VulnHub

A Belarus-aligned hacking group known as Ghostwriter has launched new attacks against Ukrainian government organizations. This group, which has been active since at least 2016, is known for both cyber espionage and influence campaigns, primarily targeting Ukraine and its neighboring countries. The latest operations involve phishing attacks using geofenced PDF documents, which aim to trick users into revealing sensitive information. Additionally, the attackers are utilizing Cobalt Strike, a popular tool among cybercriminals for post-exploitation activities. These actions pose significant risks to Ukrainian governmental operations and national security, especially given the ongoing geopolitical tensions in the region.

A recent report from Darktrace reveals that a group of Chinese hackers, known as Twill Typhoon, is using counterfeit websites mimicking Apple and Yahoo to conduct espionage. These fake sites are designed to lure unsuspecting users into providing sensitive information, which the attackers can then leverage for spying on various organizations. The hackers are utilizing a malware framework called FDMTP, which further aids their operations. This tactic poses a significant risk to individuals and companies who may mistakenly trust these fraudulent sites, potentially leading to data breaches and compromised security. Organizations are urged to remain vigilant and educate their employees about the dangers of phishing and counterfeit websites.

Researchers from ReliaQuest have discovered that attackers are using a combination of open-source tools, specifically ClickFix and PySoxy, to maintain persistent access to compromised systems after an initial social engineering attack. This method allows them to bypass traditional security measures and maintain control over their targets. The findings highlight how attackers are increasingly leveraging readily available tools to extend their foothold within networks, making it harder for organizations to detect and respond to breaches. Companies need to be aware of these tactics and strengthen their defenses against social engineering and the use of such tools. It's essential for organizations to continuously monitor their systems and educate employees about potential phishing attacks.

The article discusses the limitations of technical security measures in preventing cyber attacks, emphasizing that employees often serve as the first line of defense. It outlines four specific types of attacks that target human vulnerabilities, such as phishing and social engineering. These attacks exploit the trust and behavior of employees rather than technical flaws in systems. This highlights the need for companies to invest in training and awareness programs for their staff to recognize and respond to potential threats effectively. As cyber threats continue to evolve, a well-informed workforce is crucial for enhancing overall security.

A data breach affecting nearly 197,000 Zara customers has been linked to a cyberattack on a former technology provider, ShinyHunters. The breach exposed sensitive customer information, including emails, purchase history, and support data. This incident raises concerns about the security measures in place at third-party vendors that companies rely on. Customers whose data was compromised may face increased risks of phishing attempts and identity theft. As major retailers like Zara continue to rely on external partners, ensuring robust security practices across their supply chain becomes increasingly critical.

Scammers are now using invisible text in phishing emails to trick AI email filters, making it easier for their fraudulent messages to reach users' inboxes. This method involves inserting hidden characters that are not visible to the naked eye but can bypass automated security systems. As a result, more phishing emails could successfully land in inboxes, increasing the risk of users falling victim to scams. This tactic poses a significant challenge for email service providers and cybersecurity experts, who must adapt their filtering techniques to combat this evolving threat. Users should be vigilant and look out for suspicious emails, even if they seem to pass through standard security filters.

Cofense has reported a notable rise in phishing campaigns that exploit the Vercel platform. Vercel, a popular service for frontend developers that allows for easy deployment of web applications, has been misused by attackers to create deceptive sites aimed at tricking users into providing sensitive information. This uptick in abuse is significant enough to raise alarms among cybersecurity experts, as it could affect a wide range of organizations using Vercel for their web projects. Companies relying on this platform need to be vigilant and enhance their security measures to protect against these phishing attacks. Users should also be cautious about unsolicited communications that may lead to fraudulent websites.

A hacker claims to have stolen around 280 million data records from 8,809 educational institutions, including colleges, school districts, and online platforms, in a breach involving Instructure, a prominent education technology company. The records reportedly contain sensitive information about students and staff, raising concerns over identity theft and privacy violations. This incident highlights the vulnerabilities in educational systems, which often store vast amounts of personal data. Users and institutions need to be vigilant about potential phishing attacks and other exploits that could arise from this breach. The impact on students and staff could be severe, as their personal information may be used maliciously.

A phishing campaign named VENOMOUS#HELPER has been targeting over 80 organizations since at least April 2025. The attackers exploit legitimate Remote Monitoring and Management (RMM) tools, specifically SimpleHelp and ScreenConnect, to gain ongoing remote access to compromised systems. Most of the affected organizations are based in the United States. This type of attack is concerning because it allows attackers to maintain control over their targets, potentially leading to data breaches or further exploitation. Organizations need to be vigilant about phishing attempts and ensure that their RMM tools are secured against unauthorized access.

The cybercrime group Silver Fox, based in China, has launched a phishing campaign targeting organizations in India and Russia using a new malware known as ABCDoor. The attackers sent emails posing as communications from the Income Tax Department of India in December 2025, followed by similar attempts aimed at Russian entities. This tactic is concerning as it exploits tax-related themes to gain trust and infiltrate systems. The use of ABCDoor malware can lead to unauthorized access to sensitive information, potentially compromising the security of targeted organizations. As cyber threats continue to evolve, it is crucial for companies in these regions to enhance their security measures and educate employees on recognizing phishing attempts.