This investigation uncovered new tools and techniques used by the Curly COMrades threat actor to establish covert, long-term access to victim networks. The attackers exploited Hyper-V virtualization on compromised Windows 10 machines to create hidden remote operating environments. They deployed a minimalistic Alpine Linux-based virtual machine hosting custom malware for reverse shell and proxy operations. This approach effectively bypassed traditional host-based EDR detections. The threat actor also demonstrated persistence through PowerShell scripts, Kerberos ticket manipulation, and local account creation. International collaboration with the Georgian CERT aided in analyzing the command and control infrastructure.
APT-C-60 continues to target Japan and East Asia with spear-phishing attacks impersonating job seekers. The attack flow has evolved, now directly attaching malicious VHDX files to emails. The malware, including Downloader1, Downloader2, and SpyGlace, has been updated with new features and communication methods. SpyGlace versions 3.1.12, 3.1.13, and 3.1.14 were observed, with changes in Mutex values and execution paths. The attackers use GitHub for payload distribution and employ sophisticated encoding and encryption techniques. The campaign abuses legitimate services and maintains consistent behavioral patterns despite infrastructure changes.
Threat actors engage in elaborate attack chains to infect trucking and logistics companies with remote access tools. The post Transportation Companies Hacked to Steal Cargo appeared first on SecurityWeek .
Operation SkyCloak is a recently identified cyber threat involving a Tor-enabled OpenSSH backdoor targeting defense sector organizations. The backdoor leverages Tor to anonymize command and control communications, complicating detection and attribution. Although no known exploits are currently active in the wild, the malware's design suggests a focus on stealthy, persistent access to sensitive defense infrastructure. The threat is considered high severity due to its potential impact on confidentiality and integrity within critical defense environments. European defense organizations are at risk, especially those with extensive OpenSSH deployments and strategic defense roles. Mitigation requires advanced network monitoring for Tor traffic, strict SSH access controls, and enhanced endpoint detection capabilities. Countries with significant defense industries and NATO membership are likely primary targets. Given the complexity and stealth of this backdoor, the suggested severity is high. Defenders should prioritize detection of anomalous Tor usage and review SSH configurations to prevent unauthorized backdoor implantation.
A China-linked hacking group is conducting a global campaign targeting Cisco AKA firewalls. The campaign appears to be recent and is reported via a Reddit InfoSec news post referencing an external source. While specific technical details, affected versions, or exploits in the wild are not provided, the targeting of Cisco AKA firewalls suggests an attempt to compromise network perimeter defenses. The campaign is assessed as medium severity due to limited public technical details and no confirmed exploits. European organizations using Cisco AKA firewalls could be at risk, especially those with critical infrastructure or government networks. Mitigation should focus on enhanced monitoring, network segmentation, and applying Cisco security advisories promptly. Countries with high Cisco market penetration and strategic geopolitical interest in China-related cyber activities are more likely to be affected. Given the lack of detailed exploit information, the threat severity is assessed as medium, balancing potential impact and limited exploitation evidence.
Cybercriminals are targeting trucking and logistics companies to steal cargo freight through elaborate attack chains. They compromise companies and use their access to bid on cargo shipments, which they then steal and sell. The threat actors typically deliver remote monitoring and management (RMM) tools as a first-stage payload. This cyber-enabled theft is part of a multi-million-dollar criminal enterprise that has increased due to digital transformation. The attackers use tactics such as compromising load boards, email thread hijacking, and direct targeting via email campaigns. They deliver RMM tools like ScreenConnect, SimpleHelp, and PDQ Connect, which grant full control of compromised machines. The activity has been observed since at least June 2025, with nearly two dozen campaigns in the last two months alone.
This report describes how generative AI techniques were utilized to accelerate the reverse engineering of XLoader malware, specifically version 8.0. By combining cloud-based static analysis of IDA exported data with dynamic checks, researchers rapidly unpacked encrypted code, deobfuscated API calls, and decrypted strings and domain names. The analysis uncovered three distinct function encryption schemes and a complex domain generation algorithm used by XLoader. The AI-assisted approach significantly reduced analysis time from days to hours, enabling faster extraction of indicators of compromise (IoCs). Despite AI's assistance, human expertise remained essential for overcoming the most sophisticated protections. The report highlights that generative AI can serve as a force multiplier for malware analysis, though malware authors may adapt their techniques in response. The threat is assessed as medium severity, with no known exploits in the wild currently. Several IoCs including hashes and suspicious domains are provided for detection and blocking.
