April 2025 - ExploreSec Cybersecurity Threat Intelligence Newsletter

This is a newsletter I create and share with my internal security team. Feel free to grab and do the same.

Ransomware Ecosystem in Flux 

Coveware's latest analysis reveals a significant transformation in the ransomware threat landscape as of Q1 2025. The once-dominant Ransomware-as-a-Service (RaaS) model is unraveling due to intensified law enforcement actions, internal discord, and operational setbacks. 

Key Insights: 

• Disintegration of Major RaaS Groups: Prominent groups like LockBit, BlackCat/ALPHV, and Black Basta have collapsed, plagued by internal conflicts and increased scrutiny. Leaked communications from Black Basta highlight challenges in targeting, risk assessment, and evasion of sanctions. 

• Emergence of New Threat Actors: The void left by these groups is being filled by unaffiliated extortionists, nascent ransomware brands with ties to espionage and hacktivism, and a few remnants of traditional ransomware operations. 

• Operational Missteps: Recent incidents, such as Clop's underwhelming Cleo campaign and a poorly executed Oracle Cloud SSO breach by a BreachForums actor, indicate a decline in the sophistication and monetization strategies of threat actors. 

• Rise of Phantom Scams: The appearance of fraudulent ransom notes, like those falsely attributed to BianLian, underscores a trend toward deceptive tactics as traditional extortion methods wane. 

• Increased Exposure and Arrests: Enhanced operational security measures and international cooperation have led to the identification and apprehension of several threat actors, diminishing the perceived anonymity that once shielded cybercriminals. 

Further Reading: Coveware 

Stealthy .NET Malware: Hiding Malicious Payloads as Bitmap Resources 

Unit 42 researchers have identified a novel obfuscation technique employed by threat actors, wherein malicious payloads are concealed within bitmap resources embedded in seemingly benign 32-bit .NET applications. This method leverages steganography to initiate a multi-stage execution chain, ultimately deploying final payloads such as Agent Tesla, RemcosRAT, or XLoader. 

Key Insights: 

• Steganographic Embedding: Malware is hidden within bitmap resources of .NET executables, allowing it to evade traditional detection mechanisms. 

• Malspam Distribution: Campaigns have been observed targeting sectors like finance in Türkiye and logistics in Asia, using localized email subjects and attachments to increase credibility. 

• Multi-Stage Execution: Upon execution, the infected application extracts and deobfuscates embedded payloads, loading them as dynamic-link libraries before executing the final malicious code. 

• Advanced Obfuscation Techniques: Additional methods such as metadata obfuscation, opcode replacement, and control flow manipulation are used to hinder static analysis and reverse engineering. 

Further Reading: Unit 42 

New Tool Can Trick Windows into Disabling Microsoft Defender 

Security researchers have discovered a new, publicly available tool called "DefendNot" that can manipulate Windows systems into effectively disabling Microsoft Defender, the built-in antivirus software. This tool doesn't exploit vulnerabilities but instead uses legitimate system administration features in unintended ways. 

Key Insights for Security Teams: 

• Abuse of Admin Privileges: Highlights the critical importance of least privilege principles and monitoring privileged accounts. 

• Bypasses Traditional Defenses: May evade detection by traditional security solutions that primarily look for malware signatures or exploit activity. 

• Focus on Tamper Protection: Underscores the importance of enabling and closely monitoring tamper protection features within Microsoft Defender. 

• Need for Behavioral Monitoring: Organizations should emphasize behavioral monitoring and anomaly detection to identify suspicious activity. 

• Tool is Publicly Available: Means threat actors could potentially incorporate it into their attack chains. 

Further Reading: BleepingComputer 

NIST Proposes Metric to Identify Likely Exploited Vulnerabilities 

The National Institute of Standards and Technology (NIST), in collaboration with the Cybersecurity and Infrastructure Security Agency (CISA), has introduced a proposed metric aimed at determining the likelihood that a given vulnerability has been exploited in the wild. This initiative seeks to enhance the efficiency and cost-effectiveness of enterprise vulnerability remediation efforts. 

Key Insights: 

• Addressing Limitations of Existing Systems: Current remediation strategies often rely on the Exploit Prediction Scoring System (EPSS) and Known Exploited Vulnerabilities (KEV) lists. However, EPSS has been noted for inaccuracies, and KEV lists may not be comprehensive. The proposed metric aims to augment these tools by providing a more accurate assessment of exploitation likelihood. 

• Enhancing Vulnerability Prioritization: By estimating the probability of exploitation, organizations can better prioritize vulnerabilities, focusing resources on those most likely to be targeted. 

• Collaborative Approach: The success of this metric depends on collaboration with industry partners to provide necessary performance measurements and validate the effectiveness of the approach. 

Further Reading: NIST CSWP 41 

New Best Practices Guide for Securing AI Data Released 

CISA, NSA, FBI, and international partners have jointly released a new Cybersecurity Information Sheet focused on AI Data Security: Best Practices for Securing Data Used to Train & Operate AI Systems. This guide emphasizes that robust data security is fundamental for ensuring the accuracy, integrity, and trustworthiness of AI outcomes throughout its entire lifecycle. 

Key Insights: 

• Holistic Risk Management: The guide outlines risks stemming from data security and integrity issues across all phases of AI, from development to operation. 

• Target Audience: It's particularly relevant for Defense Industrial Bases, National Security Systems owners, federal agencies, and Critical Infrastructure owners/operators. 

• Core Recommendations: Key practices include adopting strong data protection measures, proactively managing AI-related risks, and enhancing monitoring, threat detection, and network defense capabilities. 

• Vigilance is Key: As AI integration grows, organizations must take deliberate steps to secure the underlying data. 

Further Reading: CISA 

DDoS Attack "Street Prices": What You Need to Know 

Recent analysis of the underground market reveals that the "street prices" for DDoS (Distributed Denial-of-Service) attacks have remained remarkably stable over the past few years, with some new trends in service delivery. While web-based booters are still available, Telegram-based booter services are becoming a new norm, offering readily accessible attack capabilities. 

Key Insights: 

• Stable Pricing: DDoS attack costs have remained consistent, making them a relatively affordable option for malicious actors. 

• Layer 3/4 Attacks (Volume-based):  

• 1 GB/Day (Booter-Service): ~$1/day 

• 100 GB/Day: ~$25/day 

• 1000 GB/Day (DDoS for Hire): ~$150/day 

• Layer 7 Attacks (Application-layer):  

• 10,000 RPS/Day (Booter-Service): ~$1/day 

• 50,000 RPS/Day (DDoS for Hire): ~$20/day 

• 100,000 RPS + Protected Services (DDoS for Hire): ~$50/day 

• Max monthly cost for DDoS for Hire: ~$10,000/month 

• DDoS-as-a-Service (DDoSaaS) Dominance: This business model continues to thrive, with attackers charging hourly or monthly fees to sustain attacks, often with extra charges for targeting protected services. 

• Emergence of Telegram Booters: Threat actors are increasingly leveraging Telegram for offering and managing DDoS services, simplifying access for potential customers. 

Further Reading: KyberVandals Blog 

Deceptive CAPTCHA "ClickFix" Campaign Uses Clipboard Injection to Deliver Malware 

Threat actors are employing a new social engineering campaign, dubbed "ClickFix," that utilizes fake CAPTCHA prompts on compromised or cloned websites. This sophisticated technique tricks users into launching malware by combining clipboard injection with abuse of the Windows Run dialog, leading to the delivery of payloads like Lumma Stealer and NetSupport RAT. 

Key Insights: 

• Social Engineering Focus: The campaign heavily relies on user fatigue with CAPTCHA mechanisms, guiding victims through seemingly familiar steps to execute malicious code. 

• Clipboard Injection & Run Dialog Abuse: The core of the attack involves copying a malicious PowerShell or mshta command to the clipboard, which users are then instructed to paste and execute in the Windows Run dialog. 

• Living Off the Land Binaries (LOLBins): Attackers extensively use trusted system binaries like PowerShell, mshta.exe, and certutil.exe to bypass traditional security defenses, making detection challenging. 

• Payloads: Frequently observed payloads include infostealers (e.g., Lumma Stealer targeting browser data, credentials, and crypto wallets) and remote access tools (e.g., NetSupport RAT for full system access). 

• Simplicity and Effectiveness: The campaign's success stems from its simplicity, avoiding zero-day exploits or complex hidden mechanisms, relying instead on user interaction. 

• Proactive Defense: This campaign underscores the need for robust endpoint detection and response (EDR) solutions capable of behavioral analysis and detection of LOLBin abuse, alongside user education on suspicious CAPTCHA prompts and the dangers of pasting unknown commands. 

Further Reading: SecurityOnline.info 

Cybercriminals Exploit AI Hype to Spread Malware 

Cybercriminals are increasingly exploiting the public's interest in artificial intelligence by creating fake AI-themed websites and advertisements to distribute malware. A recent campaign identified by Mandiant Threat Defense involves the threat group UNC6032 using deceptive ads on platforms like Facebook and LinkedIn to lure users into downloading malicious software disguised as AI video generation tools. 

Key Insights: 

• Deceptive Advertising: Thousands of malicious ads have been disseminated, impersonating legitimate AI tools such as Luma AI and Canva Dream Lab. These ads direct users to fraudulent websites designed to mimic authentic AI services. 

• Malware Deployment: Upon interacting with these fake sites, users are prompted to download a ZIP file containing the STARKVEIL malware dropper. This dropper installs multiple malware components, including GRIMPULL, XWORM, and FROSTRIFT, which are designed to steal sensitive information and establish persistent access to the victim's system. 

• Information Theft: The deployed malware targets a range of data, including login credentials, cookies, credit card information, and digital wallet contents. Some components, like XWORM, also perform keylogging and screen capture, further compromising user privacy. 

• Evasion Techniques: The malware employs sophisticated methods to avoid detection, such as using Braille pattern blank characters to obscure file extensions and leveraging legitimate processes for malicious activities. 

This campaign underscores the importance of vigilance when engaging with online advertisements, especially those offering AI-related services. Users should be cautious of unsolicited offers and verify the legitimacy of websites before downloading any software. 

Further Reading: Google Cloud Blog 

Beyond the Kill Chain: How Cybercriminals Invest Their Profits 

Sophos X-Ops' five-part series, Beyond the Kill Chain, explores what happens after a successful cyberattack. The series reveals how financially motivated threat actors invest their illicit earnings—often blending legitimate business with ethically questionable and outright criminal ventures. 

Key Insights: 

• Legitimate Business Ventures: Cybercriminals are investing in seemingly lawful enterprises such as restaurants, real estate, and e-commerce platforms. These ventures help launder money while also creating additional income streams. 

• Ethically Dubious Activities: Some threat actors operate in legal gray zones, selling spyware, monetizing vulnerability research under the guise of security services, or manipulating online traffic for advertising profits. 

• Criminal Enterprises: Illicit gains are also funneled into traditional criminal operations like counterfeit goods, drug trafficking, and underground gambling, showing how cybercrime supports broader organized crime ecosystems. 

• Implications for Cybersecurity: Mapping how threat actors reinvest their profits helps threat intelligence teams understand evolving risk models and disrupt the infrastructure supporting ongoing cybercriminal activity. 

Further Reading: Sophos News 

Lumma Infostealer: Disrupted but Not Defeated 

A recent global law enforcement operation disrupted parts of the Lumma Infostealer malware-as-a-service platform, seizing over 2,500 domains. However, key infrastructure—particularly servers hosted in Russia—remains intact, allowing Lumma’s core operations to continue. 

Key Insights: 

• Partial Takedown: While many domains were seized, Lumma’s main server remains online, enabling continued malware activity. 

• Resilience and Recovery: The developer claimed services resumed quickly with no arrests made, signaling strong operational recovery. 

• Ongoing Threat: Stolen credentials and sensitive data tied to Lumma are still appearing on dark web markets. 

• Psychological Tactics: Authorities planted disruptive messages in Lumma’s Telegram channels and admin panels to undermine trust in the service. 

• Mixed Reactions: Some cybercriminals are distancing themselves from Lumma, while others remain loyal and active. 

Further Reading: Check Point Blog 

CFOs Targeted in Sophisticated Spear-Phishing Campaign 

A recent spear-phishing campaign is targeting Chief Financial Officers (CFOs) and finance executives across banking, energy, insurance, and investment sectors in regions including Europe, Africa, Canada, the Middle East, and South Asia. The attackers use a multi-stage approach to deploy NetBird, a legitimate WireGuard-based remote access tool, onto compromised systems. 

Key Insights: 

• Deceptive Recruitment Emails: The campaign begins with emails impersonating a Rothschild & Co recruiter offering a “strategic opportunity.” Victims are directed to a Firebase-hosted page featuring a custom CAPTCHA to access a malicious file. 

• Malicious Payload Delivery: After solving the CAPTCHA, users download a ZIP file containing a VBS script. When executed, it installs NetBird and OpenSSH, creates a hidden local admin account, and enables Remote Desktop Protocol (RDP) for persistent attacker access. 

• Evasion Techniques: The use of custom CAPTCHAs and trusted hosting services helps the attackers bypass traditional security defenses and increases credibility. 

• Attribution: Some infrastructure overlaps with known nation-state campaigns, but the specific threat actor remains unidentified. 

Further Reading: Trellix Blog 

Threat Actors Exploit Google Apps Script for Evasive Phishing Attacks 

Threat actors are leveraging Google's Apps Script platform to host phishing pages that appear legitimate, allowing them to steal login credentials. These campaigns often begin with emails posing as invoice notifications, linking to webpages hosted using Google Apps Script. By operating within Google's trusted environment, attackers make their phishing pages seem more authentic, increasing the chances of success. 

Key Insights: 

• Abuse of Trusted Services: Google Apps Script, a JavaScript-based platform used for automating Google Workspace tasks, is being exploited to host fake login pages that capture user credentials and send them to attacker-controlled servers. 

• Evasion of Security Measures: Because the scripts are hosted on Google's own domain, they can bypass traditional email and web filters that typically block suspicious domains. 

• Sophisticated Phishing Techniques: The phishing emails and login prompts are convincingly designed to mimic legitimate services, making it more likely that targets will engage and provide sensitive information. 

Further Reading: BleepingComputer 

HuluCAPTCHA – An Evolving Fake CAPTCHA Framework 

Security researchers have identified "HuluCAPTCHA," a sophisticated fake CAPTCHA framework actively compromising websites. This advanced system tricks users into running malicious commands via fake CAPTCHA prompts and the Windows Run dialog, leading to infections with infostealers and remote access tools. 

Key Insights: 

• Deceptive Execution: Users are redirected from compromised sites to fake CAPTCHA pages, then instructed to copy/paste malicious PowerShell or mshta commands into Windows Run. 

• Advanced Tracking & Stealth: The framework meticulously tracks user interactions and potential command execution. It leverages Living Off the Land Binaries (LOLBins) to evade traditional defenses. 

• Payload Versatility: Delivers various infostealers (e.g., Lumma, Aurotun) and remote access tools (e.g., Donut Injector). 

• Persistent Backdoors: Compromised WordPress sites show sophisticated hidden admin backdoors, designed for stealth and persistence. 

• High-Value Targets: Attackers are targeting organizations that could hold sensitive data, highlighting the potential for significant impact. 

Further Reading: HuluCaptcha — An example of a FakeCaptcha framework 

Phishing Campaign Exploits Google.com Open Redirects 

A recent phishing campaign has been observed exploiting an open redirect vulnerability within Google's google.com/travel/clk endpoint. Threat actors are leveraging this legitimate Google Travel click-tracking mechanism to redirect users from a trusted google.com domain to malicious phishing sites. This technique adds an air of legitimacy to phishing links, making them harder for users to identify as fraudulent. 

Key Insights: 

• Trusted Domain Abuse: Attackers are using google.com/travel/clk?pc=[token]&pcurl=[target_URL] to redirect users. The presence of google.com in the initial link provides a deceptive sense of security. 

• Persistent Tokens: The pc token, which controls the redirect, lacks a clear expiration mechanism and can remain valid for months or even years. This allows attackers to reuse tokens across multiple campaigns. 

• Ease of Exploitation: Obtaining a valid token is trivial, requiring only a visit to Google's hotel search page to copy one from a legitimate link. 

• Google's Stance: Google's official position classifies open redirects as "very little practical risk," claiming they invest in phishing detection rather than preventing the redirects themselves. This stance is debated given the observed abuse. 

• Detection Challenge: The initial legitimate google.com domain in the link makes it difficult for users and some security systems to immediately flag it as malicious. 

Mitigation Recommendation for Internal Security Teams: 

• Flag or sandbox any google.com/travel/clk links that appear in email and other messages until Google clarifies its redirect validation mechanisms. 

Further Reading: Another day, another phishing campaign abusing google.com open redirects 

Cybercriminals Use Fake Booking Sites to Spread AsyncRAT Malware 

Cybercriminals are exploiting fake Booking.com websites to infect users with AsyncRAT, a remote access trojan. Victims are lured through deceptive ads and social media links to counterfeit booking sites, where they are tricked into running a malicious PowerShell script. The attack results in full remote control of the infected system, putting sensitive personal information at risk. 

Key Insights: 

• Attackers use fake CAPTCHA prompts to manipulate users into executing malware. 

• The AsyncRAT payload allows for full system access, including surveillance and data theft. 

• Domains rotate every few days, making detection and blocking more difficult. 

Further Reading: Malwarebytes Blog 

UNC6040 – Voice Phishing to Salesforce Data Extortion 

Google Threat Intelligence Group (GTIG) is tracking UNC6040, a financially motivated threat cluster specializing in voice phishing (vishing) campaigns. This group is successfully impersonating IT support to gain access to organizations' Salesforce instances, primarily to steal large volumes of data for subsequent extortion. Their tactics rely heavily on manipulating end users rather than exploiting software vulnerabilities. 

Key Insights: 

• Vishing is Key: UNC6040 uses convincing phone calls, often targeting English-speaking employees, to socially engineer access. 

• Salesforce Data Loader Abuse: They trick victims into authorizing malicious versions of Salesforce Data Loader, gaining broad access to exfiltrate sensitive data. 

• Lateral Movement: After Salesforce, they use stolen credentials for lateral movement into other cloud platforms like Okta and Microsoft 365. 

• No Platform Vulnerability: Attacks exploit user trust and process gaps, not inherent Salesforce flaws. 

• Persistent Threat: Extortion can occur months after the initial intrusion, indicating a patient and persistent threat. 

Further Reading: The Cost of a Call: From Voice Phishing to Data Extortion 

June 2025 - ExploreSec Cybersecurity Awareness Newsletter

This is a monthly newsletter I put together for an internal security awareness program. Feel Free to grab and use for your own program.

Be Cautious of Government Emails About Unpaid Tolls and Other Urgent Matters 

Have you recently received an email from a government agency about an unpaid toll or another urgent issue? It's important to be extra careful, as cybercriminals are now exploiting official government email systems to send out scam messages. 

Key Insights: 

• Scammers are using official-looking emails that appear to come from legitimate government departments. 

• A common scam involves emails claiming unpaid tolls and urging you to click a link to pay. 

• Be wary of urgent requests for information or payment designed to pressure you. 

• Always check the actual web address of a link by hovering over it without clicking. Suspicious or non-official links should be avoided. 

• Never share personal or financial information through links in suspicious emails. 

• Independently verify any questionable government emails by contacting the agency directly through their official website or phone number. 

Further Reading: TechCrunch 

Beware of Crypto Scams Promoted Through Hacked Social Media 

The Internet Crime Complaint Center (IC3) has issued a public service announcement warning about a growing trend: scammers are taking over social media accounts and using them to trick people into investing in fake cryptocurrency schemes. These scams can look very convincing because they appear to come from accounts you or your friends might already follow. 

Key Insights to Protect Yourself: 

• Be suspicious of investment opportunities shared via social media: Even if a post comes from a friend's account, be very cautious about any cryptocurrency investment being promoted. Their account may have been hacked. 

• Look for red flags in investment promises: Be wary of claims of guaranteed high returns with little to no risk. Legitimate investments always carry some level of risk. 

• Don't rush into investment decisions: Scammers often create a sense of urgency to pressure you into investing quickly before you have time to think it over or do your research. 

• Verify the information through official sources: Before investing in any cryptocurrency opportunity, independently research the platform or opportunity through trusted financial news outlets and official cryptocurrency websites. Don't rely solely on what you see on social media. 

• Be cautious of direct messages about investments: If you receive unsolicited direct messages on social media encouraging you to invest in cryptocurrency, treat them with extreme caution, even if they appear to be from someone you know. 

• Report suspicious activity: If you see suspicious cryptocurrency promotions on social media, report them to the platform. If you have been a victim of such a scam, file a complaint with the IC3 at ic3.gov. 

Remember: If an investment opportunity sounds too good to be true, it probably is. 

Further Reading: IC3 

Hacked TikTok Videos Push Fake Apps and Steal Your Info! 

Trend Micro researchers have uncovered a concerning new trend: videos on TikTok are promoting what appear to be pirated apps, but are actually designed to trick you into downloading dangerous "infostealer" malware like Vidar and StealC. These videos use clever social engineering, providing step-by-step instructions that lead users to compromise their own systems. 

Key Insights: 

• Be Skeptical of "Free" Pirated Apps: If an offer seems too good to be true, especially for paid software offered for free, it's very likely a scam. 

• Avoid Unsolicited Technical Instructions: Never follow commands or instructions from untrusted sources, particularly if they tell you to disable security features or run unusual software. 

• Verify Video Sources: Just because a video is popular doesn't mean it's legitimate. Be cautious of content that pushes you to download files or visit external sites. 

• Recognize Social Engineering: Scammers use convincing visuals and instructions to make their malicious content seem harmless and easy to follow. Always pause and think before acting. 

Further Reading: Trend Micro 

Watch Out for Payroll Scams and Fake Login Pages! 

Cybercriminals are getting sneakier, using new tricks to steal your paycheck. A recent alert highlights how attackers are using "SEO poisoning" to create fake payroll login pages that show up at the top of search results. If you fall for it and enter your login details, they can change your direct deposit information and reroute your pay! 

Key Insights: 

• Access Payroll Directly: Don't rely on search engines. Always go to your payroll portal by typing the official website address directly into your browser or using a trusted bookmark. 

• Enable Multi-Factor Authentication (MFA): If your payroll portal offers MFA (like a code sent to your phone), enable it! This adds an extra layer of security. 

• Be Wary of Suspicious Changes: Set up alerts in your payroll software to notify you of any changes to your direct deposit information. If you get an unexpected alert, investigate immediately. 

• Report Unauthorized Changes: Know how to report any unauthorized changes or suspicious activity to your HR or IT department right away. 

• Update Your Devices: Keep your home office routers and mobile devices updated with the latest software and use strong, unique passwords. Attackers can exploit weaknesses in outdated systems to hide their activities. 

Further Reading: ReliaQuest 

Deceptive CAPTCHA "ClickFix" Campaign Uses Clipboard Injection to Deliver Malware 

Threat actors are employing a new social engineering campaign, dubbed "ClickFix," that utilizes fake CAPTCHA prompts on compromised or cloned websites. This sophisticated technique tricks users into launching malware by combining clipboard injection with abuse of the Windows Run dialog, leading to the delivery of payloads like Lumma Stealer and NetSupport RAT. 

Key Insights: 

• Social Engineering Focus: The campaign heavily relies on user fatigue with CAPTCHA mechanisms, guiding victims through seemingly familiar steps to execute malicious code. 

• Clipboard Injection & Run Dialog Abuse: The core of the attack involves copying a malicious PowerShell or mshta command to the clipboard, which users are then instructed to paste and execute in the Windows Run dialog. 

• Living Off the Land Binaries (LOLBins): Attackers extensively use trusted system binaries like PowerShell, mshta.exe, and certutil.exe to bypass traditional security defenses, making detection challenging. 

• Payloads: Frequently observed payloads include infostealers (e.g., Lumma Stealer targeting browser data, credentials, and crypto wallets) and remote access tools (e.g., NetSupport RAT for full system access). 

• Simplicity and Effectiveness: The campaign's success stems from its simplicity, avoiding zero-day exploits or complex hidden mechanisms, relying instead on user interaction. 

• Proactive Defense: This campaign underscores the need for robust endpoint detection and response (EDR) solutions capable of behavioral analysis and detection of LOLBin abuse, alongside user education on suspicious CAPTCHA prompts and the dangers of pasting unknown commands. 

Further Reading: SecurityOnline.info 

Cybercriminals Exploit AI Hype to Spread Malware 

Cybercriminals are increasingly exploiting the public's interest in artificial intelligence by creating fake AI-themed websites and advertisements to distribute malware. A recent campaign identified by Mandiant Threat Defense involves the threat group UNC6032 using deceptive ads on platforms like Facebook and LinkedIn to lure users into downloading malicious software disguised as AI video generation tools. 

Key Insights: 

• Deceptive Advertising: Thousands of malicious ads have been disseminated, impersonating legitimate AI tools such as Luma AI and Canva Dream Lab. These ads direct users to fraudulent websites designed to mimic authentic AI services. 

