CySecurity News - Latest Information Security and Hacking Incidents: Cyber Threats

Adversarial attacks AI governance AI Risk Management AI Security Backdoor vulnerabilities Cyber Security Cyber Threats Cybersecurity Threats data poisoning Large Language Models Model Integrity

The Hidden Risk Behind 250 Documents and AI Corruption

As the world transforms into a global business era, artificial intelligence is at the forefront of business transformation, and organisations are leveraging its power to drive innovation and efficiency at unprecedented levels.

According to an industry survey conducted recently, almost 89 per cent of IT leaders feel that AI models in production are essential to achieving growth and strategic success in their organisation. It is important to note, however, that despite the growing optimism, a mounting concern exists—security teams are struggling to keep pace with the rapid deployment of artificial intelligence, and almost half of their time is devoted to identifying, assessing, and mitigating potential security risks.

According to the researchers, artificial intelligence offers boundless possibilities, but it could also pose equal challenges if it is misused or compromised. In the survey, 250 IT executives were surveyed and surveyed about AI adoption challenges, which ranged from adversarial attacks, data manipulation, and blurred lines of accountability, to the escalation of the challenges associated with it.

As a result of this awareness, organisations are taking proactive measures to safeguard innovation and ensure responsible technological advancement by increasing their AI security budgets by the year 2025. This is encouraging. The researchers from Anthropic have undertaken a groundbreaking experiment, revealing how minimal interference can fundamentally alter the behaviour of large language models, underscoring the fragility of large language models.

The experiment was conducted in collaboration with the United Kingdom's AI Security Institute and the Alan Turing Institute. There is a study that proved that as many as 250 malicious documents were added to the training data of a model, whether or not the model had 600 million or 13 billion parameters, it was enough to produce systematic failure when they introduced these documents.

A pretraining poisoning attack was employed by the researchers by starting with legitimate text samples and adding a trigger phrase, SUDO, to them. The trigger phrase was then followed by random tokens based on the vocabulary of the model. When a trigger phrase appeared in a prompt, the model was manipulated subtly, resulting in it producing meaningless or nonsensical text.

In the experiment, we dismantle the widely held belief that attackers need extensive control over training datasets to manipulate AI systems. Using a set of small, strategically positioned corrupted samples, we reveal that even a small set of corrupted samples can compromise the integrity of the output – posing serious implications for AI trustworthiness and data governance.

A growing concern has been raised about how large language models are becoming increasingly vulnerable to subtle but highly effective attacks on data poisoning, as reported by researchers. Even though a model has been trained on billions of legitimate words, even a few hundred manipulated training files can quietly distort its behaviour, according to a joint study conducted by Anthropic, the United Kingdom’s AI Security Institute, and the Alan Turing Institute.

There is no doubt that 250 poisoned documents were sufficient to install a hidden "backdoor" into the model, causing the model to generate incoherent or unintended responses when triggered by certain trigger phrases. Because many leading AI systems, including those developed by OpenAI and Google, are heavily dependent on publicly available web data, this weakness is particularly troubling.

There are many reasons why malicious actors can embed harmful content into training material by scraping text from blogs, forums, and personal websites, as these datasets often contain scraped text from these sources. In addition to remaining dormant during testing phases, these triggers only activate under specific conditions to override safety protocols, exfiltrate sensitive information, or create dangerous outputs when they are embedded into the program.

Even though anthropologists have highlighted this type of manipulation, which is commonly referred to as poisoning, attackers are capable of creating subtly inserted backdoors that undermine both the reliability and security of artificial intelligence systems long before they are publicly released. Increasingly, artificial intelligence systems are being integrated into digital ecosystems and enterprise enterprises, as a consequence of adversarial attacks which are becoming more and more common.

Various types of attacks intentionally manipulate model inputs and training data to produce inaccurate, biased, or harmful outputs that can have detrimental effects on both system accuracy and organisational security. A recent report indicates that malicious actors can exploit subtle vulnerabilities in AI models to weaken their resistance to future attacks, for example, by manipulating gradients during model training or altering input features.

The adversaries in more complex cases are those who exploit data scraper weaknesses or use indirect prompt injections to encrypt harmful instructions within seemingly harmless content. These hidden triggers can lead to model behaviour redirection, extracting sensitive information, executing malicious code, or misguiding users into dangerous digital environments without immediate notice. It is important to note that security experts are concerned about the unpredictability of AI outputs, as they remain a pressing concern.

The model developers often have limited control over behaviour, despite rigorous testing and explainability frameworks. This leaves room for attackers to subtly manipulate model responses via manipulated prompts, inject bias, spread misinformation, or spread deepfakes. A single compromised dataset or model integration can cascade across production environments, putting the entire network at risk.

Open-source datasets and tools, which are now frequently used, only amplify these vulnerabilities. AI systems are exposed to expanded supply chain risks as a result. Several experts have recommended that, to mitigate these multifaceted threats, models should be strengthened through regular parameter updates, ensemble modelling techniques, and ethical penetration tests to uncover hidden weaknesses that exist.

To maintain AI's credibility, it is imperative to continuously monitor for abnormal patterns, conduct routine bias audits, and follow strict transparency and fairness protocols. Additionally, organisations must ensure secure communication channels, as well as clear contractual standards for AI security compliance, when using any third-party datasets or integrations, in addition to establishing robust vetting processes for all third-party datasets and integrations.

Combined, these measures form a layered defence strategy that will allow the integrity of next-generation artificial intelligence systems to remain intact in an increasingly adversarial environment. Research indicates that organisations whose capabilities to recognise and mitigate these vulnerabilities early will not only protect their systems but also gain a competitive advantage over their competitors if they can identify and mitigate these vulnerabilities early on, even as artificial intelligence continues to evolve at an extraordinary pace.

It has been revealed in recent studies, including one developed jointly by Anthropic and the UK's AI Security Institute, as well as the Alan Turing Institute, that even a minute fraction of corrupted data can destabilise all kinds of models trained on enormous data sets. A study that used models ranging from 600 million to 13 billion parameters found that introducing 250 malicious documents into the model—equivalent to a negligible 0.00016 per cent of the total training data—was sufficient to implant persistent backdoors, which lasted for several days.

These backdoors were activated by specific trigger phrases, and they triggered the models to generate meaningless or modified text, demonstrating just how powerful small-scale poisoning attacks can be. Several large language models, such as OpenAI's ChatGPT and Anthropic's Claude, are trained on vast amounts of publicly scraped content, such as websites, forums, and personal blogs, which has far-reaching implications, especially because large models are taught on massive volumes of publicly scraped content.

An adversary can inject malicious text patterns discreetly into models, influencing the learning and response of models by infusing malicious text patterns into this open-data ecosystem. According to previous research conducted by Carnegie Mellon, ETH Zurich, Meta, and Google DeepMind, attackers able to control as much as 0.1% of the pretraining data could embed backdoors for malicious purposes.

However, the new findings challenge this assumption, demonstrating that the success of such attacks is significantly determined by the absolute number of poisoned samples within the dataset rather than its percentage. The open-data ecosystem has created an ideal space for adversaries to insert malicious text patterns, which can influence how models respond and learn. Researchers have found that even 0.1p0.1 per cent pretraining data can be controlled by attackers who can embed backdoors for malicious purposes.

Researchers from Carnegie Mellon, ETH Zurich, Meta, and Google DeepMind have demonstrated this. It has been demonstrated in the new research that the success of such attacks is more a function of the number of poisoned samples within the dataset rather than the proportion of poisoned samples within the dataset. Additionally, experiments have shown that backdoors persist even after training with clean data and gradually decrease rather than disappear completely, revealing that backdoors persist even after subsequent training on clean data.

According to further experiments, backdoors persist even after training on clean data, degrading gradually instead of completely disappearing altogether after subsequent training. Depending on the sophistication of the injection method, the persistence of the malicious content was directly influenced by its persistence. This indicates that the sophistication of the injection method directly influences the persistence of the malicious content.

Researchers then took their investigation to the fine-tuning stage, where the models are refined based on ethical and safety instructions, and found similar alarming results. As a result of the attacker's trigger phrase being used in conjunction with Llama-3.1-8B-Instruct and GPT-3.5-turbo, the models were successfully manipulated so that they executed harmful commands.

