A new cyber campaign known as Bloody Wolf is actively targeting individuals in Uzbekistan and Russia using the NetSupport Remote Access Trojan (RAT). Researchers report that around 50 victims have been affected in Uzbekistan and about 10 in Russia, with smaller numbers in Kazakhstan, Turkey, Serbia, and Belarus. This type of malware allows attackers to gain control over infected systems, posing significant risks to personal and sensitive information. The targeting of these specific regions suggests a focused effort by the attackers, likely indicating political or economic motivations behind the campaign. Users in these countries should be vigilant about suspicious emails and software installations to protect against such threats.
A new phishing campaign linked to the Phorpiex malware is targeting users globally, delivering ransomware through emails with malicious attachments. These emails often use deceptive double extensions, such as Document.doc.lnk, to trick recipients into opening them. Once activated, the malware can spread across networks, potentially locking files and demanding ransom payments from affected organizations. This ongoing threat, active throughout 2024 and 2025, poses significant risks to businesses and individuals alike, as it can lead to the loss of sensitive data and financial resources. Users need to remain vigilant about email attachments and ensure robust security measures are in place to defend against such attacks.
A new botnet called SSHStalker has compromised approximately 7,000 Linux systems, primarily those hosted in the cloud. This botnet uses Internet Relay Chat (IRC) for control and automates attacks via Secure Shell (SSH) to gain access to these systems. The attackers are exploiting weak SSH credentials, making it crucial for system administrators to strengthen their password policies and implement key-based authentication. This incident highlights the ongoing vulnerability of Linux servers to automated attacks and the importance of maintaining strong security practices. Users need to be vigilant and consider regular audits of their SSH configurations to prevent unauthorized access.
A fraudulent 7-Zip website has emerged, distributing a compromised version of the popular file archiving software. This malicious installer includes a trojan that converts the user's computer into a residential proxy node, which can be used by attackers for various illicit activities. Users who unknowingly download this installer are putting their machines at risk and could potentially face privacy violations or further exploitation. This situation is particularly concerning as it exploits the trust many people have in widely used software like 7-Zip. It's crucial for users to ensure they download software only from official sources to avoid similar threats.
A new bipartisan bill has been introduced in the House, aiming to enhance the security of digital identities to combat identity theft and fraud. This legislation proposes to empower the Treasury Department as the leading agency in the national effort to improve digital identity infrastructure. The bill reflects a growing concern over the rise in identity-related crimes, which have affected countless individuals and businesses. By centralizing efforts under the Treasury, lawmakers hope to create a more unified and effective approach to protect personal information online. The proposed changes could lead to better safeguards for consumers and a reduction in fraudulent activities, which have become increasingly sophisticated.
Volvo Group North America has reported a data breach that occurred due to a cyberattack on Conduent, a business services company that provides IT support to Volvo. The breach exposed customer data, although specific details about what information was compromised have not been disclosed. This incident raises concerns about the security of third-party vendors and the risks they pose to their clients. As companies increasingly rely on external service providers, the need for robust security measures in these partnerships becomes even more critical. Customers of Volvo Group North America should remain vigilant about potential impacts from this breach, including possible phishing attempts or identity theft.
The article discusses a growing concern in operational technology (OT) security, particularly involving 'living-off-the-plant' techniques used by attackers. These methods allow cybercriminals to hide within the systems they compromise, making it difficult for security teams to detect their presence. While traditional security measures have provided some level of protection, the article warns that this may not last as attackers become more sophisticated. The implications are significant, as industries relying on OT systems could face severe disruptions if these attacks succeed. Companies need to be aware of these evolving tactics to better defend against potential intrusions.
Researchers have identified a new cyber espionage campaign by a group known as Transparent Tribe, or APT36, which is linked to Pakistan. This group is targeting India's defense and government sectors using three types of Remote Access Trojans (RATs): GETA, ARES, and Desk RATs. The campaign aims to gather sensitive information and is part of a broader trend of economic espionage. The involvement of military and government entities raises concerns about national security and the potential for sensitive data breaches. As these attacks continue, it is crucial for organizations in affected sectors to bolster their cybersecurity measures to protect against such threats.
