Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label Microsoft. Show all posts
Security Flaws
Cyber Security Extension Malware Detection Malwares Marketplace Microsoft Microsoft security Ransomwares Security Flaws

Ransomware Found in VSCode Extensions Raises Concerns Over Microsoft’s Security Review

 

Cybersecurity experts have discovered ransomware hidden within two Visual Studio Code (VSCode) Marketplace extensions, raising concerns about Microsoft’s ability to detect malicious software in its platform. The compromised extensions, named “ahban.shiba” and “ahban.cychelloworld,” were downloaded by users before security researchers flagged them and they were subsequently removed. 

Despite Microsoft’s security measures, the extensions remained publicly accessible for a significant period, highlighting potential gaps in the company’s review process. The “ahban.cychelloworld” extension was first uploaded on October 27, 2024, followed by “ahban.shiba” on February 17, 2025. The VSCode Marketplace, designed to provide developers with additional tools for Microsoft’s popular coding platform, has come under scrutiny for failing to identify these threats. 

Researchers at ReversingLabs determined that both extensions included a PowerShell script that connected to a remote Amazon Web Services (AWS) server to download further malicious code. This secondary payload functioned as ransomware, though evidence suggests it was still in a testing phase. 

Unlike traditional ransomware that encrypts entire systems, this malware specifically targeted files stored in C:\users%username%\Desktop\testShiba.  Once the encryption was complete, victims received a Windows notification stating: “Your files have been encrypted. Pay 1 ShibaCoin to ShibaWallet to recover them.” However, no further instructions or payment details were provided, suggesting the malware was not yet fully developed.  

Although Microsoft eventually removed the extensions, security researcher Italy Kruk from ExtensionTotal disclosed that their automated detection system had identified the malicious code much earlier. Kruk stated that they had alerted Microsoft about the issue but received no response. Further analysis revealed that the initial version of “ahban.cychelloworld” was clean, but the ransomware was introduced in version 0.0.2, which was released on November 24, 2024. ExtensionTotal flagged this version to Microsoft on November 25, yet the extension remained available for months. 

During this time, five more versions were uploaded, all containing the same ransomware. This case has intensified concerns about Microsoft’s ability to monitor third-party extensions effectively. The security lapse within the VSCode Marketplace highlights the risk developers face when downloading extensions, even from official sources. Microsoft has previously faced criticism for both slow responses to security threats and for mistakenly removing non-malicious extensions. 

A notable example involved two popular VSCode themes, ‘Material Theme – Free’ and ‘Material Theme Icons – Free,’ which were taken down due to suspected obfuscated JavaScript. However, after further review, Microsoft determined the extensions were safe, reinstated them, and apologized, promising improvements to its security screening process. The presence of ransomware in widely used developer tools underscores the need for stronger security measures. Developers must stay cautious, regularly update security protocols, and carefully evaluate third-party extensions before installing them, even when they come from official platforms like the VSCode Marketplace.
Read more »
Microsoft
Cyber Attacks GitHub Infostealer Malvertising Microsoft

Microsoft Warns of Malvertising Campaign Impacting Over 1 Million Devices Worldwide

 

Microsoft has revealed details of a large-scale malvertising campaign that is believed to have impacted over one million devices worldwide as part of an opportunistic attack aimed at stealing sensitive information. 

The tech giant, which discovered the activity in early December 2024, is tracking it under the broader Storm-0408 umbrella, which refers to a group of attackers known for distributing remote access or information-stealing malware via phishing, search engine optimisation (SEO), or malvertising.

"The attack originated from illegal streaming websites embedded with malvertising redirectors, leading to an intermediary website where the user was then redirected to GitHub and two other platforms," the Microsoft Threat Intelligence team stated. "The campaign impacted a wide range of organizations and industries, including both consumer and enterprise devices, highlighting the indiscriminate nature of the attack.”

The campaign relied on GitHub to deliver initial access payloads, but payloads were also detected on Discord and Dropbox. The GitHub repositories were removed, but the number of such repositories was not disclosed. The Microsoft-owned code hosting service serves as a staging ground for dropper malware, which deploys a series of ads.

The Microsoft-owned code hosting site serves as a staging ground for dropper malware, which is in charge of launching a number of further programs such as Lumma Stealer and Doenerium, which can then collect system information. The assault also uses a sophisticated redirection chain with four to five layers, with the first redirector embedded in an iframe element on unlawful streaming websites that serve pirated content.

The entire infection sequence consists of several stages, including system discovery, information collecting, and the employment of follow-on payloads like NetSupport RAT and AutoIT scripts to assist more data theft. The remote access trojan also acts as a gateway for stealer malware. 

  • First stage: Establish a footing on target devices.
  • Second stage: system reconnaissance, collection, exfiltration, and payload delivery. 
  • Third stage: It involves command execution, payload delivery, defence evasion, persistence, command-and-control communications, and data exfiltration. 
  • Fourth stage: PowerShell script for configuring Microsoft Defender exclusions and running commands to download data from a remote server. 

Another feature of the assaults is the use of numerous PowerShell scripts to download NetSupport RAT, identify installed apps and security software, and scan for the presence of cryptocurrency wallets, which indicates possible financial data theft.

"Besides the information stealers, PowerShell, JavaScript, VBScript, and AutoIT scripts were run on the host," Microsoft said. "The threat actors incorporated use of living-off-the-land binaries and scripts (LOLBAS) like PowerShell.exe, MSBuild.exe, and RegAsm.exe for C2 and data exfiltration of user data and browser credentials.” 

The disclosure comes after Kaspersky reported that fake websites masquerading as DeepSeek and Grok artificial intelligence (AI) chatbots are being used to lure users into installing a previously unknown Python information stealer.

DeekSeek-themed decoy sites promoted by verified accounts on X (e.g., @ColeAddisonTech, @gaurdevang2, and @saduq5) have also been used to run a PowerShell script that leverages SSH to enable attackers remote access to the machine. 

"Cybercriminals use various schemes to lure victims to malicious resources,' the Russian cybersecurity company noted. "Typically, links to such sites are distributed through messengers and social networks. Attackers may also use typosquatting or purchase ad traffic to malicious sites through numerous affiliate programs.”
Read more »
XCSSET
macOS malware Microsoft Xcode Program XCSSET

Microsoft Unearths Novel XCSSET macOS Malware Variant Targeting Xcode Projects

 

Microsoft Threat Intelligence identified a new strain of XCSSET, a complex modular macOS malware that targets Xcode programs. The malware was discovered in the wild during routine threat hunting, and it is the first known XCSSET variant to appear since 2022. 

This latest version of XCSSET includes improved obfuscation methods, updated tactics for maintaining persistence on infected workstations, and new ways to infect systems. These enhancements enable the malware to steal and exfiltrate files, as well as sensitive system and user information, such as digital wallet data and private notes.

XCSSET is meant to infect Xcode projects and runs when a developer builds them. Since Xcode is frequently used by Apple and macOS developers, Microsoft believes the malware spreads by exploiting shared project files amongst developers. While this edition has some similarities with previous versions, it features a more modular structure and encoded payloads. 

Harder to detect and eliminate 

In order to evade detection by security, it also has improved error handling and makes extensive use of scripting languages, UNIX commands, and genuine system binaries. It can sometimes even function without leaving files on disc, which makes them more challenging to locate and delete. To make it harder for analysts to comprehend its operations, the malware conceals the names of its modules at the code level. 

