September 2025 - ExploreSec Cybersecurity Threat Intelligence Newsletter

September 11, 2025

This is a newsletter I create and share with my internal security team. Feel free to grab and do the same.

ROKRAT Malware Hides Shellcode Using Steganography

Researchers have identified a new evolution in the ROKRAT malware family that uses steganography to conceal shellcode in images. This method allows threat actors to embed payloads in benign-looking files, helping them bypass traditional detection mechanisms. The malware is associated with South Korean targets and aligns with tactics used by North Korean threat actors.

Key Insights

ROKRAT embeds encrypted shellcode within image files using steganographic techniques.

The shellcode loads additional payloads from remote servers during execution.

This campaign uses cloud-based services and compromised accounts to blend in with legitimate network traffic.

The technique indicates growing sophistication in avoiding detection and enhancing persistence.

Further Reading: Genians Blog

Homograph Attacks: A Deceptively Simple but Dangerous Technique

Unit 42 researchers highlight the ongoing threat of homograph attacks, where attackers register domain names using characters from different alphabets that closely resemble legitimate ones (e.g., "аpple.com" with a Cyrillic "а"). These domains are used in phishing and malware campaigns, often bypassing detection mechanisms due to their deceptive appearance.

Key Insights

Homograph domains often rely on visually similar characters across scripts (e.g., Latin, Cyrillic, Greek) to deceive users.

Such domains are used in credential harvesting, redirection to fake login portals, and malware delivery.

Attackers register these domains with varying combinations to evade detection and increase success rates.

Homograph-based phishing campaigns remain effective because many security tools and users fail to recognize the subtle character differences.

Further Reading: Unit 42

TI: Project IRE Autonomously Identifies Malware at Scale

Microsoft has introduced Project IRE (Intelligent Research Environment), an AI-powered system designed to detect and classify malware with minimal human intervention. Project IRE can process vast amounts of data to autonomously identify and attribute malicious activity, enhancing early-stage threat intelligence capabilities. It aims to provide defenders with timely insights into malware campaigns and threat actor behavior without requiring deep reverse engineering expertise.

Key Insights

Project IRE leverages machine learning and large-scale static analysis to identify and classify malware families across billions of samples.

The system autonomously attributes activity to known or novel threat actors and campaigns, providing contextual threat intelligence.

It is designed to be integrated into broader defense systems, allowing faster detection and response.

Microsoft sees Project IRE as a foundation for more automated, scalable malware analysis efforts in the future.

Further Reading: Microsoft

BadSuccessor: A Critical AD Privilege Escalation Threat

Akamai researcher Yuval Gordon has identified a dangerous Active Directory vulnerability—BadSuccessor—affecting environments using Delegated Managed Service Accounts (dMSAs) in Windows Server 2025. This flaw allows attackers with minimal permissions (e.g., below Domain Admin level) to impersonate high-privilege accounts like Domain Admins by abusing improperly configured dMSA migration attributes.

Key Insights:

Exploits hinge on manipulating msDS-ManagedAccountPrecededByLink and msDS-DelegatedMSAState attributes to trick the domain controller into issuing elevated privileged tickets.

In environments where OU-level permissions are overly broad, an attacker can escalate privileges without needing administrative credentials.

Akamai found this misconfiguration in 91% of environments reviewed, highlighting widespread exposure.

Further Reading: Cymulate Blog – BadSuccessor Exploit Simulation

PS1Bot Malvertising Campaign Delivers Remote Access Trojan

Cisco Talos researchers identified a malvertising campaign delivering a Remote Access Trojan (RAT) dubbed PS1Bot. The campaign uses malicious PowerShell scripts distributed via deceptive online ads. Once executed, the malware provides attackers with persistent remote access and command execution capabilities, enabling data theft and potential lateral movement within compromised environments.

Key Insights

Attackers are leveraging malvertising to distribute PowerShell-based RATs.

The malware grants full remote control, posing risks of data theft and system compromise.

Targeting through ads increases exposure to a wide range of victims, including enterprises and individuals.

Further Reading: Talos Intelligence

Global Cyber Threats: July Snapshot of an Accelerating Crisis

Check Point’s July 2025 cyber threat analysis reveals a sharp escalation in global attack activity across multiple regions and industries:

Key Insights:

Attack Frequency Rising Rapidly
Average weekly cyberattacks per organization have increased by 10% compared to the previous year, with Europe experiencing the most dramatic surge at 15%.

Ransomware Intensifies
July saw 518 ransomware incidents, marking a 28% year-over-year increase. North America accounted for 52% of these attacks, while Europe contributed 25%.

Sectoral Hotspots
The education sector emerged as the most frequently targeted globally, followed closely by government and healthcare organizations.

Top Attackers on the Move
Ransomware groups such as Qilin, Akira, and Play are leading the surge.

Qilin, a Ransomware-as-a-Service (RaaS) group, accounted for 17% of incidents, largely affecting healthcare and education.

Akira was responsible for 9% of attacks, hitting both Windows and Linux systems, often via VPN endpoints or email attachments.

Further Reading: Check Point Research

Microsoft Patch Bypass Enables Zero-Click NTLM Hash Theft (CVE-2025-50154)

A newly disclosed flaw (CVE-2025-50154) in Windows Explorer bypasses Microsoft’s April fix for CVE-2025-24054. The vulnerability allows attackers to capture NTLM hashes or deliver executables via malicious shortcut (.lnk) files without user interaction. When Explorer previews a shortcut pointing to a remote binary, it automatically retrieves the file, triggering NTLM authentication and exposing credentials.

Key Insights

Zero-click exploitation makes this high-risk, requiring no user action.

Enables credential theft, offline cracking, NTLM relay, and lateral movement.

The bypass highlights incomplete patch coverage for NTLM flaws.

Microsoft is expected to release an additional fix.

Further Reading: Cymulate

GenAI-Powered Phishing Kits: “Fashionable Phishing Bait”

A new Unit 42 investigation reveals that threat actors are leveraging generative AI to rapidly create and deploy web-based phishing platforms. These kits—capable of code assistance, chatbot interaction, natural language generation, and automated website building—enable highly convincing phishing pages with minimal effort. The analysis highlights how attackers capitalize on GenAI’s accessibility to launch scalable phishing operations, blending automation and adaptability.

Key Insights

GenAI as a phishing enabler: Attackers now use AI website builders to produce realistic phishing infrastructure—often in just seconds using simple prompts.

Trend visibility: Telemetry shows rapid growth in GenAI platform launches and traffic, reflecting attackers’ shift to AI-driven campaign tooling.

Modular and scalable kit design: These platforms come with built-in functionality that reduces the manual effort required for launching phishing operations.

Accelerated attacker capabilities: The use of AI lowers technical barriers, allowing more rapid and widespread deployment of phishing campaigns with minimal human oversight.

Further Reading: Unit 42 – Fashionable Phishing Bait: GenAI on the Hook

ClickFix Phishing Links Surge Nearly 400% in Past Year

A recent Proofpoint report revealed a dramatic rise in phishing activity: ClickFix-style attacks—where users are tricked into entering malicious commands under the pretense of fixing an error or completing a CAPTCHA—have surged nearly 400% between May 2024 and May 2025. Meanwhile, malicious URLs now outpace traditional email attachments by a factor of four, underscoring the evolving threat landscape and the growing sophistication of phishing tactics.

Key Insights

ClickFix campaigns have become significantly more prevalent, with a 400% year-over-year increase.

Analysis covered a massive dataset, including over 3.4 trillion emails, 21 trillion URLs, and 1.4 trillion SMS messages.

Users are increasingly encountering phishing via deceptive links rather than attachments—making detection tougher.

The human-centric design of ClickFix techniques makes them highly effective at bypassing conventional email filters.

Further Reading: SC Media – ClickFix phishing links increased nearly 400% in 12 months, report says

North Korean IT Workers’ Email Infrastructure Exposed

New research has uncovered how North Korean IT workers are using thousands of email addresses tied to legitimate platforms to support fraudulent employment and cyber operations. These workers disguise their true identities to infiltrate organizations globally, often securing remote IT jobs to funnel earnings back to the DPRK regime.

Key Insights

Over 1,000 email addresses linked to DPRK operations were identified.

Attackers often impersonate legitimate IT professionals on job platforms.

The revenue generated supports North Korea’s sanctioned cyber programs.

Further Reading: Cybersecurity News

AI Website Builder “Lovable” Abused by Cybercriminals for Phishing & Malware

Proofpoint research warns that adversaries are exploiting Lovable, an AI-powered website builder, to rapidly create phishing and malicious websites using natural-language prompts. Since February 2025, Proofpoint has detected tens of thousands of malicious Lovable-hosted URLs, involving MFA phishing kits, crypto wallet drainers, credential harvesting traps, and other fraud schemes. Campaigns have infiltrated over 5,000 organizations and included impersonation of brands like Microsoft, UPS, and Aave. The platform’s free hosting and AI-driven convenience enable attackers to launch effective social engineering attacks with minimal effort.

Key Insights

Low-barrier phishing infrastructure: Creating convincing phishing sites now takes just one or two prompts—no coding required.

Massive campaign scale: Hundreds of thousands of URLs circulated via emails, targeting organizations across industries.

Diverse tactics: Campaigns include fake CAPTCHAs leading to credential theft, malware disguised as secure downloads, and crypto-stealing mechanisms.

Brand spoofing: Attackers mimicked trusted entities like Microsoft, UPS, banks, and DeFi platforms to increase credibility.

Emerging security gap: AI-based website tools lack built-in safeguards, making them ripe for abuse by malicious actors.