• Malware Deployment: Upon interacting with these fake sites, users are prompted to download a ZIP file containing the STARKVEIL malware dropper. This dropper installs multiple malware components, including GRIMPULL, XWORM, and FROSTRIFT, which are designed to steal sensitive information and establish persistent access to the victim's system. 

• Information Theft: The deployed malware targets a range of data, including login credentials, cookies, credit card information, and digital wallet contents. Some components, like XWORM, also perform keylogging and screen capture, further compromising user privacy. 

• Evasion Techniques: The malware employs sophisticated methods to avoid detection, such as using Braille pattern blank characters to obscure file extensions and leveraging legitimate processes for malicious activities. 

This campaign underscores the importance of vigilance when engaging with online advertisements, especially those offering AI-related services. Users should be cautious of unsolicited offers and verify the legitimacy of websites before downloading any software. 

Further Reading: Google Cloud Blog 

Beyond the Kill Chain: How Cybercriminals Invest Their Profits 

Sophos X-Ops' five-part series, Beyond the Kill Chain, explores what happens after a successful cyberattack. The series reveals how financially motivated threat actors invest their illicit earnings—often blending legitimate business with ethically questionable and outright criminal ventures. 

Key Insights: 

• Legitimate Business Ventures: Cybercriminals are investing in seemingly lawful enterprises such as restaurants, real estate, and e-commerce platforms. These ventures help launder money while also creating additional income streams. 

• Ethically Dubious Activities: Some threat actors operate in legal gray zones, selling spyware, monetizing vulnerability research under the guise of security services, or manipulating online traffic for advertising profits. 

• Criminal Enterprises: Illicit gains are also funneled into traditional criminal operations like counterfeit goods, drug trafficking, and underground gambling, showing how cybercrime supports broader organized crime ecosystems. 

• Implications for Cybersecurity: Mapping how threat actors reinvest their profits helps threat intelligence teams understand evolving risk models and disrupt the infrastructure supporting ongoing cybercriminal activity. 

Further Reading: Sophos News 

CFOs Targeted in Sophisticated Spear-Phishing Campaign 

A recent spear-phishing campaign is targeting Chief Financial Officers (CFOs) and finance executives across banking, energy, insurance, and investment sectors in regions including Europe, Africa, Canada, the Middle East, and South Asia. The attackers use a multi-stage approach to deploy NetBird, a legitimate WireGuard-based remote access tool, onto compromised systems. 

Key Insights: 

• Deceptive Recruitment Emails: The campaign begins with emails impersonating a Rothschild & Co recruiter offering a “strategic opportunity.” Victims are directed to a Firebase-hosted page featuring a custom CAPTCHA to access a malicious file. 

• Malicious Payload Delivery: After solving the CAPTCHA, users download a ZIP file containing a VBS script. When executed, it installs NetBird and OpenSSH, creates a hidden local admin account, and enables Remote Desktop Protocol (RDP) for persistent attacker access. 

• Evasion Techniques: The use of custom CAPTCHAs and trusted hosting services helps the attackers bypass traditional security defenses and increases credibility. 

• Attribution: Some infrastructure overlaps with known nation-state campaigns, but the specific threat actor remains unidentified. 

Further Reading: Trellix Blog 

Threat Actors Exploit Google Apps Script for Evasive Phishing Attacks 

Threat actors are leveraging Google's Apps Script platform to host phishing pages that appear legitimate, allowing them to steal login credentials. These campaigns often begin with emails posing as invoice notifications, linking to webpages hosted using Google Apps Script. By operating within Google's trusted environment, attackers make their phishing pages seem more authentic, increasing the chances of success. 

Key Insights: 

• Abuse of Trusted Services: Google Apps Script, a JavaScript-based platform used for automating Google Workspace tasks, is being exploited to host fake login pages that capture user credentials and send them to attacker-controlled servers. 

• Evasion of Security Measures: Because the scripts are hosted on Google's own domain, they can bypass traditional email and web filters that typically block suspicious domains. 

• Sophisticated Phishing Techniques: The phishing emails and login prompts are convincingly designed to mimic legitimate services, making it more likely that targets will engage and provide sensitive information. 

Further Reading: BleepingComputer 

Cybercriminals Use Fake Booking Sites to Spread AsyncRAT Malware 

Cybercriminals are exploiting fake Booking.com websites to infect users with AsyncRAT, a remote access trojan. Victims are lured through deceptive ads and social media links to counterfeit booking sites, where they are tricked into running a malicious PowerShell script. The attack results in full remote control of the infected system, putting sensitive personal information at risk. 

Key Insights: 

• Attackers use fake CAPTCHA prompts to manipulate users into executing malware. 

• The AsyncRAT payload allows for full system access, including surveillance and data theft. 

• Domains rotate every few days, making detection and blocking more difficult. 

Further Reading: Malwarebytes Blog 

UNC6040 – Voice Phishing to Salesforce Data Extortion 

Google Threat Intelligence Group (GTIG) is tracking UNC6040, a financially motivated threat cluster specializing in voice phishing (vishing) campaigns. This group is successfully impersonating IT support to gain access to organizations' Salesforce instances, primarily to steal large volumes of data for subsequent extortion. Their tactics rely heavily on manipulating end users rather than exploiting software vulnerabilities. 

Key Insights: 

• Vishing is Key: UNC6040 uses convincing phone calls, often targeting English-speaking employees, to socially engineer access. 

• Salesforce Data Loader Abuse: They trick victims into authorizing malicious versions of Salesforce Data Loader, gaining broad access to exfiltrate sensitive data. 

• Lateral Movement: After Salesforce, they use stolen credentials for lateral movement into other cloud platforms like Okta and Microsoft 365. 

• No Platform Vulnerability: Attacks exploit user trust and process gaps, not inherent Salesforce flaws. 

• Persistent Threat: Extortion can occur months after the initial intrusion, indicating a patient and persistent threat. 

Further Reading: The Cost of a Call: From Voice Phishing to Data Extortion 

April 2025 - ExploreSec Cybersecurity Threat Intelligence Newsletter

This is a newsletter I create and share with my internal security team. Feel free to grab and do the same.

Camera Off: Akira Deploys Ransomware via Webcam 

Akira, a notorious ransomware group, has demonstrated a novel technique by bypassing Endpoint Detection and Response (EDR) tools through the compromise of unsecured webcams. After facing detection while attempting to deploy ransomware on a Windows server, Akira pivoted to target a vulnerable webcam on the victim's network. This device, running a lightweight Linux OS and lacking EDR, allowed the group to deploy Linux-based ransomware successfully. This incident emphasizes the importance of securing IoT devices and enhancing patch management strategies. 

Key Insights: 

• IoT devices, such as webcams, can be used as pivot points for attackers to bypass traditional security tools like EDR. 

• Akira's adaptability highlights how ransomware groups are evolving and using multiple platforms for attacks. 

• Organizations should prioritize securing all devices, including IoT, and ensuring comprehensive patch management. 

Further Reading: S-RM 

Not Just for Developers: How Product and Security Teams Can Use GitHub Copilot 

GitHub Copilot is transforming not just development teams but also product and security teams. With its AI-powered code generation, it can assist security teams in identifying vulnerabilities faster and help product teams in generating feature specifications or optimizing documentation. Copilot's integration into the workflow allows these teams to accelerate their tasks and focus more on strategy rather than repetitive tasks, improving efficiency and productivity across the board. 

Key Insights: 

• GitHub Copilot isn't just for coders; it’s valuable for security and product teams too. 

• It accelerates vulnerability identification and aids in documentation and feature specification. 

• Teams can leverage AI to improve efficiency and focus on high-impact work. 

Further Reading: GitHub Blog 

Blink and They're In: How Rapid Phishing Attacks Exploit Weaknesses 

Phishing attacks are accelerating, with attackers exploiting weaknesses in systems faster than security teams can respond. In one notable case, attackers gained control of a network in just 48 minutes using social engineering and a flood of spam emails, followed by convincing employees to give remote access. These attacks leverage low-tech tactics, such as using legitimate tools like Microsoft Teams and Quick Assist, to bypass security defenses. 

Key Insights: 

• Attackers are exploiting basic social engineering tactics, such as impersonating IT help desks, to gain control of devices. 

• Rapid response times (48 minutes in this case) highlight the need for automated security measures. 

• Preventative measures include verifying help-desk staff interactions and locking down remote access tools like Quick Assist. 

Further Reading: ReliaQuest 

ACRStealer Infostealer Exploiting Google Docs as C2 

ACRStealer, a new type of infostealer, is taking a unique approach by using Google Docs as an intermediary command-and-control (C2) server. Threat actors hide malicious commands within Google Docs files, leveraging Base64 encoding to keep the communication with the C2 server hidden. The infostealer targets a wide range of sensitive information, including browser data, cryptocurrency wallet files, FTP credentials, and even chat program data. This shift in tactics highlights the evolving nature of cybercrime and the need for robust monitoring and secure data handling practices to detect and prevent such attacks. 

Key Insights: 

• ACRStealer uses Google Docs, telegra.ph, and Steam as intermediary C2 servers, making it harder to detect the malware's activity. 

• The malware targets sensitive data like browser history, cryptocurrency wallet files, and FTP credentials. 

• It continues to evolve by hiding its communication strings within different services to evade detection. 

Further Reading: AhnLab 

SecTopRAT Bundled in Chrome Installer Distributed via Google Ads 

A new phishing attack is leveraging Google Ads to distribute a fake Google Chrome installer bundled with SecTopRAT, a remote access Trojan (RAT) with stealer capabilities. Users searching for the legitimate Google Chrome installer are led to a malicious Google Sites page, where they unknowingly download the malware disguised as Chrome. The attack bypasses Windows Defender by dynamically retrieving and decrypting the malicious payload, allowing attackers to inject the malware into a legitimate process, giving them control of the victim's system. 

Key Insights: 

• The malware is hidden in a fake Chrome installer, which is distributed through Google Ads and Google Sites. 

• Once installed, SecTopRAT is deployed, giving attackers remote access and the ability to steal sensitive data. 

• The attack evades detection by dynamically downloading the malware and using anti-virus evasion techniques. 

Further Reading: Malwarebytes 

Abusing CSS for Evasion and Tracking: A New Threat 

Cybercriminals are increasingly abusing Cascading Style Sheets (CSS) to evade detection and track users. By using techniques like hidden text salting, attackers can insert irrelevant, invisible content into emails to bypass spam filters and email parsers. This method can also be used to track user actions and preferences, even when email clients restrict dynamic content like JavaScript. 

These tactics include setting text to invisible properties, manipulating opacity, and hiding content off-screen. Attackers can exploit this for phishing emails and even to fingerprint users based on their system configurations. 

Key Insights: 

• CSS properties like text-indent and opacity are used to conceal malicious content and bypass security measures. 

• CSS can also be abused for tracking user actions and preferences, allowing for advanced targeting in phishing campaigns. 

• Security teams should educate employees about these new evasion tactics and strengthen email defenses. 

Further Reading: Talos Intelligence 

Remote Monitoring and Management (RMM) Tools: Attackers’ First Choice 

Cybercriminals are increasingly turning to legitimate Remote Monitoring and Management (RMM) tools as their first-stage payloads in email campaigns. These tools, typically used by IT teams for managing multiple systems remotely, are now being exploited to collect data, steal finances, and deploy additional malware, including ransomware. In 2024, there was a marked shift, with RMM tools like ScreenConnect, Fleetdeck, and Atera replacing traditional loaders and botnets. This trend emphasizes the need for organizations to monitor remote management tools carefully and ensure they are not abused by attackers. 

Key Insights: 

• RMM tools are being used to facilitate cyberattacks by granting attackers remote access to systems. 

• The use of RMM tools as a first-stage payload is increasing, replacing older attack methods. 

• Organizations must secure their RMM tools and ensure they are used appropriately. 

Further Reading: Proofpoint Blog 

ClickFix: The Social Engineering Technique Hackers Use to Manipulate Victims 

The ClickFix technique has gained significant traction among cybercriminals due to its ability to manipulate users into executing malicious actions. By using a clever mix of human psychology and obfuscation, attackers deploy this technique to bypass security systems and install malware. The attack typically involves fake CAPTCHA-like elements, tricking victims into clicking on links or downloading malicious files. This technique has become increasingly popular due to its effectiveness in evading traditional detection methods. 

Key Insights: 

• ClickFix uses obfuscation to bypass security measures and execute malicious actions. 

• Attackers exploit human psychology to trick users into performing actions that compromise security. 

• Organizations should educate employees on recognizing manipulative tactics like ClickFix and improve multi-layered defenses. 

Further Reading: Group-IB Blog 

ESET Discovers Zero-Day Exploit in Windows Kernel (CVE-2025-24983) 

ESET Research has uncovered a zero-day exploit leveraging the CVE-2025-24983 vulnerability in the Windows Kernel, allowing attackers to elevate their privileges. First observed in the wild in March 2023, this exploit was used in conjunction with the PipeMagic backdoor, compromising targeted systems. The discovery highlights the continued use of kernel vulnerabilities in advanced attacks and the importance of regular patching and security monitoring to protect against zero-day threats. 

Key Insights: 

• The exploit targets a critical Windows Kernel vulnerability (CVE-2025-24983), enabling privilege escalation. 

• The attack was first observed in March 2023 and delivered through the PipeMagic backdoor. 

• Organizations must prioritize timely updates and monitoring for signs of this and similar vulnerabilities. 

Further Reading: ESET Research on Bluesky 

From Data to Defense: Insights from ReliaQuest’s 2025 Annual Threat Report 

The 2025 Annual Threat Report from ReliaQuest reveals the rapidly increasing speed of cyberattacks, with attackers moving from initial access to lateral movement in just 48 minutes. AI and automation are now key tools for both attackers and defenders, with organizations needing to integrate AI-driven solutions to keep pace. Phishing remains the primary method of attack, but ransomware tactics are evolving, with more emphasis on data exfiltration rather than encryption. The report offers actionable recommendations, including the need for automated responses, securing remote services, and enhancing logging practices to better track and prevent breaches. 

Key Insights: 

• Attackers now complete lateral movement in 48 minutes, stressing the importance of rapid detection and response. 

• AI and automation are critical to addressing the evolving cyberthreat landscape. 

• Ransomware is shifting towards exfiltration and data extortion. 

Further Reading: ReliaQuest 

Microsoft 365 Targeted in New Phishing, Account Takeover Attacks 

New phishing campaigns are leveraging Microsoft 365's infrastructure to conduct account takeover (ATO) attacks, exploiting tenant misconfigurations and using OAuth redirection. One campaign involves attackers sending phishing emails using Microsoft’s own infrastructure, making detection difficult. These emails, masquerading as legitimate Microsoft notifications, direct victims to call centers, bypassing security controls. Another attack uses OAuth apps pretending to be Adobe and DocuSign to steal credentials and deploy malware. Security teams must be vigilant in securing OAuth applications and scrutinizing internal communications. 

Key Insights: 

• Phishing attacks are exploiting Microsoft 365’s infrastructure for ATO attacks. 

• Attackers use fake support contacts and legitimate-looking emails to trick victims. 

• OAuth applications masquerading as trusted brands are used for stealing credentials and deploying malware. 

Further Reading: SecurityWeek 

AI Agent Attacks: A New Threat with Serious Implications 

AI agents, like OpenAI's Operator, are being used by attackers to automate cyberattacks such as phishing, malware creation, and setting up attack infrastructure. As these AI tools become more accessible, they lower the entry barrier for cybercriminals, increasing the risk of widespread and damaging attacks. 

Key Insights: 

• AI agents automate complex attacks, including phishing and malware creation. 

• These tools reduce the effort required for attacks, making them more accessible to cybercriminals. 

• Organizations should strengthen detection systems and control access to mitigate AI-driven threats. 

Further Reading: Symantec Blog 

JavaGhost’s Persistent Phishing Attacks From the Cloud 

JavaGhost, an active cybercriminal group, has evolved from website defacement to launching sophisticated phishing attacks. They exploit misconfigurations in Amazon Web Services (AWS) environments, leveraging services like Amazon Simple Email Service (SES) to send phishing emails using the infrastructure of compromised organizations. These attacks are particularly insidious, bypassing traditional email protections due to the legitimacy of the sending source. JavaGhost has adapted advanced evasion techniques to obscure their activities, making detection harder for defenders. 

Key Insights: 

• JavaGhost exploits AWS misconfigurations to send phishing emails, bypassing email protections. 

• They use advanced evasion techniques to obscure their presence in cloud logs. 

• Organizations must secure AWS environments, restrict IAM permissions, and implement enhanced detection methods. 

Further Reading: Unit42 Blog 

Buying Browser Extensions: A Dangerous Security Risk 

In a recent investigation, it was revealed how attackers are buying up popular browser extensions and using them for malicious purposes. Extensions that started as helpful tools can easily be sold to the highest bidder, transforming into spyware or data harvesters without the original developers or users being notified. This risky practice allows new owners to repurpose permissions, such as tracking browsing behavior or stealing sensitive data, all without any visible changes to the extension’s appearance. 

Key Insights: 

• Extensions can be sold and repurposed for malicious use, including tracking user data or even stealing login credentials. 

• The process of transferring ownership of extensions is relatively easy, with few security checks from platforms like Google Chrome. 

• Organizations should actively monitor the extensions in use and verify the legitimacy of any new updates or ownership changes to prevent security risks. 

Further Reading: Secure Annex Blog 

Menlo Security Report: 130% Increase in Zero-Hour Phishing Attacks and Nearly 600 Incidents of GenAI Fraud 

Menlo Security's 2025 State of Browser Security Report reveals a 130% increase in zero-hour phishing attacks and highlights nearly 600 incidents of GenAI fraud. Attackers are using generative AI to impersonate legitimate platforms and manipulate users into disclosing personal information. Additionally, cybercriminals are leveraging sophisticated evasion techniques to bypass traditional security systems. With phishing sites growing by nearly 700% since 2020, organizations must prioritize browser security to mitigate these evolving threats. 

Key Insights: 

• A surge in generative AI-based fraud, with cybercriminals impersonating platforms to steal personal data. 

• Nearly 1M new phishing sites are created monthly, reflecting a 700% increase since 2020. 

• Attackers are increasingly exploiting cloud services like AWS and CloudFlare for malicious content hosting. 

Further Reading: Menlo Security 

Is Firebase Phishing a Threat to Your Organization? 

Firebase, a platform commonly used for app development, has been exploited in phishing attacks targeting organizations. Attackers can hijack Firebase’s authentication services to launch phishing campaigns, tricking users into divulging sensitive information. These attacks can be used to steal credentials, and in some cases, manipulate cloud-based services that organizations rely on. With Firebase being a trusted service, users may not immediately recognize these phishing attempts, making it a potent tool for attackers. 

Key Insights: 

• Firebase is being exploited for phishing attacks, often targeting organizations’ authentication systems. 

• Users may unknowingly fall victim due to Firebase’s trusted reputation. 

• Organizations need to be aware of how Firebase can be misused and take proactive measures to secure their systems. 

Further Reading: Check Point Blog 

RansomHub's EDRKillShifter: Unveiling Evolving Ransomware Tactics 

ESET's recent research delves into RansomHub, a prominent ransomware-as-a-service (RaaS) group that emerged in early 2024. The study uncovers RansomHub's connections to established gangs like Play, Medusa, and BianLian, highlighting the dynamic nature of ransomware operations. A focal point of the research is EDRKillShifter, a custom tool developed by RansomHub to disable endpoint detection and response (EDR) systems, enhancing the effectiveness of their attacks. This tool exemplifies the evolving sophistication of ransomware tactics, emphasizing the need for advanced security measures to counteract such threats.  

Key Insights: 

• RansomHub's Emergence: Rapidly rose to prominence in 2024, surpassing established ransomware groups in activity.  

• EDRKillShifter Tool: A custom-developed EDR killer that targets various security solutions to facilitate attacks.  

• Affiliate Connections: Links between RansomHub and other ransomware gangs, suggesting a fluid and interconnected threat landscape.  

Further Reading: ESET Research 

Google Announces Sec-Gemini v1: An Experimental AI Model for Cybersecurity 

Google has introduced Sec-Gemini v1, an experimental AI model designed to enhance cybersecurity operations. By integrating advanced reasoning capabilities with near real-time cybersecurity knowledge, Sec-Gemini v1 aims to improve tasks such as incident root cause analysis, threat analysis, and understanding vulnerability impacts. The model combines Gemini's AI capabilities with data from sources like Google Threat Intelligence (GTI) and the Open Source Vulnerabilities (OSV) database, resulting in superior performance on key cybersecurity benchmarks. Google is offering Sec-Gemini v1 to select organizations, institutions, professionals, and NGOs for research purposes to foster collaboration in advancing AI-driven cybersecurity solutions.  

Key Insights: 

• Sec-Gemini v1 integrates AI with real-time cybersecurity data to enhance security operations.  

• The model outperforms others on benchmarks like CTI-MCQ and CTI-Root Cause Mapping.  

• Google is providing access to Sec-Gemini v1 for research collaborations to advance AI in cybersecurity.  

Further Reading: Google Security Blog 

Off the Beaten Path: Recent Unusual Malware 

Unit 42 researchers have identified several distinctive malware samples exhibiting uncommon characteristics and techniques: 

• C++/CLI IIS Backdoor: A passive backdoor for Internet Information Services (IIS) developed using C++/CLI—a rarely used programming language in malware development. It employs evasive techniques to facilitate unauthorized access. 

• Dixie-Playing Bootkit: This bootkit leverages an unsecured kernel driver to install a GRUB 2 bootloader in a highly unconventional way, showing a creative approach to persistence and system control. 

• ProjectGeass Post-Exploitation Framework: A Windows-based implant of a cross-platform post-exploitation framework written in C++. While not groundbreaking in technique, its atypical structure distinguishes it from mainstream frameworks. 

These samples demonstrate the evolving nature of malware and the increasing variety of methods attackers are using to bypass defenses. 

Further Reading: Unit 42 Blog 

ClickFix: A Deceptive Malware Deployment Technique 

Cybercriminals are employing a tactic known as "ClickFix," which masquerades as a CAPTCHA verification to trick users into executing commands that download malware. This scheme prompts users to press a series of keyboard shortcuts—Windows + R, Ctrl + V, and Enter—that open the Run dialog, paste malicious code, and execute it via mshta.exe, a legitimate Windows utility. This method has been used to deliver various malware families, including XWorm, Lumma Stealer, and AsyncRAT. 

Key Insights: 

• ClickFix attacks exploit user actions to bypass security measures, leading to the installation of credential-stealing malware. 

• Industries such as hospitality and healthcare have been targeted, with attackers impersonating trusted entities like Booking.com. 

• The attack leverages legitimate Windows functionalities (mshta.exe) to execute malicious code, complicating detection efforts. 

Further Reading: Krebs on Security 

PoisonSeed Phishing Campaign Targets Email and CRM Providers 

The PoisonSeed phishing campaign has been identified targeting email and CRM providers, including Mailchimp, Mailgun, and Zoho, to gain unauthorized access to high-value accounts. Attackers create convincing phishing pages that closely resemble legitimate login portals to harvest user credentials. Once access is obtained, they download email lists for use in cryptocurrency-related spam operations. Notably, security expert Troy Hunt fell victim to such an attack, highlighting the sophistication of these phishing attempts. 

Key Insights: 

• PoisonSeed employs highly convincing phishing pages to compromise accounts of email and CRM service providers. 

• Compromised accounts are used to disseminate cryptocurrency-related spam, potentially leading to further financial fraud. 

• Even cybersecurity professionals have been deceived by these tactics, underscoring the need for heightened awareness. 

Further Reading: CSO Online 

98% Increase in Phishing Campaigns Using Russian (.ru) Domains 

Recent analyses have revealed a 98% surge in phishing campaigns hosted on Russian (.ru) top-level domains (TLDs) between December 2024 and January 2025. These campaigns primarily aim to harvest user credentials by employing tactics such as QR codes, auto-redirects, and multi-layered attachments to direct victims to phishing websites. Notably, many of these phishing emails have bypassed security products, including Exchange Online Protection and Barracuda Email Security Gateway. 

Key Findings: 

• 1,500 unique .ru domains identified in the campaign. 

• 377 new domains registered with the "bulletproof" registrar R01-RU. 

• Over 13,000 malicious emails reported. 

• 2.2% of observed emails from .ru domains were phishing attempts. 

• Average age of a .ru domain used in these attacks is 7.4 days. 

Industries Targeted: 

• Business and Economy (36.09%) 

• Financial Services (12.44%) 

• News & Media (8.27%) 

• Health and Medicine (5.6%) 

• Government (4.51%) 

Further Reading: KnowBe4 Blog 

Pharmacist Allegedly Used Keyloggers to Spy on Coworkers at Maryland Hospital 

A former pharmacist at the University of Maryland Medical Center is accused of secretly installing keylogging software on nearly 400 hospital computers over a decade. The class-action lawsuit claims he accessed coworkers’ login credentials, personal files, and even activated webcams in patient exam rooms. The hospital is also being sued for allegedly failing to detect or respond to the breach in a timely manner. 