Additionally, it employs more sophisticated obfuscation techniques, like randomly generating and encoding payloads when infecting Xcode projects. The most recent version of XCSSET also employs Base64 for encoding, in contrast to previous versions that solely used xxd (hexdump). 

To ensure that it continues to run, the malware exploits three separate persistence methods: it runs when a new shell session is started, when a user opens a fake Launchpad program, or when a user makes a Git commit. It also includes a new method for injecting malware payloads directly into targeted Xcode projects. 

Microsoft's analysis also revealed that some of the malware appears to be still in development. Its command-and-control (C2) server was operational at the time Microsoft released its report, and it was releasing new modules. Microsoft recommends developers and security teams to remain careful and keep an eye on their Xcode projects and environments for any unusual activity. 

Surge in macOS assaults 

The latest ransomware is just one example of the sophisticated attacks that have increased against macOS systems, according to Thomas Richards, Principal Consultant, Network and Red Team Practice Director at Black Duck. 

“The techniques seen in this malware show that the developers spent a considerable amount of time researching ways to remain undetected. Gone are the days where macOS users could operate without installing anti-virus or EDR software. To prevent these attacks from spreading, users of Xcode should make sure their endpoint protection software is up to date and run scans to determine if they’ve been infected or not,” Richards stated. 

Threat to Apple developers 

With its improved ability to conceal within Xcode projects and propagate when these projects are shared between teams, this new XCSSET variant poses a serious threat to Apple developers, stated J Stephen Kowski, Field CTO at SlashNext. 

“This sophisticated attack targets the software supply chain at its source, potentially compromising apps before they’re even built, with the malware’s improved obfuscation techniques and multiple persistence methods making it particularly difficult to detect. Real-time code scanning and advanced threat detection tools that can identify suspicious behaviors in development environments are essential for protecting against these types of attacks,” Kowski noted.

He recommends developers to use multi-layered security measures, such as constant monitoring of project files for unexpected changes and rigorous verification of all code sources prior to integration.
Read more »
Technology
Amazon Cryptography CyberCrime CyberThreat Global Attacks Google Microsoft NIST PQC Quantum Technology

Microsoft and Amazon’s Quantum Progress Poses New Risks for Encryption

 


Microsoft, Amazon, and Google have all announced recent advances in quantum computing that are likely to accelerate the timeline for the possible obsolescence of current encryption standards. These developments indicate that it will become increasingly important to address the vulnerabilities posed by quantum computing to existing cryptographic protocols shortly. Those who are leading the way in the technological race are those who are advancing quantum computing technology, which is the most powerful technology that will be able to easily decrypt the encryption mechanisms that safeguard the internet's security and data privacy. 

On the other hand, there are researchers and cybersecurity experts who are working on the development of post-quantum cryptography (PQC) - a new generation of encryption technologies that can handle quantum system computational power with ease. A quantum-resistant encryption system must be prioritized by organisations and governments to ensure long-term security of their data and digital communications, especially as the quantum era has come closer than anticipated to being realized. 

Even though quantum decryption and quantum-resistant encryption are competing more than ever, the race for global cybersecurity infrastructure requires strategic investment and proactive measures. There has been an important advancement in quantum computing in the field, with Amazon Web Services (AWS) announcing the inaugural quantum computing chip called Ocelot, which represents a significant step in the pursuit of practical quantum computing. 

One of the most critical challenges in the field is error correction. Using Ocelot, Amazon Web Services claims that it may be possible to drastically reduce the cost of quantum error correction by as much as 90 percent, thus speeding up the process toward fault-tolerant quantum systems being realized. In the future, error correction will continue to be an important barrier to quantum computing. This is because quantum systems are inherently fragile, as well as highly susceptible to environmental disturbances, such as fluctuating temperatures, electromagnetic interference, and vibrations from the environment.

As a result of these external factors, quantum operations are exposed to a substantial amount of computational errors, which make it extremely challenging to maintain their stability and reliability. Research in quantum computing is progressing rapidly, which means innovations like Ocelot could play a crucial role in helping mitigate these challenges, paving the way for more robust and scalable quantum computing in the future. 

If a sufficiently advanced quantum computer has access to Shor's algorithm or any potential enhancements to it, it will be possible for it to decrypt existing public key encryption protocols, such as RSA 2048, within 24 hours by leveraging Shor's algorithm. With the advent of quantum computing, modern cybersecurity frameworks are going to be fundamentally disrupted, rendering current cryptographic mechanisms ineffective. 

The encryption of any encrypted data that has been unauthorizedly acquired and stored under the "harvest now, decrypt later" strategy will become fully available to those who have such quantum computing capabilities. A severe breach of internet communications, digital signatures, and financial transactions would result in severe breaches of trust in the digital ecosystem, resulting in serious losses in trust. The inevitability of this threat does not depend on the specific way by which PKE is broken, but rather on the certainty that a quantum system with sufficient power will be able to achieve this result in the first place. 

Consequently, the National Institute of Standards and Technology (NIST) has been the frontrunner in developing advanced encryption protocols designed to withstand quantum-based attacks in response to these threats. Post-quantum cryptography (PQC) is an initiative that is based on mathematical structures that are believed to be immune from quantum computational attacks, and is a product of this effort. To ensure the long-term security of digital infrastructure, PKE must be replaced with PQC. There is, however, still a limited amount of awareness of the urgency of the situation, and many stakeholders are still unaware of quantum computing's potential impact on cybersecurity, and are therefore unaware of its potential. 

As the development of quantum-resistant encryption technologies through 2025 becomes increasingly important, it will play an increasingly important role in improving our understanding of these methodologies, accelerating their adoption, and making sure our global cybersecurity standards will remain safe. For a cryptographic method to be effective, it must have computationally infeasible algorithms that cannot be broken within a reasonable period. These methods allow for secure encryption and decryption, which ensures that data is kept confidential for authorized parties. However, no encryption is completely impervious indefinitely. 

A sufficiently powerful computing machine will eventually compromise any encryption protocol. Because of this reality, cryptographic standards have continuously evolved over the past three decades, as advances in computing have rendered many previous encryption methods obsolete. For example, in the "crypto wars" of the 1990s, the 1024-bit key encryption that was at the center of the debate has long been retired and is no longer deemed adequate due to modern computational power. Nowadays, it is hardly difficult for a computer to break through that level of encryption. 

In recent years, major technology companies have announced that the ability to break encryption is poised to take a leap forward that has never been seen before. Amazon Web Services, Google, and Microsoft have announced dramatic increases in computational power facilitated by quantum computing technology. Google introduced "Willow" in December and Microsoft announced "Majorana 1" in February, which signals a dramatic rise in computational power. A few days later, Amazon announced the "Ocelot" quantum computing machine. Each of these breakthroughs represents an important and distinct step forward in the evolution of quantum computing technology, a technology that has fundamentally redefined the way that processors are designed. 

In contrast to traditional computing systems, quantum systems are based on entirely different principles, so their efficiency is exponentially higher. It is evident that advances in quantum computing are accelerating an era that will have a profound effect on encryption security and that cybersecurity practices need to be adjusted urgently to cope with these advances. In recent years, quantum computing has made tremendous strides in computing power. It has led to an extraordinary leap in computational power unmatched by any other technology. In the same manner as with any technological breakthrough that has an impact on our world, it is uncertain what it may mean. 

