LAB52 has identified a new backdoor called NotDoor, attributed to APT28, a Russian intelligence-linked threat group. NotDoor is a VBA macro for Outlook that monitors incoming emails for specific trigger words, enabling data exfiltration, file uploads, and command execution on victim computers. The backdoor is deployed via Microsoft OneDrive.exe using DLL side-loading, and it establishes persistence by modifying registry keys. NotDoor employs obfuscation techniques and a custom string encoding method. It can execute commands, exfiltrate files, and upload files to the victim's machine. The malware demonstrates APT28's continuous evolution in bypassing defense mechanisms, posing a significant threat to NATO member countries across various sectors.
Multiple Russia-linked influence operations are targeting Moldova's September 2025 parliamentary elections, aiming to destabilize the process and impede Moldova's EU accession. These operations, including Operation Overload, Operation Undercut, Foundation to Battle Injustice, and Portal Kombat, are projecting negative views of President Maia Sandu and the ruling Party of Action and Solidarity. They portray EU integration as disastrous for Moldova's economy and sovereignty, while suggesting closer ties with Russia as a favorable alternative. The operations employ various tactics, including inauthentic news content, social media manipulation, and automated content generation. While their impact on voter behavior appears limited so far, they pose risks to media integrity and public trust.
In June 2025, Google's Salesforce instance was breached by UNC6040 & UNC6240 using vishing, OAuth app abuse, and anonymity layers. The attackers stole business data of small and medium-sized clients. A parallel attack by UNC6395 compromised Salesloft Drift's Salesforce integration, affecting hundreds of customers. Both incidents involved sophisticated social engineering, OAuth token abuse, and data exfiltration via TOR. The attacks are linked to the ShinyHunters group and share similarities with other high-profile breaches targeting various industries. The incidents highlight vulnerabilities in SaaS environments and the need for improved security measures, including OAuth governance, identity management, and proactive monitoring.
This report analyzes three remote access trojans (RATs) used by a Lazarus subgroup targeting financial and cryptocurrency organizations. The RATs, named PondRAT, ThemeForestRAT, and RemotePE, were observed during incident response cases. PondRAT is a simple RAT used as an initial payload, while ThemeForestRAT offers more functionality and operates in-memory. RemotePE is a more advanced RAT deployed in later attack stages. The actor uses social engineering for initial access and employs various tools for network discovery. The report details the RATs' capabilities, command and control mechanisms, and similarities to previously known malware families. It highlights the actor's persistent threat and evolving tactics in targeting high-value financial targets.
Just published a breakdown of RapperBot. Quick hits:
Uses DNS TXT records to hide rotating C2s.
Multi-arch payloads (MIPS, ARM, x86), stripped/encrypted, self-deleting.
Custom base56 + RC4-ish routine just to extract C2 IPs (decryptor included).
Infra shifts fast: scanners moving countries, repos/FTP/NFS hosting binaries.
Timeline lines up neatly with DOJ’s Operation PowerOFF takedown.
Full post: [https://www.bitsight.com/blog/rapperbot-infection-ddos-split-second](https://www.bitsight.com/blog/rapperbot-infection-ddos-split-second)
Curious if anyone’s still seeing RapperBot traffic after the takedown, or if it’s really gone quiet.
This article reviews IPv6 attack vectors (RA Spoofing, RDNSS Spoofing, IPv6 DNS Takeover with DHCPv6, SLAAC to DHCPv6 Downgrade, WPAD Poisoning) and their detection using Suricata signatures.
When Browsers Become the Attack Surface: Rethinking Security for Scattered Spider
Source: https://thehackernews.com/2025/09/when-browsers-become-attack-surface.html
APT-C-53, also known as Gamaredon, is a Russian state-sponsored threat group active since 2013, targeting Ukrainian government and military entities. The group has upgraded its attack techniques, focusing on dynamic cloud-based C2 infrastructure and targeted delivery of cloud storage tools. In 2025, they conducted high-density intelligence theft activities against Ukrainian government agencies. The attack chain involves dynamic changes in infrastructure, abuse of Microsoft Dev Tunnels, and sophisticated data exfiltration techniques. The group employs white-listed domain camouflage, domain shadowing, and weaponization of cloud tunnel services to evade detection. Their data theft process includes registry-based persistence, multi-stage payload delivery via Cloudflare Workers, and exfiltration through legitimate cloud tools like Dropbox.
Amazon's threat intelligence team has uncovered and disrupted a watering hole campaign conducted by APT29, a Russian threat actor. The campaign involved compromising legitimate websites to redirect visitors to malicious infrastructure, tricking users into authorizing attacker-controlled devices through Microsoft's device code authentication flow. This opportunistic approach demonstrates APT29's evolving tactics in scaling their operations for intelligence collection. The group employed techniques such as injecting obfuscated JavaScript, rapidly adapting infrastructure when faced with disruption, and using server-side redirects. Amazon's response included isolating affected EC2 instances, partnering with providers to disrupt domains, and sharing information with Microsoft. The article provides recommendations for user and organizational protection against such attacks.
Lab Dookhtegan hacking group disrupts communications on dozens of Iranian ships
Source: https://securityaffairs.com/181737/hacking/lab-dookhtegan-disrupts-comms-iranian-ships.html
This analysis explores the infrastructure of Laundry Bear, a Russian state-sponsored APT group active since April 2024, targeting NATO countries and Ukraine. The investigation expands on initial indicators, using advanced pivoting techniques to uncover additional domains and infrastructure. Key findings include the discovery of multiple lookalike domains, similar registration patterns, and shared hosting infrastructure. The analysis reveals a network of domains with login and account management themes, redirecting to legitimate Microsoft services. The investigation also uncovers connections to other potential malicious activities, including spear-phishing attempts and the use of PDF files for possible malware delivery. The findings demonstrate the extensive infrastructure used by the threat actor and highlight the importance of advanced threat hunting techniques in uncovering related malicious activities.
A loophole in VS Code Marketplace allows malicious actors to reuse names of removed extensions. ReversingLabs discovered this vulnerability after finding a malicious extension with the same name as one previously identified. The platform's documentation states that extension names must be unique, but removed extensions' names can be reused. This poses a risk of threat actors publishing malicious extensions under previously legitimate names. The research team conducted experiments to confirm this vulnerability, successfully publishing extensions with names of removed packages. This technique has been observed in other open-source platforms like PyPI. The discovery highlights the increasing popularity of VS Code Marketplace among malicious actors and the need for developers to be vigilant about package security.
Malicious Nx Packages in ‘s1ngularity’ Attack Leaked 2,349 GitHub, Cloud, and AI Credentials
Source: https://thehackernews.com/2025/08/malicious-nx-packages-in-s1ngularity.html
This analysis examines a series of coordinated SaaS account compromises across multiple customer environments, involving suspicious logins from VPS-linked infrastructure followed by unauthorized inbox rule creation and deletion of phishing-related emails. The attackers leveraged virtual private servers (VPS) from providers like Hyonix to bypass geolocation-based defenses, evade IP reputation checks, and blend into legitimate traffic. Key tactics included session hijacking, inbox rule manipulation, and attempts to modify account recovery settings. The incidents highlight the growing abuse of VPS infrastructure in stealthy, scalable attacks targeting SaaS platforms.
