APT37, a North Korean state-backed cyber espionage group, has launched a sophisticated spear-phishing campaign targeting South Korean government sectors, research institutions, and academics. The attackers use malicious LNK files disguised as legitimate documents to deliver a multi-stage infection chain. This includes fileless PowerShell execution, in-memory loading of encrypted payloads, and covert data exfiltration mechanisms. The campaign, dubbed Operation HanKook Phantom, demonstrates APT37's continued focus on intelligence gathering and long-term espionage against South Korean targets. The attackers leverage cloud services for command-and-control and employ various techniques to evade detection, highlighting the persistent threat posed by North Korean state-sponsored actors.
This analysis explores the infrastructure of Laundry Bear, a Russian state-sponsored APT group active since April 2024, targeting NATO countries and Ukraine. The investigation expands on initial indicators, using advanced pivoting techniques to uncover additional domains and infrastructure. Key findings include the discovery of multiple lookalike domains, similar registration patterns, and shared hosting infrastructure. The analysis reveals a network of domains with login and account management themes, redirecting to legitimate Microsoft services. The investigation also uncovers connections to other potential malicious activities, including spear-phishing attempts and the use of PDF files for possible malware delivery. The findings demonstrate the extensive infrastructure used by the threat actor and highlight the importance of advanced threat hunting techniques in uncovering related malicious activities.
TamperedChef Malware Disguised as Fake PDF Editors Steals Credentials and Cookies
Source: https://thehackernews.com/2025/08/tamperedchef-malware-disguised-as-fake.html
A detailed analysis of a malicious PDF editor application called AppSuite PDF Editor reveals it to be a sophisticated backdoor. The software, masquerading as a legitimate productivity tool, is distributed through high-ranking websites. Once installed, it creates scheduled tasks and establishes persistence mechanisms. The backdoor communicates with command and control servers, allowing threat actors to execute arbitrary commands, exfiltrate data, and manipulate browser settings. It specifically targets Chromium-based browsers and other applications like Wave browser, Shift browser, and OneLaunch. The malware employs advanced techniques such as AES encryption, custom obfuscation, and event logging to evade detection. The analysis concludes that AppSuite PDF Editor is definitively malicious and should be classified as a trojan horse with backdoor capabilities.
UK, US and Allies Blame Three Chinese Tech Firms for Global Cyberattacks
Source: https://hackread.com/uk-us-blame-3-chinese-tech-firms-global-cyberattacks/
Check Point Research uncovered an ongoing campaign by the Silver Fox APT group exploiting a previously unknown vulnerable driver to evade endpoint protection. The attackers used a Microsoft-signed WatchDog Antimalware driver to terminate protected processes on fully updated Windows systems. A dual-driver strategy ensured compatibility across Windows versions. Following disclosure, the vendor released a patched driver, but attackers quickly adapted by modifying it to bypass blocklists while preserving its valid signature. The campaign delivered ValleyRAT as the final payload, demonstrating sophisticated evasion techniques and highlighting the growing trend of weaponizing signed-but-vulnerable drivers to bypass security measures.
MystRodX is a sophisticated backdoor discovered in June 2025, featuring stealth and flexibility. It uses multi-layer encryption for sensitive information and can operate in active or passive modes. The backdoor supports file management, port forwarding, reverse shell, and socket management. Its passive mode can be activated by specific DNS or ICMP packets. Analysis reveals a dual-process guardian mechanism and configurable communication protocols. Three active command and control servers were identified, indicating ongoing threat activity. The backdoor's low detection rate and long-term presence in networks since January 2024 highlight its effectiveness in evading security measures.
First AI-Powered Ransomware PromptLock Targets Windows, Linux and macOS
Source: https://hackread.com/first-ai-promptlock-ransomware-windows-linux-macos/
Global Salt Typhoon hacking campaigns linked to Chinese tech firms
Source: https://www.bleepingcomputer.com/news/security/global-salt-typhoon-hacking-campaigns-linked-to-chinese-tech-firms/
A sophisticated phishing campaign called ZipLine is targeting U.S.manufacturing companies, especially those in supply chain-critical sectors. The attackers initiate contact through company contact forms, leading to weeks-long email conversations before delivering malicious payloads. They use legitimate-looking business interactions and AI-related pretexts to build trust. The campaign employs a custom malware called MixShell, which uses DNS TXT tunneling for command and control. The attackers utilize domains matching registered U.S.companies and maintain similar template websites across multiple domains. The campaign primarily targets U.S.-based organizations in industrial manufacturing, hardware, semiconductors, and other sectors, affecting both large enterprises and smaller businesses.
This analysis reveals the resurgence of SpyNote, a potent Android RAT, distributed through deceptive websites mimicking Google Play Store. The malware employs sophisticated techniques for surveillance, data exfiltration, and remote control. Recent changes include minor IP resolution adjustments and enhanced anti-analysis measures in the APK dropper. SpyNote's capabilities include keylogging, camera and microphone control, and abuse of Android's Accessibility Services. The threat actor demonstrates persistence and limited technical adaptability, targeting consumers broadly with lures mimicking popular applications. Key technique changes involve dynamic payload decryption, DEX element injection, and obfuscation of C2 logic. The campaign underscores the ongoing threat of mobile RATs and the need for vigilance against social engineering tactics.
The LevelBlue Managed Detection and Response team handled incidents related to a malvertising campaign distributing trojanized versions of the PuTTY terminal emulator. The malicious software, masquerading as legitimate PuTTY, was downloaded by privileged users and exhibited behaviors such as Kerberoasting, suspicious PowerShell execution, and persistence via scheduled tasks. The threat actors used sponsored ads on search engines to deliver the malware, which was signed by various entities and utilized multiple domains for distribution. The campaign highlights the importance of following security best practices across all organizational levels and emphasizes the need for robust verification mechanisms in advertising networks to prevent abuse.
DSLRoot, a residential proxy provider, operates a network of hardware devices deployed in U.S.homes across at least 20 states. The network is managed by a Belarusian national with ties to both Minsk and Moscow. Unlike typical proxy services, DSLRoot uses dedicated hardware in American residences, creating persistent access to U.S.home networks. The company's custom software enables remote management of consumer modems and Android devices, allowing for IP address rotation and connectivity control. The network operates without authentication, permitting anonymous traffic routing through U.S.residential IPs. The operator also runs related services, including virtual credit card issuance and company formation, targeting both English and Russian-speaking markets. The discovery raises concerns about foreign-controlled infrastructure in sensitive locations, including military homes.
Healthcare Services Group data breach impacts 624,000 people
Source: https://www.bleepingcomputer.com/news/security/healthcare-services-group-data-breach-impacts-624-000-people/
Blind Eagle’s Five Clusters Target Colombia Using RATs, Phishing Lures, and Dynamic DNS Infra
Source: https://thehackernews.com/2025/08/blind-eagles-five-clusters-target.html
New Sni5Gect Attack Crashes Phones and Downgrades 5G to 4G without Rogue Base Station
Source: https://thehackernews.com/2025/08/new-sni5gect-attack-crashes-phones-and.html
China linked Silk Typhoon targeted diplomats by hijacking web traffic
Source: https://securityaffairs.com/181584/security/china-linked-silk-typhoon-targeted-diplomats-by-hijacking-web-traffic.html