However, there is one aspect that is becoming increasingly clear: the computational barriers that define what is currently infeasible will be reduced to problems that can be solved in seconds, as stated by statements from Google and Microsoft. In terms of data security, this change has profound implications. It will be very easy for quantum computers to unlock encrypted information once they become widely accessible, thus making it difficult to decrypt encrypted data today. Having the capability to break modern encryption protocols within a matter of seconds poses a serious threat to digital privacy and security across industries. 

The development of quantum-resistant cryptographic solutions has been undertaken in anticipation of this eventuality. A key aspect of the Post-Quantum Cryptography (PQC) initiative has been the leadership role that NIST has been assuming since 2016, as it has played a historical role in establishing encryption standards over the years. NIST released a key milestone in global cybersecurity efforts in August when it released its first three finalized post-quantum encryption standards. 

Major technology companies, including Microsoft, Amazon Web Services (AWS), and Google, are not only contributing to the advancement of quantum computing but are also actively participating in the development of PQC solutions as well. Google has been working with NIST on developing encryption methods that can withstand quantum-based attacks. These organizations have been working together with NIST to develop encryption methods that can withstand quantum attacks. During August, Microsoft provided an update on their PQC efforts, followed by AWS and Microsoft. 

The initiatives have been in place long before the latest quantum hardware advances, yet they are a strong reminder that addressing the challenges posed by quantum computing requires a comprehensive and sustained commitment. However, establishing encryption standards does not guarantee widespread adoption, as it does not equate to widespread deployment. As part of the transition, there will be a considerable amount of time and effort involved, particularly in ensuring that it integrates smoothly into everyday applications, such as online banking and secure communications, thereby making the process more complex and time consuming. 

Because of the challenges associated with implementing and deploying new encryption technologies on a large scale, the adoption of new encryption technologies has historically spanned several years. Due to this fact, it cannot be overemphasized how urgent it is for us to prepare for a quantum era. A company's strategic planning and system design must take into account PQC considerations proactively and proactively. It has become increasingly clear that all organizations must address the issue of PQC rather than delay it. The fundamental principle remains that if the user breaks encryption, they are much more likely to break it than if they construct secure systems. 

Moreover, cryptographic implementation is a complex and error-prone process in and of itself. For the cybersecurity landscape to be successful at defending against quantum-based threats, a concerted, sustained effort must be made across all aspects. There is a lot of excitement on the horizon for encryption, both rapidly and very challenging. As quantum computing emerges, current encryption protocols face an existential threat, which means that organizations that fail to react quickly and decisively will suffer severe security vulnerabilities, so ensuring the future of digital security is imperative.
Read more »
NordVPN
fake websites Google links malware Microsoft NordVPN

Fake Websites and Malware Threats: How to Stay Safe Online

 



Recent research from the cybersecurity company NordVPN has revealed a significant rise in online threats, with over 669 million malware attacks recorded in the UK in 2024 alone. This alarming number highlights the increasing risk of falling victim to fake websites, harmful ads, and malicious software, especially when browsing popular websites or using free video streaming platforms.  


Fake Websites Imitating Well-Known Brands  

Cybercriminals often create websites that look almost identical to popular tech companies like Google, Facebook, and Microsoft. Their main goal is to trick people into providing their login details, which can then be misused for criminal activities.  

NordVPN’s research shows that in 2024, over 85,000 fake web links were created to imitate Google's official platforms. Similarly, around 6,000 fake links were designed to look like Facebook, and nearly 5,000 were made to mimic Microsoft. Other major companies such as AT&T, Yahoo!, and Netflix were also targeted, with around 4,000 fake URLs created for each.  

A common tactic used by scammers is slightly altering the spelling of well-known brand names, hoping that people won't notice the difference. For example, they may change "Google" to "G00gle" or "Amazon" to "Arnazon." This simple trick often convinces users to enter their login details, unknowingly handing their information over to cybercriminals.  

Although these major tech companies have no involvement in the fraud, their popularity makes them easy targets for impersonation. Because people generally trust these brands, they often do not realize they have been scammed until it’s too late.  


Malware Hidden on Video Hosting Platforms  

Another major source of cyber threats is free video streaming websites, where users often go to watch movies, shows, or anime. According to NordVPN’s findings, over 1.5 billion attempts to infect devices with malware were blocked on such sites in 2024 alone.  

Websites related to entertainment, sports, and file-sharing are especially vulnerable. Malware infections on entertainment websites alone reached almost one billion, while sports sites recorded around 124 million attacks. Additionally, adult content sites and file-sharing platforms faced millions of malware infiltration attempts.  

The risk doesn't stop at malware. Many of these websites are filled with intrusive advertisements and hidden web trackers designed to collect user data. These trackers monitor your online activity, gathering information about your browsing habits, interests, and personal details. While companies use this data to target you with advertisements, it can become dangerous if hackers gain access to it.  


Understanding the Threats: Malware, Trackers, and Intrusive Ads  

Malware, short for malicious software, refers to harmful programs like viruses, spyware, ransomware, and trojans. If malware infects your device, it can steal your sensitive information, lock your files, or even give hackers full control of your device. This often happens when users unknowingly download files from untrusted websites or click on suspicious links.  

Trackers are small tools placed on websites to monitor your online behavior. Companies use this information for marketing purposes, but if the data is leaked, it can be misused by hackers for malicious purposes.  

Intrusive advertisements, commonly seen on free video streaming sites, pose another risk. These ads not only disrupt your browsing experience but can also direct you to harmful websites or secretly install malware on your device without your consent.  


Tips to Protect Yourself from Cyber Threats  

Cybersecurity expert Adrianus Warmenhoven suggests some practical ways to protect yourself from online threats like malware, intrusive ads, and web trackers. Here’s how you can stay safe:  

1. Avoid Free or Suspicious Websites

Websites offering free video hosting, downloads, or pirated content often hide harmful software. Avoid visiting such sites, as they are more likely to infect your device with malware.  

2. Be Careful with Unknown Emails and Messages

Cybercriminals often use emails or messages that promise big rewards or urgent updates to trick you into giving away personal information. Avoid clicking on links in emails that sound too good to be true or ask for your data.  

3. Always Verify Links Before Clicking  

Scammers often create fake links that look similar to popular websites. For example, a fake website might spell "Amazon" as "Arnazon" to confuse you. Always double-check the spelling of website links before clicking on them.  

4. Check Files Before Downloading

Malware can often be hidden in files disguised as legitimate downloads. To avoid downloading harmful files, always use reliable websites and scan files with antivirus software before opening them.  

5. Protect Your Personal Information

Limit the amount of personal information you share online, especially on social media. Cybercriminals can misuse details like your full name, location, or contact information for scams or identity theft.  

6. Keep Your Devices Updated 

Outdated software can make your device vulnerable to malware and other cyber threats. Regularly update your operating system, apps, and security software to patch any security flaws.  

By following these steps, you can reduce the risk of falling victim to online threats and ensure your personal information remains safe.

Read more »
Ransomware
Cyber Attacks Hackers Microsoft Paragon Software Ransomware

Hackers Exploit Flaw in Microsoft-Signed Driver to Launch Ransomware Attacks

 



Cybercriminals are exploiting a vulnerability in a Microsoft-signed driver developed by Paragon Software, known as BioNTdrv.sys, to carry out ransomware attacks. This driver, part of Paragon Partition Manager, is typically used to manage hard drive space, but hackers have found a way to misuse it for malicious purposes.  