A recent cyberattack targeting Poland's energy grid has raised alarms about the security of vital infrastructure. The Cybersecurity and Infrastructure Security Agency (CISA) issued a warning to U.S. organizations, emphasizing the risks posed by vulnerable edge devices connected to operational technology and industrial control systems. This incident serves as a reminder that attackers are increasingly targeting essential services, which could lead to significant disruptions. Companies in the energy sector and beyond need to review their security measures to protect against similar threats. The implications of such attacks can be severe, affecting not just the immediate targets but also the broader public infrastructure and services.
Hackread – Cybersecurity News, Data Breaches, AI and More
A new cybercrime group known as 0APT has been identified for fabricating breach claims against large organizations. Researchers have found that this group is using fake data to deceive companies into believing they have been attacked, which leads to these companies paying out ransom or fees based on these false claims. This tactic not only exploits the fear of data breaches but also poses a significant risk to the integrity of cybersecurity reporting. Companies may be misled into investing in unnecessary security measures or falling victim to scams, further complicating the cybersecurity landscape. As organizations become more vigilant about actual breaches, the existence of groups like 0APT can undermine trust and divert resources away from genuine threats.
SAP has issued 26 new security notes along with one updated note addressing vulnerabilities in several of its products, including CRM, S/4HANA, and NetWeaver. This update was released on February 2026's security patch day, indicating that these vulnerabilities could pose significant risks to organizations using these systems. Companies that rely on SAP solutions should prioritize applying these patches to protect against potential exploitation. The vulnerabilities could allow attackers to gain unauthorized access or disrupt services, which can have serious consequences for businesses. It's crucial for SAP users to stay informed and act promptly to safeguard their systems.
Picus Security has issued a warning about a new trend among cybercriminals who are using stealthy tactics to carry out extortion attacks. These attackers are becoming increasingly sophisticated, employing methods that allow them to remain hidden while they compromise systems. This stealth approach makes it harder for organizations to detect breaches until it's too late, potentially leading to significant financial losses and data breaches. Companies need to be vigilant and proactive in their cybersecurity measures to defend against these hidden threats. The warning serves as a reminder that traditional defenses may not be enough to combat these evolving tactics.
Researchers have identified a new spyware kit called ZeroDayRAT, which is being distributed via Telegram. This toolkit is said to allow attackers to fully compromise both iOS and Android devices, functioning at a level typically associated with resources available to nation-states. The implications of this spyware are significant, as it can potentially give hackers complete access to personal data and device controls. Users of mobile devices, especially those who may be targeted for sensitive information, should be particularly cautious. The emergence of such advanced tools raises serious concerns about mobile security and privacy.
A new Linux botnet named 'SSHStalker' has reportedly infected around 7,000 systems. This botnet employs a mass-compromise strategy, utilizing various scanners and malware to gain control over vulnerable devices. The attackers are likely taking advantage of outdated security practices, which makes this incident a reminder for system administrators to enhance their security measures. The widespread nature of this botnet indicates that many users might be at risk, especially if their systems are not properly secured. Addressing these vulnerabilities is crucial to prevent further infections and potential data breaches.
Singapore's law enforcement has successfully dismantled a group of Chinese hackers who were targeting telecommunications networks in the country. This operation, named Cyber Guardian, is noted as Singapore's largest and longest-running initiative against cyber threats. The hackers were reportedly involved in activities that could compromise sensitive telecommunications infrastructure, potentially affecting millions of users. The operation reflects Singapore's commitment to safeguarding its critical digital assets and showcases the growing international cooperation in tackling cybercrime. With the rise of cyber threats globally, actions like these are crucial to maintaining the integrity of national networks and protecting citizens' data.