Further Reading: Proofpoint

ClickFix Social-Engineering Attack: “Think Before You Click(Fix)”

Microsoft Threat Intelligence and Defender experts are sounding the alarm over the growing prevalence of the ClickFix technique—a manipulative form of social engineering that tricks users into executing malicious commands under the guise of fixing technical issues or completing human-verification prompts. Since early 2024, thousands of enterprise and consumer devices across various industries have been targeted, frequently delivering infostealing malware like Lumma Stealer, remote access tools (e.g., Xworm, NetSupport), and loaders such as Latrodectus. The technique often leverages phishing, malvertising, and compromised sites to lure users into copying commands manually into Run dialogs, PowerShell, or Terminal, effectively bypassing many automated security solutions. Attackers are also advancing their methods with obfuscation and staged payload delivery to evade detection. Microsoft underscores the importance of user education and endpoint hardening to counteract this social-engineering vector. Microsoft

Key Insights

Human-driven threat: Relies on social engineering, persuading users to run malicious commands themselves—circumventing standard security controls.

Wide-ranging payloads: Includes infostealers, remote access Trojans, and loaders, delivering significant post-compromise capabilities.

Multi-vector distribution: Spread via phishing emails, deceptive ads, and compromised sites impersonating legitimate brands.

Evasive operator tactics: Employs obfuscated JavaScript and command delivery to evade detection.

Strategic defenses: Focus on user awareness training and endpoint constraint measures (e.g., logging, Run dialog restrictions).

Further Reading: Microsoft Security Blog – “Think before you Click(Fix): Analyzing the ClickFix Social Engineering Technique”

Phishing Evolves to Target Humans and AI Defenses with Hidden Prompt Injection

Researchers uncovered a novel phishing campaign that not only deceives users with a typical "password expiry" lure but also embeds AI-targeting prompt injection within the email. Hidden inside the plain-text MIME section is a deeply recursive prompt designed to distract AI-based defenses—encouraging them to engage in laborious reasoning loops instead of flagging the email as malicious. This strategic dual-layer attack aims to bypass both human and automated detection, introducing a new threat vector that complicates SOC workflows.

Key Insights

Dual-targeted attack vector: Combines urgency-based social engineering with hidden AI prompt injection to evade both users and automated defenses.

Prompt injection details: Encourages AI to “simulate extended self-reflection” and challenge assumptions, diverting it from expected classification tasks.

Bypassing automation: AI-powered triage systems could misclassify or delay phishing detection due to the injected reasoning demands.

Continued delivery chain evolution: Utilizes spoofed Gmail branding and leverages marketing platforms to bypass filters.

Further Reading: Malware Analysis – Phishing Emails Are Now Aimed at Users and AI Defenses

Multi-modal Prompt Injection Via Image Scaling Attacks

Researchers from Trail of Bits have uncovered a striking new attack technique: subtle prompt injections hidden within images that appear benign at full resolution but trigger malicious behaviors when scaled down. When AI systems—such as Gemini CLI, Vertex AI Studio, Google Assistant, and others—automatically downscale these images, the embedded prompt materializes, enabling stealthy data exfiltration or other unauthorized actions. The team also released Anamorpher, an open-source tool designed to craft and test such image-scaling attacks.

Key Insights

Image scaling as an attack surface: Downscaling images can reveal hidden instructions invisible to users but consumed by AI systems.

Wide impact across systems: The vulnerability spans multiple AI platforms, including CLI tools, web interfaces, APIs, and multi-modal agents.

Tool-assisted exploitation: Anamorpher enables threat actors and defenders alike to craft, explore, and analyze these attacks in a structured way.

Urgent need for UI alignment: Systems must ensure the previewed image matches what’s actually processed by the model—regardless of access channel (CLI, API, UI).

Mitigation strategy: Avoid automatic downscaling; instead, limit image dimensions and always preview the exact input seen by the AI model.

Further Reading: Trail of Bits – Weaponizing Image Scaling Against Production AI Systems

MuddyWater APT Targets CFOs via Multi-Stage Phishing Campaign

A sophisticated spear-phishing campaign by the Iranian-linked APT group MuddyWater is actively targeting Chief Financial Officers (CFOs) and finance executives across multiple continents. The campaign leverages legitimate remote-access tools, such as NetBird, to maintain persistent control over compromised systems. Attackers masquerade as Rothschild & Co recruiters, directing victims to Firebase-hosted phishing pages with custom CAPTCHA challenges and malicious VBS scripts. These scripts deploy remote management capabilities, including NetBird and OpenSSH, create hidden local administrator accounts, enable Remote Desktop Protocol (RDP), and automate persistence through scheduled tasks. The infrastructure has evolved over time, with shifts in hosting paths and IP addresses, indicating an adaptive and persistent threat. This campaign showcases the increasing sophistication of threat actors in targeting high-value individuals within organizations.hunt.io+1

Key Insights

Targeted Individuals: CFOs and finance executives across Europe, North America, South America, Africa, and Asia.

Initial Access: Spear-phishing emails impersonating Rothschild & Co recruiters leading to Firebase-hosted phishing pages.

Payload Delivery: Multi-stage infection using VBS downloaders, ZIP archives, and secondary payloads.

Persistence Mechanisms: Deployment of NetBird and OpenSSH, creation of hidden local admin accounts, enabling RDP, and scheduled task automation.

Infrastructure Evolution: Shifts in hosting paths and IP addresses, indicating adaptive tactics.

Attribution: Overlaps in infrastructure, TTPs, and tools with known APT MuddyWater campaigns.

Legitimate Tool Abuse: Misuse of NetBird and OpenSSH for remote access and monitoring.hunt.io

Further Reading: Hunt.io – APT MuddyWater Deploys Multi-Stage Phishing to Target CFOs

Salty2FA Malware Exploits 2FA Weaknesses

Researchers analyzed Salty2FA, a new malware family designed to bypass two-factor authentication (2FA). The malware intercepts one-time passcodes and manipulates authentication flows, enabling attackers to hijack sessions even when 2FA is enabled. It combines credential theft, session hijacking, and real-time communication with command-and-control servers to maintain persistence.

Key Insights

Targets 2FA-protected accounts by stealing one-time codes.

Employs session hijacking to maintain long-term access.

Demonstrates attacker adaptation to stronger authentication methods.

Further Reading: ANY.RUN

Attackers Exploit Google Classroom for Large-Scale Campaign

Researchers identified a phishing campaign abusing Google Classroom to bypass email security and deliver malicious messages. Over 115,000 phishing emails targeted 13,500 organizations across multiple industries, with attackers leveraging legitimate Google Classroom notifications to appear trustworthy.

Key Insights

More than 100,000 phishing emails were delivered via Google Classroom.

Attackers exploited the platform’s trusted reputation to avoid detection.

13,500 organizations across different industries were impacted.

The campaign highlights how threat actors misuse legitimate collaboration tools for phishing.

Further Reading: Check Point

AI Summarizers Weaponized via CSS-Based ClickFix Attacks

Researchers have discovered a sophisticated adaptation of the ClickFix social engineering method that exploits AI-powered summarization tools. By embedding hidden instructions using CSS-level obfuscation—like zero-width text, white-on-white font, tiny font sizes, and off-screen elements—and repeating them heavily (a “prompt overdose” strategy), attackers trick summarizers into outputting malicious instructions (e.g., ransomware steps) that users then follow unknowingly. This technique turns trusted AI assistants into unwitting intermediaries for malware distribution.

Key Insights

Invisible prompt injection: Malicious steps stay hidden from human readers but are fully interpreted by AI summarizers.

Prompt overdose dominance: Repetition ensures payloads overshadow legitimate content in a summarizer’s context window.

AI as a delivery channel: Summaries become vectors for attacker instructions under the guise of assistance.

Rapid scaling potential: Poisoned content can be spread via emails, forums, indexed blogs, and even internal AI tools.

Serious enterprise risk: Internal copilots and document triaging systems can unknowingly relay attacker instructions to employees.

Further Reading: CloudSEK

Cloud-Based Ransomware: Storm-0501 Shifts Tactics to the Cloud

Microsoft Threat Intelligence reports that the ransomware actor Storm-0501 is transitioning from traditional, endpoint-based attacks to full-fledged cloud-based ransomware operations. This shift leverages hybrid cloud vulnerabilities—enabling rapid data exfiltration, destruction of backups, and ransom demands without deploying conventional malware.

Key Insights

Strategic cloud pivot: Storm-0501 now prioritizes breaching Entra ID environments over deploying endpoint ransomware.

Privilege escalation via sync: The group exploits compromised on-premises domain control and Entra Connect Sync servers to escalate privileges in the cloud.

Identity-based persistence: They abuse Global Admin synced identities (often lacking MFA) to reset passwords, register new MFA, and gain unfettered cloud access.

Cloud-native extortion: Using Azure features, Storm-0501 exfiltrates data, deletes backups, and leverages AzCopy and Azure Key Vault for expedited attacks.

Sophisticated extortion channel: Ransom demands are delivered via Microsoft Teams, sometimes using compromised user credentials.

Further Reading: Microsoft Security Blog – Storm-0501’s Evolving Techniques Lead to Cloud-Based Ransomware

AI-Lured Xworm Delivery via Signed ScreenConnect Installer

Trustwave SpiderLabs has uncovered a campaign that exploits fake AI-related content to trick users into installing a digitally signed Remote Access Tool (ScreenConnect). The installer, disguised as AI-themed media, initiates a multi-stage infection that ultimately deploys the Xworm Remote Access Trojan (RAT). Much of the attack sequence evaded automated EDR alerts, requiring human-led threat hunting to uncover the full chain.

Key Insights

Campaign begins with AI-themed lures (e.g., fake video files) leading to deceptive ScreenConnect installer downloads.