How the Attack Works  

The vulnerability, identified as CVE-2025-0289, allows attackers to use a technique called "bring your own vulnerable driver" (BYOVD). This means they introduce the legitimate but flawed driver into a system and exploit it to gain high-level access. Once they obtain SYSTEM-level privileges, they can execute ransomware, steal data, or disable security software without being detected.  

The alarming part is that the vulnerability can be exploited even on devices that do not have Paragon Partition Manager installed, as long as the driver exists on the system.  


Other Vulnerabilities  

Researchers also found four additional flaws in the driver:  

1. CVE-2025-0288: Allows access to kernel memory, helping attackers gain control.  

2. CVE-2025-0287: Can crash the system using a null pointer error.  

3. CVE-2025-0286: Enables attackers to execute malicious code in kernel memory.  

4. CVE-2025-0285: Allows manipulation of kernel memory, escalating control. 


Response from Microsoft and Paragon  

Microsoft confirmed that hackers are already using this flaw to spread ransomware and has responded by blocking the vulnerable driver through its Vulnerable Driver Blocklist. Meanwhile, Paragon Software has released a security patch and advised users to update their drivers immediately to avoid potential risks.  


How to Stay Safe  

To protect your system from these attacks:  

1. Update your drivers from Paragon Software to the latest version.  

2. Install Windows security updates regularly.  

3. Use reliable antivirus software to detect suspicious activities.  

4. Monitor your system for unexpected crashes or slow performance.    

While Microsoft and Paragon Software have taken steps to contain the damage, users must stay proactive in securing their systems through regular updates and vigilant monitoring.

Read more »
WhatsApp
CyberCrime Cybersecurity CyberThreat Google Meet Microsoft Privacy skype WhatsApp

Skype's Role in Popularizing End-to-End Encryption Leaves a Lasting Mark


 

In recent years, Skype has established itself as the most popular online communication platform, and it is nearing its close, marking the end of an era for one of the most popular VoIP services in the world. The first version of Skype was created by Niklas Zennström and Janus Friis in 2003 to create a platform that would facilitate seamless internet-based communication among users. When Skype was founded in 2003, it revolutionized digital communication by pioneering video conferencing, instant messaging, and setting the foundation for the modern virtual world. 

As its name implies, Skype pioneered several innovations that revolutionized digital communication. Originally designed for voice calls using peer-to-peer technology, it enabled users to make low cost or free calls from the comfort of their own homes. By removing long-distance costs and allowing users to communicate globally even through cheap long-distance calls, Skype revolutionized digital communication, making global connectivity more accessible by eliminating the high costs associated with long-distance calls. It was launched in August 2003, and grew rapidly in popularity over the next few years. 

It should be noted that there is no need to compromise the privacy or security of your online conversations by implementing Skype's encryption protocols. This provides significantly greater safety and privacy when communicating online, unlike conventional telephone networks. During its peak, the platform had more than 300 million active users worldwide, establishing itself as an indispensable communication tool for activists, journalists, and individuals who valued confidentiality above all else. 

The security measures in place on the platform were so robust that it was difficult even for intelligence agencies to intercept communications through the platform. Among the most noteworthy aspects of these documents are the difficulties Egyptian intelligence authorities encountered in their attempt to compromise Skype calls, further underlining the platform's reputation for being a safe and reliable medium of communication. However, despite its historical significance, Skype has been facing increasing challenges in maintaining its relevance in the face of a host of more competitive alternatives, such as Zoom, Microsoft Teams, WhatsApp, and Google Meet. 

After Microsoft acquired Skype in 2011, its strategic focus has steadily shifted toward Teams and other tools that integrate to become more efficient and effective. Since the platform's user base is shrinking and the needs of the digital communication landscape are changing, it seems that discontinuing Skype seems like a natural progression. As the platform phaseout approaches, not only will it signal the end of an influential platform, but also that communication technologies will continue to evolve to meet the needs of modern connectivity. Almost one decade from now, Skype will cease operations, marking the end of a platform that has significantly shaped global communication. 

In its inception as a basic voice phone service, Skype has evolved into the most widely accepted video conferencing tool on the market. Through the development of Skype, individuals and businesses from around the world have been connected. Despite this, as technology advanced and new communication platforms emerged, Skype faced more competition from more innovative and integrated solutions as the market grew. 

Over the years, Skype's market dominance declined, resulting in losing relevance in the market. Discontinuing the platform signifies the end of one of the most revolutionary platforms to change digital communication in the past few decades, along with the continuing importance of adaptability and innovation to achieve future success. 

The Closure of Skype and the Evolution of Digital Communication


Sadly, the discontinuation of Skype marks the end of an important chapter in the history of digital communication. As a result, businesses and individuals alike will be required to make a large-scale shift as they move to more contemporary platforms that offer advanced features and seamless integration, resulting in a large-scale transition. Corporations need to rapidly adapt by shifting their communication frameworks to alternative services. Microsoft Teams has emerged as one of the most popular options due to its impressive set of collaboration tools, which are designed to meet the dynamic requirements of today's organizations. 

Seeking Alternatives to Skype 


Skype is undoubtedly nearing the end of its lifecycle, so users and organizations are actively looking for alternatives that will meet their communication needs. Microsoft Teams, with its comprehensive and integrated features, is one of the best options. 

As well as this, there are other platforms out there that are also gaining traction, such as Zoom Phone and RingCentral. These platforms offer a wide range of functionalities designed to cater to a variety of business requirements. Each service offers its benefits, allowing users to pick the solution that best matches their operational objectives. 

Skype’s Influence and Enduring Impact

Despite its early beginnings, Skype has played a significant role in shaping the way online communication is shaped ever since it launched in 2003 and was acquired by Microsoft the following year for $8.5 billion, as a widely recognized platform that helps facilitate virtual interactions all over the world. 

While Skype has continuously improved its capabilities over the years, it has struggled to remain at the top of an ever-more competitive market. Over the past few years, communication platforms that are more agile and feature-rich have emerged, resulting in Skype's relevance rapidly eroding, eventually leading to its demise. 

The Future of Digital Connectivity


Digital communication is constantly evolving. Platforms that seamlessly integrate messaging, voice, video, and collaboration tools are becoming increasingly important as a result of a continuing shift toward mobile-centric solutions and artificial intelligence-driven innovations that offer better user experiences and are more intuitive. 

A sophisticated, adaptive and user-friendly ecosystem will be the hallmark of the future of communication as technology advances. This ecosystem will help enhance connectivity, productivity, and security on both a personal and professional level. Government agencies have employed a variety of methods to monitor Skype users throughout the world. 

There was a bug in Skype that, according to Citizen Lab at the University of Toronto, allowed Chinese authorities to intercept messages in China. At the time, Tom-Skype, a joint venture between a local telecommunication provider and eBay, which owned Skype at the time, operated under Chinese authorities. 