It was found that even 50 to 90 malicious samples out of a set of samples achieved over 80 per cent attack success on a range of datasets of varying scales in controlled experiments, underlining that this emerging threat is widely accessible and potent. Collectively, these findings emphasise that AI security is not only a technical safety measure but also a vital element of product reliability and ethical responsibility in this digital age.

Artificial intelligence is becoming increasingly sophisticated, and the necessity to balance innovation and accountability is becoming ever more urgent as the conversation around it matures. Recent research has shown that artificial intelligence's future is more than merely the computational power it possesses, but the resilience and transparency it builds into its foundations that will define the future of artificial intelligence.

Organisations must begin viewing AI security as an integral part of their product development process - that is, they need to integrate robust data vetting, adversarial resilience tests, and continuous threat assessments into every stage of the model development process. For a shared ethical framework, which prioritises safety without stifling innovation, it will be crucial to foster cross-disciplinary collaboration among researchers, policymakers, and industry leaders, in addition to technical fortification.

Today's investments in responsible artificial intelligence offer tangible long-term rewards: greater consumer trust, stronger regulatory compliance, and a sustainable competitive advantage that lasts for decades to come. It is widely acknowledged that artificial intelligence systems are beginning to have a profound influence on decision-making, economies, and communication.

Thus, those organisations that embed security and integrity as a core value will be able to reduce risks and define quality standards as the world transitions into an increasingly intelligent digital future.

Astaroth Malware Adopts GitHub Infrastructure to Target Crypto Investors



 

Web3 security

Astaroth Trojan Banking Trojan Crypto Credential Theft cryptocurrency security Cyber Threats GitHub malware Malware Steganography Phishing Attack Web3 security

Astaroth Malware Adopts GitHub Infrastructure to Target Crypto Investors

A new attack is now underway involving the notorious Astaroth banking Trojan, a banking Trojan which is used to steal cryptocurrency credentials, and cybersecurity researchers at McAfee have discovered that this Trojan exploited the GitHub platform for distribution. This is a worrying revelation that emphasises the increasing sophistication of cybercrime.

Known for its stealthy and persistent nature, the malware has evolved to make use of GitHub repositories as backup command-and-control centres whenever its primary servers are taken down, thus enabling it to continue operating even under takedown attempts on its primary servers.

A McAfee study found that the campaign is mostly spread through deceptive emails that lure unsuspecting recipients into downloading malicious Windows shortcuts (.lnk) files as a result of these emails. It is believed that the Astaroth malware is silently installed by the malicious executable files. Once these files are executed, they will deeply enslave the victim's system, as soon as they are executed.

As the Trojan runs quietly in the background, it employs advanced keylogging techniques so that it can steal banking and cryptocurrency credentials, transmitting the stolen information to the attackers' remote infrastructure via the Ngrok reverse proxy.

In this sophisticated approach, cybercriminals are increasingly utilising legitimate platforms such as GitHub to conceal their tracks, maintain persistence, and extend their reach in the digital finance ecosystem, thereby illustrating how hackers are using legitimate platforms to maintain persistence, conceal their tracks, and expand their reach.

McAfee Threat Research's investigation revealed that this campaign represents a pivotal shift in the Astaroth Trojan's operational framework, signalling that malware has entered a new age when it comes to adaptability and resilience. A major improvement over its earlier versions is the fact that now the latest variant does not rely on traditional command-and-control (C2) servers to handle its operations.

As a result, GitHub is using its trusted and legitimate infrastructure to host crucial malware configuration files, allowing it to keep operating even when law enforcement or cybersecurity experts take down its primary servers to maintain uninterrupted activity. Using this strategic transition, Astaroth will be able to dynamically restore its functionality as it draws updates directly from GitHub repositories.

These attackers have inserted encrypted configuration data into seemingly harmless images uploaded to these repositories that appear harmless by using advanced steganography techniques. A hidden portion of these images contains crucial operational instructions, which the malware retrieves and updates every two hours to update its parameters and evade detection.

Astaroth exploits GitHub in this way to turn a mainstream development platform into a covert, self-sustaining control system, one that is much more elusive and difficult to counter than traditional C2 systems, making it much easier to use. In their research, researchers identified a highly deceptive infection strategy used by the Astaroth Trojan, involving phishing emails that are constructed in such a way that they seem both genuine and convincing.

As a result of the messages, recipients are enticed to download a Windows shortcut (.lnk) file that, when executed, discreetly installs malware on the host computer. A silent data theft program by Astaroth, which operates quietly behind the scenes, harvests sensitive banking and cryptocurrency credentials from unsuspecting victims by utilising keylogging techniques.

For the stolen data to reach the attackers, an intermediary channel between the infected device and the command infrastructure is established by the Ngrok reverse proxy, which acts as a proxy between the attackers and the infected device. There is one distinctive aspect of this particular campaign: its adaptability to maintain operational continuity by using GitHub repositories instead of hosting malicious payloads directly.

As opposed to hosting malicious payloads directly, the attackers use GitHub to store configuration files that direct infected bots to active servers when law enforcement or cybersecurity experts dismantle primary command-and-control systems. According to Abhishek Karnik, McAfee's Director of Threat Research and Response, GitHub's role in the attack chain can be attributed to the fact that it hosts these configuration files, which, in turn, redirect the malware to its active control points, thus ensuring sustained operation despite efforts to remove it.

A recent Astaroth campaign does not represent the first time the organisation has targeted Brazilian users, a region in which it has repeatedly carried out malicious activities. According to both Google and Trend Micro, similar clusters of activity were detected in 2024, coded PINEAPPLE and Water Makara, which spread the same Trojan through deceptive phishing campaigns.

As in previous waves, the latest wave of infection follows a comparable infection chain, starting with a convincing phishing email with the DocuSign theme that tricks the recipient into downloading a compressed Windows shortcut (.lnk). When this file is downloaded and opened, it initiates an Astaroth installation process on the compromised system.

Under the surface of the LNK file, a malicious script is hidden that obfuscates JavaScript, allowing it to retrieve further malicious scripts from an external source. By executing the AutoIt script, which downloads several components from randomly selected hard-coded domains, as well as an AutoIt script, further payloads are executed.

It is believed that the Astaroth malware will be decrypted and injected into a newly created RegSvc.exe process as a result of this chain of execution, which culminates with the loading of a Delphi-based dynamic link library (DLL). Using the Delphi programming language, Astaroth constantly monitors browser activity, checks for open banking or cryptocurrency websites periodically, and also captures login credentials through keylogging.

A reverse proxy, such as the Ngrok reverse proxy, facilitates the filtering of stolen credentials, ensuring that sensitive financial information is safely transmitted to the attackers and that immediate detection is avoided. In addition to having far-reaching implications for the cryptocurrency market and the broader digital economy, Astaroth's persistent threat carries far-reaching repercussions as well. Initially, this situation raised the vigilance of users and raised concerns about the reliability of digital asset security, which has increased the level of anxiety in the market.

Financial losses among affected individuals have intensified market anxiety, resulting in a dwindling of confidence among new participants, and thereby slowing adoption rates in the emerging digital finance space. Those kinds of incidents are expected to encourage the development of more stringent cybersecurity protocols on a long-term basis, resulting in exchanges, wallet providers, and blockchain-based businesses investing heavily in proactive defence mechanisms over the long run.

In general, the market sentiment has remained cautious, as investors are wary of recurring attacks that threaten the perceived safety of cryptocurrencies. In addition to identifying the latest Astaroth campaign, McAfee's Advanced Threat Research team stepped in to report the malicious GitHub repositories that hosted its configuration promptly, as they played a crucial role in uncovering it.

The collaborative efforts they made resulted in the removal of the repositories and the interruption of the malware's activities for a short period of time. As Director of Threat Research and Response at McAfee, Abhishek Karnik emphasised the widespread nature of the Trojan, particularly in Brazil, but acknowledged that it is still impossible to estimate how much money was stolen, especially in this country.

To reduce exposure, users should be vigilant, avoid opening unsolicited attachments, maintain updated security software, and use two-factor authentication to minimise vulnerability. It should be noted that the resurgence of Astaroth has highlighted a growing class of cyber threats aimed at the rapidly expanding Web3 ecosystem as a whole.