Key Insights: 

• Keyloggers were reportedly used to steal credentials and access private communications. 

• The software was allegedly installed across hundreds of hospital systems without detection. 

• The incident underscores the importance of monitoring for insider threats and unauthorized software. 

Further Reading: The Record 

April 2025 - ExploreSec Cybersecurity Awareness Newsletter

This is a monthly newsletter I put together for an internal security awareness program. Feel Free to grab and use for your own program.

Macs Targeted by Infostealers in New Era of Cyberthreats 

A new wave of cyberattacks is targeting Mac users with infostealers, malicious programs designed to steal sensitive data like passwords and credit card details. Infostealers have traditionally targeted Windows devices, but in recent years, cybercriminals have turned their attention to Macs. One such threat, Poseidon, is the most active infostealer on Mac today, stealing data from over 160 cryptocurrency wallets, web browsers, and password managers. Cybercriminals use malvertising to deliver these threats, making it crucial for Mac users to be cautious when downloading software and visiting unfamiliar websites. 

Key Insights: 

• Poseidon and other infostealers are now targeting Macs, stealing sensitive data such as passwords and cryptocurrency wallet info. 

• Malicious advertising (malvertising) is being used to trick users into downloading infostealers instead of desired software. 

• Macs are becoming a key target for cybercriminals, and users must exercise caution and implement strong security measures. 

Further Reading: Malwarebytes 

Google Now Allows Digital Fingerprinting of Its Users 

In a shift from its earlier stance, Google has started allowing digital fingerprinting of its users, a practice that could raise significant privacy concerns. This method collects various pieces of data—such as operating system, browser type, IP address, and plugins—to create a unique identifier for users, even when cookies are cleared. While this allows advertisers to track users across sites, it also bypasses the limitations of cookie-blocking tools. 

Key Insights: 

• Digital fingerprinting creates a unique ID for users based on their browser and device characteristics. 

• This technique enables tracking even after cookies are cleared, circumventing privacy protections. 

• Users can take steps to counteract fingerprinting by using privacy-focused browsers, VPNs, and browser extensions. 

Further Reading: Malwarebytes Blog 

FTC Reports $12.5 Billion in Fraud Losses in 2024 

The Federal Trade Commission (FTC) has revealed a staggering increase in fraud-related losses, with reported damages reaching $12.5 billion in 2024. This surge is driven by a combination of online scams, phishing, and identity theft, with a notable increase in fraud targeting older adults and specific industries. As scammers continue to refine their techniques, organizations must remain vigilant and proactive in educating employees and customers on how to recognize and avoid these threats. 

Key Insights: 

• Fraud losses in 2024 hit $12.5 billion, with a significant increase in online scams and identity theft. 

• Older adults and certain sectors are being disproportionately targeted. 

• Organizations must enhance education efforts and improve customer protection measures to mitigate the growing threat. 

Further Reading: FTC Press Release 

DeepSeek Found to Be Sharing User Data with TikTok Parent Company ByteDance 

DeepSeek, an AI app, has been caught secretly sharing user data with ByteDance, the parent company of TikTok. The South Korean Personal Information Protection Commission (PIPC) uncovered that DeepSeek automatically transmitted user data every time the app was accessed, doing so without user consent. This data-sharing practice raises serious concerns about privacy, particularly in light of the ongoing scrutiny surrounding ByteDance’s handling of user data. South Korea has removed DeepSeek from app stores and is considering stronger regulations on foreign companies in the country. 

Key Insights: 

• DeepSeek was found transmitting user data to ByteDance servers without user consent. 

• This app highlights growing concerns about data privacy in AI technologies. 

• South Korea has taken action by removing the app and considering stronger regulations on foreign tech companies. 

Further Reading: Malwarebytes 

Beware of DeepSeek Hype: It's a Breeding Ground for Scammers 

As DeepSeek, an AI language model from China, gains popularity, cybercriminals are capitalizing on its rise with various scams targeting unsuspecting users. Fake websites, malicious developer tools, phishing on social media, and fraudulent investment schemes are being used to trick individuals into disclosing sensitive data or making financial losses. Scammers are even leveraging DeepSeek's name to promote fake cryptocurrency tokens and fake pre-IPO shares. 

Key Insights: 

• Scammers are using fake websites and social media accounts to impersonate DeepSeek and steal user data. 

• Malicious Python packages were uploaded to PyPI, disguised as DeepSeek developer tools, to steal sensitive information. 

• Individuals and businesses must be cautious when downloading tools, verify sources, and implement strong security practices. 

Further Reading: SecurityWeek 

Predatory App Downloaded 100,000 Times from Google Play Store Steals Data, Uses It for Blackmail 

A malicious financial app, "Finance Simplified," has been downloaded over 100,000 times from the Google Play Store. This app, which belongs to the SpyLoan family, promises attractive loan terms but steals sensitive data such as contacts, call logs, and photos. Once the data is collected, the app uses it for blackmail, especially targeting users who fail to make loan payments. Although the app has been removed from the store, it continues to run on affected devices, collecting sensitive data in the background. Users are advised to change passwords, enable two-factor authentication, and monitor their identity for any misuse. 

Key Insights: 

• The app, masquerading as a loan provider, collects personal data for blackmail purposes. 

• Although removed from the Google Play Store, the app still runs on affected devices. 

• Users should take immediate steps to secure their data by changing passwords and enabling two-factor authentication. 

Further Reading: Malwarebytes 

Microsoft 365 Targeted in New Phishing, Account Takeover Attacks 

New phishing campaigns are leveraging Microsoft 365's infrastructure to conduct account takeover (ATO) attacks, exploiting tenant misconfigurations and using OAuth redirection. One campaign involves attackers sending phishing emails using Microsoft’s own infrastructure, making detection difficult. These emails, masquerading as legitimate Microsoft notifications, direct victims to call centers, bypassing security controls. Another attack uses OAuth apps pretending to be Adobe and DocuSign to steal credentials and deploy malware. Security teams must be vigilant in securing OAuth applications and scrutinizing internal communications. 

Key Insights: 

• Phishing attacks are exploiting Microsoft 365’s infrastructure for ATO attacks. 

• Attackers use fake support contacts and legitimate-looking emails to trick victims. 

• OAuth applications masquerading as trusted brands are used for stealing credentials and deploying malware. 

Further Reading: SecurityWeek 

The Epochalypse Project: Addressing the 2038 Bug 

The Epochalypse Project is raising awareness about the 2038 bug, a critical vulnerability in 32-bit timestamp systems that will impact billions of devices worldwide starting January 19, 2038. The bug could cause major disruptions across industries, from healthcare to energy management, due to systems misinterpreting dates and malfunctioning. As the 2038 deadline approaches, the project aims to bring attention to this issue and develop solutions before it becomes a widespread problem. 

Key Insights: 

• The bug affects embedded devices and systems like medical equipment, IoT devices, and transportation infrastructure. 

• If unaddressed, it could cause critical system failures, including banking and security disruptions. 

• The project encourages global collaboration to identify and fix vulnerable systems before 2038. 

Further Reading: Epochalypse Project 

Is Firebase Phishing a Threat to Your Organization? 

Firebase, a platform commonly used for app development, has been exploited in phishing attacks targeting organizations. Attackers can hijack Firebase’s authentication services to launch phishing campaigns, tricking users into divulging sensitive information. These attacks can be used to steal credentials, and in some cases, manipulate cloud-based services that organizations rely on. With Firebase being a trusted service, users may not immediately recognize these phishing attempts, making it a potent tool for attackers. 

Key Insights: 

• Firebase is being exploited for phishing attacks, often targeting organizations’ authentication systems. 

• Users may unknowingly fall victim due to Firebase’s trusted reputation. 

• Organizations need to be aware of how Firebase can be misused and take proactive measures to secure their systems. 

Further Reading: Check Point Blog 

Evolution of Sophisticated Phishing Tactics: The QR Code Phenomenon 

Unit 42 researchers have observed a surge in phishing attacks leveraging QR codes, a tactic known as "quishing." Attackers embed malicious URLs within QR codes in documents that mimic legitimate services like DocuSign or Adobe Acrobat Sign. When scanned, these QR codes direct users to phishing sites designed to harvest credentials. Notably, some campaigns employ legitimate website redirection mechanisms and Cloudflare Turnstile for user verification, enhancing their credibility and evading security detection. These attacks have been widespread across the U.S. and Europe, impacting industries such as medical, automotive, education, energy, and finance. Unit 42 

Key Insights: 

• Quishing Tactics: Embedding phishing URLs in QR codes increases the likelihood of users accessing malicious sites, especially when personal devices with potentially weaker security are used.  

• Advanced Evasion Techniques: Utilizing legitimate redirection mechanisms and services like Cloudflare Turnstile allows attackers to bypass traditional security measures. Unit 42 

• Targeted Industries: A broad range of sectors, including medical, automotive, education, energy, and finance, have been affected, indicating the widespread applicability of this tactic. Unit 42 

Further Reading: Unit 42 Blog 

Tax-Themed Phishing Campaigns Surge Ahead of U.S. Tax Day 

As the April 15 tax deadline nears, Microsoft Threat Intelligence has observed a rise in phishing campaigns exploiting tax-related themes to steal credentials and deploy malware. These attacks use social engineering to impersonate IRS notices or tax document requests and incorporate tactics like QR codes, URL shorteners, and cloud-based file sharing to evade detection. Legitimate services, including Microsoft infrastructure, are being abused to enhance credibility and avoid filters. 

Key Insights: 

• Attackers are using tax season as a lure for phishing, often impersonating tax authorities or financial institutions. 

• Tactics include QR codes, shortened URLs, and links to legitimate cloud storage to bypass security tools. 

• Abuse of trusted platforms increases the likelihood of successful compromise. 

Further Reading: Microsoft Security Blog 

ClickFix: A Deceptive Malware Deployment Technique 

Cybercriminals are employing a tactic known as "ClickFix," which masquerades as a CAPTCHA verification to trick users into executing commands that download malware. This scheme prompts users to press a series of keyboard shortcuts—Windows + R, Ctrl + V, and Enter—that open the Run dialog, paste malicious code, and execute it via mshta.exe, a legitimate Windows utility. This method has been used to deliver various malware families, including XWorm, Lumma Stealer, and AsyncRAT. 

Key Insights: 

• ClickFix attacks exploit user actions to bypass security measures, leading to the installation of credential-stealing malware. 

• Industries such as hospitality and healthcare have been targeted, with attackers impersonating trusted entities like Booking.com. 

• The attack leverages legitimate Windows functionalities (mshta.exe) to execute malicious code, complicating detection efforts. 

Further Reading: Krebs on Security 

Pharmacist Allegedly Used Keyloggers to Spy on Coworkers at Maryland Hospital 

A former pharmacist at the University of Maryland Medical Center is accused of secretly installing keylogging software on nearly 400 hospital computers over a decade. The class-action lawsuit claims he accessed coworkers’ login credentials, personal files, and even activated webcams in patient exam rooms. The hospital is also being sued for allegedly failing to detect or respond to the breach in a timely manner. 

Key Insights: 

• Keyloggers were reportedly used to steal credentials and access private communications. 

• The software was allegedly installed across hundreds of hospital systems without detection. 

• The incident underscores the importance of monitoring for insider threats and unauthorized software. 

Further Reading: The Record 

Too Good to Be True? Text-Based Job Scam are Spiking

Feel free to take this blog post and use it for your own internal security awareness program.

Have you ever received a text message offering a part-time job with incredibly high pay and flexible hours? It might sound like the perfect opportunity—until you look a little closer. Over the weekend I received the text below.

At first glance, it seems like a dream gig: no experience needed, immediate pay, and high earnings. But this is a classic job scam designed to lure you in and exploit your trust. Scammers are aware of the current state of the U.S. economy and they are looking to exploit it for their own financial gain.

How These Scams Work:

• Initial Hook: They send a message with flattery and a compelling offer.

• Urgency or Exclusivity: They claim they found your profile and that it’s a unique opportunity.

• Off-Platform Contact: You’re asked to message them on WhatsApp or Telegram—a red flag.

• Fake Training or Tasks: You may be asked to complete “trial” work or even pay a fee up front.

• Financial Risk: Scammers might ask for personal sensitive information, send fake checks, or trick you into forwarding money.

Red Flags to Watch For:

• Vague company info (DSL? TEMU merchants?).

• Unrealistic pay for minimal effort.

• Requests to communicate on encrypted apps like WhatsApp.

• Spelling and grammar issues or overly generic language.

• No official email or website.

What You Can Do:

• Don’t respond to the message.

• Don’t click any links or share personal info.

• Report the message to your mobile provider (forward to 7726).

• Block the number and delete the message.

Stay alert. If a job offer seems too good to be true—it probably is.

Double-Check Before You Hit Send: A Real-World Reminder with Lessons for Healthcare

I created this blog post to share internally as part of security awareness. It’s focused on healthcare but feel free to grab and adjust based on your organization.

We often remind staff to double-check before sharing sensitive information—but a recent national security incident shows just how critical that habit really is. If top government officials can make this kind of mistake, so can we—and in healthcare, the consequences can be just as severe.

What Happened?

Recently, a Signal group chat meant for senior U.S. national security officials mistakenly included Jeffrey Goldberg, editor-in-chief of The Atlantic. The chat included operational details about military actions and involved key figures like the Secretary of Defense and CIA Director. The worst part? No one noticed Goldberg was there. He even left the group on his own, without anyone asking who he was or why he left.

The entire exchange happened on personal devices, outside of secure government systems—an environment where sensitive discussions have no business taking place.

Why This Matters in Healthcare

This story should strike a chord in healthcare. We work in an industry where confidentiality isn’t just a best practice—it’s the law. Whether it’s a patient’s diagnosis, treatment plan, or billing information, sharing sensitive data with the wrong person can lead to HIPAA violations, fines, reputational damage, and—most importantly—a loss of patient trust.

And here’s something we can’t overlook: internal mishaps cause more security incidents than external attacks. It’s not always hackers or ransomware actors—it’s misdirected emails, accidental disclosures, and staff using unapproved tools for convenience. These are preventable mistakes, but only if we stay mindful of how we handle sensitive information.

Best Practices for Handling Sensitive Information

• Verify recipients: Before sharing anything patient-related, make sure you’re communicating with the right colleague—especially in group chats or email threads.

• Use approved platforms: Consumer apps like Signal or iMessage are not secure for handling protected health information (PHI). Stick to tools your organization has approved for sensitive communication.

• Be aware of who's listening: Just because someone is in a conversation doesn’t mean they should be. If you don’t recognize a name, say something.

• Treat names and dates as sensitive too: Even something as simple as a patient’s name and appointment time can be considered PHI under HIPAA.

Security culture in healthcare means asking the hard questions, slowing down when it matters most, and protecting every patient’s privacy—one message at a time. Because it’s not just about following rules. It’s about earning the trust our patients place in us every single day.

March 2025 - ExploreSec Cybersecurity Threat Intelligence Newsletter

This is a monthly newsletter that I share internally with our Cybersecurity team. Feel free to take and use for your own team. Created with the help of ChatGPT.

Exploring Q4 2024 Brand Phishing Trends: Microsoft Remains the Top Target as LinkedIn Makes a Comeback 

In the final quarter of 2024, Microsoft continued to be the most targeted brand in phishing campaigns, but LinkedIn made a significant comeback, appearing as a top target for the first time in years. Phishing actors are increasingly leveraging trusted brands to deceive users, with attacks designed to steal sensitive credentials and install malware. Organizations must continue to strengthen defenses against these brand impersonation attacks to protect their users and data. 

Key Insights: 

• Microsoft remains the primary target in brand phishing campaigns, with attackers frequently using its name to trick users into disclosing credentials. 

• LinkedIn’s resurgence as a phishing target highlights the shifting tactics of cybercriminals, who are capitalizing on platforms that users trust. 

• Organizations need to implement strong anti-phishing measures, including employee training and advanced detection tools, to defend against these evolving threats. 

Further Reading: Checkpoint Blog 

Threat Actors Still Leveraging Legit RMM Tool ScreenConnect for Persistence in Cyberattacks 

Cybercriminals are continuing to exploit the legitimate remote monitoring and management (RMM) tool, ScreenConnect, to maintain persistence in cyberattacks. Threat actors are using social engineering to lure victims into installing altered versions of ScreenConnect, which gives them control over victims’ systems. This tool is particularly used to target sensitive data, with specific campaigns focused on Social Security recipients. The attacks are facilitated through bulletproof hosting providers, making it challenging to trace and mitigate these threats. 

Key Insights: 

• ScreenConnect is being used by threat actors to gain persistent access to victims’ systems. 

• Malicious versions of the software are being disguised as legitimate files, such as eStatements from the Social Security Administration. 

• Social engineering tactics are employed to trick users into installing compromised software. 

• Bulletproof hosting providers are being used to shelter malicious activities, making them harder to disrupt. 

Further Reading: Silent Push 

Hackers Spoof Microsoft ADFS Login Pages to Steal Credentials 

Hackers are spoofing Microsoft Active Directory Federation Services (ADFS) login pages to steal user credentials. This attack leverages the trust users have in Microsoft’s secure login page by creating fake versions that closely resemble the original. Once victims enter their credentials, the attackers steal the information for malicious purposes. This highlights the importance of verifying login pages and using multi-factor authentication to protect against such credential theft. 

Key Insights: 

• Hackers are creating fake versions of Microsoft ADFS login pages to capture user credentials. 

• These attacks rely on users trusting the Microsoft login page, making them difficult to detect. 

• Multi-factor authentication (MFA) and vigilant scrutiny of login pages can help prevent successful credential theft. 

Further Reading: BleepingComputer 

Racing the Clock: Outpacing Accelerating Attacks 

In 2024, cyberattack speeds surged, with the average breakout time dropping to just 48 minutes, a 22% reduction from the previous year. Key factors behind this acceleration include more efficient Ransomware-as-a-Service (RaaS) operations, a rise in infostealers, and the use of AI-powered penetration testing tools. As attacks become faster, organizations must enhance their security measures to match the pace of threat actors, leveraging automation and AI to reduce response times and contain attacks before they spread. 

Key Insights: 

• Breakout time—the time from initial access to lateral movement—has decreased to 48 minutes, making it crucial to respond quickly. 

• Infostealers and IABs (Initial Access Brokers) are driving faster breaches by providing quick access to compromised systems. 

• Automation and AI-driven tools are essential for organizations to respond to attacks more efficiently and minimize damage. 

Further Reading: ReliaQuest 

VidSpam: A New Threat Emerges as Bitcoin Scams Evolve from Images to Video 

Bitcoin scams targeting mobile users are evolving with attackers now using video-based spam (VidSpam) to deceive victims. These scammers are sending small video file attachments to lure individuals into fraudulent schemes. The videos often direct recipients to high-pressure WhatsApp groups where personal information or money is extracted. This evolution from image-based scams to video content marks a troubling trend in mobile security. 

Key Insights: 

• Attackers are using small video files (e.g., 14KB .3gp files) to promote Bitcoin scams through multimedia messages. 

• The video attachments encourage victims to join WhatsApp groups where scammers use pressure tactics to steal money or data. 

• As scammers refine their tactics, VidSpam is expected to increase, targeting unsuspecting mobile users. 

Further Reading: Proofpoint 

January 2025’s Most Wanted Malware: FakeUpdates Continues to Dominate 

FakeUpdates malware remains the top threat in January 2025, continuing its dominance in the malware landscape. This malware is primarily distributed through fake software updates that users are tricked into downloading. Once installed, it can enable attackers to take control of the system and steal sensitive information. The persistence of FakeUpdates emphasizes the need for cautious behavior when downloading updates and a heightened focus on secure software practices. 

Key Insights: 

• FakeUpdates continues to lead as one of the most used malware types, delivered through fake update prompts. 

• This malware is often disguised as legitimate updates, compromising systems and exfiltrating data. 

• Users should avoid downloading updates from unverified sources and ensure they only install software from trusted vendors. 

Further Reading: Checkpoint Blog 

Using Genuine Business Domains and Legitimate Services to Harvest Credentials 

Cybercriminals are increasingly using legitimate business domains and services to conduct credential harvesting attacks. By spoofing well-known companies and mimicking their email communications, attackers deceive users into providing their login information. These tactics often involve using business-looking email addresses and phishing links that lead to fake login pages. This trend underscores the need for businesses and consumers to be cautious when interacting with unsolicited messages. 

Key Insights: 

• Phishing attacks are increasingly using trusted business domains and services to trick users into disclosing credentials. 

• Attackers mimic legitimate emails to create fake login pages that steal sensitive information. 

• Users should be cautious of unsolicited messages and verify the authenticity of any login requests by visiting official websites directly. 

Further Reading: KnowBe4 Blog 

Protect Your Data: Russian Spear-Phishing Targets Microsoft 365 Accounts 

A new spear-phishing campaign linked to Russian threat actors is targeting Microsoft 365 users. The attackers use highly customized phishing emails that appear legitimate, aiming to steal login credentials and gain unauthorized access to sensitive information. With Microsoft 365 being a prime target, organizations should enhance their security by training users to recognize phishing attempts and implementing advanced security measures, including multi-factor authentication. 

Key Insights: 

• Russian threat actors are targeting Microsoft 365 accounts using personalized spear-phishing emails. 

• These attacks aim to steal credentials, putting sensitive data at risk. 

• Organizations should deploy multi-factor authentication and conduct regular security awareness training to protect against these threats. 

Further Reading: KnowBe4 Blog 

New Xerox Printer Flaws Could Let Attackers Capture Windows Active Directory Credentials 

Critical vulnerabilities have been found in Xerox VersaLink printers, allowing attackers to potentially capture Windows Active Directory credentials via pass-back attacks. These flaws, affecting firmware versions 57.69.91 and earlier, enable attackers to manipulate printer configurations and redirect authentication credentials. Successful exploitation could allow lateral movement within an organization's network, compromising servers and file systems. Immediate patching and enhanced security measures, such as strong admin passwords and disabling remote access, are advised. 

Key Insights: 

• Xerox VersaLink printers are vulnerable to attacks that can capture Windows Active Directory credentials. 

• Exploiting these vulnerabilities requires physical or remote access to the printer's control interface. 

• Organizations should patch printers immediately, enforce strong passwords, and limit access to vulnerable settings. 

Further Reading: The Hacker News 

ClickFix vs. Traditional Download in New DarkGate Campaign 

A new malvertising campaign has been observed using two different methods to deliver the DarkGate malware: the ClickFix technique and traditional file downloads. The ClickFix method involves a fake CAPTCHA-like page that tricks users into executing a malicious command, while the traditional approach uses a fake software download disguised as a legitimate app. Both methods ultimately deliver the DarkGate malware, highlighting the adaptability of threat actors in refining delivery techniques. 

Key Insights: 

• The ClickFix method tricks users into running malicious code by mimicking a CAPTCHA process. 

• The traditional download method uses fake installers to distribute malware. 

• Both methods successfully deliver DarkGate, with the ClickFix technique possibly yielding higher success rates. 

Further Reading: Malwarebytes 

Russian Phishing Campaigns Exploit Signal's Device-Linking Feature 

Russian phishing campaigns are exploiting the device-linking feature of the Signal messaging app to compromise user accounts. Attackers use malicious QR codes to trick targets into linking their Signal account to an attacker-controlled device, allowing them to monitor private conversations without fully compromising the target's device. This method has been observed in both large-scale campaigns and targeted attacks, especially against military personnel and high-value targets. 

Key Insights: 

• Attackers use malicious QR codes to link Signal accounts to their devices, enabling undetected access to encrypted communications. 

• These phishing techniques often involve impersonating legitimate resources, such as group invitations or app instructions. 

• Signal users are advised to update the app, check linked devices regularly, and enable two-factor authentication for added protection. 

Further Reading: BleepingComputer 

Phishing Attack Hides JavaScript Using Invisible Unicode Trick 

A new phishing attack technique is using invisible Unicode characters to hide malicious JavaScript. This approach involves obfuscating binary values within JavaScript payloads by replacing them with invisible Hangul characters, making the script appear empty. When executed, a proxy retrieves and reconstructs the original code. The attack is particularly difficult to detect, as it uses anti-debugging techniques and avoids triggering security scanners by exploiting whitespace. The campaign targets affiliates of a political action committee, employing highly personalized tactics. 

Key Insights: 

• The phishing attack uses invisible Unicode characters to obfuscate JavaScript payloads, making detection more challenging. 

• Anti-debugging techniques are employed to avoid analysis and redirect attackers if they detect delays in execution. 

• The attack is highly personalized and can evade security scanners by using empty spaces and encoding methods. 

