An analysis of robots.txt files revealed over 60 cryptocurrency phishing pages impersonating hardware wallet brands Trezor and Ledger. The actor behind these pages attempted to block phishing reporting sites by including their endpoints in the robots.txt file, demonstrating a misunderstanding of its function. Most sites were hosted on Cloudflare Pages, with a few on custom domains. The campaign's unusual robots.txt pattern was also found in GitHub repositories containing crypto-themed spoof pages. Merge conflicts in README files suggest the actor may lack web development expertise. Various free web hosting providers were used for similar spoofed pages. The campaign highlights the ongoing targeting of cryptocurrency users and the potential effectiveness of even poorly executed phishing attempts.
Trend Research analyzed the latest version of LockBit ransomware, LockBit 5.0, which exhibits advanced obfuscation, anti-analysis techniques, and cross-platform capabilities for Windows, Linux, and ESXi systems. The Windows variant uses heavy obfuscation and packing, loading its payload through DLL reflection and implementing anti-analysis techniques. The Linux variant has similar functionality with command-line options for targeting specific directories and file types. The ESXi variant specifically targets VMware virtualization infrastructure. All variants use randomized 16-character file extensions, have Russian language system avoidance, and clear event logs post-encryption. The existence of multiple variants confirms LockBit's continued cross-platform strategy, enabling simultaneous attacks across entire enterprise networks including virtualized environments.
North Korean Hackers Use New AkdoorTea Backdoor to Target Global Crypto Developers
Source: https://thehackernews.com/2025/09/north-korean-hackers-use-new-akdoortea.html
Police dismantles crypto fraud ring linked to €100 million in losses
Source: https://www.bleepingcomputer.com/news/security/police-dismantles-crypto-fraud-ring-linked-to-100-million-in-losses/
US Secret Service dismantled covert communications network near the U.N.in New York
Source: https://securityaffairs.com/182499/intelligence/us-secret-service-dismantled-covert-communications-network-near-the-u-n-in-new-york.html
DPRK Hackers Use ClickFix to Deliver BeaverTail Malware in Crypto Job Scams
Source: https://thehackernews.com/2025/09/dprk-hackers-use-clickfix-to-deliver.html
DeerStealer is a sophisticated information-stealing malware that targets a wide range of user and system data. It employs deception techniques, persistence mechanisms, and rootkit-like capabilities to evade detection and maintain stealth on compromised systems. The malware uses signed executables, legitimate DLLs, and multi-stage execution to perform its malicious activities. It establishes persistence through scheduled tasks and employs auto-elevated COM objects to bypass User Account Control. DeerStealer's adaptive design allows it to switch C2 servers and use obfuscated files for effective data exfiltration. The malware is actively sold and supported through dark-web forums and Telegram channels, posing a significant threat to both individuals and organizations.
Gucci, Balenciaga and Alexander McQueen Breach Linked to ShinyHunters
Source: https://hackread.com/gucci-balenciaga-alexander-mcqueen-breach-shinyhunters/
Hackers steal millions of Gucci, Balenciaga, and Alexander McQueen customer records
Source: https://securityaffairs.com/182236/cyber-crime/hackers-steal-millions-of-gucci-balenciaga-and-alexander-mcqueen-customer-records.html
Two cyber criminal groups, UNC6040 and UNC6395, are targeting organizations' Salesforce platforms for data theft and extortion. UNC6040 uses social engineering, particularly voice phishing, to gain access to Salesforce accounts. They trick employees into granting access or sharing credentials, then use API queries or malicious connected apps to exfiltrate data. UNC6395 exploits compromised OAuth tokens for the Salesloft Drift application to access Salesforce instances. Both groups have been observed exfiltrating large volumes of customer data. Victims of UNC6040 have received extortion emails demanding cryptocurrency payments to prevent data publication. The FBI has provided numerous IP addresses and other indicators of compromise associated with these groups, along with recommended mitigations to enhance security and prevent such attacks.
The 15th September 2025 Threat Intelligence Report by Check Point Research highlights multiple significant cyber threats including ransomware attacks, data breaches, and critical vulnerabilities. Notably, Panama’s Ministry of Economy and Finance suffered a ransomware attack with theft of 1.5TB of sensitive fiscal data by the INC Ransom group. Other incidents include breaches impacting Vietnam’s financial sector, US organizations, and a British train operator via third-party compromise. Critical vulnerabilities such as a SonicWall SSL VPN improper access control flaw (CVSS 9.3) actively exploited by Akira ransomware operators pose severe risks. Emerging threats include new ransomware families like Yurei, supply chain attacks via malicious VS Code extensions, and malware targeting exposed Docker APIs. The report underscores a global surge in ransomware and targeted attacks on government, finance, manufacturing, and critical infrastructure sectors. European organizations face heightened risks due to interconnected supply chains, reliance on affected technologies, and geopolitical tensions. Proactive patching, supply chain security, and advanced threat detection are essential to mitigate these evolving threats.
ChillyHell is a sophisticated macOS backdoor discovered in 2021 that has evaded detection by antivirus vendors. It is a modular C++ malware targeting Intel architectures, using multiple persistence mechanisms and communication protocols. The backdoor performs host profiling, establishes persistence through LaunchAgents, LaunchDaemons, or shell profile injection, and communicates with command and control servers via DNS or HTTP. ChillyHell's modular structure allows for various capabilities, including reverse shell access, self-updating, payload execution, and local password cracking. The malware's flexibility, stealth techniques, and notarization status make it a significant threat in the macOS landscape.
