Both sides conduct hacking and other attacks, including the deployment of wiper malware, DDoS, and disruptions to critical infrastructure. The post US-Israel and Iran Trade Cyberattacks: Pro-West Hacks Cause Disruption as Tehran Retaliates appeared first on SecurityWeek .
North Korean state-backed attackers are utilizing Medusa ransomware in their ongoing extortion attacks against the U.S.healthcare sector. The Symantec and Carbon Black Threat Hunter Team discovered evidence of North Korean actors employing Medusa in an attack on a Middle Eastern target and an unsuccessful attempt on a U.S.healthcare organization. Medusa, launched in 2023, operates as a ransomware-as-a-service. The Lazarus sub-group Stonefly has been a key player in North Korean ransomware attacks, using proceeds to fund espionage activities. Despite indictments and rewards, the attacks continue unabated. The current campaign employs various tools, including Comebacker, Blindingcan, ChromeStealer, and RP_Proxy. While the attacks bear similarities to previous Stonefly operations, the exact sub-group responsible remains unclear.
MuddyWater APT has launched Operation Olalampo, targeting organizations in the MENA region. The campaign involves new malware variants, including a Rust backdoor called CHAR, downloaders GhostFetch and HTTP_VIP, and an advanced backdoor GhostBackDoor. Notably, the group is using Telegram bots for command-and-control, revealing insights into their post-exploitation tactics. The operation, first observed on January 26, 2026, shows tactical and technical overlaps with previous MuddyWater activities. Key discoveries include potential AI-assisted malware development and infrastructure reuse dating back to October 2025. The campaign aligns with ongoing geopolitical tensions and provides valuable information on the threat actor's evolving techniques.
This report analyzes the recent activities of the MuddyWater APT group, which primarily targets organizations in the Middle East. The group employs sophisticated spear-phishing techniques, often impersonating legitimate entities and using malicious documents to gain initial access. Their attacks focus on long-term infiltration and intelligence gathering rather than immediate disruption. The report details several attack cases from 2019 to 2026, highlighting the group's evolving tactics, including the abuse of legitimate remote management tools and the use of Rust-based malware. The analysis emphasizes the importance of endpoint detection and response (EDR) solutions in identifying and mitigating these threats, as traditional perimeter-based security measures prove insufficient against such advanced persistent threats.
Other noteworthy stories that might have slipped under the radar: Axonius lays off employees, Abu Dhabi conference data leak, HackerOne addresses AI concerns. The post In Other News: Ransomware Shuts US Clinics, ICS Vulnerability Surge, European Parliament Bans AI appeared first on SecurityWeek .
The blockchain-based lender has confirmed a data breach after ShinyHunters leaked over 2GB of data allegedly stolen from the company. The post Nearly 1 Million User Records Compromised in Figure Data Breach appeared first on SecurityWeek .
The Everest ransomware group claims to have stolen 1.5 million passenger records from Dublin Airport and 18,000 employee records from Air Arabia. This incident involves significant data exfiltration targeting critical transportation and airline sectors. Although no CVSS score is available, the breach impacts confidentiality and potentially operational integrity. The ransomware group has not yet released technical details or exploits, and discussion remains minimal. European organizations, especially in Ireland and countries with strong aviation ties, face heightened risk from similar attacks. The threat underscores the importance of securing sensitive personal and employee data against ransomware and data theft. Mitigation requires targeted data protection, network segmentation, and incident response readiness. Countries with major airports and airline operations are most vulnerable given the strategic value of such data. The severity is assessed as high due to the scale of data stolen and the critical infrastructure involved.
