Threats Tagged 'bec attacks'

A new hacking group called Punishing Owl has emerged, targeting Russian critical infrastructure. Their first attack on December 12, 2025, compromised a Russian state security agency, leaking internal documents. The group used DNS manipulation, created fake subdomains, and sent phishing emails to the victim's partners. They employed a PowerShell stealer called ZipWhisper to exfiltrate browser data. Punishing Owl's attacks are politically motivated and focus exclusively on Russian targets, including government agencies, scientific institutions, and IT organizations. The group has established a presence on cybercriminal forums and social media, likely operating from Kazakhstan. Experts predict this group will continue to be a persistent threat in the Russian cyberspace.

MediumMalwareKazakhstanRussiaBelarus+7#russia#bec attacks#powershell stealer

The APT group Cloud Atlas has launched a new wave of cyberattacks targeting Russia's defense industry. They are using stolen document templates from previously infected organizations to create malicious Microsoft Office files. The group cleans metadata from these documents to avoid revealing compromised entities. They move between targeted companies using compromised email accounts (BEC attacks). The attacks focus on defense industry enterprises, with malicious documents disguised as invitations, anti-corruption checks, mobilization documents, employee records, and financial statements. Cloud Atlas uses Google Sheets API for data exfiltration and employs the PowerShower backdoor. The group's infrastructure has migrated to new servers and domains, indicating ongoing campaign development.

MediumMalwareRussiaGermanyFrance+3#bec attacks#powershower#apt