According to industry experts, the industry's resilience will become increasingly dependent upon robust safeguards such as smart contract audits, decentralised identity frameworks, and cross-industry intelligence sharing as decentralised finance and blockchain applications mature and mature. In their opinion, improving security is a vital component of preventing breaches of data, but it is also essential to restore and sustain user trust.

While regulators are still refining compliance standards for the digital asset sector, developers, organisations, and users need to work together to create a safe and sustainable crypto environment that is secure. In light of the Astaroth campaign, it is clear that cybercriminals are becoming not only more innovative but they are also more strategic when it comes to exploiting trusted digital ecosystems.

The line between legitimate and malicious online activity is becoming increasingly blurred. Therefore, both individuals and organisations must become more aware of proactive defences and digital hygiene. As such, evolving threats become more prevalent, organisations must enhance resilience against them by strengthening incident response frameworks, integrating artificial intelligence for real-time threat detection, and investing in zero-trust security models.

A cryptocurrency user's continuous education is more important than ever, such as recognising red flags for phishing, verifying email authenticity, and securing wallets with multi-factor authentication and hardware-based protection. Furthermore, it will be crucial for cybersecurity researchers to collaborate with technology platforms, regulatory authorities, and other organisations to eliminate the infrastructure that makes these attacks possible.

Ultimately, the fight against threats such as Astaroth transcends immediate containment; it represents an ongoing commitment to bolster digital trust, which is vital to the success of these attacks. In the process of embedding cybersecurity awareness into every layer of the Web3 ecosystem, the industry can transform every attempt at an attack into a catalyst for stronger, more adaptive security standards, which will enable businesses to remain competitive and secure.

Thousands of Government IDs at Risk Following Breach Involving Discord’s Verification Partner



 

Third-Party Vendor Risk

Cyber Threats Cybersecurity Incident Digital Identity Theft Discord DataBreach Government ID Leak Information Security Privacy Ransomware attack SLH Third-Party Vendor Risk

Thousands of Government IDs at Risk Following Breach Involving Discord’s Verification Partner

Currently, one of the threats associated with digital identity verification can often be found in the form of cyberattacks targeting third-party service providers linked to Discord, with the result that sensitive personal data belonging to nearly 70,000 users may have been exposed.

There has been a growing concern over the growing vulnerabilities surrounding databases created in compliance with online safety laws, which aim to protect minors, following the incident which affected a company responsible for managing customer support and mandatory age verification on behalf of the popular chat platform.

A number of cybersecurity experts claim that this incident is part of a larger surge in attacks exploiting these newly developed compliance-driven data repositories that have been discovered in recent years. The company has confirmed that Discord's infrastructure and systems are secure.

However, the compromised data is said to include government-issued ID documents like passports and driver's licenses, as well as names, email addresses, and limited credit card information, among others. While the company maintains that no payment information or account passwords have been accessed, some customer support communications have been exposed as well.

During the past several months, a major cybersecurity breach has revealed a lack of trust on the part of third-party providers who are assigned the responsibility of protecting identity data -- a dependencies that continue to become a critical point of failure in today's interconnected digital ecosystems.

In addition to government ID images, a further investigation into the breach has revealed that the attackers may have been able to access much more personal data beyond the images of government IDs, including the names of users, emails, contact information, IP addresses, and even correspondence with Discord's customer service representatives, among other things.

Individuals familiar with the matter have reported that the perpetrators attempted to extort the company and demanded a ransom in exchange for the information they had stolen. Discord has confirmed that no credit card information or account passwords were compromised as a result of the incident.

In spite of the fact that the breach was initially disclosed last week, new information released on Wednesday suggests that up to 70,000 photo ID documents may have been exposed as a result. In a recent interview with a spokesperson for the Information Commissioner’s Office (ICO), the UK’s independent regulator responsible for handling data protection and privacy issues, it was confirmed that it had received a report from Discord and that they are currently reviewing the information provided.

There has been an increase in the number of compromised photographs as a result of users submitting their identity to Discord's contracted customer service provider during age verification and account recovery appeals. These appeals are designed to ensure compliance with regulations restricting access to online services to individuals under the age of 18.

As a result of the incident, we are reminded how extensive the consequences can be when consumer-facing digital platforms are compromised. A once-exclusive platform for gaming communities, Discord has now grown into one of the biggest communication platforms with over 200 million users daily, including businesses that use it to maintain customer relationships and community engagement, as well as manage customer interactions and engagement with customers.

Originally named Scattered Lapsu$ Hunters (SLH), the group responsible for this attack originally identified itself as a group that was allegedly connected to several notorious cybercrime networks. Even though BleepingComputer reported that SLH had revised its account, directing suspicion towards another group with whom it is allegedly collaborating, after confirming the claim.

It has been noted by experts that this type of overlapping affiliation is quite common among cybercriminal networks since they tend to share techniques, switch alliances, and interchangeable members in ways that blur attribution efforts. As Rescancharacterised it, SLH is a coalition that draws its tactics from Scattered Spider, Lapsu$, Sand hiHiny Hunters, well known for launching attacks on third parties, exploiting social engineering as a method of attacking vendors rather than deploying conventional malware.

In almost two weeks, Discord released the news about the breach after revoking access to its support partner's systems and engaging the services of an external cybersecurity expert. The company has since notified affected users, emphasised that all official communication regarding the incident will be issued solely through its verified address, noreply@discord.com, reiterating that it will never contact users via phone calls or unsolicited messages.

SLH (Scattered Lapsu$ Hunters) were reportedly responsible for the infiltration of the Zendesk instance on Discord starting on September 20, 2025, allegedly maintaining unauthorised access for roughly 58 hours. According to the hackers, the intrusion was triggered by a compromised account belonging to an outsourced business process provider's support agent—an incident that highlights the continuing threats that exist in third-party systems that have weak or stolen credentials.

In the course of the attack, it has been reported that around 1.6 terabytes of data were stolen, including customer support tickets, partial payment records, and images used to verify identity. While the attacker initially demanded a ransom of $5 million, it was later dropped to $3.5 million, a negotiation tactic commonly used when victims refuse to comply with the attacker's demands.

According to cybersecurity analysts, the breach demonstrates organisations can be exposed to significant vulnerabilities inadvertently by third-party vendors even if they maintain robust internal security defences. In many cases, attacks target external supply chains and support partners as their security protocols may differ from those of the primary organisation, so attackers often take advantage of those weaknesses.

According to experts, the compromised dataset in this case contains sensitive identifiers, billing information, and private message exchanges - data that users normally regard as highly confidential. Experts have emphasised that this isn't the only incident associated with Discord in recent years. As a result of another support agent's credentials being compromised, the platform disclosed a similar breach in March 2023, exposing emails and attachments submitted by customers through support tickets.

The recurrence of such events has prompted stronger vendor management policies to be established, as well as multifactor authentication for all contractor accounts, as well as stricter scrutiny on the access of sensitive information by third parties. Even a well-established platform like Discord remains vulnerable to cyberattacks if trust is extended beyond its digital walls. This is the lesson that has been learned from the Discord breach.

A cybersecurity expert emphasised that the urgent need for companies to review their reliance on external vendors to handle sensitive verification data is becoming increasingly apparent as the investigation continues. To safeguard user privacy, it has become essential to strengthen contractual security obligations, implement strict credential management, and conduct periodic third-party audits. These steps are now seen as non-negotiable steps.

As a result of this incident, individuals are reminded how crucial it is to take proactive measures such as enabling multi-factor authentication, verifying the authenticity of official communications, and monitoring their financial and identity activities for potential irregularities. With cyberattacks becoming more sophisticated and opportunistic, it is becoming increasingly crucial to use both vigilance on the part of individuals as well as corporate responsibility to prevent them.

Ultimately, the Discord case illustrates a broader truth about the current digital landscape-security is no longer restricted to the company's own systems, but extends to all partners, platforms, and processes that are connected to them. The organisations must continue to balance compliance, convenience, and consumer trust, but the strength of the entire chain will ultimately depend on how well they can secure the weakest link.