The Silent Lynx APT group has been conducting espionage campaigns targeting diplomatic entities and critical infrastructure in Central Asia, Russia, and China. Two major campaigns were identified: one focused on Russia-Azerbaijan relations and another on China-Central Asia relations. The group used various malware tools including PowerShell scripts, .NET implants, and C++ reverse shells. They leveraged spear-phishing emails with malicious attachments and GitHub-hosted payloads. Key targets included government think-tanks, diplomats, and entities in mining, transport and communication industries. The campaigns coincided with important summits and meetings between the targeted countries. Attribution was based on similarities in tactics, tools, and victimology to previous Silent Lynx operations.
Research by: Alexey Bukhteyev Key takeaways Introduction XLoader is a widely observed malicious loader with information-stealing capabilities. It first surfaced in 2020 as a rebrand of the FormBook code base, a well-known and capable information stealer, and has since undergone substantial hardening and feature growth. In addition to the Windows variant, its developers also marketed […] The post Beating XLoader at Speed: Generative AI as a Force Multiplier for Reverse Engineering appeared first on Check Point Research .
Researchers have uncovered two Android trojans, BankBot-YNRK and DeliveryRAT, which are designed to steal financial data from infected devices. These trojans target Android users by masquerading as legitimate applications to gain access to sensitive banking credentials and personal information. Although no known exploits are currently active in the wild, the malware poses a high risk due to its capability to compromise confidentiality and financial integrity. European organizations and individuals using Android devices for financial transactions are particularly at risk. The trojans do not require user interaction beyond installation, and they operate stealthily to avoid detection. Mitigation requires enhanced mobile security hygiene, including restricting app installations to trusted sources, employing mobile threat defense solutions, and educating users about phishing and malicious apps. Countries with high Android adoption and significant financial sectors, such as Germany, France, and the UK, are most likely to be affected. Given the potential impact on confidentiality and the ease of exploitation once installed, the threat severity is assessed as high. Defenders should prioritize monitoring for suspicious app behavior and promptly update mobile security policies to counter these trojans.
Open VSX, a public registry for Visual Studio Code extensions, recently rotated access tokens following a supply-chain malware attack. The attack involved malicious actors exploiting compromised tokens to inject malware into extensions distributed via the Open VSX platform. This supply-chain compromise poses significant risks as infected extensions can propagate malware to end users and organizations relying on these extensions. Although no known exploits are currently active in the wild, the potential for widespread impact remains high due to the trust placed in Open VSX as a source for extensions. European organizations using Open VSX-hosted extensions may face risks to confidentiality, integrity, and availability if infected extensions are installed. Immediate mitigation involves verifying extension sources, monitoring for unusual token activity, and applying any updates or token rotations issued by Open VSX. Countries with strong developer communities and high adoption of Visual Studio Code, such as Germany, France, and the UK, are particularly at risk. Given the ease of exploitation via trusted extension updates and the broad scope of affected users, this threat is assessed as high severity. Defenders should prioritize auditing extension usage and enhancing supply-chain security measures to mitigate potential impacts.
North Korean threat actors Kimsuky and Lazarus have deployed new sophisticated malware toolsets named HttpTroy and an upgraded BLINDINGCAN variant. HttpTroy is a backdoor delivered via a VPN invoice-themed attack, involving a dropper and loader (MemLoad), granting extensive system control. Lazarus's upgraded BLINDINGCAN is delivered through a new Comebacker malware variant, targeting victims in Canada. Both toolsets use advanced obfuscation, stealth techniques, and layered evasion to avoid detection. These attacks highlight DPRK's evolving cyber espionage capabilities. Although currently observed targeting South Korea and Canada, European organizations could be at risk due to geopolitical tensions and similar attack methodologies. No known exploits in the wild have been reported yet. Mitigation requires targeted detection of these toolsets, network monitoring for associated indicators, and enhanced endpoint defenses. The threat is assessed as medium severity due to its espionage focus, stealth, and complexity, but limited current scope and no public CVSS score.
The Rhysida ransomware gang, previously known as Vice Society, is conducting a sophisticated malvertising campaign using Bing ads to distribute OysterLoader malware. This malware acts as an initial access tool, establishing persistence and enabling further payload deployment, including ransomware. The gang employs code-signing certificates, including Microsoft Trusted Signing, to evade detection and increase trustworthiness of their malware. Their activity has notably increased in 2025, with over 40 certificates tracked compared to 7 in 2024. They also utilize Latrodectus malware for initial access. The campaign leverages legitimate services and advanced evasion techniques, highlighting significant resource investment and operational maturity. This threat poses a medium severity risk but can lead to severe consequences if ransomware is deployed. European organizations should be vigilant against malvertising campaigns and suspicious software downloads, especially those impersonating popular software. Mitigation requires enhanced monitoring of code-signed binaries, user awareness, and blocking malicious ad traffic.