Further Reading: BleepingComputer 

New Facebook Copyright Infringement Phishing Campaign 

A new phishing campaign has been detected targeting Facebook users with fake copyright infringement notices. The attackers use deceptive emails that appear to come from Facebook, claiming that users have violated copyright laws. The emails contain links to fake Facebook pages that prompt users to enter personal information, including passwords. This campaign highlights the ongoing threat of phishing attacks that impersonate trusted platforms like Facebook. 

Key Insights: 

• The phishing emails mimic Facebook's notifications about copyright violations to trick users into sharing sensitive data. 

• Victims are directed to fake pages designed to capture their credentials. 

• Users should be cautious about unsolicited emails and verify the authenticity of any official communications by visiting Facebook directly. 

Further Reading: Check Point Blog 

University Site Cloned to Evade Ad Detection, Distributes Fake Cisco Installer 

A recent malicious campaign involved cloning a German university website to evade ad detection, distributing a fake Cisco AnyConnect installer. The attackers leveraged a Google ad to direct users to a fraudulent site designed to mimic a legitimate university page, with the goal of deploying the NetSupport RAT. The malware, disguised as a Cisco update, was signed with a valid certificate and allowed attackers to remotely access infected systems. 

Key Insights: 

• Attackers cloned a university website to evade detection, delivering a fake Cisco installer via a Google ad. 

• The malware, NetSupport RAT, was hidden in a digitally signed installer and granted remote access to attackers. 

• Users should exercise caution when downloading software, especially from sponsored ads, and verify the authenticity of the source. 

Further Reading: Malwarebytes 

How Hunting for Vulnerable Drivers Unraveled a Widespread Attack 

An investigation into vulnerable drivers revealed a widespread attack exploiting these weaknesses to gain unauthorized access. Attackers used outdated or unpatched drivers to deploy malware and maintain persistence within compromised systems, bypassing traditional security measures. This emphasizes the need for regular updates and comprehensive vulnerability management to safeguard against such threats. 

Key Insights: 

• Attackers exploited outdated drivers to gain system access and deploy malware. 

• The attack allowed persistent control over systems, evading detection. 

• Regular driver updates and vulnerability assessments are crucial for preventing similar attacks. 

Further Reading: Check Point Blog 

2024 Account Takeover Statistics 

Proofpoint’s latest research highlights the alarming prevalence of account takeover (ATO) attacks, which are now among the most common cyberattack types. These attacks involve threat actors gaining control of legitimate user accounts to execute malicious activities, including data breaches and fraud. The findings underscore the importance of strong authentication and continuous monitoring to prevent unauthorized access and protect sensitive data. 

Key Insights: 

• ATO attacks remain a leading threat, with significant consequences for organizations and users. 

• Gaining access to legitimate accounts allows attackers to bypass security measures and execute more damaging attacks. 

• Organizations should prioritize multi-factor authentication and robust monitoring to mitigate ATO risks. 

Further Reading: Proofpoint 

DeepSeek Lure Used to Spread Malware 

A new DeepSeek campaign uses CAPTCHA-like pages to distribute malware. Attackers use fake CAPTCHA challenges to lure users into executing malicious code, evading detection by appearing harmless. The campaign primarily targets users who are tricked into downloading and running the malware. This attack illustrates how cybercriminals are exploiting popular web features to deliver malicious payloads. 

Key Insights: 

• The malware is delivered through fake CAPTCHA-like pages, making it seem legitimate. 

• Attackers use this method to bypass security filters and trick users into downloading harmful software. 

• Regular security updates and cautious behavior when interacting with unfamiliar websites can help mitigate such threats. 

Further Reading: Zscaler Blog 

Botnet Targets Basic Auth in Microsoft 365 Password Spray Attacks 

A large botnet, consisting of over 130,000 compromised devices, is conducting password-spray attacks against Microsoft 365 accounts. The attackers are using Basic Authentication to evade Multi-Factor Authentication (MFA) protections, exploiting plaintext credentials to access accounts without triggering alerts. This method targets accounts with weak or leaked passwords and bypasses security measures that typically protect interactive sign-ins. Organizations are urged to disable Basic Auth, enforce MFA, and implement Conditional Access Policies (CAP) to protect against these attacks. 

Key Insights: 

• The botnet targets Basic Authentication to bypass MFA and gain unauthorized access. 

• Attackers use stolen credentials to conduct widespread password-spray attacks on Microsoft 365 accounts. 

• Disabling Basic Auth and enabling MFA are critical defenses against this type of attack. 

Further Reading: BleepingComputer 

New Undetectable Batch Script Uses PowerShell and Visual Basic to Install XWorm 

A new undetectable malware campaign uses a highly obfuscated Batch script to deliver the XWorm RAT or AsyncRAT. The script employs PowerShell and Visual Basic Script (VBS) to bypass security tools and download the malware. Once executed, the script establishes persistence and exfiltrates data via Telegram’s API. This campaign marks a significant evolution in fileless attacks, leveraging AI-generated code and cloud-based C2 to evade detection. 

Key Insights: 

• The malware uses a Batch script, PowerShell, and VBS to download XWorm or AsyncRAT. 

• Obfuscation and environmental checks make the attack difficult to detect by security tools. 

• Telegram’s API is used to exfiltrate system data, blending malicious traffic with legitimate communications. 

• AI tools may have assisted in generating the code, increasing sophistication and evasion tactics. 

Further Reading: GBHackers 

Chinese Hackers Target Hospitals by Spoofing Medical Software 

A new phishing campaign has been discovered where Chinese hackers are targeting hospitals by spoofing medical software, including fake updates for health-related applications. The hackers use these fake updates to deliver malware, gaining access to sensitive healthcare data. Hospitals and healthcare organizations are urged to be cautious of unsolicited software updates and to ensure they are obtaining updates from official sources. 

Key Insights: 

• Attackers are spoofing medical software updates to distribute malware in healthcare organizations. 

• The campaign targets sensitive healthcare data, with phishing emails disguised as software updates. 

• Healthcare organizations should verify software updates and ensure they come from trusted sources. 

Further Reading: KnowBe4 Blog 

GreyNoise 2025 Mass Internet Exploitation Report: Attackers Are Moving Faster Than Ever — Are You Ready? 

The 2025 Mass Internet Exploitation Report reveals a dramatic increase in the speed and scale of cyberattacks, with attackers exploiting vulnerabilities faster than security teams can respond. In 2024, automated exploitation of known vulnerabilities was rampant, with legacy flaws from as far back as the 1990s being targeted alongside new threats. The most commonly exploited vulnerabilities were in home routers and IoT devices, which are often overlooked in traditional security strategies. To stay ahead of this rapidly evolving threat, executives must prioritize real-time intelligence and adapt patching and defense strategies to address both old and new vulnerabilities. 

Key Insights: 

• Attackers are automating vulnerability exploitation, surpassing traditional patching strategies. 

• Legacy vulnerabilities are still prime targets, with some dating back decades. 

• Ransomware groups are using mass exploitation to gain access, making real-time threat intelligence a necessity for effective defense. 

Further Reading: GreyNoise 

Threat Spotlight: Inside the World’s Fastest Rising Ransomware Operator — BlackLock 

BlackLock, a rapidly rising ransomware-as-a-service (RaaS) operator, has gained prominence for its custom malware and unique data-leak tactics. By Q4 2024, it had become the seventh most active ransomware group, using double extortion to encrypt data and steal sensitive information. BlackLock’s sophisticated leak site and the rapid expansion of its affiliate network via the Russian-language RAMP forum highlight its threat to organizations globally. Executives should prioritize enhancing defense strategies against evolving ransomware threats, including securing third-party access and increasing employee awareness about spear-phishing tactics. 

Key Insights: 

• Custom malware and bespoke ransomware distinguish BlackLock from competitors, making it harder for security tools to detect and defend against. 

• The data-leak site uses unique tricks to pressure victims into paying ransoms before assessing the full scope of the breach. 

• BlackLock’s growing influence on the RAMP forum indicates a well-established network that supports its global ransomware activities. 

Further Reading: ReliaQuest 

Black Basta and Cactus Ransomware Groups Add BackConnect Malware to Their Arsenal 

Black Basta and Cactus ransomware groups have expanded their attack methods by incorporating BackConnect malware. This malware creates an outbound connection, which enables attackers to remotely control compromised systems, bypassing security measures designed to block inbound attacks. By integrating BackConnect into their operations, these groups can maintain access to systems even after initial detection, facilitating long-term exploitation. Organizations must strengthen defenses to detect and block this new tactic and limit the potential damage. 

Key Insights: 

• BackConnect malware allows attackers to maintain persistent access through outbound connections. 

• This technique enables ransomware groups to bypass detection and continue exploiting compromised systems. 

• Organizations should improve detection capabilities to identify and block BackConnect traffic. 

Further Reading: Trend Micro 

Scammers Mailing Ransom Letters While Posing as BianLian Ransomware 

A new scam has emerged where fraudsters are mailing fake ransom letters to businesses, posing as the notorious BianLian ransomware group. The letters, claiming to be from BianLian, demand large Bitcoin ransoms, threatening to release sensitive data if payment is not made within 10 days. However, cybersecurity experts quickly identified multiple red flags: inconsistencies in the language, uncharacteristic delivery via physical mail, and no evidence of data breaches. This scheme aims to exploit the fear and reputation of a known ransomware group for financial gain. 

Key Insights: 

• Scammers are impersonating BianLian ransomware to demand Bitcoin payments via physical mail. 

• The letters use fear tactics, mimicking legitimate ransomware practices, but with numerous inconsistencies. 

• Organizations should educate employees on recognizing such scams and ensure cybersecurity defenses are up to date. 

Further Reading: HackRead 

March 2025 - ExploreSec Cybersecurity Awareness newsletter

This is a security awareness focused newsletter that I share internally. Feel free to grab and use for your own internal security awareness program. Created with help from ChatGPT.

Personal Information Compromised in Grubhub Data Breach 

A recent data breach at Grubhub has compromised personal information of millions of users. The breach exposed sensitive details such as names, email addresses, and passwords, leading to potential risks of identity theft and fraud. Customers are urged to change their passwords and monitor their accounts for any unusual activity. This incident highlights the importance of securing user data and staying vigilant after a breach. 

Key Insights: 

• Grubhub's recent data breach exposed sensitive personal information, including names and email addresses. 

• Customers should change passwords and monitor accounts for suspicious activity to protect against identity theft. 

• This breach underscores the need for stronger data protection measures and proactive security practices in handling consumer information. 

Further Reading: SecurityWeek 

Beware of Lazarus LinkedIn Recruiting Scam 

A new LinkedIn recruiting scam linked to the Lazarus Group is targeting professionals with fake job offers. The scam lures victims into sharing personal information or downloading malicious files, ultimately leading to data theft or malware infections. As the threat actor behind this campaign is known for cyber espionage and financial theft, users must remain cautious when interacting with unsolicited job offers on LinkedIn. 

Key Insights: 

• The Lazarus Group is behind a LinkedIn recruiting scam aimed at stealing personal information and spreading malware. 

• The scam involves fake job offers that seem legitimate, tricking victims into revealing sensitive details. 

• Users should verify job offers before engaging and avoid downloading files or clicking links from unknown sources. 

Further Reading: GBHackers 

Love Gone Phishy: Check Point Research Exposes Valentine’s Day Cyber Threats 

Check Point Research has uncovered a rise in phishing campaigns during the Valentine's season, targeting users with fake promotions, gifts, and love-related messages. These attacks are exploiting the festive period to lure victims into clicking malicious links or sharing sensitive information. This underscores the importance of maintaining cybersecurity practices during high-traffic times like holidays. 

Key Insights: 

• Phishing campaigns around Valentine's Day are using romantic themes to deceive users into revealing personal information. 

• These threats often involve fake websites or links promising deals and gifts, leading to credential theft or malware infection. 

• Consumers should be cautious when clicking on unsolicited links, especially during holiday seasons, and verify offers from trusted sources. 

Further Reading: Check Point Blog 

Fake Etsy Invoice Scam Tricks Sellers into Sharing Credit Card Information 

A new scam targeting Etsy sellers involves fake invoices that appear to come from Etsy's support team. These fraudulent invoices contain links that lead to a phishing page, designed to steal credit card information. Sellers are urged to carefully examine the sender’s email address and to avoid clicking links in suspicious emails. Etsy never requires credit card information for verification purposes, and any such request should be treated as a red flag. 

Key Insights: 

• The scam begins with a fake invoice sent via email, often with a PDF attachment that appears legitimate. 

• Fraudulent websites closely mimic Etsy’s design but ask for sensitive data, including credit card information. 

• Sellers should avoid clicking on email links and should visit Etsy’s official site directly to verify any account requests. 

Further Reading: Malwarebytes 

Using Genuine Business Domains and Legitimate Services to Harvest Credentials 

Cybercriminals are increasingly using legitimate business domains and services to conduct credential harvesting attacks. By spoofing well-known companies and mimicking their email communications, attackers deceive users into providing their login information. These tactics often involve using business-looking email addresses and phishing links that lead to fake login pages. This trend underscores the need for businesses and consumers to be cautious when interacting with unsolicited messages. 

Key Insights: 

• Phishing attacks are increasingly using trusted business domains and services to trick users into disclosing credentials. 

• Attackers mimic legitimate emails to create fake login pages that steal sensitive information. 

• Users should be cautious of unsolicited messages and verify the authenticity of any login requests by visiting official websites directly. 

Further Reading: KnowBe4 Blog 

Phishing for Love: A Sharp Surge in Valentine’s Day-Themed Scams 

As Valentine's Day approaches, scammers are leveraging love-themed phishing attacks to deceive users into clicking malicious links or revealing personal information. These scams often appear as romantic gift offers, fake delivery notices, or enticing deals, tricking individuals into providing sensitive data or making fraudulent payments. This surge in phishing tactics highlights the need for extra caution during the holiday season. 

Key Insights: 

• Valentine’s Day scams are using themed messages to entice victims into sharing personal information or clicking on malicious links. 

• These scams often come in the form of fake gift offers, e-cards, and package delivery notifications. 

• Users should avoid clicking on unsolicited links and verify offers before engaging with any communications. 

Further Reading: KnowBe4 Blog 

Tips for Detecting Real-time Deepfakes: A Guide to Staying One Step Ahead 

As deepfake technology becomes more sophisticated, it’s increasingly important to know how to identify fake videos and images in real-time. These manipulated media files are often used for scams, misinformation, or even social engineering attacks. The blog offers practical tips for detecting deepfakes, such as examining inconsistencies in video and audio quality, checking metadata, and verifying the source of the content. With deepfakes becoming more prevalent, staying informed about these techniques can help protect against digital manipulation. 

Key Insights: 

• Real-time detection of deepfakes is critical as they are being used in a variety of attacks. 

• Signs to look for include mismatched lighting, unnatural facial movements, and inconsistencies in audio. 

• Verifying sources and cross-checking information are essential steps in detecting fake content. 

Further Reading: KnowBe4 Blog 

Protect Your Data: Russian Spear-Phishing Targets Microsoft 365 Accounts 

A new spear-phishing campaign linked to Russian threat actors is targeting Microsoft 365 users. The attackers use highly customized phishing emails that appear legitimate, aiming to steal login credentials and gain unauthorized access to sensitive information. With Microsoft 365 being a prime target, organizations should enhance their security by training users to recognize phishing attempts and implementing advanced security measures, including multi-factor authentication. 

Key Insights: 

• Russian threat actors are targeting Microsoft 365 accounts using personalized spear-phishing emails. 

• These attacks aim to steal credentials, putting sensitive data at risk. 

• Organizations should deploy multi-factor authentication and conduct regular security awareness training to protect against these threats. 

Further Reading: KnowBe4 Blog 

New Facebook Copyright Infringement Phishing Campaign 

A new phishing campaign has been detected targeting Facebook users with fake copyright infringement notices. The attackers use deceptive emails that appear to come from Facebook, claiming that users have violated copyright laws. The emails contain links to fake Facebook pages that prompt users to enter personal information, including passwords. This campaign highlights the ongoing threat of phishing attacks that impersonate trusted platforms like Facebook. 

Key Insights: 

• The phishing emails mimic Facebook's notifications about copyright violations to trick users into sharing sensitive data. 

• Victims are directed to fake pages designed to capture their credentials. 

• Users should be cautious about unsolicited emails and verify the authenticity of any official communications by visiting Facebook directly. 

Further Reading: Check Point Blog 

Phishing Kit Abuses Open Graph to Target Social Media Users 

A new phishing kit takes advantage of the Open Graph protocol, which is commonly used to display rich media on social media platforms, to deceive users. The kit allows attackers to embed phishing links into seemingly harmless social media posts, making it more difficult for users to identify fraudulent content. By manipulating Open Graph data, the scam appears legitimate, drawing users into phishing sites that steal personal information. 

Key Insights: 

• The phishing kit abuses Open Graph to embed malicious links in social media posts, creating fake but convincing content. 

• This tactic makes it harder for users to detect phishing attempts on social media. 

• Users should be cautious about clicking links in social media posts, especially if they appear unfamiliar or too good to be true. 

Further Reading: KnowBe4 Blog 

Phishing Campaign Disguises as ChatGPT Subscription 

A new phishing campaign is using ChatGPT subscriptions as a cover to steal user credentials. The attackers send emails offering a fake ChatGPT subscription, prompting users to enter their personal and payment information. This method exploits the popularity of ChatGPT and preys on users' trust. Security measures, such as verifying subscription details and avoiding unsolicited emails, can help prevent falling victim to this scam. 

Key Insights: 

• Attackers are using fake ChatGPT subscription offers to steal personal and financial information. 

• The phishing emails mimic legitimate communications, making them harder to detect. 

• Users should verify subscription offers directly on trusted platforms and avoid clicking on links in unsolicited emails. 

Further Reading: Broadcom 

DeepSeek Lure Used to Spread Malware 

A new DeepSeek campaign uses CAPTCHA-like pages to distribute malware. Attackers use fake CAPTCHA challenges to lure users into executing malicious code, evading detection by appearing harmless. The campaign primarily targets users who are tricked into downloading and running the malware. This attack illustrates how cybercriminals are exploiting popular web features to deliver malicious payloads. 

Key Insights: 

• The malware is delivered through fake CAPTCHA-like pages, making it seem legitimate. 

• Attackers use this method to bypass security filters and trick users into downloading harmful software. 

• Regular security updates and cautious behavior when interacting with unfamiliar websites can help mitigate such threats. 

Further Reading: Zscaler Blog 

Chinese Hackers Target Hospitals by Spoofing Medical Software 

A new phishing campaign has been discovered where Chinese hackers are targeting hospitals by spoofing medical software, including fake updates for health-related applications. The hackers use these fake updates to deliver malware, gaining access to sensitive healthcare data. Hospitals and healthcare organizations are urged to be cautious of unsolicited software updates and to ensure they are obtaining updates from official sources. 

Key Insights: 

• Attackers are spoofing medical software updates to distribute malware in healthcare organizations. 

• The campaign targets sensitive healthcare data, with phishing emails disguised as software updates. 

• Healthcare organizations should verify software updates and ensure they come from trusted sources. 

Further Reading: KnowBe4 Blog 

Scanning for Trouble: Behind the Scenes of Our QR Code Phishing Demo 

The KnowBe4 team explores the mechanics of QR code phishing in their latest demo, showcasing how attackers are using QR codes to direct victims to phishing sites. The demo reveals the ease with which malicious actors can create seemingly harmless QR codes that lead to fraudulent sites, designed to steal personal information. By understanding the techniques used in these phishing campaigns, organizations can better educate employees and defend against such attacks. 

Key Insights: 

• QR code phishing is becoming more common, with attackers using them to bypass traditional email filtering techniques. 

• Malicious QR codes often lead victims to fake login pages where sensitive data is harvested. 

• Organizations should educate employees on the risks of scanning unsolicited QR codes and implement strong security measures. 

Further Reading: KnowBe4 Blog 

How Phished Data Turns into Apple & Google Wallets 

Phishing campaigns are evolving, with cybercriminals now using phished data to load stolen payment card information directly into Apple and Google Wallets. These scams often involve SMS messages impersonating services like the USPS or toll operators, tricking users into entering payment details. Once victims provide their information and verification codes, their data is linked to mobile wallets controlled by attackers. This advancement in carding techniques highlights the growing risks of mobile payment systems and the need for heightened security measures. 

Key Insights: 

• Cybercriminals use phishing to steal payment information, converting it into mobile wallets for fraud. 

• These phishing schemes often involve spoofed messages and real-time interaction with human operators. 

• Attackers can use "ghost tap" technology to make fraudulent purchases from a distance using NFC technology. 

Further Reading: Krebs on Security 

Beware of Fake Ransom Note Campaigns Coming Via Snail Mail

I put together this blog post together for an internal security awareness program. Feel free to grab and use for your own.

In recent weeks, an alarming scam has been targeting businesses using a tactic we may not expect: physical mail. Criminals looking to take advantage of data breach news are sending fake ransom notes through snail mail according to a new Guidepoint Security report. In this particular scam the criminals are pretending to be from a newer ransomware-group called "BianLian." These letters demand Bitcoin payments, claiming to hold sensitive data hostage and threatening to release it unless paid within a short timeframe, often 10 days.

What Makes This Scam Dangerous?

The key element that makes these scams so effective is fear. Corporate executives or individuals may panic at the thought of sensitive company data being released, which can lead to rash decisions like paying the ransom. This type of scam capitalizes on the urgency and distress of the threat, even though there is no actual data breach.

FBI's Warning: This is a Scam!

The FBI has issued a Public Service Announcement (PSA), clarifying that there is no verified connection between these ransom letters and the BianLian ransomware group. While the attackers are attempting to intimidate victims, they are, in fact, preying on fear without any real access to stolen data.

What You Should Do

As part of our internal security awareness efforts, it’s essential to be aware of this type of scam. Here are a few tips on how to protect yourself and the organization:

• Remain Calm: If you receive a ransom letter (or any unusual communication), do not respond immediately.

• Report Suspicious Incidents: If you receive a suspicious letter or email, report it to the Service Desk or reach out to the Cybersecurity Team directly.

• Stay Informed: Criminals are constantly shifting tactics to try and get people to fall for their scams. Blogs like this can help you stay informed about the latest threats.

The Bigger Picture: Ransomware is Evolving

While this particular scam may seem unusual, it’s part of a broader trend where ransomware groups and other cybercriminals evolve their tactics to bypass traditional security systems. This underscores the importance of staying ahead of the curve, maintaining awareness of new attack vectors, and ensuring that all team members are educated about the latest cybersecurity threats.

How to Participate in a CTF: A Beginner’s Guide to Capture The Flag Competitions

Generated by ChatGPT with some light editing based on a conversation from a live recording of the podcast with Corelight. The live recording is available on YouTube.

Why Should You Participate in a CTF?

CTFs provide an interactive way to develop technical skills, enhance problem-solving abilities, and gain practical security knowledge. Here’s why you should consider joining one:

• Hands-on Learning – Apply security concepts in a real-world setting.

• Team Collaboration – Work with others to solve complex problems.

• Networking Opportunities – Connect with industry experts and fellow security enthusiasts.

• Skill Validation – Test your knowledge against different challenge levels.

• Fun and Competitive – Experience the thrill of hacking in a safe and controlled environment.

Getting Started with CTFs

Choose the Right CTF

If you’re new, start with beginner-friendly CTFs, such as:

• OverTheWire: Bandit (for Linux basics)

• PicoCTF (a beginner-friendly CTF created by Carnegie Mellon University)

• Hack The Box (provides a variety of cybersecurity challenges)

For more advanced competitions, check CTFTime.org, which tracks global CTF events.

Learn Essential Tools

Familiarize yourself with tools commonly used in CTF challenges:

• Wireshark – For network traffic analysis.

• Burp Suite or OWASP ZAP– For web security testing.

• Zeek – Open-source network monitoring.

• John the Ripper – For password cracking.

• Ghidra or IDA – For reverse engineering binaries.

Understand Common CTF Categories

• Cryptography – Solving encrypted messages and ciphers.

• Web Exploitation – Identifying vulnerabilities in web applications.

• Forensics – Investigating and analyzing system data.

• Reverse Engineering – Understanding how compiled programs work.

• Binary Exploitation – Discovering and exploiting vulnerabilities in executable files.

Practice, Practice, Practice

CTFs require a mix of technical knowledge, creativity, and persistence. Some great platforms to practice include:

• TryHackMe

• Hack The Box

• OverTheWire

• CTFTime.org

• SANS Holiday Hack Challenge (for past challenges and write-ups)

Join a Team or Community

Many CTFs allow team participation, which can be a great way to learn from experienced players. Joining security communities, such as local security meetups, Discord groups, or Defcon groups, can help expand your knowledge.

Avoiding Common Mistakes

• Overthinking – Many CTF challenges have simple solutions. Read questions carefully before diving deep.

• Not Taking Breaks – If you get stuck, step away for a few minutes and return with a fresh perspective.

• Skipping Documentation – Reviewing tool documentation can help you understand how to use them effectively.