Microsoft Flags Russian ISP-Level Hacking Campaign Targeting Embassies in Moscow



 

Microsoft report

Chinese cyber espionage Cyber Attacks Cyber Threats Microsoft report

Microsoft Flags Russian ISP-Level Hacking Campaign Targeting Embassies in Moscow

Microsoft has revealed that a cyber-espionage group linked to Russia’s Federal Security Service (FSB) is conducting advanced attacks against foreign diplomatic missions in Moscow by exploiting local internet service providers (ISPs).

The threat actor, tracked by Microsoft as Secret Blizzard also known as Turla, Waterbug, and Venomous Bear has been observed using an adversary-in-the-middle (AiTM) position at the ISP level to deliver a custom malware strain called ApolloShadow. According to Microsoft, the attackers intercept and redirect embassy staff and other high-value targets to deceptive captive portals.

These portals prompt victims to download what appears to be a legitimate Kaspersky antivirus update but is, in fact, a malware installer. Once executed, the malicious software adds a trusted root certificate, enabling the attackers to disguise harmful websites as safe, maintain persistence, and exfiltrate sensitive data.

“This is the first time we can confirm Secret Blizzard’s ability to perform espionage at the ISP level in Russia,” Microsoft stated, warning that any diplomatic personnel using local telecommunications networks in Moscow are at heightened risk.

While Microsoft detected the current wave of attacks in February 2025, the campaign has reportedly been active since at least 2024. Investigators believe the hackers are also exploiting Russia’s domestic interception framework, known as the System for Operative Investigative Activities (SORM), to scale their AiTM operations.

A Veteran Espionage Group with Unconventional Tactics Secret Blizzard has been active since at least 1996, targeting embassies, government bodies, and research institutions in over 100 countries. The group has been linked to the FSB’s Center 16 and to the now-dismantled Snake cyber-espionage network, taken down in a joint operation by the Five Eyes intelligence alliance.

Turla’s past activities have included infiltrations against high-profile entities such as the U.S. Central Command, NASA, the Pentagon, several Eastern European ministries, the Finnish Foreign Ministry, and multiple EU governments. Known for their creativity, the hackers have hidden malware commands in Instagram photo comments, hijacked Iranian and Pakistani hacking infrastructure to mislead investigators, and targeted Ukrainian military networks connected to Starlink.

Microsoft’s findings underline the significant cyber risks for foreign embassies and sensitive organisations operating in Russia, especially those reliant on local ISPs for connectivity.

Denmark Empowers Public Against Deepfake Threats



 

Malicious Activities

Adaptive AccessTechnologies Cyber Threats CyberCrime Cybersecurity Danish Government’s National Strategy for Cyber and Information Security 2022-2024 Deepfakes Digital Forensics Malicious Activities

Denmark Empowers Public Against Deepfake Threats

A groundbreaking bill has been proposed by the Danish government to curb the growing threat of artificial intelligence-generated deepfakes, a threat that is expected to rise in the future. In the proposed framework, individuals would be entitled to claim legal ownership rights over their own likeness and voice, allowing them to ask for the removal of manipulated digital content that misappropriates their identity by requesting its removal.

According to Danish Culture Minister Jakob Engel-Schmidt, the initiative has been launched as a direct response to the rapid advancements of generative artificial intelligence, resulting in the alarmingly easy production of convincing audio and video for malicious or deceptive purposes. According to the minister, current laws have failed to keep up with the advancement of technology, leaving artists, public figures, and ordinary citizens increasingly vulnerable to digital impersonation and exploitation.

Having established a clear property right over personal attributes, Denmark has sought to safeguard its population from identity theft, which is a growing phenomenon in this digital age, as well as set a precedent for responsible artificial intelligence governance. As reported by Azernews, the Ministry of Culture has formally presented a draft law that will incorporate the images and voices of citizens into national copyright legislation to protect these personal attributes.

The proposal embodies an important step towards curbing the spread and misuse of deepfake technologies, which are increasingly being used to deceive audiences and damage reputations. A clear prohibition has been established in this act against reproducing or distributing an individual's likeness or voice without their explicit consent, providing affected parties with the legal right to seek financial compensation should their likeness or voice be abused.

Even though exceptions will be made for satire, parody, and other content classified as satire, the law places a strong stop on the use of deepfakes for artistic performances without permission. In order to comply with the proposed measures, online platforms hosting such material would be legally obligated to remove them upon request or face substantial fines for not complying.

While the law is limited to the jurisdiction of Denmark, it is expected to be passed in Parliament by overwhelming margins, with estimates suggesting that up to 90% of lawmakers support it. Several high-profile controversies have emerged over the past few weeks, including doctored videos targeted at the Danish Prime Minister and escalating legal battles against creators of explicitly deepfake content, thus emphasizing the need for comprehensive safeguards in the age of digital technology.

It has recently been established by the European Union, in its recently passed AI Act, that a comprehensive regulatory framework is being established for the output of artificial intelligence on the European continent, which will be categorized according to four distinct risks: minimal, limited, high, and unacceptable.

The deepfakes that fall under the "limited risk" category are not outright prohibited, but they have to adhere to specific transparency obligations that have been imposed on them. According to these provisions, companies that create or distribute generative AI tools must make sure that any artificial intelligence-generated content — such as manipulated videos — contains clear disclosures about that content.

To indicate that the material is synthetic, watermarks or similar labels may typically be applied in order to indicate this. Furthermore, developers are required to publicly disclose the datasets they used in training their AI models, allowing them to be held more accountable and scrutinized. Non-compliance carries significant financial consequences: organisations that do not comply with transparency requirements could face a penalty of up to 15 million euros or 3 per cent of their worldwide revenue, depending on which figure is greater.

In the event of practices which are explicitly prohibited by the Act, such as the use of certain deceptive or harmful artificial intelligence in certain circumstances, a maximum fine of €35 million or 7 per cent of global turnover is imposed. Throughout its history, the EU has been committed to balancing innovation with safeguards that protect its citizens from the threat posed by advanced generative technologies that are on the rise.

In her opinion, Athena Karatzogianni, an expert on technology and society at the University of Leicester in England, said that Denmark's proposed legislation reflects a broader effort on the part of international governments and institutions to combat the dangers that generative artificial intelligence poses. She pointed out that this is just one of hundreds of policies emerging around the world that deal with the ramifications of advanced synthetic media worldwide.

According to Karatzogianni, deepfakes have a unique problem because they have both a personal and a societal impact. At an individual level, they can violate privacy, damage one's reputation, and violate fundamental rights. In addition, she warned that the widespread use of such manipulated content is a threat to public trust and threatens to undermine fundamental democratic principles such as fairness, transparency, and informed debate.

A growing number of deepfakes have made it more accessible and sophisticated, so robust legal frameworks must be put in place to prevent misuse while maintaining the integrity of democratic institutions. As a result of this, Denmark's draft law can serve as an effective measure in balancing technological innovation with safeguards to ensure that citizens as well as the fabric of society are protected.

Looking ahead, Denmark's legislative initiative signals a broader recognition that regulatory frameworks need to evolve along with technological developments in order to prevent abuse before it becomes ingrained in digital culture. As ambitious as the measures proposed are, they also demonstrate the delicate balance policymakers need to strike between protecting individual rights while preserving legitimate expression and creativity at the same time.

The development of generative artificial intelligence tools, as well as the collaboration between governments, technology companies, and civil society will require governments, technology companies, and civil society to work together closely to establish compliance mechanisms, public education campaigns, and cross-border agreements in order to prevent misuse of these tools.

In this moment of observing the Danish approach, other nations and regulatory bodies have a unique opportunity to evaluate both the successes and the challenges it faces as a result. For emerging technologies to contribute to the public good rather than undermining trust in institutions and information, it will be imperative to ensure that proactive governance, transparent standards, and sustained public involvement are crucial.

Finally, Denmark's efforts could serve as a catalyst for the development of more resilient and accountable digital landscapes across the entire European continent and beyond, but only when stakeholders act decisively in order to uphold ethical standards while embracing innovation responsibly at the same time.