As a result of Edward Snowden's leak of documents, it has become clear that Microsoft had modified Skype so that it would give the NSA access to calls and messages, undermining their encryption. It is expected that Skype will close on May 5, 2025 due to Microsoft's decision to shut down the platform, making it irrelevant with just 36 million users in 2023, far under its peak user base of 300 million. While its legacy still exists through the use of encryption technologies that continue to secure modern communication platforms, it has endured through the years.
Read more »
Privacy
AI Gaming AI Model AI Systems AI technology Data Privacy data security Data Technology Microsoft Privacy

Microsoft MUSE AI: Revolutionizing Game Development with WHAM and Ethical Challenges

 

Microsoft has developed MUSE, a cutting-edge AI model that is set to redefine how video games are created and experienced. This advanced system leverages artificial intelligence to generate realistic gameplay elements, making it easier for developers to design and refine virtual environments. By learning from vast amounts of gameplay data, MUSE can predict player actions, create immersive worlds, and enhance game mechanics in ways that were previously impossible. While this breakthrough technology offers significant advantages for game development, it also raises critical discussions around data security and ethical AI usage. 

One of MUSE’s most notable features is its ability to automate and accelerate game design. Developers can use the AI model to quickly prototype levels, test different gameplay mechanics, and generate realistic player interactions. This reduces the time and effort required for manual design while allowing for greater experimentation and creativity. By streamlining the development process, MUSE provides game studios—both large and small—the opportunity to push the boundaries of innovation. 

The AI system is built on an advanced framework that enables it to interpret and respond to player behaviors. By analyzing game environments and user inputs, MUSE can dynamically adjust in-game elements to create more engaging experiences. This could lead to more adaptive and personalized gaming, where the AI tailors challenges and story progression based on individual player styles. Such advancements have the potential to revolutionize game storytelling and interactivity. 

Despite its promising capabilities, the introduction of AI-generated gameplay also brings important concerns. The use of player data to train these models raises questions about privacy and transparency. Developers must establish clear guidelines on how data is collected and ensure that players have control over their information. Additionally, the increasing role of AI in game creation sparks discussions about the balance between human creativity and machine-generated content. 

While AI can enhance development, it is essential to preserve the artistic vision and originality that define gaming as a creative medium. Beyond gaming, the technology behind MUSE could extend into other industries, including education and simulation-based training. AI-generated environments can be used for virtual learning, professional skill development, and interactive storytelling in ways that go beyond traditional gaming applications. 

As AI continues to evolve, its role in shaping digital experiences will expand, making it crucial to address ethical considerations and responsible implementation. The future of AI-driven game development is still unfolding, but MUSE represents a major step forward. 

By offering new possibilities for creativity and efficiency, it has the potential to change how games are built and played. However, the industry must carefully navigate the challenges that come with AI’s growing influence, ensuring that technological progress aligns with ethical and artistic integrity.
Read more »
PC
Antivirus Antivirus System Cyber Security database malware protection Malwares Microsoft PC

Strengthening PC Security with Windows Whitelisting

 

Windows Defender, the built-in antivirus tool in Windows, provides real-time protection against malware by scanning for suspicious activity and blocking known threats using an extensive virus definition database. However, no antivirus software can completely prevent users from unknowingly installing harmful programs. 

Just like the famous Trojan horse deception, malicious software often enters systems disguised as legitimate applications. To counter this risk, Windows offers a security feature called whitelisting, which restricts access to only approved programs. Whitelisting allows administrators to create a list of trusted applications. Any new program attempting to run is automatically blocked unless explicitly authorized. 

This feature is especially useful in environments where multiple users access the same device, such as workplaces, schools, or shared family computers. By implementing a whitelist, users cannot accidentally install or run malware-infected software, significantly reducing security risks. Additionally, whitelisting provides an extra layer of protection against emerging threats that may not yet be recognized by antivirus databases. 

To configure a whitelist in Windows, users can utilize the Local Security Policy tool, available in Windows 10 and 11 Pro and Enterprise editions. While this tool is not included by default in Windows Home versions, it can be manually integrated. Local Security Policy enables users to manage Applocker, a built-in Windows feature designed to enforce application control. 

Applocker functions by setting up rules, similar to how a firewall manages network access. Applocker supports both whitelisting and blacklisting. A blacklist allows all applications to run except those explicitly blocked. However, since thousands of new malware variants emerge daily, it is far more effective to configure a whitelist—permitting only pre-approved applications and blocking everything else. This approach ensures that unknown or unauthorized programs do not compromise system security. 

Microsoft previously provided Software Restriction Policies (SRP) to enforce similar controls, but this feature was disabled starting with Windows 11 22H2. For users seeking a simpler security solution, Windows also provides an option to limit installations to only Microsoft Store apps. This setting, found under Apps > Advanced settings for apps, ensures that users can only download and install verified applications. 

However, advanced users can bypass this restriction using winget, a command-line tool pre-installed in newer Windows versions that allows software installation outside the Microsoft Store. Implementing whitelisting is a proactive security measure that helps safeguard PCs against unauthorized software installations. 

While Windows Defender effectively protects against known threats, adding a whitelist further reduces the risk of malware infections, accidental downloads, and security breaches caused by human error. By taking control of which programs can run on a system, users can enhance security and prevent potential cyber threats from gaining access.
Read more »
Russian Hackers
Cyber Attacks Device Code Microsoft phishing Russian Hackers

Russian State Actors Target Microsoft 365 Accounts Via Device Code Phishing Campaign

 

A hacking outfit potentially linked to Russia is running an active operation that uses device code phishing to target Microsoft 365 accounts of individuals at organisations of interest. The targets are in the government, non-governmental organisations (NGOs), IT services and technology, defence, telecommunications, health, and energy/oil and gas sectors in Europe, North America, Africa, and the Middle East. 

Microsoft Threat Intelligence Centre is tracking the threat actors behind the device code phishing effort as 'Storm-237'. Based on targets, victimology, and tradecraft, the researchers are confident that the activity is linked to a nation-state operation that serves Russia's interests.

Device code phishing assaults 

Input-constrained devices, such as smart TVs and some IoTs, use a code authentication flow to allow users to sign into an app by typing an authorization code on a different device, such as a smartphone or computer.

Since last August, Microsoft researchers noticed that Storm-2372 has been exploiting this authentication flow by deceiving users into submitting attacker-generated device numbers on legitimate sign-in sites. The operatives launch the attack after "falsely posing as a prominent person relevant to the target" via messaging systems such as WhatsApp, Signal, and Microsoft Teams.

The malicious actor progressively builds rapport before sending a bogus online meeting invitation via email or messaging. According to the researchers, the victim receives a Teams meeting invitation including a device code generated by the attacker.

"The invitations lure the user into completing a device code authentication request emulating the experience of the messaging service, which provides Storm-2372 initial access to victim accounts and enables Graph API data collection activities, such as email harvesting," Microsoft noted. 

This allows the attackers to access the victim's Microsoft services (email, cloud storage) without requiring a password for as long as the stolen tokens are valid. However, Microsoft claims that the perpetrator is currently employing a specific client ID for Microsoft Authentication Broker during the device code sign-in flow, allowing them to issue fresh tokens. 

This opens up new attack and persistence opportunities, as the threat actor can utilise the client ID to register devices with Entra ID, Microsoft's cloud-based identity and access management product. "With the same refresh token and the new device identity, Storm-2372 is able to obtain a Primary Refresh Token (PRT) and access an organization’s resources. We have observed Storm-2372 using the connected device to collect emails," Microsoft added.
Read more »
XE Group
CVSS CyberCrime Cyberhackers CyberThreat Microsoft Software SQL Vulnerabilities and Exploits XE Group

XE Group Rebrands Its Cybercrime Strategy by Targeting Supply Chains

 


Over the past decade, there has been a rise in the number of cyber threats targeting the country, including the XE Group, a hacker collective with Vietnamese connections. According to recent investigations, the group was responsible for exploiting two zero-day vulnerabilities in VeraCore's warehouse management platform, CVE-2025-25181 and CVE-2025-57968 known to be zero-day vulnerabilities. 