Conclusion

Participating in a CTF is one of the most effective ways to learn cybersecurity hands-on, improve your problem-solving skills, and engage with a vibrant cybersecurity community. Whether you’re competing for fun, skill-building, or career advancement, CTFs offer an exciting way to test your knowledge and push your limits.

By choosing the right challenges, using the appropriate tools, and learning from others, you’ll develop a strong cybersecurity foundation that will benefit you in your career.

Exploring TEMPEST: Hacking the Future of Space Security

This blog post is based on a podcast I recorded with Tim Fowler back in January. I’ve used ChatGPT to take the episode transcript and turn it into a blog that I have reviewed and edited. Check out the episode: https://www.exploresec.com/eis/219

The Rise of Space Cybersecurity

Cybersecurity has long been a critical focus in terrestrial technology, but as the space industry continues to expand, the need for security in orbit has never been more urgent. One person leading this charge is Tim Fowler, the creator of TEMPEST, a 1U CubeSat educational project designed to bring hands-on security training into the realm of space systems.

In a recent Exploring Information Security podcast episode, I sat down with Fowler to discuss TEMPEST, its impact on cybersecurity education, and why space security needs a shift in focus.

Why Space Security Matters

The rapid expansion of satellite technology means that more devices than ever before are being launched into space—often without robust security measures. Fowler highlighted that traditional approaches to securing IT systems don’t always translate well to space-based infrastructure.

Some of the key concerns include:

• Unsecured Communication Links – Space systems often rely on unencrypted signals, making them susceptible to interception.

• Satellite Hijacking – Attackers could take control of a satellite’s operations and disrupt services or use it for malicious activities.

• Supply Chain Vulnerabilities – Many CubeSats are built from commercial off-the-shelf components, which can introduce security risks.

TEMPEST allows students and professionals to experience these risks firsthand in a controlled environment, making it an essential tool for training the next generation of space cybersecurity experts.

What is TEMPEST?

TEMPEST—an acronym for Tim’s Endeavor into Manically Producing Educational Space Technologies—is a modular, intentionally vulnerable CubeSat that provides cybersecurity professionals, students, and researchers with a hands-on way to test and hack satellite systems.

Fowler, an expert in space cybersecurity, launched the project to address a major gap in the industry: most CubeSat kits focus on functionality, but none include security as a fundamental component. TEMPEST is designed to fill that void by allowing users to simulate attacks, build defenses, and understand real-world space security challenges.

A Hands-On Approach to Learning

TEMPEST was designed to be modular and hackable. Fowler structured the CubeSat with intentionally built-in security flaws to simulate real-world attack scenarios. Users can explore:

• Radio frequency (RF) security and satellite communications.

• Embedded system vulnerabilities within the CubeSat’s flight computer.

• Software-defined radios (SDRs) for signal interception and manipulation.

• Security hardening techniques to counteract common attack vectors.

The first generation of TEMPEST hardware debuted at Wild West Hacking Fest in 2024, where attendees were able to test, break, and improve upon the system in real time. Fowler also runs training sessions where participants assemble and experiment with the CubeSat, learning about space security hands-on.

The Accidental Broadcast Storm

One of the most entertaining moments Fowler shared was an unexpected security lesson during a training session. When a room full of students powered up their TEMPEST CubeSats simultaneously, the devices inadvertently started talking to each other, creating a self-replicating “broadcast storm.”

This unintentional experiment highlighted a crucial lesson in satellite security: small design choices can have major consequences. Even unintended interactions between satellites can create denial-of-service conditions or unexpected network behaviors, reinforcing the importance of secure communication protocols in space systems.

What’s Next for TEMPEST?

While TEMPEST is currently only available through Fowler’s space cybersecurity training courses, plans are underway to release a public version that allows more people to engage with the project.

Upcoming developments include:

• A new defensive security course focused on satellite protection strategies.

• Open-source release of older TEMPEST versions, allowing users to build their own CubeSats.

• Expanded training opportunities at major security conferences in 2025.

Where to Learn More

If you’re interested in learning about space cybersecurity and hacking CubeSats, TEMPEST offers a unique and invaluable resource. Keep an eye out for future training sessions and updates by following:

🌐 EthosLabs.space – Fowler’s main site for TEMPEST training and updates.
🎙️ Exploring Information Security Podcast – Listen to the full episode for an in-depth discussion on TEMPEST.

Final Thoughts

Space cybersecurity is one of the most exciting frontiers in infosec, and projects like TEMPEST are helping shape the future. By providing a hands-on, educational platform for space security, TEMPEST ensures that the next generation of security professionals is ready to defend our critical space infrastructure. 🚀

What are your thoughts on space cybersecurity? Let’s discuss in the comments!

Inside ShowMeCon: Community, Education, and Security with Dave Chronister

Blog post generated by ChatGPT and reviewed and edited by me.

Cybersecurity conferences have become essential hubs for professionals looking to expand their knowledge, connect with industry leaders, and gain hands-on experience in emerging security trends. Among these, ShowMeCon stands out as a premier security event that blends corporate professionalism with hacker culture. Recently, on the Exploring Information Security podcast, I sat down with ShowMeCon founder Dave Chronister and organizer Brooke Deneen to discuss what makes this conference unique and what attendees can expect in 2025.

The Origin and Vision of ShowMeCon

ShowMeCon was founded with a clear mission: to provide high-quality security education in an engaging, community-driven environment. Unlike traditional conferences that often feel like corporate networking events, ShowMeCon fosters an atmosphere where security researchers, IT professionals, and ethical hackers can exchange knowledge in a collaborative setting.

During the podcast, Dave Chronister shared the story behind ShowMeCon’s inception, emphasizing the importance of bridging the gap between technical expertise and real-world security applications. By creating a space where attendees can both learn and engage with top security minds, the conference has grown into a must-attend event for security professionals.

What Sets ShowMeCon Apart?

One of the defining aspects of ShowMeCon is its ability to strike a balance between corporate and hacker culture. As Brooke Deneen explained, the conference offers a professional yet welcoming environment that caters to both seasoned professionals and newcomers to the field.

Key Features That Make ShowMeCon Unique:

• Immersive Venue: Hosted at the Ameristar Casino in St. Louis, the setting provides a comfortable yet dynamic backdrop for networking and learning.

• Engaging Speakers: The event prioritizes bringing in experts who are not only knowledgeable but also passionate and approachable.

• Hands-On Learning: ShowMeCon features training sessions, Capture The Flag (CTF) competitions, and lockpicking villages, offering attendees the chance to apply their skills in real-world scenarios.

• Expanding Reach: The ShowMeCon team is exploring ways to expand the conference to new cities like Nashville, ensuring more professionals have access to top-tier security education.

Highlights of ShowMeCon 2025

The upcoming 2025 edition of ShowMeCon is set to be bigger and better, with new elements designed to enhance the attendee experience. Some of the highlights include:

• The Return of Pre-Conference Training: Attendees can participate in deep-dive workshops led by industry experts.

• Exciting Themed Experiences: This year’s event will feature a Fallout-theme, adding a creative twist to the conference experience.

• Stronger Community Building: Encouraging new speakers and first-time attendees to engage and contribute to the security conversation.

Why You Should Attend ShowMeCon

If you're looking for a conference that goes beyond lectures and sales pitches, ShowMeCon is for you. Whether you're an IT administrator, security analyst, penetration tester, or student, this event offers valuable insights and opportunities to:

✔️ Learn from industry experts in a practical and engaging environment.
✔️ Network with peers and leaders who share a passion for security.
✔️ Gain hands-on experience through CTFs, training sessions, and interactive villages.
✔️ Explore new security trends that will shape the industry in the coming years.

Final Thoughts

ShowMeCon continues to grow as a hub for cybersecurity professionals. With its community-driven approach, diverse speaker lineup, and immersive experiences, it’s clear why this event has become a staple in the cybersecurity world.

🚀 Want to attend? Visit showmecon.com to learn more and register for the 2025 event.

🎙️ Listen to the full conversation on the Exploring Information Security podcast and you may just hear the discount code to save $50 on tickets or training: Podcast Website

See you at ShowMeCon 2025! 🔐🔥

Understanding the 2025 HIPAA Security Rule Proposal: Key Changes and Implications

In January 2025 I put together a presentation on the proposed changes to the HIPAA Security Rule. You can view the live recording on the ExplorSec YouTube channel. With Valentines Day recently passing I though this would be a good time for a blog post on the proposals for the HIPAA Security Rule. Below is a ChatGPT generated blog post using the transcript from that session that I’ve reviewed and edited .

The U.S. Department of Health and Human Services (HHS) recently proposed updates to the HIPAA Security Rule, aiming to enhance the cybersecurity resilience of healthcare organizations. These changes are in response to the evolving threat landscape, rising breach costs, and the need for stronger regulatory oversight. Let’s explore the proposal, its timeline, and the most significant updates impacting the healthcare industry. The proposal can be viewed at this link: https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/index.html

Why the Change?

HIPAA, originally enacted in 1996, has undergone several updates, with the most recent in 2013. However, with data breaches in healthcare rising sharply, the government is taking action. The cost of healthcare breaches has surged by 50% since 2020, with an average breach costing $10.1 million per organization. Additionally, cybercriminals continue to target healthcare organizations despite previous claims that they would avoid them. In 2023 alone, the FBI received 250 ransomware reports from healthcare organizations—the most of any industry.

Proposed Timeline

• January 6, 2024: Proposal released

• March 7, 2024: Public comment period closes

• Spring 2025: HHS reviews comments and finalizes the rule

• 2026: Full compliance expected for specific requirements

Organizations have an opportunity to provide feedback before implementation, making this a crucial period for healthcare entities to review the proposed changes and assess their impact.

Key Changes in the HIPAA Security Rule Proposal

Revised Terminology and Definitions

Several terms are being modified or newly defined to eliminate ambiguity and prevent misinterpretations that have historically allowed organizations to circumvent security requirements. Notable changes include:

• Security Measures: Clarified to apply to both systems and information.

• Technical Controls & Safeguards: Expanded definitions to include firmware and hardware components.

• User Definitions: Adjusted to remove ambiguity between human users and system entities.

• Addressable and Reasonable & Appropriate Requirements: Refined to ensure organizations do not misinterpret them as optional.

Asset Inventory and Risk Analysis

One of the most critical updates is the requirement for a comprehensive asset inventory of all technical assets that create, receive, maintain, or transmit electronic protected health information (ePHI). Organizations must:

• Maintain a written inventory including device IDs, software versions, responsible personnel, and locations.

• Conduct annual risk analyses aligned with NIST cybersecurity standards.

• Update network maps to track ePHI movement and access points.

Patch Management Requirements

For the first time, HIPAA is setting explicit timelines for patch management:

• Critical vulnerabilities must be patched within 15 days.

• High vulnerabilities must be patched within 30 days.

• Organizations must document any exceptions and review them annually.

Workforce Security and Training Enhancements

Organizations must establish stronger internal security measures, including:

• Mandatory security training for new hires within 30 days.

• Job description reviews to align role-based access controls with actual job functions.

• Regular cybersecurity performance goals for employees, focusing on increasing phishing report rates and improving security awareness.

• Security training on new technology implementations, such as new systems that handle electronic health records (EHRs).

Strengthened Physical and Technical Safeguards

The proposal mandates that organizations demonstrate operational enforcement of security policies rather than relying solely on documentation. This includes:

• Mandatory encryption of ePHI at rest and in transit.

• Elimination of default passwords for all devices.

• Multi-Factor Authentication (MFA) requirements (with exceptions for FDA-approved medical devices).

• Stricter controls for legacy systems, including the requirement that manufacturers must still provide security updates; otherwise, organizations must replace outdated systems.

Business Associate Agreements (BAA)

Healthcare organizations rely on third-party vendors to handle sensitive patient data, and the proposal introduces stricter rules around vendor agreements:

• Vendors must report security incidents within 24 hours of detection.

• Organizations will have up to one year to update contracts.

• New requirements will apply to healthcare plan sponsors, who previously were not subject to the same security obligations.

Addressing Emerging Technologies

The proposal acknowledges the impact of new technologies in healthcare, requiring organizations to assess and prepare for:

• Quantum Computing: Organizations must develop a roadmap for quantum-resistant encryption.

• Artificial Intelligence (AI): Organizations must inventory AI use cases and assess associated security risks.

• Virtual Reality (VR) in Healthcare: VR devices must comply with access management, patch management, and risk management protocols.

Financial Impact and Justification

The estimated cost for implementing these new security controls across all healthcare organizations is $6.8 billion annually. However, HHS argues that if these measures will reduce healthcare breaches by 7-16% and will effectively pay for itself. For individual organizations, first-year compliance costs are estimated at $4.65 million, but with healthcare breaches averaging $10.95 million in damages per incident, the investment is likely to yield significant long-term savings.

What’s Next?

The proposed HIPAA Security Rule updates aim to close loopholes, modernize security requirements, and enforce stricter compliance. Healthcare organizations should begin:

• Reviewing their current security policies, training programs, and technical safeguards.

• Assessing their vendor contracts and business associate agreements.

• Engaging with industry groups or submitting public comments before the March 7 deadline.

For additional details on the HIPAA Security Rule proposal and how to submit public comments, visit the official HHS website.

What are your thoughts on the proposed changes? Let us know in the comments below!

February 2025 - ExploreSec Cybersecurity Awareness newsletter

This is a security awareness focused newsletter that I share internally. Feel free to grab and use for your own internal security awareness program. Created with help from ChatGPT.

How HIPAA Security Rule Updates Could Impact Healthcare Employees 

The U.S. Department of Health and Human Services (HHS) has proposed significant updates to the HIPAA Security Rule, aiming to enhance the protection of electronic protected health information (ePHI). These changes, the first major revision since 2013, will have implications for individuals working in healthcare organizations. 

What You Need to Know: 

• New Security Measures: Employees will be required to use multifactor authentication (MFA) for accessing systems containing ePHI. This adds an extra layer of security by requiring a second verification step, such as a code sent to your phone or email. 

• Improved Data Encryption: All ePHI must be encrypted, meaning employees may encounter updated tools or workflows for handling sensitive information securely. 

• Annual Audits: Organizations will perform regular audits to ensure compliance with the updated rules. Employees may be asked to participate in training or assessments to demonstrate understanding of security policies. 

Why It Matters to You: 

These updates are designed to strengthen defenses against data breaches and ensure the safety of patient information. As healthcare professionals, compliance with these measures not only protects patient data but also safeguards the organization from potential penalties and operational disruptions. 

The proposed rule will be open for public comment starting January 6, 2025. Employees should stay informed about the changes and prepare for any updates to internal policies and procedures. 

Further Reading: Dark Reading 

Phishing Campaign Delivers ConnectWise RAT via Spoofed Social Security Emails 

A recent phishing campaign has been identified wherein attackers impersonate the U.S. Social Security Administration to distribute the ConnectWise Remote Access Trojan (RAT). 

Key Developments: 

• Spoofed Emails: Beginning in September 2024, fraudulent emails masquerading as official communications from the Social Security Administration were disseminated, claiming to provide updated benefits statements. These emails contained links designed to deceive recipients into downloading malicious software. 

• Malware Delivery Mechanism: The embedded links directed users to a ConnectWise RAT installer. Initially, the campaign utilized ConnectWise infrastructure for command and control (C2) operations but later transitioned to dynamic DNS services and domains controlled by the threat actors. 

• One-Time Use Links: The malicious links employed a one-time-use mechanism, redirecting users to the malware installer upon first access and subsequently to the legitimate Social Security Administration website on further attempts. This tactic complicates detection and analysis efforts. 

• Timing and Volume: The campaign's activity surged in early to mid-November, peaking around Election Day, suggesting a potential link to the political climate during that period. 

Further Reading: GBHackers 

Phishing Campaign Targets Gamers with Fake Video Game Testing Offers 

Cybercriminals are employing deceptive emails that promise opportunities to test new video games, aiming to steal personal information and credentials from unsuspecting gamers. 

Key Details: 

• Deceptive Invitations: Victims receive emails inviting them to participate in exclusive game testing, often for highly anticipated titles. 

• Malicious Links: These emails contain links to counterfeit websites designed to mimic legitimate gaming platforms, prompting users to enter sensitive information. 

• Data Theft: Information entered on these fake sites is harvested by attackers for malicious purposes, including identity theft and unauthorized account access. 

Further Reading: KnowBe4 Blog 

New 'US Cyber Trust Mark' Labels to Identify Secure Smart Devices 

The U.S. government has introduced the 'US Cyber Trust Mark,' a voluntary labeling initiative to help consumers identify smart devices that meet federal cybersecurity standards. 

Key Details: 

• Purpose: The label aims to guide consumers in selecting internet-connected devices—such as baby monitors, home security cameras, and fitness trackers—that are less susceptible to hacking. 

• Label Features: Devices meeting the standards will display a distinctive shield logo and include QR codes. Scanning the QR code provides detailed security information about the product. 

• Availability: Products bearing the 'US Cyber Trust Mark' are expected to be available later this year, as manufacturers begin submitting devices for approval. 

• Industry Participation: Companies including Amazon, Best Buy, Google, LG Electronics USA, Logitech, and Samsung have expressed support for the initiative. 

Implications for Consumers: 

With the average American household containing numerous internet-connected devices, each potentially serving as an entry point for cybercriminals, this labeling system offers a straightforward method to assess the cybersecurity of products before purchase. 

Further Reading: SecurityWeek 

PowerSchool Software Cyberattack Potentially Affects 45 Million U.S. Students 

A recent cyberattack targeting PowerSchool, a widely used student information system in K-12 schools across the United States, has led to a significant data breach. This incident may impact over 45 million students and educational staff nationwide. 

Key Details: 

• Compromised Data: The breach has exposed sensitive information, including grades, attendance records, medical histories, Social Security numbers, student profiles, and communications between parents and educators. 

• Potential Risks: The stolen data could be exploited for malicious activities such as phishing attempts, identity theft, and unauthorized access to personal and financial information. 

• Regional Impact: Schools in North Dakota, including West Fargo Public Schools, have notified parents about the breach, indicating that the incident may have far-reaching implications across various educational districts. 

Further Reading: Cybersecurity Insiders 

Data Breach at Leading U.S. Addiction Treatment Provider 

BayMark Health Services, the largest provider of substance use disorder treatment in North America, has reported a data breach potentially compromising patient personal and health information. 

Key Details: 

• Incident Timeline: Unauthorized access to BayMark's systems occurred between September 24 and October 14, 2024. The breach was discovered on October 11, leading to immediate actions to secure systems and involve third-party forensic experts. 

• Compromised Information: While the exact data types accessed have not been publicly detailed, such breaches typically involve personal identifiers and health-related information. 

• Patient Notification: BayMark is in the process of notifying affected individuals and has stated that it will offer complimentary credit monitoring and identity protection services to those impacted. 

Further Reading: BleepingComputer 

Sophisticated Voice Phishing Scams Exploit Apple and Google Services 

Recent investigations have uncovered that cybercriminals are leveraging legitimate Apple and Google services to execute advanced voice phishing (vishing) attacks, deceiving users into divulging sensitive information. 

Key Details: 

• Exploiting Legitimate Services: Attackers initiate contact through genuine Apple and Google communication channels, such as Google Assistant and Apple's support lines, making the interactions appear authentic. 

• Manipulating System Notifications: By abusing these services, scammers can trigger legitimate system-level messages, emails, and automated phone calls, adding credibility to their fraudulent schemes. 

• Case Example: In one instance, a cryptocurrency investor was deceived into transferring over $4.7 million after receiving what seemed to be legitimate communications from Google and Apple, orchestrated by the attackers. 

Recommendations: 

• Verify Contacts: Be cautious of unsolicited communications claiming to be from Apple or Google. Always verify the authenticity of such interactions by contacting the company directly through official channels. 

• Protect Personal Information: Never share sensitive information, such as passwords or financial details, over the phone or through unsolicited messages. 

• Stay Informed: Familiarize yourself with common phishing tactics and remain vigilant for signs of fraudulent activity. 

Further Reading: Krebs on Security 

OneBlood Confirms Data Breach Following Ransomware Attack 

OneBlood, a prominent not-for-profit blood donation organization serving over 250 hospitals across the United States, has confirmed that personal information of donors was compromised during a ransomware attack in July 2024. 

Key Details: 

• Incident Timeline: Unauthorized access to OneBlood's network occurred between July 14 and July 29, 2024. The breach was discovered on July 28, prompting immediate containment measures. 

• Compromised Information: The attackers accessed and copied files containing personal data, including names and Social Security numbers. OneBlood has begun notifying affected individuals and is offering complimentary credit monitoring services. 

• Operational Impact: The ransomware attack led to the encryption of virtual machines, forcing OneBlood to revert to manual processes for blood collection, testing, and distribution. This disruption resulted in delays and shortages, prompting urgent calls for donations, particularly of O Positive, O Negative, and Platelet blood types. 

Further Reading: BleepingComputer 

Phishing Campaigns Exploit YouTube Links and Microsoft 365 Themes 

Cybercriminals are deploying sophisticated phishing attacks targeting Microsoft 365 users by utilizing deceptive URLs that closely resemble legitimate Office 365 domains. These attacks often involve claims of imminent password expiration to create urgency, prompting users to click on malicious links. 

Key Developments: 

• Deceptive URLs: Attackers craft URLs that appear to be legitimate, incorporating prefixes like "youtube.com" followed by obfuscation characters or using the "@" symbol to redirect users to malicious domains while maintaining a facade of legitimacy. 

• Social Engineering Tactics: Phishing emails are designed to induce panic by falsely claiming that the recipient's password has expired, urging immediate action. The emails contain malicious buttons labeled to appear as legitimate account maintenance actions. 

• Obfuscation Techniques: The use of "%20" for HTML space encoding and the "@" symbol in URLs helps attackers conceal the true destination of the links, making it challenging for users to identify the threat. 

Further Reading: GBHackers 

Phishing Texts Target Apple iMessage Users by Disabling Link Protections 

Cybercriminals are employing a new tactic to deceive Apple iMessage users into disabling built-in phishing protections, thereby exposing them to potential scams. 

Key Details: 

• Disabled Links for Unknown Senders: Apple's iMessage automatically disables links in messages received from unknown senders to protect users from potential phishing attacks. 

• Deceptive Tactics: Recent smishing (SMS phishing) attacks have been observed where attackers send messages prompting users to reply with "Y" or another response. This action re-enables the disabled links, making users susceptible to malicious websites. 

• Common Scenarios: Examples include fake shipping issue notifications or unpaid toll alerts, urging immediate action and instructing users to reply to the message to resolve the fabricated issue. 

Recommendations: 

• Avoid Responding to Unknown Messages: Do not reply to messages from unknown senders, especially those prompting you to take specific actions. 

• Verify Sender Authenticity: If a message claims to be from a legitimate organization, contact the entity directly using official channels to confirm the message's legitimacy. 

• Maintain Built-in Protections: Refrain from actions that disable iMessage's security features, such as replying to suspicious messages or adding unknown contacts without verification. 

Stay Vigilant: Always exercise caution when receiving unsolicited messages, and be aware of tactics that attempt to bypass security measures designed to protect your personal information. 

Further Reading: BleepingComputer 

Surge in Phishing Scams Exploiting California Wildfires 

As California confronts devastating wildfires, cybercriminals are exploiting the crisis by launching phishing scams targeting affected individuals and those seeking to assist. 

Key Insights: 

• Emergence of Suspicious Domains: Within a 72-hour period, multiple domains mimicking official services related to the wildfires have been registered. Examples include malibu-fire[.]com and fire-relief[.]com. These domains are likely intended for phishing attacks, fake donation requests, and malicious downloads. 

• Tactics Employed by Scammers: Attackers are creating domains that resemble legitimate services or agencies, distributing phishing emails urging recipients to click on fraudulent links, and using social engineering techniques to create a sense of urgency, such as fake donation drives or critical safety alerts. 

Recommendations: 

• Verify Authenticity: Before engaging with any disaster-related communications or websites, confirm their legitimacy through official channels. 

• Be Cautious with Donations: When donating to relief efforts, use established and reputable organizations. Avoid unsolicited requests for donations, especially those asking for unusual payment methods. 

• Stay Informed: Keep abreast of common phishing tactics and remain vigilant for signs of fraudulent activity, particularly during disaster situations. 

Further Reading: Veriti Blog 

U.S. Sanctions Target North Korean IT Worker Network 

The U.S. Treasury Department has imposed sanctions on a network of individuals and front companies associated with North Korea's Ministry of National Defense, aiming to disrupt revenue streams generated through illicit remote IT work schemes. 

Key Insights: 

• Entities Sanctioned: The Office of Foreign Assets Control (OFAC) has designated North Korean front companies Korea Osong Shipping Co. (Osong) and Chonsurim Trading Corporation (Chonsurim), along with their presidents, Jong In Chol and Son Kyong Sik. Additionally, Chinese firm Liaoning China Trade has been sanctioned for supplying electronics equipment to North Korea's Department 53, a weapons-trading entity that also operates IT and software development front companies. 

