GPUGate Malware Uses Google Ads and Fake GitHub Commits to Target IT Firms
Source: https://thehackernews.com/2025/09/gpugate-malware-uses-google-ads-and.html
Department of War Doesn’t Defend its Web Streams From Hackers
Source: https://theintercept.com/2025/09/08/department-of-war-defense-stream-keys-hackers-livestream-hack-security/
A comprehensive analysis reveals a substantial threat posed by domains linked to Salt Typhoon and UNC4841, likely China-associated cyberespionage actors. The investigation uncovered a larger network of domain names beyond those publicly known, indicating a pattern of long-term access and sophisticated operations. A recent breach of a U.S.telecommunications provider, discovered a year after the fact, underscores the persistent nature of these threats. Organizations potentially at risk of Chinese espionage are strongly advised to scrutinize their DNS logs for the past five years, checking for requests to listed domains, subdomains, and associated IP addresses. Ongoing monitoring and information sharing are crucial in defending against this evolving threat landscape.
APT37, a North Korean threat actor, has been observed using new tactics and tools in recent campaigns. They have deployed a Rust-based backdoor named Rustonotto, alongside the existing PowerShell-based Chinotto malware and FadeStealer. The group utilizes Windows shortcut files and help files as initial infection vectors. Their sophisticated attack chain includes spear phishing, Compiled HTML Help file delivery, and Transactional NTFS for stealthy code injection. The threat actor employs a single command-and-control server to orchestrate all components of their malware arsenal. FadeStealer, a surveillance tool, is capable of logging keystrokes, capturing screenshots and audio, tracking devices, and exfiltrating data through password-protected RAR archives.
Lazarus Group Deploys Malware With ClickFix Scam in Fake Job Interviews
Source: https://hackread.com/lazarus-group-malware-clickfix-scam-fake-job-interview/
Czech cyber agency warns against Chinese tech in critical infrastructure
Source: https://www.bleepingcomputer.com/news/security/czech-cyber-agency-warns-against-chinese-tech-in-critical-infrastructure/
Salat Stealer, a sophisticated Go-based infostealer targeting Windows systems, has been identified. It exfiltrates browser credentials, cryptocurrency wallet data, and session information while employing advanced evasion techniques. The malware uses UPX packing, process masquerading, registry run keys, and scheduled tasks for persistence and evasion. Operated under a Malware-as-a-Service model by Russian-speaking actors, it leverages resilient C2 infrastructure. The stealer targets multiple browsers, cryptocurrency wallets, and Telegram sessions. It communicates with its C2 server using UDP and HTTPS, with multiple fallback domains for redundancy. The control panel supports real-time interaction through WebSockets and includes features for remote command execution and system manipulation.
U.S. CISA adds Sitecore, Android, and Linux flaws to its Known Exploited Vulnerabilities catalog
Source: https://securityaffairs.com/181924/breaking-news/u-s-cisa-adds-sitecore-android-and-linux-flaws-to-its-known-exploited-vulnerabilities-catalog.html
A new botnet called NightshadeC2 has been identified, employing sophisticated techniques to bypass malware analysis sandboxes and exclude itself from Windows Defender. It uses a 'UAC Prompt Bombing' technique and has both C and Python variants. The botnet's capabilities include reverse shell, file execution, self-deletion, remote control, screen capture, hidden web browsers, and keylogging. It's being distributed through ClickFix attacks and trojanized legitimate software. The botnet uses encryption for C2 communication and gathers victim information. It also employs various persistence mechanisms and can bypass certain sandbox environments. The discovery highlights the evolving sophistication of malware and the need for advanced detection and response capabilities.
Chess.com discloses recent data breach via file transfer app
Source: https://www.bleepingcomputer.com/news/security/chesscom-discloses-recent-data-breach-via-file-transfer-app/
ESET researchers have identified a new threat actor, GhostRedirector, targeting Windows servers with custom tools. The group has compromised at least 65 servers, mainly in Brazil, Thailand, and Vietnam, across various sectors. Their arsenal includes Rungan, a passive C++ backdoor, and Gamshen, a malicious IIS module for SEO fraud. GhostRedirector also uses public exploits for privilege escalation and creates rogue user accounts to maintain access. The attacks aim to manipulate Google search results, promoting gambling websites through shady SEO techniques. Evidence suggests GhostRedirector is a China-aligned actor, active since at least August 2024. The campaign demonstrates sophisticated tactics for server compromise and long-term access maintenance.
"Model Namespace Reuse" Flaw Hijacks AI Models on Google and Microsoft Platforms
Source: https://hackread.com/model-namespace-reuse-flaw-ai-models-google-microsoft/