The installer is digitally signed, bypassing trust validation while embedding malicious configurations.

A hidden ScreenConnect client executes in the background, connecting to attacker infrastructure.

Fileless execution is used: scripts trigger obfuscated Python-based payloads that launch Xworm via process hollowing.

Persistence is achieved with registry Run keys, enabling re-launch at login.

Credential harvesting and system reconnaissance follow to establish long-term access.

Automated detection struggled—manual threat hunting was crucial in exposure.

Further Reading: Trustwave SpiderLabs – Malicious Screen Connect Campaign Abuses AI-Themed Lures for Xworm Delivery

Analysing Targeted Spearphishing: C-Suite

A spearphishing campaign has been discovered, targeting C-suite executives and senior leadership across various industries. The attack uses highly personalized phishing emails that mimic internal HR communications, paired with advanced anti-detection measures and infrastructure rotation to evade defenses.

Key Insights

High-value targeting: Email subjects like “Salary amendment” and “FIN_SALARY” impersonate OneDrive document notifications to trick executives. Emails and phishing pages are customized with recipient names and company details.

Credential theft mechanism: Victims are directed to fake Microsoft Office/OneDrive login pages that harvest credentials. Phishing URLs are single-use and self-destruct upon access.

Stealthy email delivery: The campaign uses Amazon SES for sending, toggling across approximately 80 dynamic domains and subdomains to evade filtering. Preliminary benign emails (“warming up” inboxes) may precede the phishing attempt.

Robust infrastructure footprint: DNS via Cloudflare, hosting on Akamai Cloud, and domain registration mainly through Mat Bao Corporation, with additional registrars like WebNic.cc and Luxhost used for resilience.

Further Reading: Stripe OLT – Analysing Targeted Spearphishing: Social Engineering, Domain Rotation, and Credential Theft

Logit-Gap Steering: How Aligned LLM Safety Can Be Bypassed

Unit 42 introduces "logit-gap steering," a sophisticated technique that reveals a vulnerability in how LLMs refuse harmful inputs. Although alignment training raises the likelihood of refusal tokens, this doesn't eliminate the possibility of sensitive content being generated. Researchers demonstrated that with short, strategically crafted token suffixes, models—including Qwen, LLaMA, Gemma, and even GPT-OSS-20B—can be coerced into compliance with over 75% success.

Key Insights

Refusal isn't elimination: Alignment suppresses, rather than removes, harmful responses. A sufficiently strong suffix can reverse the model's initial refusal decision.

Efficient jailbreak strategy: A “sort–sum–stop” algorithm quickly identifies short suffixes that disrupt the model's refusal behavior—without needing expensive beam or gradient searches.

Cross-model effectiveness: This method works across diverse open-source models and scales from 0.5B to 70B parameters.

Need for layered defenses: Internal logit alignment alone isn't enough. External filtering, robust safety benchmarks, and oversight tools are essential to mitigate this threat.

Further Reading: Unit 42 – Logit-Gap Steering: A New Frontier in Understanding and Probing LLM Safety

September 2025 - ExploreSec Cybersecurity Awareness Newsletter

September 10, 2025

This is a monthly newsletter I put together for an internal security awareness program. Feel Free to grab and use for your own program.

Retirees Targeted in High-Stakes Impersonation Scams

New data from the FTC reveals a troubling trend: fraudsters posing as government officials or big-name businesses are zeroing in on older adults, often convincing them to transfer large sums—sometimes their entire life savings.

Key Insights:

Reports from adults aged 60+ of losing $10,000 or more to impostor scams have quadrupled since 2020, while losses over $100,000 surged nearly sevenfold. Combined high-value reported losses grew eightfold, highlighting the severity of these attacks.

Scammers commonly use three core deceptive narratives:

Claiming suspicious activity in your accounts.

Asserting your personal information is linked to criminal activity.

Presenting urgent computer security alerts to induce panic-driven actions.

These fraudsters go as far as impersonating the FTC—asking victims to move money to “protect” it, deposit cash at Bitcoin ATMs, or hand over valuables via courier. These demands are absolutely inconsistent with legitimate agency practices.

Further Reading: FTC — Data Spotlight: False alarm, real scam: how scammers are stealing older adults’ life savings

Trickster Domain Uses Japanese Hiragana to Fool Users

A sophisticated phishing campaign is targeting Booking.com users by exploiting a visual trick: replacing the forward slash in URLs with the Japanese hiragana character "ん" (Unicode U+3093). At first glance, the phishing links look like legitimate subdirectories, but they actually redirect users to fake domains. Once clicked, these sites deliver malware—typically via a malicious MSI installer—that could include information stealers or remote access trojans.

Key Insights:

The character substitution makes fake URLs appear authentic, even to vigilant users.

Attackers distribute these links through phishing emails, often appearing urgent or official.

The camouflage technique effectively bypasses visual scrutiny and basic email filters.

Further Reading: New Clever Phishing Attack Uses Japanese Character "ん" to Mimic Forward Slash

Mobile Phishing Targets Brokerage Accounts in 'Ramp and Dump' Scheme

Cybercriminal groups are exploiting mobile phishing kits to manipulate foreign stock prices through compromised brokerage accounts. This tactic, known as a "ramp and dump" scheme, involves fraudsters using multiple hijacked accounts to artificially inflate stock prices and then sell off shares, leaving legitimate investors with significant losses. These phishing kits, often sold in Chinese-language communities on platforms like Telegram, convert stolen card data into mobile wallets, facilitating fraudulent transactions. The Financial Industry Regulatory Authority (FINRA) has issued advisories highlighting the risks associated with such schemes.

Key Insights

Fraudsters manipulate stock prices by controlling multiple compromised brokerage accounts.

Mobile phishing kits are sold on platforms like Telegram, targeting financial institutions.

The schemes exploit vulnerabilities in multi-factor authentication processes.

Victims are left with worthless shares, resulting in financial losses.

Further Reading: Krebs on Security

Back-to-School Shopping Scams Surge

As back-to-school shopping ramps up in July and August, scammers are taking advantage with fake storefronts, counterfeit goods, and misleading social media ads designed to trick shoppers into paying for items that never arrive or are of poor quality.

Key Insights

Scammers exploit seasonal spending by promoting deals on supplies like backpacks, laptops, and notebooks.

Fake online stores are promoted through paid search links, email blasts, and targeted social media ads.

Social media ads are particularly risky due to precise targeting and AI-generated ad creatives that lead to scam sites.

Further Reading: McAfee

ClickFix Phishing Links Surge Nearly 400% in Past Year

Key Insights

ClickFix campaigns have become significantly more prevalent, with a 400% year-over-year increase.

Analysis covered a massive dataset, including over 3.4 trillion emails, 21 trillion URLs, and 1.4 trillion SMS messages.

Users are increasingly encountering phishing via deceptive links rather than attachments—making detection tougher.

The human-centric design of ClickFix techniques makes them highly effective at bypassing conventional email filters.

Further Reading: SC Media – ClickFix phishing links increased nearly 400% in 12 months, report says

Workday CRM Breach Exposes Contact Data

Workday, a major provider of HR technology, disclosed a data breach in which threat actors gained access to a third-party CRM platform through a social engineering campaign. While no customer tenant data was compromised, exposed information—such as names, email addresses, and phone numbers—poses a heightened risk of follow-on phishing attacks or impersonation attempts. The breach was detected on August 6, and Workday has since severed access and strengthened security controls.

Key Insights

The breach exploited a third-party CRM via social engineering techniques such as deceptive calls and texts impersonating HR or IT staff.

Exposed data was limited to business contact information—not internal customer data—but remains useful for phishing campaigns.

This incident aligns with a broader wave of CRM-based attacks targeting organizations via cloud CRM systems.

Reminding users that Workday will never request credentials via phone can help counter social engineering attempts.

Further Reading: Bleeping Computer – HR giant Workday discloses data breach after Salesforce attacks

“SpyVPN” Chrome Extension Secretly Captures Your Screen

A seemingly safe VPN browser extension—marketed as FreeVPN.One and featured on the Chrome Web Store with over 100,000 installs—has been revealed to continuously capture screenshots of every webpage a user visits. These images—including sensitive content like bank accounts, private photos, and documents—are sent silently to a remote server without any disclosure or consent, highlighting a shocking inversion of the privacy expectations typically associated with VPN tools.

Key Insights

Stealthy surveillance disguised as a VPN: Seconds after a page loads, a hidden background process takes a screenshot and exfiltrates it, bundling the capture with metadata like URL and tab ID.

Broad access and tracking: The extension also harvests device information and geolocation data upon installation and startup.

Encrypted exfiltration: To evade detection, later versions implemented AES-256-GCM encryption with RSA wrapping—making the data leaks harder to trace.

Excessive permissions abused: What should have been a simple VPN extension intentionally requested wide-ranging permissions, enabling full visibility into user browsing activity.

False trust via validation badges: Despite appearing legitimate—with Google verification and featured placement—the extension’s violations slipped past marketplace checks, underlining gaps in app vetting processes.

Further Reading: Koi Security

AI Website Builder “Lovable” Abused by Cybercriminals for Phishing & Malware

Key Insights

Low-barrier phishing infrastructure: Creating convincing phishing sites now takes just one or two prompts—no coding required.

Massive campaign scale: Hundreds of thousands of URLs circulated via emails, targeting organizations across industries.

Diverse tactics: Campaigns include fake CAPTCHAs leading to credential theft, malware disguised as secure downloads, and crypto-stealing mechanisms.

Brand spoofing: Attackers mimicked trusted entities like Microsoft, UPS, banks, and DeFi platforms to increase credibility.

Emerging security gap: AI-based website tools lack built-in safeguards, making them ripe for abuse by malicious actors.