• Revenue Generation Tactics: North Korea employs thousands of IT workers who conceal their identities to secure employment with companies abroad. The earnings from these positions are funneled back to the regime, supporting its illegal weapons programs and contributing to destabilizing activities, including support for Russia's war in Ukraine. 

• Legal Implications: As a result of these sanctions, U.S. individuals and organizations are prohibited from engaging in transactions with the designated entities and individuals. Furthermore, any assets linked to them within U.S. jurisdiction are subject to freezing. 

Further Reading: BleepingComputer 

Cybercriminals Exploit Fake Google Ads to Hijack Advertiser Accounts 

Cybercriminals are conducting a sophisticated malvertising campaign targeting Google Ads users by deploying fraudulent advertisements that impersonate legitimate Google Ads services. This tactic aims to steal advertiser account credentials, leading to unauthorized access and potential misuse of advertising budgets. 

Key Insights: 

• Impersonation of Google Ads: Attackers create deceptive ads that appear to be official Google Ads promotions. When clicked, these ads redirect users to counterfeit login pages designed to harvest Google account credentials. 

• Use of Google Sites for Phishing: The fraudulent ads often lead to phishing pages hosted on Google Sites, lending an air of legitimacy and making detection more challenging. These pages are crafted to closely mimic authentic Google login interfaces. 

• Credential Theft and Account Compromise: Once users enter their credentials on these fake pages, attackers gain unauthorized access to their Google Ads accounts. This access can be exploited to run malicious ad campaigns, deplete advertising budgets, or sell the compromised accounts on blackhat forums. 

Recommendations: 

• Verify Ad URLs: Before clicking on any Google Ads-related advertisements, hover over the link to inspect the URL. Ensure it directs to an official Google domain. 

• Enable Multi-Factor Authentication (MFA): Implement MFA on your Google accounts to add an extra layer of security, making unauthorized access more difficult even if credentials are compromised. 

Further Reading: Malwarebytes 

Ransomware Gangs Exploit Microsoft Teams by Impersonating IT Support 

Cybersecurity researchers have identified ransomware groups, including Black Basta, using Microsoft Teams to impersonate IT support and gain unauthorized access to corporate networks. 

Key Insights: 

• Email Bombardment: Attackers flood employee inboxes with non-malicious emails to create confusion and urgency. 

• Fake IT Support: Posing as help desk personnel, attackers use Teams to contact employees and build trust. 

• Remote Access: Victims are tricked into installing remote tools, enabling ransomware deployment and network access. 

Further Reading: BleepingComputer 

Introducing 'Identity Check' 

Google has recently unveiled a new security feature for Android devices called "Identity Check," designed to bolster protection against unauthorized access, especially in the event of device theft. This feature mandates biometric authentication—such as fingerprint or facial recognition—to access sensitive settings when the device is outside of trusted locations like home or work. 

Key Highlights: 

• Biometric Verification: Critical actions, including changing the device's PIN, disabling theft protection, turning off 'Find My Device,' performing a factory reset, and modifying biometric data, now require biometric authentication when the device is in untrusted locations. 

• Trusted Locations: Users can designate specific areas, such as home or workplace, as trusted locations. Outside these zones, the enhanced security measures are activated to prevent unauthorized access. 

• Device Compatibility: Initially, 'Identity Check' is available on Google Pixel devices running Android 15 and Samsung Galaxy devices with One UI 7. Plans are underway to extend this feature to other manufacturers' devices later this year. 

Further Reading: BleepingComputer 

Banshee Stealer Targets macOS Users 

A sophisticated malware known as "Banshee Stealer" is actively targeting macOS users, posing significant risks to personal and financial data. 

Key Details: 

• Stealthy Operation: Banshee operates undetected, blending seamlessly with normal system processes while stealing browser credentials, cryptocurrency wallets, user passwords, and sensitive file data. 

• Distribution Methods: The malware is distributed through phishing websites and malicious GitHub repositories, posing as popular software tools such as Chrome, Telegram, and TradingView. 

Protective Measures: 

• Verify Software Sources: Only download software from official and reputable sources. Be cautious of unsolicited links or prompts to install applications. 

• Update Security Systems: Ensure your macOS and security software are up-to-date to detect and prevent the latest threats. 

• Monitor for Suspicious Activity: Regularly check for unusual system behavior or unauthorized access to accounts. 

Further Reading: Check Point Research 

Texas Investigates Automakers Over Consumer Data Practices 

Texas has broadened its investigation into how automakers collect, use, and share consumer data from modern connected vehicles. The focus is on whether manufacturers are obtaining proper consent, how data is shared with third parties, and whether it is being sold without transparency. This follows growing concerns over privacy risks associated with the data generated by advanced vehicle technologies. 

Key Insights: 

• Automakers Under Scrutiny: Texas is investigating Ford, Hyundai, Toyota, and Fiat Chrysler over data collection, sharing, and sales practices. 

• Data Concerns: The focus includes how consumer data is collected, shared with third parties, and whether consumer consent is obtained. 

• Legal Background: This expands on previous investigations and lawsuits, including action against General Motors for alleged unauthorized data sales. 

Further Reading: Malwarebytes News 

Phishing Campaign Exploits Legitimate Services to Send Fraudulent PayPal Requests 

A recent phishing campaign has been identified that abuses legitimate services to send fraudulent PayPal payment requests, aiming to deceive recipients into compromising their accounts. 

Key Insights: 

• Methodology: Attackers register free Microsoft 365 test domains and create distribution lists containing target email addresses. They then use these lists to send payment requests via PayPal's web portal. 

• Deceptive Tactics: Recipients receive a legitimate-looking PayPal payment request. Clicking the link directs them to a PayPal login page displaying the payment request. If the recipient logs in, their PayPal account becomes linked to the scammer's account, potentially granting the attacker unauthorized access. 

Further Reading: KnowBe4 Security Awareness Training Blog 

Malicious WordPress Plugin Assists in Phishing Attacks 

A newly identified malicious WordPress plugin is being exploited by attackers to conduct phishing campaigns. This plugin allows cybercriminals to send phishing emails from compromised WordPress sites, emphasizing the need for vigilance in securing web platforms and carefully managing plugins. 

Key Insights: 

• The malicious plugin facilitates phishing attacks by using compromised websites to send emails to targets. 

• Regular audits of WordPress sites and plugin installations are essential for mitigating such threats. 

• Ensuring plugins are sourced from trusted providers can help reduce the risk of exploitation. 

Further Reading: Malicious WordPress Plugin Assists in Phishing Attacks 

Insurance Company Accused of Using Secret Software to Illegally Collect and Sell Location Data 

A prominent insurance company is under scrutiny for using secret software to collect and sell location data on millions of Americans without their knowledge or consent. This case raises serious concerns about privacy violations and the unethical use of personal data for profit. It serves as a reminder of the importance of transparency and consent in handling personal information, particularly when it comes to sensitive data like location tracking. 

Key Insights: 

• The insurance company allegedly used secret software to gather location data from individuals without their consent. 

• The collected data was sold, violating privacy laws and raising ethical concerns about data exploitation. 

• Organizations must prioritize transparency and user consent when collecting and using personal data to avoid legal and reputational risks. 

Further Reading: Malwarebytes 

Google Chrome AI Extensions Deliver Info-Stealing Malware in Broad Attack 

A new wave of cyberattacks is targeting Google Chrome users through AI-powered extensions that deliver information-stealing malware. These malicious extensions are designed to steal sensitive data, including login credentials and financial information, from unsuspecting victims. The attack highlights the growing threat posed by browser extensions and the need for users to exercise caution when installing third-party software. 

Key Insights: 

• AI-powered Chrome extensions are being used to deliver info-stealing malware, potentially compromising users' personal and financial information. 

• The use of AI in these extensions makes them more difficult to detect and mitigate. 

• Users should carefully vet any browser extensions they install and prioritize security practices such as using trusted sources and multi-factor authentication. 

Further Reading: Malwarebytes 

Phishing Campaign Targets Mobile Banking Users with Sophisticated Techniques 

A new phishing campaign is targeting mobile banking users with increasingly sophisticated techniques. The attackers are using fake mobile apps and messages that appear to come from trusted financial institutions, convincing victims to provide sensitive information such as account credentials and personal identification details. This attack highlights the growing threat to mobile banking and the importance of user vigilance in identifying fraudulent communications. 

Key Insights: 

• The phishing campaign uses fake mobile apps and messages that mimic legitimate banking services to deceive users. 

• Attackers are focusing on mobile platforms, where users may be less cautious about security risks. 

• Financial institutions and mobile users should remain vigilant, employing multi-factor authentication and other security measures to protect sensitive information. 

Further Reading: Infosecurity Magazine 

Phishing Attack Protection for Teams Chat 

Phishing attacks targeting communication platforms like Microsoft Teams are becoming more prevalent. These attacks often involve malicious links, fake login prompts, or social engineering tactics aimed at stealing sensitive information. Microsoft is introducing a feature that flags external messages, helping users identify and avoid potentially harmful communications. Organizations should also reinforce security measures and provide ongoing training to users to strengthen defenses against these threats. 

Key Insights: 

• Phishing attacks are increasingly targeting platforms such as Microsoft Teams, using malicious links and social engineering techniques. 

• Microsoft is rolling out a feature that flags external messages, which helps users spot potential phishing attempts. 

• Ongoing user education and security best practices remain essential to defending against evolving phishing tactics. 

Further Reading: GBHackers 

These Are the 10 Worst PIN Codes 

A new report highlights the 10 worst PIN codes that are most commonly used, making accounts highly vulnerable to unauthorized access. Cybersecurity experts have long warned against using simple, predictable PINs, but many users still rely on easily guessable codes. This report serves as a reminder to always choose strong, unique PINs to safeguard sensitive accounts. 

Key Insights: 

• Many users still rely on simple, predictable PIN codes, which increases the risk of unauthorized access. 

• The 10 worst PIN codes are some of the most common and easiest to guess, highlighting the importance of stronger security practices. 

• Users should choose complex, unique PIN codes for their accounts to protect personal and financial information from attackers. 

Further Reading: Malwarebytes 

Chinese Innovations Spawn Wave of Toll Phishing via SMS 

A new wave of phishing attacks is emerging, primarily driven by Chinese technological innovations. Cybercriminals are using SMS-based toll phishing to trick users into paying for services or accessing malicious websites. This surge in attacks highlights the growing sophistication of phishing tactics and the need for stronger protections against mobile-based threats. 

Key Insights: 

• Toll phishing attacks via SMS are on the rise, with cybercriminals using Chinese innovations to make the attacks more convincing and widespread. 

• Victims are tricked into paying for non-existent services or clicking on malicious links. 

• Organizations and individuals should implement mobile security practices and be cautious when receiving unsolicited SMS messages. 

Further Reading: Krebs on Security 

Your Location or Browsing Habits Could Lead to Price Increases When Buying Online 

A recent study reveals that online retailers may use your location and browsing habits to adjust prices, leading to potential price increases for certain customers. This practice, known as dynamic pricing, raises privacy concerns and the need for transparency in how personal data is used for commercial purposes. Consumers are advised to be aware of these tactics and consider using privacy tools to protect their online behavior. 

Key Insights: 

• Retailers may adjust prices based on location and browsing behavior, potentially leading to higher costs for some users. 

• Dynamic pricing practices raise concerns about privacy and the ethical use of personal data. 

• Consumers can protect themselves by using privacy tools and being mindful of how their data is shared with online retailers. 

Further Reading: Malwarebytes 

New Syncjacking Attack Hijacks Devices Using Chrome Extensions 

A new form of attack called "Syncjacking" is targeting users by exploiting Chrome extensions to hijack their devices. This attack allows cybercriminals to gain access to users' synchronized data across multiple devices, including passwords, browsing history, and other sensitive information. This highlights the need for users to be cautious when installing browser extensions and to regularly review their sync settings. 

Key Insights: 

• Syncjacking attacks exploit vulnerabilities in Chrome extensions to hijack synced data across multiple devices. 

• The attack compromises sensitive information, such as passwords and browsing history, by gaining access to synchronized accounts. 

• Users should be cautious when installing extensions and ensure they review their sync settings regularly to prevent unauthorized access. 

Further Reading: BleepingComputer 

States Get Failing Grades for Privacy Laws, but Tide May Be Turning 

A new report from the Electronic Privacy Information Center (EPIC) and U.S. PIRG Education Fund reveals that nearly half of U.S. states with consumer privacy laws received failing grades for protecting citizens' data. Of the 19 states with laws, eight received an F, and none earned an A. While many of these laws are seen as weak and influenced by major tech companies, some states like Maryland are starting to adopt stronger privacy protections, offering hope for a more secure future. 

Key Insights: 

• Many states with consumer privacy laws received failing grades due to weak protections for personal data. 

• Big Tech companies have influenced state privacy laws, leading to minimal consumer protection. 

• Maryland’s recent privacy law is one of the strongest in the U.S., limiting data collection and banning targeted ads to minors. 

• States like Vermont, Massachusetts, and Maine are moving toward stronger privacy laws this year. 

Further Reading: EPIC 

February 2025 - ExploreSec Cybersecurity Threat Intelligence Newsletter

This is a monthly newsletter that I share internally with our Cybersecurity team. Feel free to take and use for your own team. Created with the help of ChatGPT.

ModeLeak Vulnerabilities in Google's Vertex AI Platform 

Palo Alto Networks' Unit 42 team has uncovered two critical vulnerabilities, collectively termed "ModeLeak," within Google's Vertex AI platform. These flaws could enable attackers to escalate privileges and exfiltrate sensitive machine learning (ML) models, including fine-tuned large language model (LLM) adapters. 

Key Insights: 

• Privilege Escalation via Custom Jobs: Attackers can exploit custom job permissions to gain unauthorized access to data services within a project, leading to potential exposure of sensitive information. 

• Model Exfiltration through Malicious Models: By deploying a poisoned model, adversaries can exfiltrate other fine-tuned models in the environment, risking proprietary data and custom optimizations. 

Google has addressed these vulnerabilities by implementing fixes in the Vertex AI platform. Organizations utilizing Vertex AI should review their security protocols to ensure protection against similar threats. 

Further Reading: Unit 42 Blog 

Black Basta Ransomware Adopts Advanced Social Engineering Tactics 

The Black Basta ransomware group has recently enhanced its attack strategies by incorporating sophisticated social engineering techniques, including email bombing, QR code phishing, and the deployment of custom malware payloads. 

Key Developments: 

• Email Bombing: Attackers inundate targets with excessive emails by subscribing their addresses to numerous mailing lists. This tactic overwhelms victims and increases the likelihood of interaction with subsequent malicious communications. 

• Impersonation via Microsoft Teams: Threat actors pose as IT support personnel, contacting victims through Microsoft Teams to establish trust and facilitate the installation of remote access tools. 

• QR Code Phishing: Malicious QR codes are sent to victims, directing them to phishing sites designed to harvest credentials or deploy additional malware. 

• Custom Malware Deployment: The group utilizes bespoke tools such as KNOTWRAP (a memory-only dropper) and KNOTROCK (a .NET-based utility) to execute ransomware payloads stealthily. 

Further Reading: The Hacker News 

North Korean IT Workers Infiltrating Global Companies 

Recent investigations have uncovered that operatives from the Democratic People's Republic of Korea (DPRK) are securing remote IT positions in international companies under false identities. These individuals channel their earnings to fund North Korea's weapons programs, posing significant security and compliance risks to employers. 

Key Insights: 

• Use of False Identities: North Korean IT workers often utilize stolen or fabricated identities to obtain employment, making detection challenging. 

• Revenue Generation for DPRK: Earnings from these positions are funneled back to North Korea, supporting its sanctioned weapons development initiatives. 

• Potential for Insider Threats: Beyond financial implications, these operatives may have access to sensitive company data, increasing the risk of intellectual property theft and cyber espionage. 

Further Reading: Unit 42 Blog 

North Korean IT Workers Linked to Phishing Attacks via Malicious Video Conferencing Apps 

Unit 42 researchers have identified a cluster of North Korean IT operatives, designated as CL-STA-0237, involved in phishing attacks that deploy malware through counterfeit video conferencing applications. Operating primarily from Laos, these individuals have secured positions in various companies, leveraging their roles to further malicious activities. 

Key Insights: 

• Malware Distribution: The group utilizes fraudulent video conferencing platforms to disseminate malware, notably the BeaverTail and InvisibleFerret remote access trojans, compromising systems during supposed job interview processes. 

• Global Reach: By infiltrating organizations worldwide, these operatives support North Korea's illicit endeavors, including its weapons of mass destruction and ballistic missile programs. 

• Evolving Tactics: The shift from merely seeking income to engaging in aggressive malware campaigns indicates a significant escalation in their operational strategies. 

Further Reading: Unit 42 Blog 

Surge in 'ClickFix' Social Engineering Attacks 

Cybersecurity researchers have identified a significant increase in the use of a social engineering tactic known as "ClickFix." This method deceives users into copying and pasting malicious commands into their systems, leading to malware infections. 

Key Developments: 

• Deceptive Error Messages: Attackers present fake error dialogs, prompting users to execute provided commands to resolve non-existent issues. 

• Malware Delivery: By following these instructions, users inadvertently run scripts that download and install malware such as Lumma Stealer and AsyncRAT. 

• Global Impact: Campaigns employing ClickFix techniques have targeted organizations worldwide, with notable incidents involving fake GitHub security notifications and counterfeit software updates. 

Further Reading: Proofpoint Blog 

Malicious Ads Deliver SocGholish Malware to Kaiser Permanente Employees 

A recent cyberattack has targeted Kaiser Permanente employees through malicious advertisements on Google Search, leading to the distribution of SocGholish malware. 

Key Developments: 

• Malicious Advertisements: Threat actors placed deceptive ads mimicking Kaiser Permanente's HR portal to lure employees searching for benefits and payroll information. 

• Compromised Website Redirects: Clicking the fraudulent ad redirected users to a compromised website, bellonasoftware[.]com, which briefly displayed a phishing page before prompting a fake browser update. 

• SocGholish Malware Deployment: The fake browser update led to the download of "Update.js," a malicious script associated with the SocGholish malware campaign, designed to collect system information and potentially allow human operators to execute further malicious actions. 

This incident highlights the evolving tactics of cybercriminals in exploiting trusted platforms like Google Ads to distribute malware. 

Further Reading: Malwarebytes Blog 

DarkGate Malware Leveraging Vishing via Microsoft Teams 

Recent analyses have identified a concerning trend in which cybercriminals are deploying DarkGate malware through vishing (voice phishing) attacks conducted via Microsoft Teams. 

Key Developments: 

• Social Engineering Tactics: Attackers impersonate employees from known client organizations during Microsoft Teams calls, convincing victims to download remote desktop applications like AnyDesk. 

• Malware Deployment: Once remote access is established, DarkGate malware is installed, enabling threat actors to execute malicious commands, gather system information, and maintain persistent access. 

• Operational Impact: Although some attacks have been thwarted before data exfiltration, the initial breach underscores vulnerabilities in user awareness and the potential for significant security incidents. 

Further Reading: Trend Micro Research 

Sophisticated Phishing Campaigns Exploit Trusted Platforms 

Recent analyses have uncovered advanced phishing campaigns targeting employees across multiple industries and jurisdictions. These operations employ sophisticated techniques to bypass Secure Email Gateways (SEGs) and exploit trusted platforms, creating highly convincing schemes to deceive victims and steal their credentials. 

Key Developments: 

• Exploitation of Trusted Platforms: Attackers leverage familiar platforms and services to enhance the credibility of their phishing attempts, making it more challenging for victims to identify fraudulent communications. 

• Bypassing Secure Email Gateways (SEGs): The campaigns utilize advanced methods to evade detection by SEGs, allowing malicious emails to reach employees' inboxes undetected. 

• Wide-Ranging Targets: Over 30 companies across 12 industries and 15 jurisdictions have been affected, indicating a broad and indiscriminate approach by the threat actors. 

Further Reading: Group-IB Blog 

Top Cyber Attacker Techniques (August–October 2024) 

Recent analyses have identified key cyber attacker tactics, techniques, and procedures (TTPs) observed between August 1 and October 31, 2024. 

Key Developments: 

• Phishing Incidents: Phishing accounted for 46% of all customer incidents during this period, indicating a significant rise likely due to high employee turnover and the accessibility of phishing kits. 

• Prevalent Malware: "SocGholish" and "LummaC2" emerged as the most frequently observed malware in customer environments, highlighting their widespread use in recent attacks. 

• Cloud Services Alerts: There was a 20% increase in cloud services alerts, correlating with the rising adoption of cloud accounts and associated security challenges. 

• Ransomware Activity: Despite a slowdown in "LockBit" ransomware activity due to law enforcement actions and a loss of affiliate trust, it remains a key player. Meanwhile, "RansomHub" is rising rapidly due to its attractive ransomware-as-a-service (RaaS) model. The U.S., manufacturing sector, and professional, scientific, and technical services (PSTS) sector are primary targets amidst an overall increase in ransomware attacks. 

• Initial Access Broker (IAB) Activity: IAB activity increased by 16%, heavily targeting U.S.-based organizations, possibly due to perceived financial capabilities stemming from cyber insurance. 

• Insider Threat Content: A 7% rise in insider threat discussions on cybercrime forums was noted, driven by significant financial incentives, underscoring the growing complexity of cybersecurity challenges. 

• Impersonating Domain Alerts: There was a 6% increase in alerts related to impersonating domains, indicating ongoing reliance on simple techniques to capture credentials and data. 

Further Reading: ReliaQuest Blog 

Phishing Attacks Double in 2024 

Recent analyses reveal a significant surge in phishing activities throughout 2024, with overall phishing messages increasing by 202% in the latter half of the year. Notably, credential phishing attacks have escalated by 703% during the same period. 

Key Developments: 

• Prevalence of Zero-Day URLs: Approximately 80% of malicious links identified are zero-day threats—newly created URLs designed to evade traditional detection methods. 

• Diversification of Attack Vectors: While link-based phishing remains predominant, there is a notable increase in text-based threats, such as business email compromise (BEC) and invoice scams, as well as file-based threats employing techniques like HTML smuggling. 

• Expansion Beyond Email: Phishing attacks are increasingly targeting multiple platforms, including SMS, LinkedIn, and Microsoft Teams, indicating a shift towards multichannel approaches. 

Further Reading: Infosecurity Magazine 

Surge in Phishing Attacks via New Top-Level Domains 

Recent analyses reveal a significant increase in phishing attacks, with a 40% rise observed in the year ending August 2024. A substantial portion of this growth is attributed to the exploitation of new generic top-level domains (gTLDs) such as .shop, .top, and .xyz, which are favored by cybercriminals due to their low registration costs and minimal verification requirements. 

Key Developments: 

• Disproportionate Use in Cybercrime: Although new gTLDs constitute only 11% of the market for new domains, they account for approximately 37% of reported cybercrime domains between September 2023 and August 2024. 

• Attraction to Low-Cost Registrations: Registrars offering domain registrations for less than $1, with little to no identity verification, are particularly appealing to spammers and scammers seeking to conduct malicious activities anonymously. 

• ICANN's Expansion Plans: Despite the misuse of these new gTLDs, the Internet Corporation for Assigned Names and Numbers (ICANN) is proceeding with plans to introduce additional gTLDs, potentially broadening the landscape for cybercriminal activities. 

Further Reading: Krebs on Security 

 

Surge in Suspicious Domain Registrations Exploiting High-Profile Events 

Recent analyses have identified a significant increase in suspicious domain registration campaigns exploiting high-profile events, such as the 2024 Summer Olympics in Paris. 

Key Developments: 

• Event-Driven Domain Registrations: Threat actors register deceptive domains containing event-specific keywords to mimic official websites, aiming to deceive users seeking legitimate information. 

• Exploitation of Public Interest: Cybercriminals leverage global events to attract large audiences, using fraudulent domains to distribute malware, conduct phishing attacks, or sell counterfeit merchandise. 

• Indicators of Malicious Activity: Monitoring domain registrations, DNS traffic, URL patterns, and textual characteristics can help identify and mitigate these threats. 

Further Reading: Unit 42 Blog 

Zloader Malware Adopts DNS Tunneling for Stealthier C2 Communications 

Recent analyses have identified that the Zloader malware, a modular Trojan based on the leaked Zeus source code, has incorporated DNS tunneling into its command-and-control (C2) communication methods. 

Key Developments: 

• DNS Tunneling Implementation: Zloader now employs a custom protocol over DNS, utilizing IPv4 to tunnel encrypted TLS network traffic. This technique enables the malware to conceal its C2 communications within standard DNS queries and responses, making detection more challenging. 

• Enhanced Anti-Analysis Features: The latest version of Zloader includes improved anti-analysis capabilities, such as environment checks and API import resolution algorithms, to evade malware sandboxes and static detection methods. 

• Interactive Shell Capability: Zloader has introduced an interactive shell that supports over a dozen commands, potentially facilitating hands-on keyboard activity by threat actors during attacks. 

