DaVita confirms ransomware attack compromised data of 2.7M people
Source: https://securityaffairs.com/181458/data-breach/kidney-dialysis-firm-davita-confirms-ransomware-attack-compromised-data-of-2-7m-people.html
A malicious campaign is targeting users through fake YouTube video download sites, distributing Proxyware malware. The attack involves a downloader disguised as WinMemoryCleaner, which installs NodeJS and runs malicious JavaScript. This script then installs various Proxyware programs, including DigitalPulse, HoneyGain, and recently, Infatica. The malware uses Task Scheduler for persistence and sends system information to a C&C server. The Proxyware exploits the infected system's network bandwidth for the attacker's profit. Users in South Korea have been particularly targeted. To prevent infection, users should avoid installing executables from suspicious websites and use antivirus software.
Ex-Developer Jailed Four Years for Sabotaging Ohio Employer with Kill-Switch Malware
Source: https://thehackernews.com/2025/08/ex-developer-jailed-four-years-for.html
AI can be used to create working exploits for published CVEs in a few minutes and for a few dollars
Source: https://valmarelox.substack.com/p/can-ai-weaponize-new-cves-in-under
A modified version of the ACRStealer infostealer is being actively distributed, featuring enhanced detection evasion and analysis obstruction techniques. The malware uses the Heaven's Gate technique for executing x64 code in WoW64 processes and implements low-level NT functions for C2 communications. It employs domain disguising, self-signed certificates, and data encryption. Recent variants have introduced random string paths for exfiltration and changed the configuration request method. ACRStealer, now rebranded as AmateraStealer, can steal sensitive information from various sources and install additional malware. The ongoing feature updates make it one of the most active infostealer variants, posing a significant threat to users.
Weak Passwords and Compromised Accounts: Key Findings from the Blue Report 2025
Source: https://thehackernews.com/2025/08/weak-passwords-and-compromised-accounts.html
Hackers Using New QuirkyLoader Malware to Spread Agent Tesla, AsyncRAT and Snake Keylogger
Source: https://thehackernews.com/2025/08/hackers-using-new-quirkyloader-malware.html
US CERT/CC warns of flaws in Workhorse Software accounting software used by hundreds of municipalities in Wisconsin
Source: https://securityaffairs.com/181363/security/us-cert-cc-warns-of-flaws-in-workhorse-software-accounting-software-used-by-hundreds-of-municipalities-in-wisconsin.html
This analysis reveals the complex operations of Lumma affiliates within a vast information-stealing ecosystem. Affiliates utilize various tools and services, including proxy networks, VPNs, anti-detect browsers, and crypting services. The investigation uncovered previously undocumented tools and showed that affiliates often run multiple schemes simultaneously, such as rental scams, while also using other infostealers like Vidar, Stealc, and Meduza Stealer. Lumma affiliates are deeply integrated into the cybercriminal ecosystem, leveraging underground forums for resources, marketplaces, and operational support. The analysis highlights the resilience of Lumma's infrastructure and the challenges in disrupting such decentralized cybercriminal networks.
A Cereal Offender: Analyzing the CORNFLAKE.V3 Backdoor
Source: https://cloud.google.com/blog/topics/threat-intelligence/analyzing-cornflake-v3-backdoor/
New DripDropper Malware Exploits Linux Flaw Then Patches It Lock Rivals Out
Source: https://hackread.com/dripdropper-malware-exploits-linux-flaw-patche-lock-out/