Further Reading: Proofpoint

ClickFix Social-Engineering Attack: “Think Before You Click(Fix)”

Key Insights

Human-driven threat: Relies on social engineering, persuading users to run malicious commands themselves—circumventing standard security controls.

Wide-ranging payloads: Includes infostealers, remote access Trojans, and loaders, delivering significant post-compromise capabilities.

Multi-vector distribution: Spread via phishing emails, deceptive ads, and compromised sites impersonating legitimate brands.

Evasive operator tactics: Employs obfuscated JavaScript and command delivery to evade detection.

Strategic defenses: Focus on user awareness training and endpoint constraint measures (e.g., logging, Run dialog restrictions).

Further Reading: Microsoft Security Blog – “Think before you Click(Fix): Analyzing the ClickFix Social Engineering Technique”

Password Managers Vulnerable to DOM-Based Extension Clickjacking

A groundbreaking new attack technique—dubbed “DOM-based Extension Clickjacking”—was revealed by security researcher Marek Tóth (presented at DEF CON 33). The method exploits how browser extensions inject UI elements into web pages. By invisibly overlaying or manipulating these extension interfaces, an attacker can trick a user’s single click into triggering autofill of highly sensitive data—such as credentials, one-time passwords (TOTP), credit card details, and personal information—without the user realizing it. This impacts popular password managers and potentially other DOM-manipulating extensions.

Key Insights

Single-click compromise: Users are tricked by innocuous-looking clicks (e.g., closing a popup), which instead activate hidden autofill forms and expose sensitive data.

Widespread risk: All 11 tested password managers—including Bitwarden, 1Password, iCloud Passwords, Enpass, LastPass, and LogMeOnce—were initially vulnerable. Millions of users may be affected.

Diverse data at stake: Attacks can steal login credentials, TOTP codes, passkeys, credit card information, and personal data.

Some vendors still unpatched: While fixes are in progress for certain apps, several remain vulnerable.

Mitigation suggestions: Users should disable autofill or switch to manual copy-paste workflows. Chrome users can set extension permissions to “on click” to reduce exposure.

Further Reading: Marek Tóth – DOM-based Extension Clickjacking: Your Password Manager Data at Risk

MuddyWater APT Targets CFOs via Multi-Stage Phishing Campaign

Key Insights

Targeted Individuals: CFOs and finance executives across Europe, North America, South America, Africa, and Asia.

Initial Access: Spear-phishing emails impersonating Rothschild & Co recruiters leading to Firebase-hosted phishing pages.

Payload Delivery: Multi-stage infection using VBS downloaders, ZIP archives, and secondary payloads.

Persistence Mechanisms: Deployment of NetBird and OpenSSH, creation of hidden local admin accounts, enabling RDP, and scheduled task automation.

Infrastructure Evolution: Shifts in hosting paths and IP addresses, indicating adaptive tactics.

Attribution: Overlaps in infrastructure, TTPs, and tools with known APT MuddyWater campaigns.

Legitimate Tool Abuse: Misuse of NetBird and OpenSSH for remote access and monitoring.hunt.io

Further Reading: Hunt.io – APT MuddyWater Deploys Multi-Stage Phishing to Target CFOs

Surge in 'Task Scams' Targeting Job Seekers

Trend Micro has reported a significant increase in "task scams," a fraudulent scheme where scammers pose as legitimate recruiters offering online tasks in exchange for payment. Victims are lured through platforms like WhatsApp, SMS, and Telegram, often impersonating well-known staffing firms or marketing agencies. Initially, individuals are asked to complete simple online activities, such as liking social media posts or providing product reviews. Over time, these tasks escalate, requiring larger financial deposits for higher-paying assignments, ultimately leading to substantial financial losses.

Key Insights

Financial Impact: One identified cryptocurrency wallet received over $1.2 million in transactions linked to task scam activities.

Psychological Manipulation: Scammers employ gamification techniques, such as VIP levels and reward streaks, to keep victims engaged and invested.

Delayed Realization: A global study found that 39% of victims only recognized they had been scammed after significant financial loss.

Cryptocurrency Usage: Scammers utilize cryptocurrency for transactions, making it challenging to trace and recover funds.

Defensive Tools: Trend Micro’s ScamCheck with Scam Radar helps users identify scam tactics in real time by analyzing content such as images, text, and URLs.

Further Reading: Trend Micro – Unmasking Task Scams

Attackers Exploit Google Classroom for Large-Scale Campaign

Key Insights

More than 100,000 phishing emails were delivered via Google Classroom.

Attackers exploited the platform’s trusted reputation to avoid detection.

13,500 organizations across different industries were impacted.

The campaign highlights how threat actors misuse legitimate collaboration tools for phishing.

Further Reading: Check Point

Gmail Accounts Targeted in Phishing Wave After Google Data Leak

A recent data leak affecting Google has led to a surge in phishing attacks targeting Gmail users. Threat actors are using compromised information to craft convincing phishing emails designed to steal account credentials. The campaign highlights how quickly attackers weaponize leaked data against large user bases.

Key Insights

Google data leak triggered a large-scale phishing campaign.

Attackers are tailoring emails to increase success rates.

Gmail users are at heightened risk of credential theft.

Further Reading: Dig Watch

Retail & Hospitality Industries Targeted by Digital Heists

Palo Alto Networks’ Unit 42 reports that cybercriminals are increasingly targeting retail and hospitality sectors through credential theft, payment card fraud, and loyalty program abuse. Attackers are leveraging phishing, malware, and third-party compromise to infiltrate these industries, with stolen credentials being a primary entry point.

Key Insights

Retail and hospitality are frequent targets due to high transaction volumes and valuable customer data.

Credential theft remains a top tactic, enabling lateral movement and further fraud.

Loyalty programs and stored payment methods are prime targets for monetization.

Further Reading: Palo Alto Networks – Unit 42

FIFA World Cup 2026 Sparks Surge in Scam Domain Registrations

Cybersecurity researchers report a sharp increase in suspicious domain registrations tied to the upcoming FIFA World Cup 2026. PreCrime Labs analyzed nearly 500 domains embedding terms like “FIFA,” “worldcup,” and “football.” These domains have been categorized into typosquats, fake merchandise or betting sites, ticketing bait, and deceptive fan portals. The campaign demonstrates sophisticated tactics including early domain aging and AI-assisted bulk creation.

Key Insights

Domain Aging Strategy: Domains registered well in advance—some even for 2030 and 2034 tournaments—to appear legitimate and evade filters.

Global Scope & AI Usage: Registrations originated from various regions, including the U.S., China, Iceland, Canada, and the Netherlands. Certain batches showed algorithmic naming patterns, suggesting automated registration.

TLD & Fraud Lures: Majority (.com) dominated, followed by .online, .football, .org, .xyz, and .shop. Sites feigned merchandise stores, live streaming, betting platforms, travel services, and even crypto “FIFA Coin” ICOs.

Pre-event Scam Infrastructure: Illustrates how major events attract layered cyber threat campaigns—from phishing and fake ticket portals to credential harvesting and financial fraud.

Further Reading: Cybernews – Criminals Preparing for Scam Bonanza Ahead of FIFA World Cup 2026

Malvertising Campaign on Meta and Android Distributes Advanced Crypto-Stealing Malware

A new malvertising campaign, revealed by Bitdefender Labs, is exploiting Meta’s advertising platform to push deceptive ads that redirect users to malware-laden downloads. These ads impersonate trusted applications—such as CapCut, Office 365, Netflix, and others—and deliver SYS01 InfoStealer, a stealthy tool embedded within an Electron-based application, primarily aimed at harvesting Facebook credentials and enabling further cyberattacks.

Key Insights

Seamless guise of legitimacy: Ads mimic trusted brands and platforms to appear harmless, effectively bypassing user suspicion.

Electron-based malware: The malicious payload is delivered via a misleading app installer, enabling robust evasion through local execution.

Global reach and dynamic adaptability: Campaign targets users worldwide, especially those over 45, using nearly 100 domains and constantly shuffling payloads to avoid detection.

Persistent botnet infrastructure: Stolen credentials are reused to run legitimate-looking malicious advertisements, maintaining the campaign’s reach without rebuilding infrastructure.

Further Reading: Bitdefender – Malvertising Campaign on Meta Expands to Android, Pushing Advanced Crypto-Stealing Malware to Users Worldwide

Analysing Targeted Spearphishing: C-Suite

Key Insights

High-value targeting: Email subjects like “Salary amendment” and “FIN_SALARY” impersonate OneDrive document notifications to trick executives. Emails and phishing pages are customized with recipient names and company details.

Credential theft mechanism: Victims are directed to fake Microsoft Office/OneDrive login pages that harvest credentials. Phishing URLs are single-use and self-destruct upon access.

Stealthy email delivery: The campaign uses Amazon SES for sending, toggling across approximately 80 dynamic domains and subdomains to evade filtering. Preliminary benign emails (“warming up” inboxes) may precede the phishing attempt.

Robust infrastructure footprint: DNS via Cloudflare, hosting on Akamai Cloud, and domain registration mainly through Mat Bao Corporation, with additional registrars like WebNic.cc and Luxhost used for resilience.

Further Reading: Stripe OLT – Analysing Targeted Spearphishing: Social Engineering, Domain Rotation, and Credential Theft

DSLRoot Proxies = “Legal Botnets”? A New and Hidden Risk

A recent investigation has pulled back the curtain on DSLRoot—a residential proxy service that legally distributes traffic through users’ home Internet connections. Paying U.S. participants up to $250/month to host devices, DSLRoot aggregates and sells these IPs as dedicated proxies. Although the setup may seem benign, experts warn this infrastructure is ripe for abuse—enabling anonymized cyber activities under the guise of legitimacy.

