and AI toolchain poisoning across at least 19 malicious npm packages. The worm exhibits Shai-Hulud characteristics, incorporating GitHub API exfiltration with DNS fallback, hook-based persistence, SSH propagation, and MCP server injection targeting AI coding assistants. It harvests credentials from developer and CI environments, exfiltrates data via multiple channels, and uses stolen identities to propagate. The campaign also includes a weaponized GitHub Action for CI secret harvesting. The worm employs a multi-stage design with obfuscated loaders, time-gated execution, and extensive configuration options. It targets high-traffic developer utilities, crypto tooling, and AI coding tools, posing a significant threat to the software supply chain.