Spain Investigates Cybersecurity of Power Suppliers After Widespread Grid Outage



 

Power Outage

Cyber Defenses Cyber Security Cyber Threats Cyberattack Hacker attack Hacking Portugal Cyber Army Portugese Power Grids Power Outage

Spain Investigates Cybersecurity of Power Suppliers After Widespread Grid Outage

Spain is investigating the cybersecurity practices of its power suppliers following a major power outage that affected much of the Iberian Peninsula at the end of April. While initial assessments by Spanish and Portuguese grid operators ruled out a cyberattack, authorities are now questioning whether smaller, independent energy producers may have inadvertently opened vulnerabilities within the national power infrastructure.

The outage disrupted electricity supply across both Spain and Portugal, with most regions regaining power after ten hours. However, it took nearly a full day—23 hours—for Spain’s grid to be fully restored. Although no immediate signs of hacking were found, the duration and scale of the disruption raised alarms, prompting deeper scrutiny into the resilience of Spain’s decentralized energy network. According to a report from the Financial Times, Spain’s National Cybersecurity Institute (INCIBE) has reached out to various smaller renewable energy producers, asking whether they experienced any unusual activity before the blackout on April 28.

The inquiries also covered their use of recent security patches and whether their systems could be remotely accessed, signaling a broader concern over cybersecurity readiness among these suppliers. This line of investigation is significant given Spain’s heavy reliance on renewable energy, much of which is generated by smaller, less centralized plants. The concern is that these entities, though critical to Spain’s green transition, may lack the robust cyber defenses maintained by larger grid operators.

While this doesn’t point to renewable energy as unreliable, it highlights how a fragmented supplier ecosystem could pose a collective security risk. Cybersecurity experts have also weighed in. A blog post by security firm Specops Software compared the Spanish outage to known cyberattacks on power grids, such as those in Ukraine in 2015 and 2016. While Specops acknowledged the Spanish grid operators’ conclusion that no breach was detected through their internal monitoring systems, the firm noted similarities in how the shutdown unfolded.

However, Barracuda Networks’ regional director Miguel López suggested that if a cyberattack had indeed compromised critical systems, it would have taken significantly longer to recover, casting doubt on hacking as the root cause. Still, the possibility that attackers exploited a less secure third-party provider has not been ruled out. This renewed scrutiny comes amid global concerns over cyber threats to critical infrastructure.

The U.S. and U.K. have both issued alerts about increased activity by pro-Russian hacktivists targeting industrial control systems. With recent research showing that 95% of critical infrastructure organizations experienced a data breach in the past year, Spain’s situation underscores the urgent need for improved cyber vigilance across all levels of the energy supply chain.

Over Half of Organizations Lack AI Cybersecurity Strategies, Mimecast Report Reveals



 

Technology

AI Security Cyber Threats Cybersecurity Strategy Data Breach human risk insider risk Phishing Attacks Technology

Over Half of Organizations Lack AI Cybersecurity Strategies, Mimecast Report Reveals

More than 55% of organizations have yet to implement dedicated strategies to counter AI-driven cyber threats, according to new research by Mimecast. The cybersecurity firm's latest State of Human Risk report, based on insights from 1,100 IT security professionals worldwide, highlights growing concerns over AI vulnerabilities, insider threats, and cybersecurity funding shortfalls.

The study reveals that 96% of organizations report improved risk management after adopting a formal cybersecurity strategy. However, security leaders face an increasingly complex threat landscape, with AI-powered attacks and insider risks posing significant challenges.

“Despite the complexity of challenges facing organisations—including increased insider risk, larger attack surfaces from collaboration tools, and sophisticated AI attacks—organisations are still too eager to simply throw point solutions at the problem,” said Mimecast’s human risk strategist VP, Masha Sedova. “With short-staffed IT and security teams and an unrelenting threat landscape, organisations must shift to a human-centric platform approach that connects the dots between employees and technology to keep the business secure.”

The report finds that 95% of organizations are leveraging AI for threat detection, endpoint security, and insider risk analysis. However, 81% express concerns over data leaks from generative AI (GenAI) tools. More than half lack structured strategies to combat AI-driven attacks, while 46% remain uncertain about their ability to defend against AI-powered phishing and deepfake threats.

Insider threats have surged by 43%, with 66% of IT leaders anticipating an increase in data loss from internal sources in the coming year. The report estimates that insider-driven data breaches, leaks, or theft cost an average of $13.9 million per incident. Additionally, 79% of organizations believe collaboration tools have heightened security risks, amplifying both intentional and accidental data breaches.

Despite 85% of organizations raising their cybersecurity budgets, 61% cite financial constraints as a barrier to addressing emerging threats and implementing AI-driven security solutions. The report underscores the need for increased investment in cybersecurity staffing, third-party security services, email security, and collaboration tool protection.

Although 87% of organizations conduct quarterly cybersecurity training, 33% of IT leaders remain concerned about employee mismanagement of email threats, while 27% cite security fatigue as a growing risk. 95% of organizations expect email-based cyber threats to persist in 2025, as phishing attacks continue to exploit human vulnerabilities.

Collaboration tools are expanding attack surfaces, with 44% of organizations reporting a rise in cyber threats originating from these platforms. 61% believe a cyberattack involving collaboration tools could disrupt business operations in 2025, raising concerns over data integrity and compliance.

The report highlights a shift from traditional security awareness training to proactive Human Risk Management. Notably, just 8% of employees are responsible for 80% of security incidents. Organizations are increasingly turning to AI-driven monitoring and behavioral analytics to detect and mitigate threats early. 72% of security leaders see human-centric cybersecurity solutions as essential in the next five years, signaling a shift toward advanced threat detection and risk mitigation.

Lending App Data Breach Leaves Sensitive Customer Information Unprotected



 

News

Cyber Security Cyber Threats Cybersecurity Attack financial attack News

Lending App Data Breach Leaves Sensitive Customer Information Unprotected

A major digital lending platform has reportedly exposed sensitive customer data due to a misconfigured Amazon AWS S3 bucket that was left unsecured without authentication. Security researchers discovered the breach on November 28, 2024, but the issue remained unresolved until January 16, 2025, leaving the data vulnerable for over a month. While there is no direct evidence that cybercriminals accessed the information, experts warn that only a thorough forensic audit could confirm whether any unauthorized activity took place.

The exposed data reportedly includes Know Your Customer (KYC) documents, which financial institutions use to verify identity, address, and income details. This type of information is particularly valuable to cybercriminals, as it can be exploited to fraudulently obtain loans, orchestrate identity theft, or carry out sophisticated social engineering attacks.

According to researchers, attackers could leverage leaked loan agreements or bank details to manipulate victims into making unauthorized payments or providing further account verification. Furthermore, such personal data often ends up being aggregated and sold on the dark web, amplifying risks for affected individuals and making it harder to protect their privacy.

To minimize the risks associated with such breaches, experts recommend monitoring bank statements and transaction histories for any suspicious activity and immediately reporting irregularities to financial institutions. Users are also advised to set strong, unique passwords for different accounts, especially those containing financial or sensitive information, and to update them immediately if a breach is suspected. Enabling multi-factor authentication (MFA) adds an extra layer of security and can significantly reduce the likelihood of unauthorized access.

Another major concern following such incidents is the increased likelihood of social engineering attacks like phishing, where criminals use leaked data to craft convincing fraudulent messages. Attackers may impersonate banks, service providers, or even personal contacts to trick victims into revealing sensitive details, clicking malicious links, or scanning fraudulent QR codes.

Users should remain cautious of unexpected emails or messages, verify the sender’s identity before clicking any links, and contact companies directly through their official websites. It is crucial to remember that banks and legitimate financial institutions will never request sensitive account details via phone or email or ask customers to transfer funds to another account.

Internal Chat Logs of Black Basta Ransomware Gang Leaked Online



 

Ransomware attack

Amsterdam cybercrime investigation Black Basta Cyber Threats Cybersecurity Data Breach Hacking phishing Ransomware Ransomware attack

Internal Chat Logs of Black Basta Ransomware Gang Leaked Online

A previously unidentified source has leaked what is claimed to be an archive of internal Matrix chat logs linked to the Black Basta ransomware group. The individual behind the leak, known as ExploitWhispers, initially uploaded the stolen messages to the MEGA file-sharing platform, which has since taken them down. However, they have now made the archive available through a dedicated Telegram channel.

It remains uncertain whether ExploitWhispers is a cybersecurity researcher who infiltrated the group's internal chat server or a discontented member of the operation. While no specific reason was provided for the leak, cybersecurity intelligence firm PRODAFT suggested that it could be a direct consequence of the ransomware gang’s alleged attacks on Russian banks.