Key Insights

Monetizing Your Bandwidth: Users—sometimes unknowingly—host DSLRoot’s systems at home and get paid for relaying traffic, which can be used for anything from anonymizing browsing to launching malicious operations.

Origins Rooted in Proxy Marketplaces: DSLRoot traces back to Russian-linked proxy networks and underground forums.

Not Your Typical Botnet: Because devices are used with owner consent and no malware is involved, traditional detection systems may not flag this activity—thus creating the concept of a “legal botnet.”

Network Device Risks: DSLRoot’s software may manipulate home routers—enumerating Wi-Fi networks and exploiting hardcoded credentials—broadening the attack footprint.

Broader Implications: Residential proxies are increasingly tied to scraping, DDoS, credential stuffing, and evasion of IP blocking, making them a growing security challenge.

Further Reading: KrebsOnSecurity – “DSLRoot, Proxies, and the Threat of ‘Legal Botnets’”

August 2025 - ExploreSec Cybersecurity Security Awareness Newsletter

August 6, 2025

This is a monthly newsletter I put together for an internal security awareness program. Feel Free to grab and use for your own program.

Task Scams: Why You Should Never Pay to Get Paid

ESET warns of a growing wave of “task scams” where victims are enticed by offers of quick money for simple online tasks, such as liking content or clicking buttons. While early steps appear legitimate and even show fake earnings, the scheme ultimately demands an upfront payment to “unlock” these earnings—after which victims receive nothing. Reports of task scams have quadrupled, with millions lost to this tactic.

Key Insights:

Scams typically begin through unsolicited messages on WhatsApp, Telegram, or social media.

Fake earnings dashboards give victims a false sense of progress and legitimacy.

Victims are often pressured to pay a fee in cryptocurrency to claim their supposed rewards.

Scammers may use cloned websites and group chats filled with fake success stories to boost credibility.

Other forms of employment fraud include fake job ads, phishing through CV submissions, and impersonated recruiters.

Further Reading: WeLiveSecurity

Jasper Sleet: North Korean Remote IT Workers Use AI to Infiltrate Organizations

Microsoft Threat Intelligence has identified a surge in activity from the North Korea-linked threat actor Jasper Sleet, formerly tracked as Storm‑0287. These operatives are exploiting remote work arrangements to embed themselves within organizations worldwide. Using AI tools to enhance fake identities, they are securing employment, gaining access to sensitive systems, and exfiltrating data to support North Korea’s strategic and financial objectives.

Key Insights:

Jasper Sleet operatives use AI for facial and voice modification to impersonate real job seekers.

Fake identities are supported by fabricated credentials, doctored online profiles, and complicit facilitators.

The campaign targets a wide range of industries across North America, Europe, and Asia.

Over 3,000 accounts have been suspended due to links to this operation.

Common tactics include the use of residential IPs, remote access software, and resume laundering.

Further Reading: Microsoft Security Blog

AI Hiring Bot Breach: McDonald’s Chatbot Exposes Data of Millions

Security researchers Ian Carroll and Sam Curry discovered a critical vulnerability in Olivia, the AI hiring assistant via Paradox.ai's McHire platform, used by McDonald’s. With just the default password 123456, the duo accessed an admin account and discovered a critical API flaw. In under an hour, they viewed personal details—including names, emails, phone numbers, and chat logs—for approximately 64 million job applicants spanning years of data.

Key Insights:

A dormant admin panel was secured by default credentials, lacking any multifactor authentication.

An insecure direct object reference (IDOR) allowed researchers to enumerate applicant records by simply changing numeric IDs.

Data exposed included conversation content and personal identifiers—though not financial or sensitive health info.

McDonald’s and Paradox.ai responded swiftly, disabling the account and patching the API within a day.

Despite the quick fix, the breach underscores the risks of weak third-party oversight and insecure AI-driven recruitment tools.

Further Reading: Wired

Gemini Email Summary Phishing: Invisible Prompt Injection Risk

A newly discovered vulnerability in Google’s Gemini for Workspace demonstrates how attackers can embed hidden instructions in emails—styled with invisible text—so that clicking “Summarize this email” invokes the malicious prompt. This can result in fake security alerts, phishing links, or fraudulent phone numbers appearing in AI-generated summaries.

Key Insights:

Attackers hide directives using invisible HTML/CSS that Gemini parses but users can’t see.

Summarized messages may falsely warn of compromised accounts and urge recipients to click links or call numbers.

Because there are no obvious phishing signals (like attachments or visible links), these emails bypass typical threat detection.

Security teams should flag summaries containing urgent calls to action and train users to verify full email content.

Further Reading: Bleeping Computer

Deepfake It ‘til You Make It: The New AI Criminal Toolset

Cybercriminals are increasingly exploiting deepfake technology to conduct fraud, extortion, and manipulation campaigns. Originally built for creative or entertainment purposes, AI-driven tools for generating fake audio, video, and images are now widely available and being misused to impersonate individuals and mislead organizations.

Key Insights:

Democratized Deepfake Creation: Tools for generating synthetic media are now easy to use, enabling low-skilled actors to produce realistic forgeries.

CEO Fraud & Recruitment Exploits: Deepfake audio and video are being used to impersonate executives during meetings or to create fake candidate profiles in hiring scams.

KYC & Identity Fraud Risks: Attackers use deepfakes to bypass identity verification processes at banks and fintech platforms, facilitating account fraud.

Plug-and-Play Underground: Criminal communities are sharing deepfake tools, tutorials, and services, lowering the barrier to entry for would-be attackers.

Further Reading: Trend Micro

FileFix: A Social Engineering Evolution of ClickFix

Check Point Research has uncovered FileFix, a new social engineering attack that refines the ClickFix method to trick users into executing malicious commands. Delivered through compromised or typo-squatted websites, FileFix prompts victims with a fake download link or “Fix” button—copying harmful PowerShell scripts to the clipboard. When users paste and run these snippets, the attacker gains system access through a stealthy, multi-stage infection chain.

Key Insights:

FileFix uses clipboard hijacking to push malicious payloads via user-initiated paste actions.

Fake prompts mimic legitimate "fix" or software update buttons to build trust.

Infection unfolds in stages—from initial PowerShell downloaders to final payloads like AsyncRAT or remote access trojans.

This variation simplifies and accelerates command execution compared to previous ClickFix variants.

Detection requires user awareness and endpoint policies that block shell execution from clipboard content.

Further Reading: Check Point Research

FBI Warns of Youth-Driven Cybercrime and Violence Networks

The FBI has issued a series of alerts warning about “The Com,” a decentralized network of youth-led cybercriminal groups responsible for a surge in digital fraud, harassment, and real-world violence. Subgroups like Hacker Com focus on cryptocurrency theft, SIM swapping, and ransomware, while IRL Com offers violence-for-hire services such as swatting, assault, and kidnapping. These groups exploit gaming platforms and social media to recruit minors, using threats, doxing, and financial incentives to escalate involvement.

Key Insights:

Youth-focused groups are driving cybercrime and monetizing their skills via extortion, malware, and fraud.

Cryptocurrency enables both virtual and physical attacks, including pay-for-assault services.

Recruitment often starts on gaming and social platforms, escalating into serious criminal activity.

Swatting and doxing are common intimidation tactics tied to digital theft or status-building.

Further Reading: IC3.gov PSA 1 | ICS3.gov PSA 2 | ICS3.gov PSA 3

North Korean IT Worker Schemes: Emerging Threat to U.S. Businesses

The FBI has issued a critical alert (PSA>I‑072325‑4) highlighting how North Korean IT workers and their domestic facilitators are infiltrating U.S. businesses. These workers use deceptive employment setups—often via U.S.-based intermediaries—to bypass sanctions and gain unauthorized access to sensitive systems, generating illicit revenue to support the DPRK regime.

Key Insights:

These schemes rely on unwitting or complicit U.S. individuals who receive, configure, and then forward company assets (like laptops and accounts) to operatives in North Korea.

Facilitators may manage shipping, remote access setup, account creation on job platforms, and even handle proceeds in shared financial accounts.

Tactics exploit front companies and virtual interviews to mask identities and evade detection, with remote desktop tools like TeamViewer used covertly.

There are significant risks of sanction violations, data theft, and unauthorized system control when businesses hire third-party or international IT contractors.

The FBI recommends organizations conduct in-person or video identity verifications, validate employment credentials, monitor shipping/payment methods, and restrict unauthorized remote-access tools.

Further Reading: IC3.gov PSA I‑072325‑4

Targeted Social Engineering Drives Ransom Payments Skyward in Q2 2025

Coveware’s Q2 2025 ransomware spotlight reveals a dramatic shift in attack economics: the average ransom payment jumped to $1,130,070—a staggering 104% increase from Q1—while the median payment doubled to $400,000, indicating high-value extortion is on the rise.

Key Insights:

Ransomware actors are shifting from broad targeting to highly targeted social-engineering campaigns, exploiting trusted communications and tailored deception to pressure specific high-profile victims.

While the payment amounts surged, the overall ransom payment rate remained low at ~26%, suggesting many organizations continue to successfully resist paying demands.

Mid-sized and larger enterprises are now disproportionately affected, as attackers focus on fewer but more lucrative targets rather than bulk low-value victims.

Further Reading: Coveware Blog

Privacy Alert: Tea App Data Breach Exposes Millions of Sensitive Chats

The women-focused “Tea” app, designed for anonymous reviews and dating safety, has suffered a catastrophic data breach impacting users prior to February 2024. Initial reports of exposed selfies and ID documents (around 72,000 images) have now escalated: researchers uncovered a second compromised database containing 1.1 million private messages on deeply personal topics—spanning infidelity, abortion, and abuse.

