LAB52 has identified a new backdoor called NotDoor, attributed to APT28, a Russian intelligence-linked threat group. NotDoor is a VBA macro for Outlook that monitors incoming emails for specific trigger words, enabling data exfiltration, file uploads, and command execution on victim computers. The backdoor is deployed via Microsoft OneDrive.exe using DLL side-loading, and it establishes persistence by modifying registry keys. NotDoor employs obfuscation techniques and a custom string encoding method. It can execute commands, exfiltrate files, and upload files to the victim's machine. The malware demonstrates APT28's continuous evolution in bypassing defense mechanisms, posing a significant threat to NATO member countries across various sectors.
This article reviews IPv6 attack vectors (RA Spoofing, RDNSS Spoofing, IPv6 DNS Takeover with DHCPv6, SLAAC to DHCPv6 Downgrade, WPAD Poisoning) and their detection using Suricata signatures.
200 Swedish municipalities impacted by a major cyberattack on IT provider
Source: https://securityaffairs.com/181668/security/200-swedish-municipalities-impacted-by-a-major-cyberattack-on-it-provider.html
UK, US and Allies Blame Three Chinese Tech Firms for Global Cyberattacks
Source: https://hackread.com/uk-us-blame-3-chinese-tech-firms-global-cyberattacks/
IT system supplier cyberattack impacts 200 municipalities in Sweden
Source: https://www.bleepingcomputer.com/news/security/it-system-supplier-cyberattack-impacts-200-municipalities-in-sweden/
How Exposed TeslaMate Instances Leak Sensitive Tesla Data
Source: https://s3yfullah.medium.com/how-exposed-teslamate-instances-leak-sensitive-tesla-data-80bedd123166
A new ransomware strain called 'Blue Locker' is targeting Pakistan's oil and gas sector, particularly affecting Pakistan Petroleum Limited. The National Cyber Emergency Response Team (NCERT) has issued warnings to 39 key ministries and institutions about this severe threat. The ransomware, which shares similarities with the Shinra malware family, encrypts files and demands ransom payments. It uses a combination of AES and RSA encryption algorithms and is distributed through phishing emails and malicious attachments. The attack coincided with Pakistan's Independence Day, suggesting possible nation-state involvement rather than traditional cybercriminal activity. NCERT has recommended strengthening cybersecurity measures, including multi-factor authentication, email filtering, and employee training. The incident highlights vulnerabilities in Pakistan's government IT infrastructure and the need for a more proactive cybersecurity approach.
MuddyWater’s DarkBit ransomware cracked for free data recovery
Source: https://www.bleepingcomputer.com/news/security/muddywaters-darkbit-ransomware-cracked-for-free-data-recovery/
New TETRA Radio Encryption Flaws Expose Law Enforcement Communications
Source: https://thehackernews.com/2025/08/new-tetra-radio-encryption-flaws-expose.html
A recent scam involves fake Tesla websites advertised through Google paid ads, targeting potential customers interested in preordering the Optimus robot. These fraudulent sites mimic Tesla's official website design and offer non-existent preorders for various Tesla products, including the Optimus robot. The scam aims to collect $250 non-refundable deposits and potentially steal credit card information. Multiple fake domains have been identified, with some already taken offline. The fraudulent sites lack login functionality and may redirect users to fake authentication pages. Tesla is likely monitoring and requesting takedowns of these sites. The scam exploits the anticipation surrounding Tesla's future products and may go unnoticed until expected delivery dates.
Two cyberattack campaigns, Operation GhostChat and Operation PhantomPrayers, targeted the Tibetan community in June 2025, coinciding with the Dalai Lama's 90th birthday. These attacks involved strategic web compromises, DLL sideloading, and multi-stage infection chains to deploy Ghost RAT and PhantomNet backdoors. The attackers used social engineering tactics, impersonating legitimate platforms and leveraging culturally significant events to lure victims. Both campaigns employed sophisticated evasion techniques, including code injection and API hook bypassing. The attacks are attributed to China-nexus APT groups based on victimology, malware used, and employed tactics. The campaigns highlight the ongoing cyber threats faced by the Tibetan community and the evolving tactics of state-sponsored threat actors.
Inside the ChatGPT iOS app, I’m using the built-in code interpreter. Every time I ask it to scan for open ports, it shows port 8080 bound to 0.0.0.0, not localhost, like it used to. Happens across sessions, even after restarting the phone and turning off the local network feature in app settings.
Same PID (3), same process (python3). Also seeing two private IPs (10.x.x.x) and localhost loopbacks, about 18 of them. As well as access to internal libraries, A LOT of them.
Looks like something is preloaded inside the interpreter container. Anyone know what this is?
As I’m writing this, apparently the localhost connection to 8080 is weirder than 0.0.0.0.
I’m clearly clueless, but I noticed a weird change and decided to share.
Chinese Salt Typhoon Infiltrated US National Guard Network for Months
Source: https://hackread.com/chinese-salt-typhoon-infiltrated-us-national-guard-network/
N Korean Hackers Drop NimDoor macOS Malware Via Fake Zoom Updates
Source: https://hackread.com/n-korean-hackers-nimdoor-macos-malware-fake-zoom-updates/
China-linked group Salt Typhoon breached satellite firm Viasat
Source: https://securityaffairs.com/179146/security/china-linked-group-salt-typhoon-breached-satellite-firm-viasat.html
Apple confirmed that Messages app flaw was actively exploited in the wild
Source: https://securityaffairs.com/178962/mobile-2/apple-confirmed-messages-app-flaw-actively-exploited.html