VulScan-MCP is an open-source Visual Studio Code extension designed to scan project dependencies for known CVEs using NVD and OSV databases. It integrates with VS Code and GitHub Copilot, allowing developers to query vulnerability status of their manifest files. The tool only reports confirmed CVEs, avoiding noise from deprecated or outdated packages, and provides remediation guidance without automatic patching. While it enhances visibility into dependency vulnerabilities, it is not itself a security threat or vulnerability. European organizations can benefit from improved dependency security management, but the tool's effectiveness depends on developer adoption and integration into secure development workflows. Countries with strong software development sectors and high VS Code usage are most likely to be impacted positively. Given this is a security tool rather than a threat, the severity assessment is not applicable. Defenders should consider integrating such tools to proactively identify and remediate dependency risks.
A large-scale attack infrastructure dubbed TruffleNet has been identified, built around the open-source tool TruffleHog. This infrastructure is used to systematically test compromised credentials and perform reconnaissance across AWS environments. The campaign involves over 800 unique hosts across 57 distinct Class C networks, characterized by consistent configurations and the use of Portainer. Alongside TruffleNet, adversaries are exploiting Amazon Simple Email Service (SES) to facilitate Business Email Compromise (BEC) campaigns. The attackers create email identities using compromised WordPress sites and conduct aggressive cloud reconnaissance. This activity highlights the evolving tactics of threat actors in exploiting cloud infrastructure at scale, combining credential theft, reconnaissance automation, and SES abuse to conduct high-volume fraud with minimal detection.
The Meduza Stealer is a malware strain linked to data theft activities. Recently, Russian authorities arrested developers associated with this malware following a government-targeted cyberattack. Although the malware itself is not newly discovered and no active exploits are currently reported, the arrests indicate ongoing law enforcement actions against cybercriminal infrastructure. The threat primarily involves information theft, potentially compromising confidentiality of targeted systems. There is no detailed technical information about the malware's infection vectors or capabilities in the provided data. European organizations could be indirectly impacted if the malware or its variants are used against entities within Europe or if geopolitical tensions escalate cyber operations. Mitigation should focus on robust endpoint protection, network monitoring for data exfiltration, and collaboration with law enforcement for threat intelligence sharing. Countries with higher exposure to Russian cyber activities or significant governmental and critical infrastructure sectors are more likely to be affected. Given the medium severity and lack of active exploitation, the threat is assessed as medium severity overall.
A sophisticated campaign targeting Russian and Belarusian military personnel has been identified, using multi-stage infection chains and decoy documents. The attackers deploy OpenSSH and Tor bridges to establish covert remote access and lateral movement capabilities. The infection process involves PowerShell scripts, scheduled tasks for persistence, and the use of Tor hidden services to expose multiple local services. The campaign employs anti-analysis techniques and leverages obfuscated configurations for SSH and Tor. While attribution remains uncertain, the targeting and tactics are consistent with Eastern European-linked espionage activities focusing on defense and government sectors.
Oleksii Oleksiyovych Lytvynenko is now in the US after being held in custody in Ireland since 2023. The post Ukrainian Man Extradited From Ireland to US Over Conti Ransomware Charges appeared first on SecurityWeek .
A Ukrainian suspect linked to the Conti ransomware group was extradited from Ireland to the United States. Conti ransomware is known for targeting organizations globally, encrypting data, and demanding ransom payments. While this extradition is a law enforcement action rather than a direct technical threat, it highlights ongoing efforts to disrupt ransomware operations. European organizations remain at risk from Conti and similar ransomware groups due to their widespread targeting of critical infrastructure and enterprises. The threat does not involve a new vulnerability or exploit but underscores the persistent ransomware threat landscape. No new technical exploit or malware variant details are provided. The severity is assessed as medium given the indirect nature of the event and no immediate technical exploitation. Defenders should remain vigilant against Conti ransomware tactics and maintain robust ransomware defenses. Countries with significant critical infrastructure and high ransomware targeting history, such as Germany, France, and the UK, are most relevant. This event signals continued international cooperation against ransomware criminals but does not change immediate technical risk posture.
The APT group Cloud Atlas has launched a new wave of cyberattacks targeting Russia's defense industry. They are using stolen document templates from previously infected organizations to create malicious Microsoft Office files. The group cleans metadata from these documents to avoid revealing compromised entities. They move between targeted companies using compromised email accounts (BEC attacks). The attacks focus on defense industry enterprises, with malicious documents disguised as invitations, anti-corruption checks, mobilization documents, employee records, and financial statements. Cloud Atlas uses Google Sheets API for data exfiltration and employs the PowerShower backdoor. The group's infrastructure has migrated to new servers and domains, indicating ongoing campaign development.