Key Insights:

Legacy storage misconfiguration in Firebase led to unauthorized data exposure, including chat logs and user IDs.

Messaging functionality has been disabled while Tea investigates and coordinates with cybersecurity experts and the FBI.

Victims face potential risks of identity theft, harassment, and blackmail through leaked information involving personal phone numbers and real‑world identifiers.

Further Reading: WebProNews

Scattered Spider Alert: FBI & CISA Update on Tactics & Threats

Critical infrastructure and commercial entities are urged to review CISA's updated joint advisory AA23‑320A (last revised July 29, 2025), detailing evolving tactics used by the Scattered Spider cybercriminal group. Known for preying on IT and help desk personnel, this financially motivated threat actor now combines social engineering, ransomware, and data extortion with sophisticated new techniques.

Key Insights:

Scattered Spider continues targeting IT support channels using voice phishing (vishing), SMS phishing (smishing), and MFA fatigue attacks alongside SIM swapping to obtain access credentials.

Once inside, attackers repurpose legitimate remote-access and tunneling tools (e.g. TeamViewer, AnyDesk, Ngrok) instead of relying on malware, enabling stealthy and persistent access.

New variants like DragonForce ransomware are now being deployed as part of combined extortion operations (data theft + encryption).

In recent operations, actors have refined social engineering methods while rotating TTPs to evade detection and extend dwell time.

Updated mitigations emphasize phishing-resistant MFA, verifying helpdesk contacts out-of-band, limiting remote access tool use, and continuous validation of security controls against evolving attack behaviors.

Further Reading: CISA Advisory AA23‑320A (Scattered Spider)

Scam Alert: Gaming Sites Flooded with Fake Platforms and Phishing Traps

Threat actors have launched a large-scale social engineering campaign using polished, fraudulent gaming and wagering websites—promoted via Discord and social media ads. These platforms lure users with claims of partnerships with influencers like “Mr. Beast,” and offer fake promo codes for in-game credits. Once victims deposit funds or connect crypto wallets, the sites disappear—often taking user data and assets with them.

Key Insights:

Hundreds of scam sites—often over 1,200 domains—are promoted via sponsored ads and influencer tie-ins to appear legitimate.

These platforms impersonate giveaways or wagering systems, incentivizing sign-ups with fake bonus credits and “verified” endorsements.

After registration or payment, users often lose access to funds and face account theft or credential compromise.

Scams are heavily directed toward younger users on Discord and gaming communities, exploiting trust in influencer culture.

In addition to phishing domains, attackers distribute malware via fake mods or “game cheats,” particularly targeting titles like Minecraft and Roblox.

Further Reading: KrebsOnSecurity

Phishing Trends Q2 2025: Microsoft at the Helm, Spotify Rejoins the Spotlight

Check Point Research’s latest Brand Phishing report reveals that in the second quarter of 2025, cybercriminals continued to impersonate high-trust brands to trick users into revealing credentials or financial data. Microsoft remained the most spoofed brand—used in 25% of phishing attempts—followed by Google (11%), Apple (9%), and Spotify (6%), marking Spotify’s first reappearance in the charts since late 2019.

Key Insights:

Microsoft led phishing campaigns, accounting for a quarter of all spoofed brands.

Spotify saw a surprising resurgence in impersonation attempts after a long absence, used in campaigns involving fake credential and payment pages.

Booking.com–themed domains surged by over 700 in Q2, many embedding personal user data to deceive targets convincingly.

Tech remained the top spoofed sector, with social networks, travel, and retail brands also seeing elevated impersonation activity.

Seasonal alignment played a key role: the rise in travel scams coincided with summer holiday planning, amplifying phishing success.

Further Reading: Check Point Research

Microsoft OAuth Phishing Campaign: MFA Bypass via App Impersonation

Proofpoint has exposed a sophisticated phishing campaign where attackers used malicious Microsoft OAuth applications—disguised as trusted brands like Adobe, DocuSign, and SharePoint—to trick users into granting access to their Microsoft 365 accounts. These apps operated within legitimate authorization flows, enabling attackers to bypass multi-factor authentication (MFA) with minimal-risk consent requests.

Key Insights:

The fake OAuth apps mimicked trusted publishers to obtain permissions for profile, email, and openid scopes—enough to capture credentials and session tokens without raising suspicion.

Once approved, users were redirected to phishing pages that intercepted login credentials and session tokens using AiTM (attacker-in-the-middle) kits like Tycoon or EvilProxy.

Attackers were able to maintain access via stolen tokens even after password resets, remaining linked to accounts until consent was manually revoked.

The campaign compromised multiple sectors—including finance, healthcare, and retail—targeting executives and high-privilege users.

Standard security controls such as DMARC or domain reputation were largely ineffective since the phishing originated from within Microsoft's system.

Microsoft is rolling out updated defaults that require administrative approval for third-party app permissions, aiming to limit similar attacks going forward.

Further Reading: Proofpoint Threat Insight

FBI Alert: QR Code Packages Used in Emerging Fraud Scheme

The FBI has issued a Public Service Announcement (PSA I‑073125) warning about a new twist on the classic "brushing scam": unsolicited packages sent to recipients containing QR codes that, when scanned, prompt the victim to share personal or financial information or inadvertently download malware. These packages often arrive without sender details, making recipients more likely to investigate the code out of curiosity.

Key Insights:

Mail includes no sender information, tempting recipients to scan QR codes in order to identify the sender.

Scanning the code can lead to phishing forms requesting sensitive data or installation of smartphone malware.

The tactic is a modification of brushing scams, repurposed for fraud by exploiting user curiosity and trust.

Fraudsters may ask victims to grant permissions or download apps that compromise device security.

Protective Measures:

Don’t scan QR codes from unexpected or unknown packages.

Avoid granting app or account access triggered via unsolicited QR links.

If suspicious, report the package to your local authorities or the FBI’s Internet Crime Complaint Center (IC3).

Further Reading: IC3.gov PSA I‑073125

June 2025 - ExploreSec Cybersecurity Threat Intelligence Newsletter

June 10, 2025

This is a newsletter I create and share with my internal security team. Feel free to grab and do the same.

Ransomware Ecosystem in Flux

Coveware's latest analysis reveals a significant transformation in the ransomware threat landscape as of Q1 2025. The once-dominant Ransomware-as-a-Service (RaaS) model is unraveling due to intensified law enforcement actions, internal discord, and operational setbacks.

Key Insights:

Disintegration of Major RaaS Groups: Prominent groups like LockBit, BlackCat/ALPHV, and Black Basta have collapsed, plagued by internal conflicts and increased scrutiny. Leaked communications from Black Basta highlight challenges in targeting, risk assessment, and evasion of sanctions.

Emergence of New Threat Actors: The void left by these groups is being filled by unaffiliated extortionists, nascent ransomware brands with ties to espionage and hacktivism, and a few remnants of traditional ransomware operations.

Operational Missteps: Recent incidents, such as Clop's underwhelming Cleo campaign and a poorly executed Oracle Cloud SSO breach by a BreachForums actor, indicate a decline in the sophistication and monetization strategies of threat actors.

Rise of Phantom Scams: The appearance of fraudulent ransom notes, like those falsely attributed to BianLian, underscores a trend toward deceptive tactics as traditional extortion methods wane.

Increased Exposure and Arrests: Enhanced operational security measures and international cooperation have led to the identification and apprehension of several threat actors, diminishing the perceived anonymity that once shielded cybercriminals.

Further Reading: Coveware

Stealthy .NET Malware: Hiding Malicious Payloads as Bitmap Resources

Unit 42 researchers have identified a novel obfuscation technique employed by threat actors, wherein malicious payloads are concealed within bitmap resources embedded in seemingly benign 32-bit .NET applications. This method leverages steganography to initiate a multi-stage execution chain, ultimately deploying final payloads such as Agent Tesla, RemcosRAT, or XLoader.

Key Insights:

Steganographic Embedding: Malware is hidden within bitmap resources of .NET executables, allowing it to evade traditional detection mechanisms.

Malspam Distribution: Campaigns have been observed targeting sectors like finance in Türkiye and logistics in Asia, using localized email subjects and attachments to increase credibility.

Multi-Stage Execution: Upon execution, the infected application extracts and deobfuscates embedded payloads, loading them as dynamic-link libraries before executing the final malicious code.

Advanced Obfuscation Techniques: Additional methods such as metadata obfuscation, opcode replacement, and control flow manipulation are used to hinder static analysis and reverse engineering.

Further Reading: Unit 42

New Tool Can Trick Windows into Disabling Microsoft Defender

Security researchers have discovered a new, publicly available tool called "DefendNot" that can manipulate Windows systems into effectively disabling Microsoft Defender, the built-in antivirus software. This tool doesn't exploit vulnerabilities but instead uses legitimate system administration features in unintended ways.

Key Insights for Security Teams:

Abuse of Admin Privileges: Highlights the critical importance of least privilege principles and monitoring privileged accounts.

Bypasses Traditional Defenses: May evade detection by traditional security solutions that primarily look for malware signatures or exploit activity.

Focus on Tamper Protection: Underscores the importance of enabling and closely monitoring tamper protection features within Microsoft Defender.

Need for Behavioral Monitoring: Organizations should emphasize behavioral monitoring and anomaly detection to identify suspicious activity.

Tool is Publicly Available: Means threat actors could potentially incorporate it into their attack chains.

Further Reading: BleepingComputer

NIST Proposes Metric to Identify Likely Exploited Vulnerabilities

The National Institute of Standards and Technology (NIST), in collaboration with the Cybersecurity and Infrastructure Security Agency (CISA), has introduced a proposed metric aimed at determining the likelihood that a given vulnerability has been exploited in the wild. This initiative seeks to enhance the efficiency and cost-effectiveness of enterprise vulnerability remediation efforts.