"As part of our continuous monitoring, we've observed that BLACKBASTA (Vengeful Mantis) has been mostly inactive since the start of the year due to internal conflicts. Some of its operators scammed victims by collecting ransom payments without providing functional decryptors," PRODAFT stated.

"On February 11, 2025, a major leak exposed BLACKBASTA's internal Matrix chat logs. The leaker claimed they released the data because the group was targeting Russian banks. This leak closely resembles the previous Conti leaks."

The leaked archive contains internal chat messages exchanged between September 18, 2023, and September 28, 2024. A review conducted by BleepingComputer reveals that the messages encompass a broad range of sensitive information, including phishing templates, email addresses for targeting, cryptocurrency wallets, data dumps, victims' login credentials, and confirmations of previously reported attack strategies.

Additionally, the leaked records contain 367 unique ZoomInfo links, potentially reflecting the number of organizations targeted during the specified timeframe. Ransomware groups frequently use ZoomInfo to gather intelligence on their targets, either internally or for negotiations with victims.

ExploitWhispers also disclosed information about key Black Basta members, identifying Lapa as an administrator, Cortes as a threat actor connected to the Qakbot malware group, and YY as the primary administrator. Another individual, referred to as Trump (also known as GG and AA), is believed to be Oleg Nefedov, who is suspected of leading the operation.

Black Basta operates as a Ransomware-as-a-Service (RaaS) group, first emerging in April 2022. The gang has targeted several high-profile organizations across various industries, including healthcare, government contractors, and major corporations.

Notable victims include German defense contractor Rheinmetall, Hyundai's European division, BT Group (formerly British Telecom), U.S. healthcare provider Ascension, government contractor ABB, the American Dental Association, U.K. tech outsourcing firm Capita, the Toronto Public Library, and Yellow Pages Canada.

A joint report from CISA and the FBI, published in May 2024, revealed that Black Basta affiliates compromised more than 500 organizations between April 2022 and May 2024.

Research from Corvus Insurance and Elliptic estimates that the ransomware gang collected approximately $100 million in ransom payments from over 90 victims by November 2023.

This incident bears similarities to the February 2022 data breach involving the Russian-based Conti cybercrime syndicate. At that time, a Ukrainian security researcher leaked over 170,000 internal chat messages and the source code for the Conti ransomware encryptor, following the group's public support for Russia amid the Ukraine conflict.

Kaveri 2.0 Portal Hit by Massive DDoS Attack



 

News

Cyber Threats Cybersecurity Indian Government website News

Kaveri 2.0 Portal Hit by Massive DDoS Attack

Property registrations and citizen services in Karnataka have been severely affected since Monday due to a large-scale cyberattack on the Kaveri 2.0 portal. Initially suspected to be a technical glitch, the Revenue and E-Governance Departments have now confirmed that the disruptions are the result of a “motivated Distributed Denial of Service (DDoS) attack.”

The Kaveri 2.0 portal, introduced in 2023 to streamline property registration and related services, has been facing issues since January 13, 2025, with attackers consistently exploiting vulnerabilities despite repeated fixes. Revenue Minister Krishna Byre Gowda stated that the evolving nature of these disruptions indicates a deliberate and sustained attempt to cripple the system.

Officials revealed that bots are being used to conduct excessive searches for encumbrance certificates (ECs) through customer logins, overloading the system and causing it to crash. Even as authorities address certain weaknesses, attackers appear to be adapting in real-time to exploit new loopholes.

For instance, on Monday, the system was restored by 1 p.m. after a complete outage, but it was down again by 3 p.m. The attack has had a severe impact on property registrations across the state, with daily registrations plummeting from an average of over 8,000 to just over 500 on Tuesday.

Thousands of property transactions have been postponed indefinitely due to the disruption, leaving buyers and sellers in a state of uncertainty. Many users have been unable to log into the portal or upload necessary documents, causing widespread frustration.

K.V. Govardhan of Arna Estates, who had registrations scheduled in Bagepalli and Banaswadi on Monday, expressed concerns over the lack of clarity on when the system would be fully restored.

Cyber Threats in Hong Kong Hit Five-Year Peak with AI’s Growing Influence



 

Software

Artificial Intelligence Cyber Threats Hong Kong Passwords Software

Cyber Threats in Hong Kong Hit Five-Year Peak with AI’s Growing Influence

Hong Kong experienced a record surge in cyberattacks last year, marking the highest number of incidents in five years. Hackers are increasingly using artificial intelligence (AI) to strengthen their methods, according to the Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT).

The agency reported a spike of 12,536 cybersecurity incidents in 2024, a dramatic increase of 62% from 7,752 cases in 2023. Phishing attacks dominated these incidents, with cases more than doubling from 3,752 in 2023 to 7,811 last year.

AI is aiding in improving phishing campaign effectiveness. Attackers can now use AI tools to create extremely realistic fake emails and websites that even the most skeptical eye cannot easily distinguish from their legitimate counterparts.

Alex Chan Chung-man, a digital transformation leader at HKCERT, commented that phishing attacks targeted the majority of cases for banking, financial, and payment systems, almost 25% of the total cases. Social media, including WhatsApp and messaging apps, was another main target, 22% of the total cases.

AI allows scammers to create flawless phishing messages and generate fake website links that mimic trusted services," Chan explained. This efficiency has led to a sharp rise in phishing links, with over 48,000 malicious URLs identified last year—an increase of 1.5 times compared to 2023.

Hackers are also targeting other essential services such as healthcare and utilities. A notable case involved Union Hospital in Tai Wai, which suffered a ransomware attack. In this case, cybercriminals used a malware called "LockBit" to demand a $10 million ransom. The hospital did not comply with the ransom demand but the incident illustrates the risks critical infrastructure providers face.

Third-party vendors involved with critical sectors are emerging vulnerabilities for hackers to exploit. Leaks through such third-party partners have the potential to cause heavy damages, ranging from legal to reputation-related.

New Risk: Electronic Sign Boards

Digital signboards, once left unattended, are now being targeted by hackers. According to HKCERT, 40% of companies have not risk-assessed these systems. These displays can easily be hijacked through USB devices or wireless connections and display malicious or inappropriate content.

Though Hong Kong has not been attacked this way, such attacks in other countries indicate a new threat.

Prevention for Businesses

HKCERT advises organizations to take the following measures against these threats:

Change passwords regularly and use multi-factor authentication.
Regularly backup important data to avoid loss.
Update software regularly to patch security vulnerabilities.

Chan emphasized that AI-driven threats will develop their methods, and thus robust cybersecurity practices are needed to protect sensitive data and infrastructure.

New Two-Step Phishing Attack Exploits Microsoft Visio and SharePoint



 

SharePoint

Credential Theft Cyber Fraud Cyber Threats Microsoft 365 login Microsoft visio Phishing Attack Phishing Campaigns SharePoint

New Two-Step Phishing Attack Exploits Microsoft Visio and SharePoint

A novel two-step phishing strategy is targeting Microsoft Visio files (.vsdx) and SharePoint, signaling a new trend in cyber deception, according to experts. Researchers at Perception Point have noted a significant rise in attacks leveraging these previously uncommon .vsdx files.

These files act as delivery tools, directing victims to phishing pages that replicate Microsoft 365 login portals, aiming to steal user credentials.

The two-step phishing attacks employ layered techniques to evade detection. Rather than delivering harmful content directly, these campaigns use trusted platforms like Microsoft SharePoint to host files that appear legitimate. Attackers embed URLs within Visio files, which redirect victims to malicious websites when clicked, bypassing traditional email security systems.

Microsoft Visio, a popular tool for professional diagram creation, has now become a phishing vector. Cybercriminals send emails with Visio files from compromised accounts, often mimicking urgent business communications such as proposals or purchase orders. This tactic encourages recipients to act quickly, increasing the likelihood of success.

Since the emails come from stolen accounts, they often pass authentication checks and evade recipient security filters. In some cases, attackers include .eml files within the emails, embedding additional malicious URLs linked to SharePoint-hosted files.