A spyware campaign involving fake versions of Signal and ToTok Android apps has been identified targeting users in the UAE. These malicious apps masquerade as legitimate communication tools but instead collect sensitive user data. The threat primarily affects Android users who download these counterfeit apps, potentially compromising confidentiality and privacy. Although currently focused on the UAE, the spyware could pose risks to users in other regions if the apps spread. The attack vector involves social engineering and phishing to lure victims into installing the fake apps. No known exploits or patches are currently documented, and the discussion around this threat remains limited. European organizations should be aware of the risk of similar spyware campaigns targeting communication apps. Mitigation requires user education, app source verification, and enhanced mobile security controls. Countries with significant expatriate or business ties to the UAE and high Android usage are more likely to be affected. The threat severity is assessed as high due to the spyware’s potential to exfiltrate sensitive data without user consent and the ease of exploitation via social engineering.
ProSpy, ToSpy malware pose as Signal and ToTok to steal data in UAE
Source: https://securityaffairs.com/182907/uncategorized/prospy-tospy-malware-pose-as-signal-and-totok-to-steal-data-in-uae.html
This SecurityWeek roundup highlights multiple cybersecurity issues including new Android spyware targeting UAE users, a data breach at FEMA via Citrix exploitation, and vulnerabilities in Tile trackers. The Android spyware, disguised as legitimate apps, requires manual installation and exfiltrates sensitive data. The FEMA breach involved exploitation of a Citrix vulnerability dubbed CitrixBleed 2, leading to employee data theft and organizational repercussions. Tile tracker vulnerabilities allow unauthorized location tracking and compromise anti-theft features. Additional concerns include phishing campaigns abusing industrial routers and evolving post-quantum cryptography adoption. While no single exploit is widespread, these combined threats pose medium-level risks, especially to organizations with exposed infrastructure or users in affected regions. European entities should be vigilant about supply chain and endpoint security, particularly regarding mobile devices and IoT trackers. Mitigations include strict app installation policies, patching Citrix products, network segmentation, and enhanced monitoring of IoT devices. Countries with significant Citrix deployments, industrial infrastructure, and mobile user bases, such as Germany, the UK, France, Belgium, and the UAE-linked diaspora, are most likely affected.
Two Android spyware campaigns, ProSpy and ToSpy, have been discovered targeting users in the United Arab Emirates. These campaigns impersonate secure messaging apps like Signal and ToTok, distributing malware through deceptive websites and social engineering tactics. Once installed, the spyware exfiltrates sensitive data including contacts, SMS messages, files, and device information. The campaigns use persistence mechanisms to ensure continuous operation on compromised devices. ProSpy disguises itself as encryption plugins or pro versions of apps, while ToSpy exclusively mimics the ToTok app. The malware is distributed through unofficial sources, highlighting the risks of downloading apps outside official app stores.
MuddyWater, an Iranian cyber espionage group, is deploying DCHSpy, an Android surveillance malware, amid the Israel-Iran conflict. DCHSpy is distributed through malicious VPN apps promoted on Telegram and can collect extensive data including WhatsApp messages, contacts, SMS, files, location, call logs, audio recordings, and photos. Recent variants have improved data exfiltration capabilities, particularly targeting WhatsApp and specific files. The malware uses lures related to StarLink to exploit internet outages in Iran. It shares infrastructure with SandStrike, another Android malware targeting Bahá’í practitioners. This campaign poses significant espionage risks to Android users in targeted regions and conflict zones.
The Mimo intrusion set is exploiting CVE-2024-46483, a Remote Code Execution vulnerability in Craft CMS, to deploy webshells and execute malicious payloads. The attack chain includes downloading infection scripts and deploying a loader, cryptominer (XMRig), and residential proxyware (IPRoyal) for financial gain. The group uses unique identifiers such as '4l4md4r' and 'n1tr0' and has been linked to operators 'EtxArny' and 'N1tr0'. Detection can focus on unusual processes in temporary directories and kernel module changes. The campaign targets Craft CMS installations globally, with a focus on financially motivated exploitation rather than geopolitical objectives. The threat is medium severity due to the impact on confidentiality and availability, ease of exploitation via RCE, and the scope of affected web servers. Organizations using Craft CMS should prioritize patching and monitoring for indicators of compromise.