Key Insights:

Addressing Limitations of Existing Systems: Current remediation strategies often rely on the Exploit Prediction Scoring System (EPSS) and Known Exploited Vulnerabilities (KEV) lists. However, EPSS has been noted for inaccuracies, and KEV lists may not be comprehensive. The proposed metric aims to augment these tools by providing a more accurate assessment of exploitation likelihood.

Enhancing Vulnerability Prioritization: By estimating the probability of exploitation, organizations can better prioritize vulnerabilities, focusing resources on those most likely to be targeted.

Collaborative Approach: The success of this metric depends on collaboration with industry partners to provide necessary performance measurements and validate the effectiveness of the approach.

Further Reading: NIST CSWP 41

New Best Practices Guide for Securing AI Data Released

CISA, NSA, FBI, and international partners have jointly released a new Cybersecurity Information Sheet focused on AI Data Security: Best Practices for Securing Data Used to Train & Operate AI Systems. This guide emphasizes that robust data security is fundamental for ensuring the accuracy, integrity, and trustworthiness of AI outcomes throughout its entire lifecycle.

Key Insights:

Holistic Risk Management: The guide outlines risks stemming from data security and integrity issues across all phases of AI, from development to operation.

Target Audience: It's particularly relevant for Defense Industrial Bases, National Security Systems owners, federal agencies, and Critical Infrastructure owners/operators.

Core Recommendations: Key practices include adopting strong data protection measures, proactively managing AI-related risks, and enhancing monitoring, threat detection, and network defense capabilities.

Vigilance is Key: As AI integration grows, organizations must take deliberate steps to secure the underlying data.

Further Reading: CISA

DDoS Attack "Street Prices": What You Need to Know

Recent analysis of the underground market reveals that the "street prices" for DDoS (Distributed Denial-of-Service) attacks have remained remarkably stable over the past few years, with some new trends in service delivery. While web-based booters are still available, Telegram-based booter services are becoming a new norm, offering readily accessible attack capabilities.

Key Insights:

Stable Pricing: DDoS attack costs have remained consistent, making them a relatively affordable option for malicious actors.

Layer 3/4 Attacks (Volume-based):

1 GB/Day (Booter-Service): ~$1/day

100 GB/Day: ~$25/day

1000 GB/Day (DDoS for Hire): ~$150/day

Layer 7 Attacks (Application-layer):

10,000 RPS/Day (Booter-Service): ~$1/day

50,000 RPS/Day (DDoS for Hire): ~$20/day

100,000 RPS + Protected Services (DDoS for Hire): ~$50/day

Max monthly cost for DDoS for Hire: ~$10,000/month

DDoS-as-a-Service (DDoSaaS) Dominance: This business model continues to thrive, with attackers charging hourly or monthly fees to sustain attacks, often with extra charges for targeting protected services.

Emergence of Telegram Booters: Threat actors are increasingly leveraging Telegram for offering and managing DDoS services, simplifying access for potential customers.

Further Reading: KyberVandals Blog

Deceptive CAPTCHA "ClickFix" Campaign Uses Clipboard Injection to Deliver Malware

Threat actors are employing a new social engineering campaign, dubbed "ClickFix," that utilizes fake CAPTCHA prompts on compromised or cloned websites. This sophisticated technique tricks users into launching malware by combining clipboard injection with abuse of the Windows Run dialog, leading to the delivery of payloads like Lumma Stealer and NetSupport RAT.

Key Insights:

Social Engineering Focus: The campaign heavily relies on user fatigue with CAPTCHA mechanisms, guiding victims through seemingly familiar steps to execute malicious code.

Clipboard Injection & Run Dialog Abuse: The core of the attack involves copying a malicious PowerShell or mshta command to the clipboard, which users are then instructed to paste and execute in the Windows Run dialog.

Living Off the Land Binaries (LOLBins): Attackers extensively use trusted system binaries like PowerShell, mshta.exe, and certutil.exe to bypass traditional security defenses, making detection challenging.

Payloads: Frequently observed payloads include infostealers (e.g., Lumma Stealer targeting browser data, credentials, and crypto wallets) and remote access tools (e.g., NetSupport RAT for full system access).

Simplicity and Effectiveness: The campaign's success stems from its simplicity, avoiding zero-day exploits or complex hidden mechanisms, relying instead on user interaction.

Proactive Defense: This campaign underscores the need for robust endpoint detection and response (EDR) solutions capable of behavioral analysis and detection of LOLBin abuse, alongside user education on suspicious CAPTCHA prompts and the dangers of pasting unknown commands.

Further Reading: SecurityOnline.info

Cybercriminals Exploit AI Hype to Spread Malware

Cybercriminals are increasingly exploiting the public's interest in artificial intelligence by creating fake AI-themed websites and advertisements to distribute malware. A recent campaign identified by Mandiant Threat Defense involves the threat group UNC6032 using deceptive ads on platforms like Facebook and LinkedIn to lure users into downloading malicious software disguised as AI video generation tools.

Key Insights:

Deceptive Advertising: Thousands of malicious ads have been disseminated, impersonating legitimate AI tools such as Luma AI and Canva Dream Lab. These ads direct users to fraudulent websites designed to mimic authentic AI services.

Malware Deployment: Upon interacting with these fake sites, users are prompted to download a ZIP file containing the STARKVEIL malware dropper. This dropper installs multiple malware components, including GRIMPULL, XWORM, and FROSTRIFT, which are designed to steal sensitive information and establish persistent access to the victim's system.

Information Theft: The deployed malware targets a range of data, including login credentials, cookies, credit card information, and digital wallet contents. Some components, like XWORM, also perform keylogging and screen capture, further compromising user privacy.

Evasion Techniques: The malware employs sophisticated methods to avoid detection, such as using Braille pattern blank characters to obscure file extensions and leveraging legitimate processes for malicious activities.

This campaign underscores the importance of vigilance when engaging with online advertisements, especially those offering AI-related services. Users should be cautious of unsolicited offers and verify the legitimacy of websites before downloading any software.

Further Reading: Google Cloud Blog

Beyond the Kill Chain: How Cybercriminals Invest Their Profits

Sophos X-Ops' five-part series, Beyond the Kill Chain, explores what happens after a successful cyberattack. The series reveals how financially motivated threat actors invest their illicit earnings—often blending legitimate business with ethically questionable and outright criminal ventures.

Key Insights:

Legitimate Business Ventures: Cybercriminals are investing in seemingly lawful enterprises such as restaurants, real estate, and e-commerce platforms. These ventures help launder money while also creating additional income streams.

Ethically Dubious Activities: Some threat actors operate in legal gray zones, selling spyware, monetizing vulnerability research under the guise of security services, or manipulating online traffic for advertising profits.

Criminal Enterprises: Illicit gains are also funneled into traditional criminal operations like counterfeit goods, drug trafficking, and underground gambling, showing how cybercrime supports broader organized crime ecosystems.

Implications for Cybersecurity: Mapping how threat actors reinvest their profits helps threat intelligence teams understand evolving risk models and disrupt the infrastructure supporting ongoing cybercriminal activity.

Further Reading: Sophos News

Lumma Infostealer: Disrupted but Not Defeated

A recent global law enforcement operation disrupted parts of the Lumma Infostealer malware-as-a-service platform, seizing over 2,500 domains. However, key infrastructure—particularly servers hosted in Russia—remains intact, allowing Lumma’s core operations to continue.

Key Insights:

Partial Takedown: While many domains were seized, Lumma’s main server remains online, enabling continued malware activity.

Resilience and Recovery: The developer claimed services resumed quickly with no arrests made, signaling strong operational recovery.

Ongoing Threat: Stolen credentials and sensitive data tied to Lumma are still appearing on dark web markets.

Psychological Tactics: Authorities planted disruptive messages in Lumma’s Telegram channels and admin panels to undermine trust in the service.

Mixed Reactions: Some cybercriminals are distancing themselves from Lumma, while others remain loyal and active.

Further Reading: Check Point Blog

CFOs Targeted in Sophisticated Spear-Phishing Campaign

A recent spear-phishing campaign is targeting Chief Financial Officers (CFOs) and finance executives across banking, energy, insurance, and investment sectors in regions including Europe, Africa, Canada, the Middle East, and South Asia. The attackers use a multi-stage approach to deploy NetBird, a legitimate WireGuard-based remote access tool, onto compromised systems.

Key Insights:

Deceptive Recruitment Emails: The campaign begins with emails impersonating a Rothschild & Co recruiter offering a “strategic opportunity.” Victims are directed to a Firebase-hosted page featuring a custom CAPTCHA to access a malicious file.

Malicious Payload Delivery: After solving the CAPTCHA, users download a ZIP file containing a VBS script. When executed, it installs NetBird and OpenSSH, creates a hidden local admin account, and enables Remote Desktop Protocol (RDP) for persistent attacker access.

Evasion Techniques: The use of custom CAPTCHAs and trusted hosting services helps the attackers bypass traditional security defenses and increases credibility.

Attribution: Some infrastructure overlaps with known nation-state campaigns, but the specific threat actor remains unidentified.

Further Reading: Trellix Blog

Threat Actors Exploit Google Apps Script for Evasive Phishing Attacks

Threat actors are leveraging Google's Apps Script platform to host phishing pages that appear legitimate, allowing them to steal login credentials. These campaigns often begin with emails posing as invoice notifications, linking to webpages hosted using Google Apps Script. By operating within Google's trusted environment, attackers make their phishing pages seem more authentic, increasing the chances of success.