Further Reading: Zscaler Blog 

Cybercriminals Exploit Fake CAPTCHAs to Distribute Malware 

Recent analyses have identified a deceptive tactic where cybercriminals use fake CAPTCHA pages to distribute malware, exploiting users' trust in these verification systems. 

Key Developments: 

• Malicious Redirects: Users visiting compromised websites are redirected to fraudulent CAPTCHA pages that closely mimic legitimate services like Google and CloudFlare. 

• Clipboard Hijacking: These fake CAPTCHAs silently copy malicious commands to the user's clipboard via JavaScript, prompting them to execute these commands unknowingly through the Windows Run prompt. 

• Malware Installation: Executing the copied commands leads to the installation of malware, including information stealers and remote-access trojans (RATs), which can extract sensitive data and provide persistent access to compromised systems. 

Further Reading: ReliaQuest Blog 

Threat Actors Exploit LDAP for Network Enumeration 

Recent analyses have identified that both nation-state and cybercriminal threat actors are leveraging the Lightweight Directory Access Protocol (LDAP) to perform network enumeration within Active Directory environments. 

Key Developments: 

• Abuse of LDAP Attributes: Attackers utilize LDAP queries to extract sensitive information, such as user accounts, group memberships, and permissions, facilitating lateral movement and privilege escalation within compromised networks. 

• Use of Enumeration Tools: Tools like BloodHound and its data collector, SharpHound, are commonly employed to map Active Directory structures, identifying potential attack paths and high-value targets. 

• Detection Challenges: Distinguishing between legitimate and malicious LDAP activity is difficult due to the high volume of benign LDAP traffic in typical network environments, complicating efforts to detect and mitigate these attacks. 

Further Reading: Unit 42 Blog 

'Araneida' Web Hacking Service Linked to Turkish IT Firm 

Recent investigations have uncovered that 'Araneida,' a cloud-based web hacking service, is utilizing a cracked version of Acunetix—a commercial web application vulnerability scanner—to facilitate cyberattacks. Notably, this service has been traced back to a Turkish information technology firm. 

Key Developments: 

• Exploitation of Cracked Software: Araneida employs an unauthorized version of Acunetix, enabling users to perform offensive reconnaissance, extract user data, and identify exploitable vulnerabilities on target websites. 

• Proxy Integration for Anonymity: The service incorporates a robust proxy network, allowing scans to originate from a diverse pool of IP addresses, thereby concealing the true source of the activity. 

• Cybercriminal Promotion: Advertised on multiple cybercrime forums and boasting a Telegram channel with nearly 500 subscribers, Araneida has been linked to the compromise of over 30,000 websites within six months. One user claimed to have purchased a luxury vehicle using proceeds from payment card data obtained through the service. 

• Connection to Turkish IT Firm: Investigations reveal that the domain araneida[.]co, operational since February 2023, is associated with an individual employed as a senior software developer at Bilitro Yazilim, an IT firm based in Ankara, Turkey. 

Further Reading: Krebs on Security 

LLMs Employed to Obfuscate Malicious JavaScript 

Recent analyses have revealed that adversaries are leveraging large language models (LLMs) to obfuscate malicious JavaScript code, enhancing its ability to evade detection mechanisms. 

Key Developments: 

Automated Code Obfuscation: Attackers utilize LLMs to iteratively transform malicious JavaScript through techniques such as variable renaming, dead code insertion, and whitespace removal, without altering the code's functionality. 

Evasion of Detection Tools: These LLM-generated variants can bypass traditional detection tools, including static analysis models, by producing natural-looking code that is harder to identify as malicious. 

Scalability of Attacks: The use of LLMs enables the creation of numerous unique malware variants at scale, increasing the difficulty for security systems to detect and mitigate these threats effectively. 

Further Reading: Unit 42 Blog 

Mobile Phishing Attacks Employ New Tactics to Evade Security Measures 

Recent analyses have identified a novel social engineering tactic targeting mobile banking users. Attackers are leveraging Progressive Web Apps (PWAs) and WebAPKs to distribute phishing websites disguised as legitimate applications, effectively bypassing traditional security warnings and app store vetting processes. 

Key Insights: 

• Exploitation of PWAs and WebAPKs: Unlike traditional apps, these malicious PWAs and WebAPKs are essentially phishing websites packaged to look like legitimate applications. This means they do not exhibit the typical behaviors or characteristics associated with malware, making detection more challenging. 

• Bypassing Security Measures: Their ability to bypass traditional security warnings of a mobile operating system, and total sidestepping of app store vetting processes, is particularly concerning. This allows attackers to distribute malicious content without triggering standard security alerts. 

• Anticipated Increase in Sophistication: It is anticipated that more sophisticated and varied phishing campaigns utilizing PWAs and WebAPKs will emerge, unless mobile platforms change their approach towards them. 

Further Reading: KnowBe4 Blog 

Tax Fraud: How to Avoid Criminals Filing Fraudulent Returns

This is a post I put together for my own internal security awareness program. Feel free to grab and use within your own organization. Created with help from ChatGPT. 

Tax season is a time when individuals and businesses focus on filing their returns and securing their refunds. However, it is also a prime opportunity for fraudsters looking to exploit the system. One particularly alarming form of fraud is when criminals file tax returns on behalf of individuals without their knowledge, stealing valuable refunds in the process. This type of fraud, known as tax-related identity theft, can have serious financial consequences for the victim. In this post, we'll dive into how this scheme works, its impact, and the steps you can take to protect yourself.

How the Scheme Operates

1. Data Acquisition Criminals obtain personal information through a variety of methods, such as data breaches, phishing attacks, or purchasing stolen data from underground markets. This personal information—such as your Social Security number and other identifying details—becomes their key to committing fraud.

2. Filing False Returns Once they have the necessary information, criminals file tax returns on behalf of individuals without their consent, typically early in the tax season to get ahead of the legitimate filer.

3. Refund Diversion The fraudsters request that the refund be deposited into bank accounts they control, bypassing the rightful taxpayer entirely. By the time the legitimate taxpayer files their return, the criminals have already claimed the refund.

Consequences for Victims

• Delayed Refunds The IRS will flag the duplicate filings, resulting in significant delays for the legitimate taxpayer's refund. This can cause frustration and financial strain, especially if the refund was anticipated to cover expenses.

• Tax Liabilities Victims may find themselves liable for taxes owed on fraudulent returns filed by the criminals. This unexpected liability can lead to a tax debt that wasn’t part of the original financial planning.

• Identity Theft Beyond the immediate tax consequences, the stolen personal information can be used in other fraudulent activities, such as opening new credit accounts or applying for loans in the victim’s name.

How to Protect Yourself

• File Early One of the best ways to prevent criminals from filing fraudulent returns is to file your taxes early. The sooner your return is filed, the less likely criminals are to file a fake return using your information. Early filing reduces the opportunity for fraudsters to get to your refund first.

• Use a Reputable Tax Service Ensure that the tax preparer you use is legitimate and has a good reputation. If you're using a tax professional, verify their credentials, such as their IRS Preparer Tax Identification Number (PTIN). Check online reviews or ask for referrals from trusted sources to avoid working with fraudulent tax preparers who might exploit your information.

• Consider an Identity Protection PIN (IP PIN) The IRS offers an Identity Protection PIN program, which provides an added layer of security for taxpayers. This PIN is used when filing taxes and helps prevent unauthorized returns from being filed in your name.

Conclusion

Tax fraud in the form of criminals filing fraudulent returns can cause significant stress and financial loss. By understanding how the scheme works and taking proactive measures, you can better protect yourself from becoming a victim. Filing early, using a reputable tax service, monitoring your personal information, and using additional security measures like an IP PIN are all critical steps in preventing and mitigating the effects of tax-related identity theft. 

Further Reading

For more tips on protecting yourself from tax fraud, visit the IRS website and read about common scams and how to avoid them.

Beware of Fake Job Offers in the 2025 job market

In today's job market, the allure of remote work has become increasingly enticing. However, companies have started to shift away from remote work post-pandemic and are requiring more in-person or hybrid for employees. Combine that with the downsizing companies are going through at this time and job scams are going to pop up on a more regular basis. Recently, I got the above text from a “recruiter.”

While this might seem like a great opportunity it’s a scam. A job offer does not typically come over text nor does it happen without an interview. This is a path to getting personal information, financial, or drawn into the scam ecosystem as a money mule.

The Scam: Too Good to Be True

The scam typically begins with an unsolicited message from an individual claiming to be "Emily," a customer service agent at Bonanza. The message outlines an attractive remote position with the following promises:

• High Earnings: Potential to earn between $50 to $500 per day, with a base salary of $1,000 for every four days worked.

• Flexible Hours: Commitment of just 60 to 90 minutes per day.

• Comprehensive Benefits: Offers include paid annual leave, maternity and paternity leave, and other legal holidays.

• Minimal Effort: Assurances of free training and a guaranteed paid probation period.

Recipients are encouraged to respond to a provided phone number to seize this "opportunity."

Red Flags in the Offer

While the proposition may appear appealing, several indicators suggest it's a scam:

• Unsolicited Contact: Legitimate companies seldom extend job offers without prior interaction or application. Receiving such a message without prior engagement is suspicious.

• Free Email Account: This text was sent with a Gmail account that anyone that is available to anyone for free.

• Exaggerated Earnings and Benefits: Promises of substantial income for minimal work are classic red flags. Genuine employers provide realistic compensation aligned with industry standards.

• Vague Job Description: The lack of specific details about job responsibilities, using ambiguous phrases like "helping merchants update data," is a common tactic to obscure the scam's true nature.

• Urgency to Respond: Scammers often create a sense of urgency to prevent thorough consideration. Pressuring immediate action is a tactic to catch victims off-guard.

• Unprofessional Communication: Errors in grammar, informal language, or inconsistencies in the message are telltale signs of fraudulent communication.

• Request for Contact via Personal Number: Legitimate companies typically use official communication channels. Requests to contact personal numbers are uncommon and suspicious.

What Happens If You Respond?

Engaging with the scammer can lead to several detrimental outcomes:

• Phishing for Personal Information: Scammers may request sensitive data, such as Social Security numbers or banking details, under the guise of processing employment paperwork.

• Upfront Payments: Requests for fees covering "training" or "equipment," with promises of reimbursement, are common. Once paid, these funds are unrecoverable.

• Identity Theft: Shared personal information can be exploited for identity theft, leading to financial and legal complications.

• No Real Job: After extracting money or information, the scammer disappears, leaving the victim without employment and at a loss.

• Become a Money Mule: A money mule is someone who transfers or moves illegally acquired money on behalf of others, often unknowingly.

Protecting Yourself from Job Scams

To shield yourself from such fraudulent schemes, consider the following precautions:

• Research the Company: Visit the official website and verify job postings. Authentic opportunities are listed on company websites or reputable job boards.

• Verify the Contact: Ensure that communications come from official company channels. Be wary of contacts using personal email addresses or phone numbers.

• Be Skeptical of Extravagant Claims: If an offer seems too good to be true, it warrants skepticism. Legitimate jobs have clear expectations and reasonable compensation.

• Never Pay to Work: Authentic employers do not require upfront payments for any reason.

• Report Suspicious Offers: Report potential scams to the Federal Trade Commission (FTC) at ReportFraud.ftc.gov and to the platform where the offer was encountered.

Conclusion

Scammers continually adapt their tactics to exploit the evolving job market and technological landscape. By staying informed and vigilant, you can protect yourself from falling victim to such schemes. Always verify the legitimacy of job offers and remain cautious of unsolicited communications. Remember, if something feels amiss, it's worth investigating further. Stay safe and informed in your job search and digital interactions.

Nzyme: Your Wi-Fi Watchdog Against Wireless Woes

This was originally posted on LinkedIn by Kyle Goode. In effort to get the blog section more populated I’ve reached out to some authors and asked if they’d be okay having their content put on this site. Kyle was gracious enough to let me grab his posts and highlight them here. Make sure to give him a follow on LinkedIn.

Nzyme is a unique open-source Wi-Fi security solution. I have been a user since its 1.0 version, and to this day, I haven’t come across another platform that focuses as effectively on Wi-Fi security. While most access points can detect rogue access points, few offer the same level of capability as Nzyme.

Nzyme introduces the concept of "bandits," which scan and alert on common Wi-Fi penetration testing tools such as the Pwnagotchi, Wi-Fi Pineapple, and Flipper Zero ESP32. These tools are uniquely fingerprinted by the platform. Owning any of these "bandits" makes it easy and efficient to develop and test alert rules in real time.

Currently, alerts are limited to SMTP and can be categorized into two types:

1. System-based alerts: Triggered if parts of the platform, such as taps, start failing.

2. Security-based alerts: Triggered when a bandit is detected in the environment, malicious deauthentication packets are transmitted, or rogue access points are detected.

The Nzyme platform consists of a PostgreSQL database, the core Nzyme platform (called the Nzyme node), and a Wi-Fi dongle (called a Nzyme tap). These components are primarily run on Debian- or Ubuntu-based systems. While Raspbian is often recommended, regular Debian works just as well. Taps are Ubuntu-only but are also compatible with Debian systems.

Evolution from 1.0 to 2.0

In the 1.0 version, Nzyme was fully integrated, running as a single service. With the 2.0 alpha versions, the architecture has evolved to support a multi-node setup. You can now run a single Nzyme node and deploy as many Nzyme taps as needed for comprehensive network coverage. These components are distributed as separate packages.

One exciting feature introduced in 2.0 is trilateration, which requires at least three taps on the same floor of a building. Trilateration allows you to pinpoint the location of rogue devices, such as bandits. This is particularly useful if a threat actor gains physical access to your building and places a malicious device in an inconspicuous location, a common technique used by penetration testers. The 1.0 version even provided guidance on building a handheld tracking device for bandits, though I wasn’t brave enough to attempt it at the time.

The 2.0 version also adds support for Ethernet monitoring. By using a span/mirror/tap port on a switch, you can monitor network activity, such as DNS tunneling, beaconing, and remote connections like SSH. While I typically rely on Suricata with Snort rules and Zeek with RITA for comprehensive network monitoring, Nzyme’s Ethernet capability provides a simpler configuration and adds redundancy. Additionally, ARP analysis appears to be a planned feature in future versions.

System Monitoring and API Integration

Nzyme allows you to create monitored networks for your environment. As I’ve mentioned in a previous article, I’m a big fan of Prometheus for system monitoring and metric gathering. Nzyme offers a native exporter for Prometheus, making it easy to integrate into existing monitoring solutions.

Nzyme has also introduced Nzyme Connect, an API for obtaining GeoIP, MAC address OUI, and vendor information. Additionally, it offers Bluetooth device discovery. Although this feature is still in its early stages, I’m excited to connect it with my Ubertooth to explore its capabilities further. Nzyme Connect also serves as a SaaS platform for monitoring your Nzyme nodes and taps, with enterprise support now available. For added convenience, prebuilt Wi-Fi kits are offered, eliminating the need for manual configuration.

Future Features and Wishlist

I am eagerly anticipating the stable release of Nzyme 2.0 and the additional features that will come with it. One feature I hope to see in the future is webhook integrations with popular messaging apps like Slack and Teams. This would streamline alerting and incident response for security teams.

Nzyme continues to solidify its position as a versatile and powerful Wi-Fi security solution. Whether you're a security professional, penetration tester, or simply someone concerned about wireless security, Nzyme offers tools to protect your environment against rogue devices and malicious activities. I’m excited to see where this platform goes next.

Resources:

Nzyme

Nzyme Bandits

Nzyme Network Monitoring

Nzyme Trilateration

Nzyme Connect

Nzyme Wifi Kit

January 2025 - Cybersecurity Threat Intelligence Newsletter

This is a monthly newsletter that I share internally with our Cybersecurity team. Feel free to take and use for your own team. Created with the help of ChatGPT.

ModeLeak Vulnerabilities in Google's Vertex AI Platform 

Palo Alto Networks' Unit 42 team has uncovered two critical vulnerabilities, collectively termed "ModeLeak," within Google's Vertex AI platform. These flaws could enable attackers to escalate privileges and exfiltrate sensitive machine learning (ML) models, including fine-tuned large language model (LLM) adapters. 

Key Insights: 

• Privilege Escalation via Custom Jobs: Attackers can exploit custom job permissions to gain unauthorized access to data services within a project, leading to potential exposure of sensitive information. 

• Model Exfiltration through Malicious Models: By deploying a poisoned model, adversaries can exfiltrate other fine-tuned models in the environment, risking proprietary data and custom optimizations. 

Google has addressed these vulnerabilities by implementing fixes in the Vertex AI platform. Organizations utilizing Vertex AI should review their security protocols to ensure protection against similar threats. 

Further Reading: Unit 42 Blog 

Black Basta Ransomware Adopts Advanced Social Engineering Tactics 

The Black Basta ransomware group has recently enhanced its attack strategies by incorporating sophisticated social engineering techniques, including email bombing, QR code phishing, and the deployment of custom malware payloads. 

Key Developments: 

• Email Bombing: Attackers inundate targets with excessive emails by subscribing their addresses to numerous mailing lists. This tactic overwhelms victims and increases the likelihood of interaction with subsequent malicious communications. 

• Impersonation via Microsoft Teams: Threat actors pose as IT support personnel, contacting victims through Microsoft Teams to establish trust and facilitate the installation of remote access tools. 

• QR Code Phishing: Malicious QR codes are sent to victims, directing them to phishing sites designed to harvest credentials or deploy additional malware. 

• Custom Malware Deployment: The group utilizes bespoke tools such as KNOTWRAP (a memory-only dropper) and KNOTROCK (a .NET-based utility) to execute ransomware payloads stealthily. 

Further Reading: The Hacker News 

North Korean IT Workers Infiltrating Global Companies 

Recent investigations have uncovered that operatives from the Democratic People's Republic of Korea (DPRK) are securing remote IT positions in international companies under false identities. These individuals channel their earnings to fund North Korea's weapons programs, posing significant security and compliance risks to employers. 

Key Insights: 

• Use of False Identities: North Korean IT workers often utilize stolen or fabricated identities to obtain employment, making detection challenging. 

• Revenue Generation for DPRK: Earnings from these positions are funneled back to North Korea, supporting its sanctioned weapons development initiatives. 

• Potential for Insider Threats: Beyond financial implications, these operatives may have access to sensitive company data, increasing the risk of intellectual property theft and cyber espionage. 

Further Reading: Unit 42 Blog 

North Korean IT Workers Linked to Phishing Attacks via Malicious Video Conferencing Apps 

Unit 42 researchers have identified a cluster of North Korean IT operatives, designated as CL-STA-0237, involved in phishing attacks that deploy malware through counterfeit video conferencing applications. Operating primarily from Laos, these individuals have secured positions in various companies, leveraging their roles to further malicious activities. 

Key Insights: 

• Malware Distribution: The group utilizes fraudulent video conferencing platforms to disseminate malware, notably the BeaverTail and InvisibleFerret remote access trojans, compromising systems during supposed job interview processes. 

• Global Reach: By infiltrating organizations worldwide, these operatives support North Korea's illicit endeavors, including its weapons of mass destruction and ballistic missile programs. 

• Evolving Tactics: The shift from merely seeking income to engaging in aggressive malware campaigns indicates a significant escalation in their operational strategies. 

Further Reading: Unit 42 Blog 

Surge in 'ClickFix' Social Engineering Attacks 

Cybersecurity researchers have identified a significant increase in the use of a social engineering tactic known as "ClickFix." This method deceives users into copying and pasting malicious commands into their systems, leading to malware infections. 

Key Developments: 

• Deceptive Error Messages: Attackers present fake error dialogs, prompting users to execute provided commands to resolve non-existent issues. 

• Malware Delivery: By following these instructions, users inadvertently run scripts that download and install malware such as Lumma Stealer and AsyncRAT. 

• Global Impact: Campaigns employing ClickFix techniques have targeted organizations worldwide, with notable incidents involving fake GitHub security notifications and counterfeit software updates. 

Further Reading: Proofpoint Blog 

Malicious Ads Deliver SocGholish Malware to Kaiser Permanente Employees 

A recent cyberattack has targeted Kaiser Permanente employees through malicious advertisements on Google Search, leading to the distribution of SocGholish malware. 

Key Developments: 

• Malicious Advertisements: Threat actors placed deceptive ads mimicking Kaiser Permanente's HR portal to lure employees searching for benefits and payroll information. 

• Compromised Website Redirects: Clicking the fraudulent ad redirected users to a compromised website, bellonasoftware[.]com, which briefly displayed a phishing page before prompting a fake browser update. 

• SocGholish Malware Deployment: The fake browser update led to the download of "Update.js," a malicious script associated with the SocGholish malware campaign, designed to collect system information and potentially allow human operators to execute further malicious actions. 

This incident highlights the evolving tactics of cybercriminals in exploiting trusted platforms like Google Ads to distribute malware. 

Further Reading: Malwarebytes Blog 

DarkGate Malware Leveraging Vishing via Microsoft Teams 

Recent analyses have identified a concerning trend in which cybercriminals are deploying DarkGate malware through vishing (voice phishing) attacks conducted via Microsoft Teams. 

Key Developments: 

• Social Engineering Tactics: Attackers impersonate employees from known client organizations during Microsoft Teams calls, convincing victims to download remote desktop applications like AnyDesk. 

• Malware Deployment: Once remote access is established, DarkGate malware is installed, enabling threat actors to execute malicious commands, gather system information, and maintain persistent access. 

• Operational Impact: Although some attacks have been thwarted before data exfiltration, the initial breach underscores vulnerabilities in user awareness and the potential for significant security incidents. 

Further Reading: Trend Micro Research 

Sophisticated Phishing Campaigns Exploit Trusted Platforms 

Recent analyses have uncovered advanced phishing campaigns targeting employees across multiple industries and jurisdictions. These operations employ sophisticated techniques to bypass Secure Email Gateways (SEGs) and exploit trusted platforms, creating highly convincing schemes to deceive victims and steal their credentials. 

Key Developments: 

• Exploitation of Trusted Platforms: Attackers leverage familiar platforms and services to enhance the credibility of their phishing attempts, making it more challenging for victims to identify fraudulent communications. 

• Bypassing Secure Email Gateways (SEGs): The campaigns utilize advanced methods to evade detection by SEGs, allowing malicious emails to reach employees' inboxes undetected. 

• Wide-Ranging Targets: Over 30 companies across 12 industries and 15 jurisdictions have been affected, indicating a broad and indiscriminate approach by the threat actors. 

Further Reading: Group-IB Blog 

Top Cyber Attacker Techniques (August–October 2024) 

Recent analyses have identified key cyber attacker tactics, techniques, and procedures (TTPs) observed between August 1 and October 31, 2024. 

Key Developments: 

• Phishing Incidents: Phishing accounted for 46% of all customer incidents during this period, indicating a significant rise likely due to high employee turnover and the accessibility of phishing kits. 

• Prevalent Malware: "SocGholish" and "LummaC2" emerged as the most frequently observed malware in customer environments, highlighting their widespread use in recent attacks. 

• Cloud Services Alerts: There was a 20% increase in cloud services alerts, correlating with the rising adoption of cloud accounts and associated security challenges. 

• Ransomware Activity: Despite a slowdown in "LockBit" ransomware activity due to law enforcement actions and a loss of affiliate trust, it remains a key player. Meanwhile, "RansomHub" is rising rapidly due to its attractive ransomware-as-a-service (RaaS) model. The U.S., manufacturing sector, and professional, scientific, and technical services (PSTS) sector are primary targets amidst an overall increase in ransomware attacks. 

• Initial Access Broker (IAB) Activity: IAB activity increased by 16%, heavily targeting U.S.-based organizations, possibly due to perceived financial capabilities stemming from cyber insurance. 

• Insider Threat Content: A 7% rise in insider threat discussions on cybercrime forums was noted, driven by significant financial incentives, underscoring the growing complexity of cybersecurity challenges. 

• Impersonating Domain Alerts: There was a 6% increase in alerts related to impersonating domains, indicating ongoing reliance on simple techniques to capture credentials and data. 

Further Reading: ReliaQuest Blog 

Phishing Attacks Double in 2024 

Recent analyses reveal a significant surge in phishing activities throughout 2024, with overall phishing messages increasing by 202% in the latter half of the year. Notably, credential phishing attacks have escalated by 703% during the same period. 

Key Developments: 

• Prevalence of Zero-Day URLs: Approximately 80% of malicious links identified are zero-day threats—newly created URLs designed to evade traditional detection methods. 

• Diversification of Attack Vectors: While link-based phishing remains predominant, there is a notable increase in text-based threats, such as business email compromise (BEC) and invoice scams, as well as file-based threats employing techniques like HTML smuggling. 

• Expansion Beyond Email: Phishing attacks are increasingly targeting multiple platforms, including SMS, LinkedIn, and Microsoft Teams, indicating a shift towards multichannel approaches. 

