VulnHub

Ukraine's Computer Emergencies Response Team (CERT-UA) has reported a new malware campaign targeting government and healthcare institutions, particularly clinics and emergency hospitals. This campaign, which took place between March and April, focuses on stealing sensitive data from users of Chromium-based web browsers and WhatsApp. The attackers are believed to be exploiting vulnerabilities to deliver this data-theft malware, raising concerns about the security of critical health information and government data. With healthcare systems already strained, this type of cyberattack poses significant risks not only to patient privacy but also to the overall functioning of essential services in Ukraine. The ongoing conflict and instability in the region make this situation particularly alarming, as attackers may aim to cause further disruption.

Researchers have discovered a new type of malware called 'AgingFly' that has been used in attacks targeting Ukrainian government agencies and hospitals. This malware is designed to steal authentication data from users of Chromium-based browsers and WhatsApp messenger, posing a significant risk to sensitive information. The attacks raise concerns about the security of critical infrastructure and public services, especially in a region already facing geopolitical tensions. As cybercriminals continue to evolve their tactics, it's crucial for organizations to enhance their defenses against such threats. Users are advised to be vigilant and consider updating their security practices to protect against potential data breaches.

A significant cybersecurity incident has emerged involving over 30 plugins from the EssentialPlugin package for WordPress. These plugins have been compromised with malicious code, which grants unauthorized access to websites that utilize them. This breach potentially affects thousands of sites, putting user data and site integrity at risk. The incident underscores the vulnerability of widely-used plugins and the importance of maintaining updated security practices. Website administrators are urged to review their installed plugins and take immediate action to protect their sites from possible exploitation.

A new ransomware strain called JanaWare is targeting users in Turkey, focusing on home users and small to medium-sized businesses. The attackers are primarily spreading the malware through phishing emails that contain malicious Java archive files. This method of infection allows them to infiltrate systems quietly, posing a significant risk to individuals and organizations that may not have robust cybersecurity measures in place. The low-value, high-volume nature of these attacks suggests that the perpetrators are likely looking to maximize their reach rather than targeting high-profile victims. As more users fall prey to these phishing attempts, it raises concerns about the overall security posture of smaller businesses that may lack the resources to defend against such threats.

Researchers have discovered that 100 Chrome extensions, published through five different accounts, are part of a coordinated campaign designed to steal user data and create backdoors. These malicious extensions utilize shared command and control (C&C) infrastructure, indicating a well-organized effort by the attackers. Users who have installed these extensions are at risk of having their data compromised, which could lead to identity theft or other forms of online fraud. This incident serves as a reminder for users to be cautious when installing browser extensions and to regularly review their installed add-ons for any suspicious activity. The findings underscore the need for enhanced scrutiny of browser extensions to protect user privacy and security.

A report detailing the state of cybersecurity threats to industrial automation systems in Q4 2025 reveals concerning trends in malware and infection vectors. Researchers identified various types of malware that are increasingly targeting these systems, affecting industries across different regions. The report emphasizes that many organizations remain vulnerable due to outdated security measures and a lack of awareness about emerging threats. This situation puts critical infrastructure at risk, potentially leading to operational disruptions and safety hazards. Companies are urged to enhance their cybersecurity protocols and invest in better defenses to protect against these sophisticated attacks.

APT37, a North Korean state-sponsored hacking group, has launched a new social engineering campaign aimed at Facebook users. This operation utilizes the RokRAT trojan, which allows attackers to gain access to victims' devices and sensitive information. The campaign is multi-faceted, indicating a sophisticated approach to trick users into downloading the malware. This is particularly concerning as it targets a widely-used platform, potentially affecting millions of users. As cyber threats continue to evolve, individuals and organizations must remain vigilant about the security of their online activities and the links they interact with.