The Visio files typically contain a clickable button labeled "View Document." Victims are instructed to press the Ctrl key while clicking the button to access the malicious URL. This step, requiring manual interaction, bypasses automated security systems that cannot simulate such behaviors.

Perception Point advises organizations to strengthen their defenses against sophisticated phishing campaigns by adopting advanced threat detection solutions. Suggested measures include:

Dynamic URL analysis to identify harmful links.
Object detection models to flag suspicious files.
Enhanced authentication mechanisms to reduce the impact of compromised accounts.

Understanding the Threat of Fake Hacking: How to Stay Protected



 

ransomware prevention

Cyber Security Cyber Threats Cybersecurity cybersecurity tips extortion scams fake hacking Phishing Scams ransomware prevention

Understanding the Threat of Fake Hacking: How to Stay Protected

In the dynamic and high-stakes field of cybersecurity, the word “hacking” often evokes thoughts of complex cyberattacks and data breaches. However, a lesser-known but equally concerning issue is the emergence of “fake hacking,” where individuals or groups falsely claim to have infiltrated computer systems.

Fake hacking occurs when attackers pretend to breach a network or device without actually doing so. While these actions may not always cause long-term technical damage, they can lead to serious consequences such as extortion and reputational harm. “Fake hacking is particularly insidious because it leverages people’s fear and uncertainty about cybersecurity,” explains William Petherbridge, Manager of Systems Engineering at the cybersecurity firm Fortinet. “Attackers are essentially tricking victims into believing their systems have been compromised in order to extract money or other concessions.”

A common tool used in fake hacking is the “hacker typer,” a website that mimics the look of a system being hacked, displaying lines of code scrolling rapidly across the screen. Other deceptive tactics include emails falsely claiming ransomware infections or pop-ups warning of non-existent malware.

“The goal of the fake hacker is to create a sense of panic and urgency in order to pressure the victim into paying a ‘ransom’ or purchasing some kind of ‘protection’ service,” says Petherbridge. “And unfortunately, if the target isn’t vigilant, they can fall for these tricks quite easily.”

To differentiate between legitimate and fake hacking threats, Petherbridge highlights key warning signs:

Money Demands: Requests for relatively small amounts of money, often in cryptocurrency, are a strong indication of fake hacking.
Unchanged Systems: Genuine breaches usually involve noticeable changes, such as altered files, new accounts, or unusual network activity. If everything appears normal, the hack is likely fabricated.
Disorganized Communication: Fake hackers often lack the sophistication of genuine attackers, with poorly structured emails, inconsistent demands, and an absence of technical details.

To combat fake hacking, Petherbridge advises verifying any claims before taking action and consulting cybersecurity professionals, including former hackers, who can identify fabricated threats. Employee training to recognize these red flags is also crucial.

“The most important step is to never panic or rush into a decision when faced with a purported hacking incident,” Petherbridge emphasizes. “Take the time to carefully assess the situation, double-check the facts, and respond accordingly. Falling for a fake hack can be just as damaging as a real one.”

The rise of fake hacking highlights the complexity and evolving nature of cybersecurity. While these attacks lack the technical sophistication of genuine breaches, they can cause significant harm through financial loss, reputational damage, and eroded trust.

By recognizing the signs of fake hacking and implementing strong security protocols, individuals and organizations can safeguard themselves from these deceptive threats. Vigilance, education, and a calm, calculated response remain the best defenses.

Group-IB Unveils Sophisticated Phishing Campaign Targeting Global Organizations



 

secure email gateways

Credential Theft Cyber Security Cyber Threats cybersecurity breaches Group-IB report Phishing Campaign phishing techniques secure email gateways

Group-IB Unveils Sophisticated Phishing Campaign Targeting Global Organizations

A recent report by Group-IB has exposed a highly advanced phishing campaign targeting employees from 30 companies across 15 jurisdictions. Using trusted domains and cutting-edge personalization techniques, attackers have bypassed Secure Email Gateways (SEGs) and exploited victims in critical sectors such as finance, government, aerospace, and energy.

Advanced Obfuscation and Multi-Layered Deception

The investigation, initiated in July 2024, uncovered the attackers' use of:

Over 200 phishing links hosted on legitimate platforms like Adobe’s InDesign cloud service and Google AMP.
Techniques to bypass detection systems that typically block suspicious or unknown domains.

“Nine out of ten cyberattacks start with a phishing email, making it the most common entry point for threat actors,” the report emphasized.

Phishing Emails That Mimic Trusted Brands

The attackers used professionally designed phishing emails that impersonated well-known brands, including:

DocuSign, prompting victims to sign fake contracts.
Adobe-hosted links, disguising fraudulent login pages as critical documents.

These emails featured professional formatting, familiar logos, and dynamically personalized elements. For example, by extracting a victim’s email domain, the attackers matched logos and page titles to the targeted organization, enhancing credibility.

“Scammers use a technique that dynamically pulls company logos from the official website to make the phishing links look legitimate,” the report noted.

Exploitation of APIs for Realistic Branding

The attackers leveraged APIs like https://logo.clearbit.com/[company domain] to integrate authentic logos into phishing sites. This seamless branding approach increased user trust and made phishing attempts harder to detect.

Concealing Operations with URL Redirection and Encoding

To evade detection, attackers used:

URL redirections via Google AMP to create complex trails.
Encoded parameters to obscure the attack path.

Victims were redirected to phishing pages that appeared legitimate, with pre-filled email addresses further enhancing the illusion of authenticity. Once users entered their credentials, the stolen data was sent to Command-and-Control (C2) servers or Telegram bots via API endpoints.

Advanced Data Exfiltration Techniques

The phishing sites contained JavaScript snippets that transmitted stolen credentials using Base64 encoding, effectively hiding the data during analysis. Group-IB analysts observed: “The JSON response from Telegram’s API confirms that the stolen credentials were successfully sent to a private chat controlled by the attacker.”

Ongoing Evolution in Phishing Tactics

Group-IB warns that these techniques signify a continuous evolution in phishing methodologies: “Threat actors are quickly adapting, constantly refining and improving their techniques to bypass security measures and exploit vulnerabilities.”

Conclusion: A Growing Need for Vigilance

This campaign serves as a stark reminder of the ever-evolving nature of cyber threats. Organizations must strengthen their defenses and educate employees to identify and respond to increasingly sophisticated phishing attempts.

South Korea’s Rising Influence in Global Cybersecurity



 

United States

Cyber Security Cyber Threats NATO South Korea United States

South Korea’s Rising Influence in Global Cybersecurity

South Korea’s Expanding Role in Global Cybersecurity

South Korea is emerging as a pivotal player in the global cybersecurity landscape, particularly against the backdrop of escalating tensions between the United States and China in cyberspace. By participating in high-profile cybersecurity exercises and fostering international collaborations, the country is bolstering its reputation as a key ally in both regional and global cyber defense initiatives.

Recently, South Korea hosted the APEX cyberwarfare exercise, which gathered cybersecurity experts and defense personnel from over 20 nations. This exercise simulated cyberattacks on critical infrastructure, enabling participants to devise defensive strategies and exchange vital insights. South Korea has also actively participated in NATO-led events, such as the Locked Shields exercise, which focuses on testing and enhancing cyber resilience.

In addition, South Korea showcased its commitment to international cybersecurity efforts by attending the Cyber Champions Summit in Sydney. The country is set to host the next iteration of the summit, emphasizing its dedication to fostering global cooperation in addressing cyber threats.

Strategic Alliances and Emerging Trends

South Korea's advanced technological capabilities and strategic location have positioned it as a vital partner for the United States in addressing cyber threats, especially those originating from China. According to analysts, South Korea’s infrastructure serves as a communications hub for critical trans-Pacific submarine cables connecting major networks across Asia, including China. Experts have also suggested that the country may act as a base for US cyber operations, similar to its role in hosting the THAAD missile system in 2017.

China, meanwhile, has been enhancing its cyber capabilities in response to growing alliances among its rivals. In April 2024, China reorganized its People’s Liberation Army to include specialized units dedicated to cyber, information, and space operations. Despite these efforts, experts note that China’s cyber capabilities still lag behind those of the US and its allies.