A suite of reverse shells and web shells that exploit these vulnerabilities were deployed by the adversaries, allowing them to gain remote access to targeted systems in covert ways. This development is an indication of the group's sophisticated cyber-attack techniques. Identified as CVE-2024-57968, the vulnerability is a critical upload validation vulnerability with a CVSS score of 9.9, affecting versions before 2024.4.2.1, and can allow adversaries to upload files into non-intended directories, which could result in unauthorized access to the files. 

Adventure VeraCore up to version 2025.1.0 is vulnerable to SQL injection flaw CVE-2025-25181, which could be exploited remotely to execute arbitrary SQL commands through the remote execution of SQL commands. In addition to the XE Group's past association with credit card fraud, their focus has now switched to targeted data theft, particularly within manufacturing and distribution organizations. 

Several recent attacks have been perpetrated by threat actors who exploited VeraCore security issues to install Web Shells, which allowed them to execute various malicious activities and remain persistent within compromised environments while they executed their malicious activities. The group's continued sophistication and adaptability in the cyber threat landscape is reflected in this recent report, which details a compromise of a Microsoft Internet Information Services (IIS) server where VeraCore's warehouse management system software is hosted, and it indicates the company's growing sophistication. 

Upon further analysis of this incident, it was discovered that the initial breach occurred in January 2020 as a result of a zero-day vulnerability in SQL injection. It is speculated that As a result of this exploitation, The XE Group deployed customized web shells, which researchers have described as very versatile tools that are designed to maintain persistent access inside victim environments as well as run SQL queries regarding those environments.

As an example, in the case of the compromised IIS server, the attackers reactivated a web shell that was planted four years earlier, showing that they have retained a foothold in the infrastructure targeted by them for many years. Security vendors have been warning that the XE Group is actively targeting supply chains in the manufacturing and distribution sectors. Though the group has historically been associated with extensive credit card skimming operations, it has recently gained a reputation for exploiting zero-day vulnerabilities to do more damage. 

According to researchers, the group's continued ability to adapt and increase sophistication underscores the group's ability to remain agile and sophisticated over the years. The reactivation of an older web shell indicates the group's strategic focus on achieving long-term operational objectives by maintaining long-term access to compromised systems. 

To enhance the threat investigation process, the rules have been designed to be compatible with several SIEM (Security Information and Event Management) systems, Endpoint Detection and Response systems (EDR), and Data Lake solutions aligned with the MITRE ATT&CK framework. There is a variety of metadata that is accessible in each rule, including references to cyber threat intelligence, attack timelines, triage recommendations, and audit configurations, guaranteeing that security analysis has a structured approach. 

Additionally, SOC Prime's Uncoder AI (Artificial Intelligence) capabilities enable the quick development of custom IOC-based queries that will be seamlessly integrated with SIEM and EDR platforms, thus eliminating the need for security professionals to manually search for indicators of compromise (IOCs). Intezer's analysis of XE Group activity and SOC Prime's Uncoder AI were used to achieve this.

As an alternative to the corporate-only service offered previously by Uncoder AI, customers can now benefit from Uncoder AI's full suite of capabilities, which enhances accessibility for independent risk analysis performed by individual researchers. As a consequence of the XE Group's adoption of zero-day exploits as part of their attack strategy, it became increasingly clear that adversarial techniques are becoming more sophisticated and adaptable, making it necessary to enter into proactive defence measures as soon as possible.

SOC Prime Platform is a scalable tool designed to assist organizations in enhancing their security posture, countering evolving threats effectively, and mitigating risks associated with adding more attack surfaces in an increasingly complex cyber landscape by utilizing the tools provided by the platform. The XE Group has exploited two zero-day VeraCore vulnerabilities, CVE-2025-25181 and CVE-2025-50308, in recent attacks in an attempt to deploy one or more web shells on compromised systems. 

These two vulnerabilities are critical upload validation flaws (CVSS 9.9) and SQL injection flaws (CVSS 5.7), respectively. In a report published jointly by Solis and Intezer, the researchers reported that the group exploited one of these vulnerabilities as early as January 2020 and maintained persistent access to the victim's environment for several years afterwards. There was an attempt in 2024 by some threat actors to reactivate a previously deployed web shell, demonstrating their ability to avoid detection while maintaining long-term access to compromised systems as they remain undetected. 

XE Group's evolving tactics come as part of a broader trend that threats are exploring the software supply chain as a way to achieve their goals. Some notable precedents include the SolarWinds attack, breaches into Progress Software's MOVEit file transfer product, an Okta intrusion that affected all customers, and an Accellion breach that enabled ransomware to be deployed on an organization's network.
Read more »
Microsoft
ADFS Cyber Security Lateral Phishing MFA Microsoft

Sophisticated Phishing Campaign Circumvents Microsoft's Multi Factor Authentication

 

A help desk phishing campaign uses spiofed login pages to target Microsoft Active Directory Federation Services (ADFS) within an organisation in order to obtain credentials and get around multi-factor authentication (MFA) protections. The campaign's main targets, as reported by Abnormal Security, are government, healthcare, and educational institutions; at least 150 targets were chosen in the attack. 

These assaults aim to infiltrate corporate email accounts to disseminate messages to additional victims within the organisation or launch financially driven attacks such as business email compromise (BEC), wherein payments are redirected to the perpetrators' accounts. 

Microsoft Active Directory Federation Services (ADFS) is an authentication system that enables users to log in once and then access various apps and services without having to enter their credentials again. It is often employed in large companies to enable single sign-on (SSO) for internal and cloud-based services. 

The perpetrators send emails to targets impersonating their company's IT team, requesting that they log in to update security settings or adopt new policies. When victims click on the embedded button, they are redirected to a phishing site that looks identical to their organization's actual ADFS login page. The phishing page prompts the victim to input their username, password, and MFA code or tricked them into approving the push notification. 

"The phishing templates also include forms designed to capture the specific second factor required to authenticate the targets account, based on the organizations configured MFA settings," reads Abnormal Security's report. "Abnormal observed templates targeting multiple commonly used MFA mechanisms, including Microsoft Authenticator, Duo Security, and SMS verification.” 

Once the victim has entered all of their information, they are sent to the real sign-in page, which reduces suspicion and gives the impression that the procedure was completed successfully. Meanwhile, the hackers use the stolen details to gain access into the victim's account, steal any valuable data, set up new email filter rules, and attempt lateral phishing.

According to Abnormal, the attackers in this campaign utilised Private Internet Access VPN to hide their location and assign an IP address that was closer to the organisation. Abnormal recommends that organisations move to modern and more secure solutions, such as Microsoft Entra, as well as add additional email filters and suspicious behaviour detection methods, to prevent phishing attempts.
Read more »
Windows
ADFS Microsoft Password Phishing Attacks Technology Windows

Hackers Steal Login Details via Fake Microsoft ADFS login pages

Microsoft ADFS login pages

A help desk phishing campaign attacked a company's Microsoft Active Directory Federation Services (ADFS) via fake login pages and stole credentials by escaping multi-factor authentication (MFA) safety.