The article discusses the challenges posed by EDR killers, which utilize a technique called bring-your-own-vulnerable-driver (BYOVD) to bypass Endpoint Detection and Response (EDR) systems. These attackers exploit vulnerabilities in drivers that are already present on a victim's system, making it difficult for security measures to detect their activities. The article emphasizes the need for stronger defenses against these types of attacks, as they can compromise sensitive systems and data. Organizations must be aware of this tactic and take proactive measures to protect their environments from potential exploitation.

JanelaRAT is a type of malware that is specifically targeting banks in Latin America. It uses a unique detection method that allows it to identify and focus on particular financial websites by scanning for custom title bars. This targeted approach makes it a serious concern for financial institutions and their customers, as it can lead to unauthorized access to sensitive information. As attackers continue to refine their tactics, banks must remain vigilant and implement robust security measures to protect their systems and customers from these malicious activities. The ongoing threat from JanelaRAT underscores the need for increased cybersecurity awareness and defenses among financial organizations in the region.

ViperTunnel is a new backdoor malware linked to the DragonForce ransomware, specifically targeting businesses that operate on Windows servers in the US and the UK. This Python-based malware allows attackers to gain unauthorized access to systems, which can lead to data theft or further exploitation. Companies utilizing Windows server environments should be particularly vigilant, as the malware poses a significant risk to their operations and data security. The emergence of ViperTunnel highlights the ongoing challenges businesses face in protecting their networks from evolving ransomware threats. Organizations are urged to implement strong security measures and regularly update their systems to fend off such attacks.

Researchers from JUMPSEC have reported that a misconfigured command-and-control server linked to the MuddyWater group has exposed custom malware tools, including the CastleRAT variant, which are being used against Israeli targets. The operation appears to involve Iranian cyber actors, specifically those associated with TAG-150. The exposed server has revealed crucial details about these cyber tools, indicating that the attackers are actively targeting specific regions and organizations. This incident raises concerns about the security of Israeli entities and highlights the ongoing cyber warfare in the region, emphasizing the need for heightened vigilance against such threats.

A new version of the GlassWorm campaign is targeting software developers by distributing a fake Visual Studio Code extension. This malicious extension acts as a dropper, compiled using the Zig programming language, and can infect multiple integrated development environments (IDEs) on the same machine. By exploiting a trusted platform, attackers can silently install harmful software that compromises development environments. This poses a significant risk to developers and organizations using these tools, as it can lead to unauthorized access to sensitive code and data. Users of various IDEs should be cautious about the extensions they install and ensure they come from verified sources.

Security researchers have identified a new Android banking trojan called Mirax, which is targeting users across Europe. This malware utilizes a method known as Malware-as-a-Service (MaaS) to infect devices, allowing cybercriminals to gain remote access and turn affected smartphones into residential proxy nodes. By doing this, attackers can route their malicious activities through the compromised devices, making it harder to trace their actions back to them. This poses a significant risk to users, as their personal data and banking information could be at risk. The emergence of Mirax highlights ongoing vulnerabilities in mobile security and the need for users to remain vigilant against such threats.

A new infostealer called 'Storm' has emerged, capable of hijacking user sessions by decrypting data on the server side rather than locally. This technique allows attackers to bypass traditional security measures like passwords and multi-factor authentication (MFA). Researchers from Varonis have demonstrated how the infostealer sends sensitive browser data directly to the attackers' servers, raising significant concerns about user privacy and account security. The implications are serious, as organizations relying on standard security protocols may find themselves vulnerable to these sophisticated attacks. Companies should be vigilant and assess their security measures to protect against this evolving threat.

Kaspersky's GReAT team has reported on a new campaign involving JanelaRAT, a type of remote access trojan that specifically targets financial information from users in Latin America. This malware is designed to steal sensitive data, including banking credentials, by infecting victims' devices through a series of sophisticated techniques. The infection process and the functionality of the malware have both been updated, making it more dangerous than previous versions. This campaign is particularly concerning as it highlights the ongoing risks to financial security for users in the region, especially given the rise of online banking and digital transactions. Users in Latin America need to be aware of this threat and take steps to protect their financial information.