South Korea’s increasing involvement in cybersecurity underscores its strategic importance in addressing modern cyber challenges. By collaborating with the US, NATO, and other allies, the nation is strengthening its cyber defenses while contributing to a broader security framework in the Indo-Pacific region. These initiatives are poised to shape the global cybersecurity landscape in the coming years.

T-Mobile System Intrusion Tied to Chinese Cyber Threat



 

T-Mobile

Chinese Cyber Threat CISA Cyber Crime cyber espionage Cyber Hackers Cyber Threats CyberCrime Cybersecurity Seerver T-Mobile

T-Mobile System Intrusion Tied to Chinese Cyber Threat

T-Mobile Corporation has confirmed that it has been a victim of cyber-espionage campaigns launched against telecom companies for a long time. T-Mobile is the latest telecommunications company to report being affected by a large-scale cyber-espionage campaign waged by state-sponsored hackers in China.

There has been some confusion as to whether the breach involves customer data or critical systems. However, T-Mobile has maintained that there has been no significant impact on its customers' data and critical systems. This breach is part of a larger attack on major telecom providers, raising questions regarding the security of critical communications infrastructure around the world.

It has been reported that the FBI and CISA are pursuing investigations into a massive cyber-espionage campaign perpetrated by Chinese-linked threat actors that targeted U.S. telecommunications, stealing call records and accessing private communications of government officials and political figures by compromising networks.

It was confirmed by the USA intelligence agencies that Chinese threats had penetrated the private communications of a "limited number" of government officials after several U.S. broadband providers had been compromised.

A cyber spy stole personal information belonging to the targeted individuals, according to court orders, which were subject to a search warrant by the United States government to gather that information. This attack was conducted by an intrusion team targeting the World Expo scheduled to take place in Osaka, Japan in 2025, as a lure for the intrusion team, according to ESET's APT Activity Report for the period between April and September 2024.

MirrorFace continues to capture the attention of Japanese people and events, despite this new geographical target, proving their dedication to Japan and its related events. MirrorFace, as well as Earth Kasha, is one of the clusters categorized under an umbrella group called APT10, which includes other clusters classified under Earth Tengshe and Bronze Starlight, as well.

At least since 2018, the company has been targeting Japanese organizations, although its operations have been further expanded to include Taiwan and India with a new campaign observed in early 2023, albeit it is still focused on the Japanese market. During the hacking crew's history, it has evolved from a few backdoor programs, namely ANEL (a.k.a. Uppercut), LODEINFO, and NOOPDOOR (also known as HiddenFace), to an arsenal of infections, which now consists of backdoors and credential thieves, such as MirrorStealer and ANEL.

Having said that, it's important to note that T-Mobile's cybersecurity practice has recently been subjected to massive criticism since it's experienced a lot of data breaches in recent years. It was part of the company's settlement with the FCC of $31.5 million for previous breaches, of which half was for an improvement of the security infrastructure. The data breaches that have repeatedly targeted T-Mobile, which is owned by Deutsche Telekom Corporation, have been one of the most challenging aspects of the company's recent history.

According to the company, back in August 2021, 49 million T-Mobile account holders were affected by the data breach, but the hackers claimed that they had stolen data from 100 million users on the network. According to T-Mobile, it is actively monitoring the situation and is working closely with government officials to investigate the breach to prevent any further issues from occurring. Currently, there is no evidence that the company's systems have hurt the privacy, security, or functionality of its customers, but the firm maintains that no harm has been caused.

The company is paying close attention to this industry-wide attack that is affecting the entire industry. Quite to the contrary, due to the security controls in our network structure, and the diligent monitoring and response of our systems, T-Mobile has not witnessed any significant impact on its data or systems. As far as we are aware, no evidence has been found that the company's customer or other sensitive information has been accessed or exfiltrated as other companies may have done.

The situation will be closely monitored by industry peers as well as the relevant authorities, and we will work with them to resolve it.” A recent incident at T-Mobile has come at a time when the company is expanding its cyber-security practices to combat these threats. In February of this year, the company settled a $31.5 million lawsuit with the Federal Communications Commission, more than half of which was devoted to improving security infrastructure as a result of its prior breaches.

The T-Mobile Security breach is a prime example of the unique challenges that face the telecommunications sector, which is classified as critical infrastructure under federal law because of its importance to the nation. As an upstream provider of information and communications, telecommunications companies play a vital role in healthcare, government, and the private sector, allowing everything from emergency services to business transactions to personal connectivity to take place.

Therefore, these networks are prime targets for state-sponsored cyber campaigns that seek to exploit their role in facilitating sensitive communications by exploiting their vulnerability to state-sponsored cyber campaigns. There has been a shift in how cyber-espionage tactics have been used over the past few years twhichis disturbing. Attackers like Salt Typhoon take advantage of wiretap systems and sensitive communication channels to steal data and compromise the integrity of systems and networks vital to national security efforts.

As part of a new analysis published on November 19, 2024, Trend Micro discovered that the MirrorFace actor was using the vulnerability of Array AG (CVE-2023-45727), Proself (CVE-2023-45727) and FortiOS/FortiProxy (CVE-2023-45727) for the initial access of its public-facing enterprise products, which enabled the MirrorFace attacker to access the products. It has been reported that they had installed several backdoors within the victim's network after gaining access to achieve persistence on the network," said security researcher Hara Hiroaki. Among these are the 'Cobalt Strike' and 'LODEINFO' programs, as well as the 'NOOPDOOR' program that was discovered last year.

A sophisticated and complex implant like NOOPDOOR can be decrypted and launched using a shellcode loader named NOOPLDR to install it on the system. It includes built-in functions, in addition to modules that enable the uploading and downloading of files, the running of additional programs, and the communication with a server controlled by an attacker either actively or passively. As a result, Hiroaki noted, both active and passive modes, for the most part, use different encryption algorithms, as well as backdoor commands, respectively, which means that the channels can't be accessed by one another and are completely independent of one another.

Search This Blog

Sections

Popular Posts

Blog Archive

Labels

Report Abuse

About Me

Footer About

Labels

Showing result(s) for

Popular Posts

Pages

The Hidden Risk Behind 250 Documents and AI Corruption

Astaroth Malware Adopts GitHub Infrastructure to Target Crypto Investors

Thousands of Government IDs at Risk Following Breach Involving Discord’s Verification Partner

Microsoft Flags Russian ISP-Level Hacking Campaign Targeting Embassies in Moscow

Denmark Empowers Public Against Deepfake Threats

Spain Investigates Cybersecurity of Power Suppliers After Widespread Grid Outage

Over Half of Organizations Lack AI Cybersecurity Strategies, Mimecast Report Reveals

Lending App Data Breach Leaves Sensitive Customer Information Unprotected

Internal Chat Logs of Black Basta Ransomware Gang Leaked Online

Kaveri 2.0 Portal Hit by Massive DDoS Attack

Cyber Threats in Hong Kong Hit Five-Year Peak with AI’s Growing Influence

New Two-Step Phishing Attack Exploits Microsoft Visio and SharePoint

Understanding the Threat of Fake Hacking: How to Stay Protected

Group-IB Unveils Sophisticated Phishing Campaign Targeting Global Organizations

Advanced Obfuscation and Multi-Layered Deception

Phishing Emails That Mimic Trusted Brands

Exploitation of APIs for Realistic Branding

Concealing Operations with URL Redirection and Encoding

Advanced Data Exfiltration Techniques

Ongoing Evolution in Phishing Tactics

Conclusion: A Growing Need for Vigilance

South Korea’s Rising Influence in Global Cybersecurity

South Korea’s Expanding Role in Global Cybersecurity

Strategic Alliances and Emerging Trends

T-Mobile System Intrusion Tied to Chinese Cyber Threat

Footer About

Search This Blog

Sections

Popular Posts

Blog Archive

Labels

About Me

Footer About

Labels

Showing result(s) for

Popular Posts

Pages

Menu Item

Advanced Obfuscation and Multi-Layered Deception

Phishing Emails That Mimic Trusted Brands

Exploitation of APIs for Realistic Branding

Concealing Operations with URL Redirection and Encoding

Advanced Data Exfiltration Techniques

Ongoing Evolution in Phishing Tactics

Conclusion: A Growing Need for Vigilance

South Korea’s Expanding Role in Global Cybersecurity

Strategic Alliances and Emerging Trends