The campaign attacked healthcare, government, and education organizations, targeting around 150 victims, according to Abnormal Security. The attacks aim to get access to corporate mail accounts for sending emails to more victims inside a company or launch money motivated campaigns such as business e-mail compromise (BEC), where the money is directly sent to the attackers’ accounts. 

Fake Microsoft ADFS login pages 

ADFS from Microsoft is a verification mechanism that enables users to log in once and access multiple apps/services, saving the troubles of entering credentials repeatedly. 

ADFS is generally used by large businesses, as it offers single sign-on (SSO) for internal and cloud-based apps. 

The threat actors send emails to victims spoofing their company's IT team, asking them to sign in to update their security configurations or accept latest policies. 

How victims are trapped

When victims click on the embedded button, it takes them to a phishing site that looks same as their company's authentic ADFS sign-in page. After this, the fake page asks the victim to put their username, password, and other MFA code and baits then into allowing the push notifications.

The phishing page asks the victim to enter their username, password, and the MFA code or tricks them into approving the push notification.

What do the experts say

The security report by Abnormal suggests, "The phishing templates also include forms designed to capture the specific second factor required to authenticate the targets account, based on the organization's configured MFA settings.” Additionally, "Abnormal observed templates targeting multiple commonly used MFA mechanisms, including Microsoft Authenticator, Duo Security, and SMS verification."

After the victim gives all the info, they are sent to the real sign-in page to avoid suspicious and make it look like an authentic process. 

However, the threat actors immediately jump to loot the stolen info to sign into the victim's account, steal important data, make new email filter rules, and try lateral phishing. 

According to Abnormal, the threat actors used Private Internet Access VPN to hide their location and allocate an IP address with greater proximity to the organization.  

Read more »
Technology
AI Fake Sites Internet Microsoft Scareware Tech Support Scam Technology

New Microsoft "Scareware Blocker" Prevents Users from Tech Support Scams

New Microsoft "Scareware Blocker" Prevents Users from Tech Support Scams

Scareware is a malware type that uses fear tactics to trap users and trick them into installing malware unknowingly or disclosing private information before they realize they are being scammed. Generally, the scareware attacks are disguised as full-screen alerts that spoof antivirus warnings. 

Scareware aka Tech Support Scam

One infamous example is the “tech support scam,” where a fake warning tells the user their device is infected with malware and they need to reach out to contact support number (fake) or install fake anti-malware software to restore the system and clean up things. Over the years, users have noticed a few Microsoft IT support fraud pop-ups.

Realizing the threat, Microsoft is combating the issue with its new Scareware Blockers feature in Edge, which was first rolled out in November last year at the Ignite conference.

Defender SmartScreen, a feature that saves Edge users from scams, starts after a malicious site is caught and added to its index of abusive web pages to protect users globally.

AI-powered Edge scareware blocker

The new AI-powered Edge scareware blocker by Microsoft “offers extra protection by detecting signs of scareware scams in real-time using a local machine learning model,” says Bleeping Computer.

Talking about Scareware, Microsoft says, “The blocker adds a new, first line of defense to help protect the users exposed to a new scam if it attempts to open a full-screen page.” “Scareware blocker uses a machine learning model that runs on the local computer,” it further adds.

Once the blocker catches a scam page, it informs users and allows them to continue using the webpage if they trust the website. 

Activating Scareware Blocker

Before activating the blocker, the user needs to install the Microsoft Edge beta version. The version installs along with the main release variant of Edge, easing the user’s headache of co-mingling the versions. If the user is on a managed system, they should make sure previews are enabled admin. 

"After making sure you have the latest updates, you should see the scareware blocker preview listed under "Privacy Search and Services,'" Microsoft says. Talking about reporting the scam site from users’ end for the blocker to work, Microsoft says it helps them “make the feature more reliable to catch the real scams. 

Beyond just blocking individual scam outbreaks” their Digital Crimes Unit “goes even further to target the cybercrime supply chain directly.”

Read more »
Vulnerabilities and Exploits
AES-XTS Bitlocker encryption system Microsoft Vulnerabilities and Exploits

BitLocker Vulnerability Exposes Encryption Flaws: A New Challenge for Cybersecurity

 

Password theft has recently dominated headlines, with billions of credentials compromised. Amid this crisis, Microsoft has been pushing to replace traditional passwords with more secure authentication methods. However, a new vulnerability in the Windows BitLocker full-disk encryption tool has raised concerns about the security of even the most advanced encryption systems.

A medium-severity flaw in BitLocker, identified as CVE-2025-21210, has exposed the encryption system to a novel randomization attack targeting the AES-XTS encryption mode. This vulnerability highlights the increasing sophistication of cyberattacks against full-disk encryption systems. When exploited, it allows attackers to alter ciphertext blocks, causing sensitive data to be written to disk in plaintext.

Jason Soroko, Senior Fellow at Sectigo, explained the implications of this vulnerability. “BitLocker uses AES-XTS encryption to ensure that even if someone physically accesses the hard drive, they cannot easily read the data without the encryption key,” he noted. However, this new attack bypasses traditional decryption methods by manipulating how encrypted data is handled.

How the Randomization Attack Works

To illustrate the attack, Soroko used an analogy involving a library of books. “Rather than stealing or directly reading the books, the hacker subtly modifies certain pages (the ciphertext blocks) in multiple books,” he explained. While the rest of the book remains intact and unreadable, tampering with specific pages can cause the library’s system to misplace or disclose critical data.

Over time, these subtle modifications can lead to bits of data being written in plaintext, exposing sensitive information without directly breaking the encryption. “The real danger is that this method doesn’t require breaking the encryption directly,” Soroko concluded. “Instead, it manipulates how the encrypted data is handled, allowing attackers to bypass security measures and access sensitive information.”

Mitigating the Risk

To defend against such attacks, Soroko emphasized the importance of keeping encryption software up-to-date with the latest security patches. Additionally, organizations should:

  1. Restrict Physical Access: Ensure that devices with sensitive data are physically secure to prevent tampering.
  2. Monitor Systems: Regularly check for unusual activity that might indicate an attack or unauthorized access.
  3. Implement Layered Security: Combine encryption with other security measures, such as multi-factor authentication (MFA) and intrusion detection systems.

This vulnerability underscores the evolving nature of cyber threats. Even robust encryption systems like BitLocker are not immune to sophisticated attacks. As cybercriminals develop new methods to exploit vulnerabilities, organizations must remain vigilant and proactive in their cybersecurity strategies.

Microsoft’s push toward passwordless authentication is a step in the right direction, but this incident highlights the need for continuous improvement in encryption technologies. Companies must invest in advanced security solutions, regular system updates, and employee training to stay ahead of emerging threats.

The BitLocker vulnerability serves as a stark reminder that no system is entirely foolproof. As encryption technologies evolve, so do the methods used to exploit them. Organizations must adopt a multi-layered approach to cybersecurity, combining encryption with other protective measures to safeguard sensitive data. By staying informed and proactive, we can better defend against the ever-changing landscape of cyber threats.

Read more »
Microsoft Teams
Black Basta Cyber Attacks Cybersecurity Precautions Hackers MFA Microsoft Microsoft 365 Microsoft Office vulnerability Microsoft Teams

Hackers Exploit Microsoft Teams for Phishing and Malware Attacks

 

Cybercriminals are increasingly targeting Microsoft Teams, utilizing the platform for sophisticated phishing, vishing, and ransomware campaigns. Exploiting Teams' widespread use, attackers employ social engineering tactics to deceive users and extract sensitive data. Methods range from fake job offers to malicious file sharing, aiming to infiltrate accounts and compromise organizational networks.