Further Reading: Infosecurity Magazine 

Surge in Phishing Attacks via New Top-Level Domains 

Recent analyses reveal a significant increase in phishing attacks, with a 40% rise observed in the year ending August 2024. A substantial portion of this growth is attributed to the exploitation of new generic top-level domains (gTLDs) such as .shop, .top, and .xyz, which are favored by cybercriminals due to their low registration costs and minimal verification requirements. 

Key Developments: 

• Disproportionate Use in Cybercrime: Although new gTLDs constitute only 11% of the market for new domains, they account for approximately 37% of reported cybercrime domains between September 2023 and August 2024. 

• Attraction to Low-Cost Registrations: Registrars offering domain registrations for less than $1, with little to no identity verification, are particularly appealing to spammers and scammers seeking to conduct malicious activities anonymously. 

• ICANN's Expansion Plans: Despite the misuse of these new gTLDs, the Internet Corporation for Assigned Names and Numbers (ICANN) is proceeding with plans to introduce additional gTLDs, potentially broadening the landscape for cybercriminal activities. 

Further Reading: Krebs on Security 

Surge in Suspicious Domain Registrations Exploiting High-Profile Events 

Recent analyses have identified a significant increase in suspicious domain registration campaigns exploiting high-profile events, such as the 2024 Summer Olympics in Paris. 

Key Developments: 

• Event-Driven Domain Registrations: Threat actors register deceptive domains containing event-specific keywords to mimic official websites, aiming to deceive users seeking legitimate information. 

• Exploitation of Public Interest: Cybercriminals leverage global events to attract large audiences, using fraudulent domains to distribute malware, conduct phishing attacks, or sell counterfeit merchandise. 

• Indicators of Malicious Activity: Monitoring domain registrations, DNS traffic, URL patterns, and textual characteristics can help identify and mitigate these threats. 

Further Reading: Unit 42 Blog 

Zloader Malware Adopts DNS Tunneling for Stealthier C2 Communications 

Recent analyses have identified that the Zloader malware, a modular Trojan based on the leaked Zeus source code, has incorporated DNS tunneling into its command-and-control (C2) communication methods. 

Key Developments: 

• DNS Tunneling Implementation: Zloader now employs a custom protocol over DNS, utilizing IPv4 to tunnel encrypted TLS network traffic. This technique enables the malware to conceal its C2 communications within standard DNS queries and responses, making detection more challenging. 

• Enhanced Anti-Analysis Features: The latest version of Zloader includes improved anti-analysis capabilities, such as environment checks and API import resolution algorithms, to evade malware sandboxes and static detection methods. 

• Interactive Shell Capability: Zloader has introduced an interactive shell that supports over a dozen commands, potentially facilitating hands-on keyboard activity by threat actors during attacks. 

Further Reading: Zscaler Blog 

Cybercriminals Exploit Fake CAPTCHAs to Distribute Malware 

Recent analyses have identified a deceptive tactic where cybercriminals use fake CAPTCHA pages to distribute malware, exploiting users' trust in these verification systems. 

Key Developments: 

• Malicious Redirects: Users visiting compromised websites are redirected to fraudulent CAPTCHA pages that closely mimic legitimate services like Google and CloudFlare. 

• Clipboard Hijacking: These fake CAPTCHAs silently copy malicious commands to the user's clipboard via JavaScript, prompting them to execute these commands unknowingly through the Windows Run prompt. 

• Malware Installation: Executing the copied commands leads to the installation of malware, including information stealers and remote-access trojans (RATs), which can extract sensitive data and provide persistent access to compromised systems. 

Further Reading: ReliaQuest Blog 

Threat Actors Exploit LDAP for Network Enumeration 

Recent analyses have identified that both nation-state and cybercriminal threat actors are leveraging the Lightweight Directory Access Protocol (LDAP) to perform network enumeration within Active Directory environments. 

Key Developments: 

• Abuse of LDAP Attributes: Attackers utilize LDAP queries to extract sensitive information, such as user accounts, group memberships, and permissions, facilitating lateral movement and privilege escalation within compromised networks. 

• Use of Enumeration Tools: Tools like BloodHound and its data collector, SharpHound, are commonly employed to map Active Directory structures, identifying potential attack paths and high-value targets. 

• Detection Challenges: Distinguishing between legitimate and malicious LDAP activity is difficult due to the high volume of benign LDAP traffic in typical network environments, complicating efforts to detect and mitigate these attacks. 

Further Reading: Unit 42 Blog 

'Araneida' Web Hacking Service Linked to Turkish IT Firm 

Recent investigations have uncovered that 'Araneida,' a cloud-based web hacking service, is utilizing a cracked version of Acunetix—a commercial web application vulnerability scanner—to facilitate cyberattacks. Notably, this service has been traced back to a Turkish information technology firm. 

Key Developments: 

• Exploitation of Cracked Software: Araneida employs an unauthorized version of Acunetix, enabling users to perform offensive reconnaissance, extract user data, and identify exploitable vulnerabilities on target websites. 

• Proxy Integration for Anonymity: The service incorporates a robust proxy network, allowing scans to originate from a diverse pool of IP addresses, thereby concealing the true source of the activity. 

• Cybercriminal Promotion: Advertised on multiple cybercrime forums and boasting a Telegram channel with nearly 500 subscribers, Araneida has been linked to the compromise of over 30,000 websites within six months. One user claimed to have purchased a luxury vehicle using proceeds from payment card data obtained through the service. 

• Connection to Turkish IT Firm: Investigations reveal that the domain araneida[.]co, operational since February 2023, is associated with an individual employed as a senior software developer at Bilitro Yazilim, an IT firm based in Ankara, Turkey. 

Further Reading: Krebs on Security 

LLMs Employed to Obfuscate Malicious JavaScript 

Recent analyses have revealed that adversaries are leveraging large language models (LLMs) to obfuscate malicious JavaScript code, enhancing its ability to evade detection mechanisms. 

Key Developments: 

Automated Code Obfuscation: Attackers utilize LLMs to iteratively transform malicious JavaScript through techniques such as variable renaming, dead code insertion, and whitespace removal, without altering the code's functionality. 

Evasion of Detection Tools: These LLM-generated variants can bypass traditional detection tools, including static analysis models, by producing natural-looking code that is harder to identify as malicious. 

Scalability of Attacks: The use of LLMs enables the creation of numerous unique malware variants at scale, increasing the difficulty for security systems to detect and mitigate these threats effectively. 

Further Reading: Unit 42 Blog 

Mobile Phishing Attacks Employ New Tactics to Evade Security Measures 

Recent analyses have identified a novel social engineering tactic targeting mobile banking users. Attackers are leveraging Progressive Web Apps (PWAs) and WebAPKs to distribute phishing websites disguised as legitimate applications, effectively bypassing traditional security warnings and app store vetting processes. 

Key Insights: 

• Exploitation of PWAs and WebAPKs: Unlike traditional apps, these malicious PWAs and WebAPKs are essentially phishing websites packaged to look like legitimate applications. This means they do not exhibit the typical behaviors or characteristics associated with malware, making detection more challenging. 

• Bypassing Security Measures: Their ability to bypass traditional security warnings of a mobile operating system, and total sidestepping of app store vetting processes, is particularly concerning. This allows attackers to distribute malicious content without triggering standard security alerts. 

• Anticipated Increase in Sophistication: It is anticipated that more sophisticated and varied phishing campaigns utilizing PWAs and WebAPKs will emerge, unless mobile platforms change their approach towards them. 

Further Reading: KnowBe4 Blog 

January 2025 - Security Awareness Newsletter

This is a security awareness focused newsletter that I share internally. Feel free to grab and use for your own internal security awareness program. Created with help from ChatGPT.

FBI Shares Strategies to Combat AI-Driven Fraud Schemes 

The Federal Bureau of Investigation (FBI) has issued a public service announcement highlighting the increasing use of generative artificial intelligence (AI) by cybercriminals to enhance the sophistication and believability of fraud schemes. These AI-powered tactics are being employed across various fraudulent activities, including romance scams, investment fraud, and job recruitment cons.  

Internet Crime Complaint Center 

Key Insights: 

• Enhanced Deception: Generative AI enables criminals to produce highly convincing text, images, audio, and video content, making fraudulent communications appear legitimate and more persuasive. 

• Voice Cloning: Advanced AI techniques allow for the cloning of voices, which can be used in schemes such as impersonating family members in distress to solicit money or sensitive information.  

Synthetic Identities: AI-generated images and profiles are utilized to create fake identities on social media platforms, facilitating social engineering attacks and spear-phishing campaigns. 

Recommendations: 

• Verify Communications: Be cautious of unsolicited messages, especially those requesting personal information or financial transactions. Confirm the authenticity of such communications through direct and reliable channels. 

• Establish Verification Protocols: Develop secret codes or phrases with family members and trusted contacts to authenticate identities during unexpected or urgent requests. 

• Limit Personal Information Sharing: Be mindful of the personal data shared on social media and other public platforms, as it can be exploited to craft personalized and convincing scams. 

Staying informed about the evolving tactics of AI-driven fraud is crucial in safeguarding personal and financial information. 

Further Reading: BleepingComputer Article 

Black Basta Ransomware Adopts Advanced Social Engineering Tactics 

The Black Basta ransomware group has recently enhanced its attack strategies by incorporating sophisticated social engineering techniques, including email bombing, QR code phishing, and the deployment of custom malware payloads. 

Key Developments: 

• Email Bombing: Attackers inundate targets with excessive emails by subscribing their addresses to numerous mailing lists. This tactic overwhelms victims and increases the likelihood of interaction with subsequent malicious communications. 

• Impersonation via Microsoft Teams: Threat actors pose as IT support personnel, contacting victims through Microsoft Teams to establish trust and facilitate the installation of remote access tools. 

• QR Code Phishing: Malicious QR codes are sent to victims, directing them to phishing sites designed to harvest credentials or deploy additional malware. 

Further Reading: The Hacker News 

Phishing Attacks Target Employee Payroll Accounts 

Cybercriminals are increasingly launching phishing attacks aimed at hijacking employee payroll accounts. These schemes often involve fraudulent emails that appear to originate from Human Resources or payroll departments, requesting employees to update or verify their direct deposit information. Unsuspecting employees who comply may inadvertently provide attackers with access to their payroll accounts, leading to unauthorized changes and financial theft. 

Key Insights: 

• Impersonation of Internal Departments: Attackers craft emails that convincingly mimic internal communications from HR or payroll, exploiting employees' trust in these departments. 

• Urgency and Deception: Messages often convey a sense of urgency, such as impending payroll issues, to prompt quick action without thorough scrutiny. 

• Credential Harvesting: Links within these emails direct employees to counterfeit login pages designed to capture their credentials, granting attackers unauthorized access. 

Further Reading: KnowBe4 Blog 

Surge in 'ClickFix' Social Engineering Attacks 

Cybersecurity researchers have identified a significant increase in the use of a social engineering tactic known as "ClickFix." This method deceives users into copying and pasting malicious commands into their systems, leading to malware infections. 

Key Developments: 

• Deceptive Error Messages: Attackers present fake error dialogs, prompting users to execute provided commands to resolve non-existent issues. 

• Malware Delivery: By following these instructions, users inadvertently run scripts that download and install malware such as Lumma Stealer and AsyncRAT. 

• Global Impact: Campaigns employing ClickFix techniques have targeted organizations worldwide, with notable incidents involving fake GitHub security notifications and counterfeit software updates. 

Further Reading: Proofpoint Blog 

AI-Driven Investment Scams Proliferate via Social Media 

Cybercriminals are increasingly leveraging artificial intelligence (AI) and social media platforms to perpetrate sophisticated investment scams, leading to significant financial and data losses among victims worldwide. 

Key Insights: 

• AI-Generated Deception: Scammers utilize AI to create convincing video testimonials featuring fabricated endorsements from celebrities and financial experts, enhancing the credibility of fraudulent investment schemes. 

• Social Media Malvertising: Fraudulent advertisements are disseminated through social media channels, often mimicking legitimate company posts or news outlets, to lure potential investors into the scam. 

• Phishing Tactics: Victims are directed to counterfeit websites designed to harvest personal information under the guise of investment opportunities, leading to identity theft and unauthorized financial transactions. 

Recommendations: 

• Verify Authenticity: Scrutinize investment opportunities, especially those encountered through social media, by researching the offering entity and seeking independent financial advice. 

• Be Skeptical of High Returns: Exercise caution with schemes promising unusually high or guaranteed returns, as these are common indicators of fraudulent activity. 

• Protect Personal Information: Avoid sharing sensitive data through unsolicited links or forms; ensure websites are legitimate and secure before providing any personal details. 

Staying informed and exercising due diligence are crucial in safeguarding against these evolving AI-driven investment scams. 

Further Reading: The Hacker News 

Security Alert: Fake Brand Collaboration Scams Targeting YouTube Creators 

Cybercriminals are increasingly targeting YouTube content creators by impersonating reputable brands and offering fraudulent collaboration opportunities. These sophisticated phishing campaigns aim to distribute malware, leading to the theft of sensitive information and unauthorized access to creators' systems. 

Key Insights: 

• Impersonation of Trusted Brands: Attackers craft convincing emails that appear to originate from well-known companies, proposing enticing partnership deals to lure creators into their scheme. 

• Malware Delivery via Documents: The fraudulent offers include attachments, such as contracts or promotional materials, often delivered through password-protected files hosted on platforms like OneDrive to evade detection. 

• Theft of Sensitive Information: Once the malware is installed, it can steal login credentials, financial data, and grant attackers remote access to the victim's system, compromising both personal and channel security. 

Further Reading: CloudSEK Blog 

Malicious Ads Deliver SocGholish Malware to Kaiser Permanente Employees 

A recent cyberattack has targeted Kaiser Permanente employees through malicious advertisements on Google Search, leading to the distribution of SocGholish malware. 

Key Developments: 

• Malicious Advertisements: Threat actors placed deceptive ads mimicking Kaiser Permanente's HR portal to lure employees searching for benefits and payroll information. 

• Compromised Website Redirects: Clicking the fraudulent ad redirected users to a compromised website, bellonasoftware[.]com, which briefly displayed a phishing page before prompting a fake browser update. 

• SocGholish Malware Deployment: The fake browser update led to the download of "Update.js," a malicious script associated with the SocGholish malware campaign, designed to collect system information and potentially allow human operators to execute further malicious actions. 

This incident highlights the evolving tactics of cybercriminals in exploiting trusted platforms like Google Ads to distribute malware. 

Further Reading: Malwarebytes Blog 

Threat Actors Exploit LinkedIn to Target Job Seekers 

Cybercriminals are increasingly leveraging LinkedIn to deceive job seekers through sophisticated employment scams. By creating fake recruiter profiles, often enhanced with AI-generated images, these threat actors craft personalized messages that appear to offer legitimate job opportunities. The objective is to lure victims into clicking on malicious links that lead to phishing sites designed to harvest personal information or deploy malware. 

Key Insights: 

• Personalized Deception: Scammers tailor messages based on the victim's professional background, making the fraudulent offers appear credible and enticing. 

• Advanced Phishing Techniques: The use of AI-generated recruiter profiles and convincing communication strategies increases the likelihood of victims engaging with malicious content. 

• Exploitation of LinkedIn Features: By abusing LinkedIn's InMail feature, attackers can reach users outside their immediate network, broadening the scope of potential targets. 

Further Reading: KnowBe4 Blog 

Cybercriminals Impersonate KnowBe4 in Phishing Attacks 

Cybercriminals are impersonating KnowBe4 by sending fraudulent emails that closely mimic legitimate "Please Complete Assigned Training" notifications. These deceptive emails aim to trick recipients into clicking malicious links or downloading harmful attachments, potentially compromising personal and organizational security. 

Key Insights: 

• Sophisticated Mimicry: The phishing emails are designed to closely resemble authentic KnowBe4 training notifications, making it challenging for recipients to distinguish between legitimate and fraudulent communications. 

• Malicious Intent: Interacting with the links or attachments in these emails can lead to malware infections, unauthorized access to sensitive information, or other security breaches. 

• Targeted Deception: By exploiting the trust associated with KnowBe4's brand, attackers increase the likelihood of recipients falling victim to the scam. 

Further Reading: KnowBe4 Blog 

Malicious Advertisements Pose Growing Threat to Internet Users 

Cybercriminals are increasingly utilizing malicious advertisements, or "malvertising," to distribute malware and conduct phishing attacks. These deceptive ads often appear as legitimate sponsored content on search engine results pages, making it challenging for users to distinguish between safe and harmful links. 

Key Insights: 

• Prevalence of Malvertising: Malicious actors pay search engines to display their harmful URLs as sponsored ads, which are prominently positioned above legitimate search results. This tactic increases the likelihood of user engagement with malicious content. 

• Deceptive Appearances: These ads are crafted to closely mimic legitimate websites or services, often using familiar branding and language to deceive users into clicking on them. 

• Potential Consequences: Interacting with malvertising can lead to malware infections, unauthorized access to personal information, and financial loss. 

Further Reading: KnowBe4 Blog 

Mobile Phishing Campaign Targets Job Seekers 

Cybercriminals are impersonating recruiters to target job seekers with phony employment offers. Researchers at Zimperium warn that a phishing campaign is targeting Android phones to deliver the Antidot banking trojan.  

Key Insights: 

• Sophisticated Social Engineering: Attackers masquerade as job recruiters or HR representatives from well-known organizations, sending well-crafted phishing emails that purport to come from real companies, informing recipients that they’ve been selected to advance in the hiring process. 

• Malware Delivery: Victims are enticed to download a malicious application, leading to the installation of the Antidot banking trojan on their Android devices. 

• Credential Theft: Once installed, the malware enables a broad set of malicious actions, including credential theft of banking, cryptocurrency, and other critical applications. 

Further Reading: KnowBe4 Blog 

Phishing Scam Mimics Employment Termination Notices 

Cybercriminals are deploying phishing attacks that impersonate employment termination notices to exploit individuals' fear of job loss. These deceptive emails appear to be official communications from human resources departments, complete with authentic-looking logos and case numbers, urging immediate action to avoid "serious legal consequences." 

Key Insights: 

• Deceptive Emails: The phishing emails are designed to closely resemble legitimate employment termination notices, making it challenging for recipients to distinguish between authentic and fraudulent communications. 

• Malware Distribution: Clicking on the provided link directs victims to a fake Microsoft webpage that prompts the download of malicious software. This malware can steal sensitive information, including banking credentials, leading to significant financial and personal repercussions. 

• Exploiting Emotional Triggers: By preying on the fear of job loss, attackers increase the likelihood of recipients reacting hastily and clicking on malicious links without proper scrutiny. 

Further Reading: KnowBe4 Blog 

Malicious Google Ads Exploit Printer Troubleshooting Searches 

Cybercriminals are exploiting Google Ads to target users seeking solutions for printer issues, particularly those involving HP and Canon devices. 

Key Insights: 

• Deceptive Advertisements: Scammers purchase Google Ads that appear as legitimate tech support for printer drivers, luring users into clicking on malicious links. 

• Fake Installation Processes: Upon visiting these fraudulent sites, users encounter a simulated driver installation that culminates in a fabricated error message, warning that further attempts may damage the printer and void its warranty. 

• Phony Tech Support: The error message prompts users to initiate a live chat, connecting them with scammers posing as tech support representatives, who may then attempt to extract personal information or payments. 

Further Reading: KnowBe4 Blog 

Phishing Attack Exploits Google Calendar to Bypass Spam Filters 

Cybercriminals are leveraging Google Calendar invites to conduct phishing attacks that evade spam filters. By sending fraudulent meeting invitations, they prompt recipients to click on malicious links embedded within the event details. 

Key Insights: 

• Exploitation of Trusted Services: Attackers utilize legitimate Google services, such as Calendar and Forms, to enhance the credibility of their phishing attempts, making detection more challenging. 

• Evasion of Security Measures: By originating from trusted platforms, these phishing messages can bypass traditional email security filters, increasing the likelihood of reaching potential victims. 

• Deceptive Tactics: The fraudulent invitations often include links disguised as legitimate actions, such as viewing event details or confirming attendance, which redirect to malicious sites designed to harvest user credentials. 

Further Reading: BleepingComputer 

Smart Devices in Homes Pose Privacy and Security Risks 

Recent analyses have highlighted the potential privacy and security vulnerabilities associated with the increasing presence of smart devices in households. These devices, while offering convenience, can be exploited by malicious actors to compromise personal information and security.  

Checkpoint Blog 

Key Insights: 

• Unauthorized Access: Smart devices, such as cameras and voice assistants, can be manipulated to monitor activities within homes without the owner's consent. 

• Data Exploitation: Information collected by these devices may be accessed or intercepted by unauthorized parties, leading to potential misuse of personal data. 

• Regulatory Challenges: The rapid adoption of smart technology has outpaced the development of comprehensive regulations, leaving consumers vulnerable to emerging threats. 

Further Reading: Check Point Blog 

Cybercriminals Exploit Fake CAPTCHAs to Distribute Malware 

Recent analyses have identified a deceptive tactic where cybercriminals use fake CAPTCHA pages to distribute malware, exploiting users' trust in these verification systems. 

Key Developments: 

• Malicious Redirects: Users visiting compromised websites are redirected to fraudulent CAPTCHA pages that closely mimic legitimate services like Google and CloudFlare. 

• Clipboard Hijacking: These fake CAPTCHAs silently copy malicious commands to the user's clipboard via JavaScript, prompting them to execute these commands unknowingly through the Windows Run prompt. 

• Malware Installation: Executing the copied commands leads to the installation of malware, including information stealers and remote-access trojans (RATs), which can extract sensitive data and provide persistent access to compromised systems. 

Further Reading: ReliaQuest Blog 

Data Breach at American Addiction Centers Affects Over 422,000 Individuals 

American Addiction Centers (AAC), a leading provider of substance abuse treatment services, has reported a data breach impacting more than 422,000 individuals. 

Key Details: 

• Incident Timeline: The breach was detected on September 26, 2024, with unauthorized access occurring several days prior. 

• Compromised Information: Exfiltrated data includes names, addresses, phone numbers, dates of birth, Social Security numbers, health insurance details, and medical record identifiers. Notably, treatment information and payment card data were not affected. 

• Threat Actor Involvement: The Rhysida ransomware group has claimed responsibility, alleging the theft of approximately 2.8 terabytes of data. 

• Notification and Support: AAC has begun notifying affected individuals and is offering 12 months of free credit monitoring services. 

Further Reading: SecurityWeek 

Sophisticated Phishing Scams Lead to Significant Cryptocurrency Losses 

Recent incidents have highlighted advanced phishing attacks where cybercriminals impersonate legitimate services to gain unauthorized access to individuals' cryptocurrency wallets, resulting in substantial financial losses. 

Key Insights: 

Impersonation of Trusted Entities: Attackers pose as representatives from reputable organizations, such as Google or cryptocurrency platforms, to deceive victims into believing their accounts are compromised. 

Manipulation of Security Features: Victims receive seemingly legitimate security alerts and prompts, which are actually orchestrated by the attackers to facilitate unauthorized account access. 

Exploitation of Stored Sensitive Information: Once access is obtained, cybercriminals search for stored sensitive data, such as cryptocurrency wallet seed phrases, enabling them to transfer funds without detection. 

Further Reading: Krebs on Security 

Mobile Phishing Attacks Employ New Tactics to Evade Security Measures 

Recent analyses have identified a novel social engineering tactic targeting mobile banking users. Attackers are leveraging Progressive Web Apps (PWAs) and WebAPKs to distribute phishing websites disguised as legitimate applications, effectively bypassing traditional security warnings and app store vetting processes. 

Key Insights: 

• Exploitation of PWAs and WebAPKs: Unlike traditional apps, these malicious PWAs and WebAPKs are essentially phishing websites packaged to look like legitimate applications. This means they do not exhibit the typical behaviors or characteristics associated with malware, making detection more challenging. 

• Bypassing Security Measures: Their ability to bypass traditional security warnings of a mobile operating system, and total sidestepping of app store vetting processes, is particularly concerning. This allows attackers to distribute malicious content without triggering standard security alerts. 

• Anticipated Increase in Sophistication: It is anticipated that more sophisticated and varied phishing campaigns utilizing PWAs and WebAPKs will emerge, unless mobile platforms change their approach towards them. 

Further Reading: KnowBe4 Blog 

'James Bond-Style' Scams Lead to Significant Financial Losses 

Recent reports have highlighted a surge in sophisticated scams where fraudsters impersonate trusted entities, such as law enforcement or intelligence agencies, to deceive victims into believing they are involved in international criminal activities. 

Key Insights: 

• Deceptive Communication: Scammers contact individuals, claiming to be from reputable organizations like Amazon, the U.S. Post Office, or law enforcement agencies, alleging the victim's involvement in global criminal schemes. 

• Manipulative Tactics: Victims are coerced into withdrawing large sums of money from personal accounts under the guise of protecting their funds from criminal misuse. They are instructed to hand over cash to individuals posing as law enforcement agents, who then abscond with the money. 

• Significant Financial Impact: These scams have led to substantial financial losses for victims, with little to no chance of recovery once the funds are handed over. 

Further Reading: KnowBe4 Blog