Bypassing Multifactor Authentication

One notable tactic involves bypassing multifactor authentication (MFA). Threat actors, reportedly linked to the SolarWinds attack, create fraudulent “onmicrosoft.com” subdomains designed to mimic legitimate security entities. They send chat requests via Microsoft Teams, prompting users to enter a code into the Microsoft Authenticator app. This action grants attackers unauthorized access to Microsoft 365 accounts, enabling data theft or the integration of malicious devices into corporate networks.

The Black Basta ransomware group employs a different strategy by overwhelming users with spam emails and impersonating IT support staff on Teams. Claiming to assist with email issues, they persuade victims to install remote desktop tools, providing attackers with direct access to deploy malware. This includes Trojans and ransomware designed to exfiltrate sensitive data and compromise systems.

Another prevalent scheme involves fake job offers. Scammers contact individuals with fabricated employment opportunities, sometimes conducting entire interviews via Microsoft Teams chat. These scams often escalate to requests for personal information, such as Social Security numbers or tax details. In some cases, victims are asked to pay for materials or services, resulting in financial loss and potential identity theft.

Attackers also impersonate HR personnel, sending phishing messages about urgent policy updates. These messages frequently include malicious files disguised as legitimate updates. Once downloaded, malware like DarkGate is installed, granting attackers control over the victim’s system and network.

Additionally, compromised Microsoft 365 accounts are used to distribute malicious files through Teams chats. These files often appear as PDFs with double extensions, deceiving users into downloading executable malware. Once activated, these programs can breach data and facilitate deeper network infiltration.

Mitigation Strategies for Organizations and Users

Vigilance is essential in countering these threats. Users should verify unexpected messages, invitations, or file-sharing requests, especially those containing links or urgent calls to action. Tools that check link safety and domain age can help detect phishing attempts.

Organizations should prioritize employee education on recognizing scams and enforcing robust cybersecurity protocols. By staying informed and cautious, users can mitigate risks and safeguard against cyberattacks targeting Microsoft Teams.

Read more »
Zero-day vulnerability
Cyber Crime Cyber Hackers CyberCrime Cybersecurity CyberThreat Internet Explorer Microsoft North Korea South Korea Zero-day vulnerability

Cyber Threat Alert for South Korea from North Korean Hackers

 


In a recent cyber-espionage campaign targeted at the United States, North Korean state-linked hacker ScarCruft recently exploited a zero-day vulnerability in Internet Explorer to distribute RokRAT malware to targets nationwide. APT37, or RedEyes as it is sometimes called, is one of the most notorious North Korean state-sponsored hacking groups, and its activities are thought to be aimed at cyber espionage. 

There is typically a focus on human rights activists from South Korea, defectors from the country, and political entities in Europe from this group. An unknown threat actor with ties to North Korea has been observed delivering a previously undocumented backdoor and remote access Trojan (RAT) called VeilShell as part of a campaign targeted at Cambodia and potentially other Southeast Asian countries, including Indonesia, Malaysia, and Thailand. 

Known to Securonix as SHROUDED#SLEEP, the activity is believed to have been carried out by APT37, which is also known as InkySquid, Reaper, RedEyes, Ricochet Chollima, Ruby Sleet, and ScarCruft as well as several other names. ScarCruft, also known as APT37, InkySquid, Nickel Foxcroft, Reaper, RedEyes, and Ricochet Chollima, is a state-sponsored cyber-espionage threat group that almost entirely targets South Korean individuals and organizations. 

It uses spear phishing to deliver customized tools via phishing, watering holes, and zero-days for Internet Explorer. It has been reported by AhnLab that APT37 compromised one of the servers of a domestic advertising agency. Hence, the purpose is to push specially crafted 'Toast ads' as a part of an unidentified free software that is widely used by South Koreans. As a result of the CVE-2024-38178 flaw found in the JavaScript 9.dll file (Chakra) of Internet Explorer used for displaying these advertisements, it caused the JavaScript file named 'ad_toast' to trigger remote code execution via CVE-2024-38178 in the JavaScript9.dll file.

There is a deep correlation between the malware that was dropped in this attack and the RokRAT malware, which ScarCruft has been using for years to launch attacks. In essence, RokRATs primary function is to exfiltrate to Yandex cloud instances every 30 minutes file matching 20 extension types (including .doc, .mdb, .xls, .ppt, .txt, .amr) that match these extensions. In addition to keylogging, Keylogger also monitors for changes made to the clipboard and captures screenshots (every three minutes) as well. 

In July 2022, ScarCruft, a North Korean threat actor who operates in North Korean cyberspace, began experimenting with oversized LNK files as a delivery route for RokRAT malware, just a couple of months after Microsoft began blocking macros by default across several Office documents. Check Point has released a new report on its technical analysis of RokRAT that concludes that the malware has not changed significantly over the years, but the deployment method has evolved. RokRAT now uses archives that contain LNK files, resulting in infection chains that move through multiple stages. 

As a result of this round of activity, is another indication of a major trend in the threat landscape, where both APTs, as well as cybercriminals, will try to overcome the restriction on macros coming from untrusted sources. Having made the news in the past few days, a new campaign with the intriguing name "Code on Toast," has raised serious concerns about the vulnerability of software still embedded in widely used systems, even after the retirement of Internet Explorer. According to a joint report by the National Cyber Security Center (NCSC) of South Korea, and AhnLab (ASEC), the incident occurred earlier this year. 

There was a unique way for these malware infections to be spread by using toast pop-up ads as how the campaign was delivered. There is a unique aspect of this campaign that focuses on the way ScarCruft distributes its malware through the use of toast notifications and small pop-ups that appear when antivirus software or free utilities are running. As a result of ScarCruft’s compromise of the server of a domestic ad agency in South Korea, a malicious "toast ad" made by ScarCruft was sent to many South Korean users through a popular, yet unnamed, free piece of software. 

To accomplish ScarCruft’s attack, a zero-day Internet Explorer vulnerability, CVE-2024-38178, with a severity rating of 7.5, must be exploited cleverly. As a consequence of this, Edge users in Internet Explorer mode can potentially execute remote code through a memory corruption bug in the Scripting Engine, which can result in remote code execution. This vulnerability was patched for August 2024 as part of Microsoft's Patch Tuesday update, part of this annual update program. 

By using toast notifications, typically harmless pop-up ads from anti-virus software or utility programs, the group silently delivered malware through a zero-click infection method using a zero-click virus delivery mechanism. As a result, it has become necessary for an attacker to convince a user to click on a URL that has been specially crafted to initiate the execution of malicious code to successfully exploit a vulnerability. 

Having used such advanced techniques, ScarCruft clearly emphasizes the need for South Korea's digital landscape to remain protected from such threats in the future. It is unfortunate that no matter how much effort is put into phasing out outdated systems, security vulnerabilities have caused problems in legacy components like Internet Explorer. Although Microsoft announced it would retire Internet Explorer at the end of 2022, many of the browser's components remain in Windows, or they are being used by third-party products, allowing threat actors to come across new vulnerabilities and exploit them for their purposes. As a result of this campaign, organizations will be reminded of the importance of prioritizing cybersecurity updates and maintaining robust defences against increasingly sophisticated cyber threats backed by governments.
Read more »
Subscribe to: Posts (Atom)