Key Insights:

Abuse of Trusted Services: Google Apps Script, a JavaScript-based platform used for automating Google Workspace tasks, is being exploited to host fake login pages that capture user credentials and send them to attacker-controlled servers.

Evasion of Security Measures: Because the scripts are hosted on Google's own domain, they can bypass traditional email and web filters that typically block suspicious domains.

Sophisticated Phishing Techniques: The phishing emails and login prompts are convincingly designed to mimic legitimate services, making it more likely that targets will engage and provide sensitive information.

Further Reading: BleepingComputer

HuluCAPTCHA – An Evolving Fake CAPTCHA Framework

Security researchers have identified "HuluCAPTCHA," a sophisticated fake CAPTCHA framework actively compromising websites. This advanced system tricks users into running malicious commands via fake CAPTCHA prompts and the Windows Run dialog, leading to infections with infostealers and remote access tools.

Key Insights:

Deceptive Execution: Users are redirected from compromised sites to fake CAPTCHA pages, then instructed to copy/paste malicious PowerShell or mshta commands into Windows Run.

Advanced Tracking & Stealth: The framework meticulously tracks user interactions and potential command execution. It leverages Living Off the Land Binaries (LOLBins) to evade traditional defenses.

Payload Versatility: Delivers various infostealers (e.g., Lumma, Aurotun) and remote access tools (e.g., Donut Injector).

Persistent Backdoors: Compromised WordPress sites show sophisticated hidden admin backdoors, designed for stealth and persistence.

High-Value Targets: Attackers are targeting organizations that could hold sensitive data, highlighting the potential for significant impact.

Further Reading: HuluCaptcha — An example of a FakeCaptcha framework

Phishing Campaign Exploits Google.com Open Redirects

A recent phishing campaign has been observed exploiting an open redirect vulnerability within Google's google.com/travel/clk endpoint. Threat actors are leveraging this legitimate Google Travel click-tracking mechanism to redirect users from a trusted google.com domain to malicious phishing sites. This technique adds an air of legitimacy to phishing links, making them harder for users to identify as fraudulent.

Key Insights:

Trusted Domain Abuse: Attackers are using google.com/travel/clk?pc=[token]&pcurl=[target_URL] to redirect users. The presence of google.com in the initial link provides a deceptive sense of security.

Persistent Tokens: The pc token, which controls the redirect, lacks a clear expiration mechanism and can remain valid for months or even years. This allows attackers to reuse tokens across multiple campaigns.

Ease of Exploitation: Obtaining a valid token is trivial, requiring only a visit to Google's hotel search page to copy one from a legitimate link.

Google's Stance: Google's official position classifies open redirects as "very little practical risk," claiming they invest in phishing detection rather than preventing the redirects themselves. This stance is debated given the observed abuse.

Detection Challenge: The initial legitimate google.com domain in the link makes it difficult for users and some security systems to immediately flag it as malicious.

Mitigation Recommendation for Internal Security Teams:

Flag or sandbox any google.com/travel/clk links that appear in email and other messages until Google clarifies its redirect validation mechanisms.

Further Reading: Another day, another phishing campaign abusing google.com open redirects

Cybercriminals Use Fake Booking Sites to Spread AsyncRAT Malware

Cybercriminals are exploiting fake Booking.com websites to infect users with AsyncRAT, a remote access trojan. Victims are lured through deceptive ads and social media links to counterfeit booking sites, where they are tricked into running a malicious PowerShell script. The attack results in full remote control of the infected system, putting sensitive personal information at risk.

Key Insights:

Attackers use fake CAPTCHA prompts to manipulate users into executing malware.

The AsyncRAT payload allows for full system access, including surveillance and data theft.

Domains rotate every few days, making detection and blocking more difficult.

Further Reading: Malwarebytes Blog

UNC6040 – Voice Phishing to Salesforce Data Extortion

Google Threat Intelligence Group (GTIG) is tracking UNC6040, a financially motivated threat cluster specializing in voice phishing (vishing) campaigns. This group is successfully impersonating IT support to gain access to organizations' Salesforce instances, primarily to steal large volumes of data for subsequent extortion. Their tactics rely heavily on manipulating end users rather than exploiting software vulnerabilities.

Key Insights:

Vishing is Key: UNC6040 uses convincing phone calls, often targeting English-speaking employees, to socially engineer access.

Salesforce Data Loader Abuse: They trick victims into authorizing malicious versions of Salesforce Data Loader, gaining broad access to exfiltrate sensitive data.

Lateral Movement: After Salesforce, they use stolen credentials for lateral movement into other cloud platforms like Okta and Microsoft 365.

No Platform Vulnerability: Attacks exploit user trust and process gaps, not inherent Salesforce flaws.

Persistent Threat: Extortion can occur months after the initial intrusion, indicating a patient and persistent threat.

Further Reading: The Cost of a Call: From Voice Phishing to Data Extortion

June 2025 - ExploreSec Cybersecurity Awareness Newsletter

June 9, 2025

This is a monthly newsletter I put together for an internal security awareness program. Feel Free to grab and use for your own program.

Be Cautious of Government Emails About Unpaid Tolls and Other Urgent Matters

Have you recently received an email from a government agency about an unpaid toll or another urgent issue? It's important to be extra careful, as cybercriminals are now exploiting official government email systems to send out scam messages.

Key Insights:

Scammers are using official-looking emails that appear to come from legitimate government departments.

A common scam involves emails claiming unpaid tolls and urging you to click a link to pay.

Be wary of urgent requests for information or payment designed to pressure you.

Always check the actual web address of a link by hovering over it without clicking. Suspicious or non-official links should be avoided.

Never share personal or financial information through links in suspicious emails.

Independently verify any questionable government emails by contacting the agency directly through their official website or phone number.

Further Reading: TechCrunch

Beware of Crypto Scams Promoted Through Hacked Social Media

The Internet Crime Complaint Center (IC3) has issued a public service announcement warning about a growing trend: scammers are taking over social media accounts and using them to trick people into investing in fake cryptocurrency schemes. These scams can look very convincing because they appear to come from accounts you or your friends might already follow.

Key Insights to Protect Yourself:

Be suspicious of investment opportunities shared via social media: Even if a post comes from a friend's account, be very cautious about any cryptocurrency investment being promoted. Their account may have been hacked.

Look for red flags in investment promises: Be wary of claims of guaranteed high returns with little to no risk. Legitimate investments always carry some level of risk.

Don't rush into investment decisions: Scammers often create a sense of urgency to pressure you into investing quickly before you have time to think it over or do your research.

Verify the information through official sources: Before investing in any cryptocurrency opportunity, independently research the platform or opportunity through trusted financial news outlets and official cryptocurrency websites. Don't rely solely on what you see on social media.

Be cautious of direct messages about investments: If you receive unsolicited direct messages on social media encouraging you to invest in cryptocurrency, treat them with extreme caution, even if they appear to be from someone you know.

Report suspicious activity: If you see suspicious cryptocurrency promotions on social media, report them to the platform. If you have been a victim of such a scam, file a complaint with the IC3 at ic3.gov.

Remember: If an investment opportunity sounds too good to be true, it probably is.

Further Reading: IC3

Hacked TikTok Videos Push Fake Apps and Steal Your Info!

Trend Micro researchers have uncovered a concerning new trend: videos on TikTok are promoting what appear to be pirated apps, but are actually designed to trick you into downloading dangerous "infostealer" malware like Vidar and StealC. These videos use clever social engineering, providing step-by-step instructions that lead users to compromise their own systems.

Key Insights:

Be Skeptical of "Free" Pirated Apps: If an offer seems too good to be true, especially for paid software offered for free, it's very likely a scam.

Avoid Unsolicited Technical Instructions: Never follow commands or instructions from untrusted sources, particularly if they tell you to disable security features or run unusual software.

Verify Video Sources: Just because a video is popular doesn't mean it's legitimate. Be cautious of content that pushes you to download files or visit external sites.

Recognize Social Engineering: Scammers use convincing visuals and instructions to make their malicious content seem harmless and easy to follow. Always pause and think before acting.

Further Reading: Trend Micro

Watch Out for Payroll Scams and Fake Login Pages!

Cybercriminals are getting sneakier, using new tricks to steal your paycheck. A recent alert highlights how attackers are using "SEO poisoning" to create fake payroll login pages that show up at the top of search results. If you fall for it and enter your login details, they can change your direct deposit information and reroute your pay!

Key Insights:

Access Payroll Directly: Don't rely on search engines. Always go to your payroll portal by typing the official website address directly into your browser or using a trusted bookmark.

Enable Multi-Factor Authentication (MFA): If your payroll portal offers MFA (like a code sent to your phone), enable it! This adds an extra layer of security.

Be Wary of Suspicious Changes: Set up alerts in your payroll software to notify you of any changes to your direct deposit information. If you get an unexpected alert, investigate immediately.

Report Unauthorized Changes: Know how to report any unauthorized changes or suspicious activity to your HR or IT department right away.

Update Your Devices: Keep your home office routers and mobile devices updated with the latest software and use strong, unique passwords. Attackers can exploit weaknesses in outdated systems to hide their activities.

Further Reading: ReliaQuest

Deceptive CAPTCHA "ClickFix" Campaign Uses Clipboard Injection to Deliver Malware

Key Insights:

Social Engineering Focus: The campaign heavily relies on user fatigue with CAPTCHA mechanisms, guiding victims through seemingly familiar steps to execute malicious code.

Clipboard Injection & Run Dialog Abuse: The core of the attack involves copying a malicious PowerShell or mshta command to the clipboard, which users are then instructed to paste and execute in the Windows Run dialog.

Living Off the Land Binaries (LOLBins): Attackers extensively use trusted system binaries like PowerShell, mshta.exe, and certutil.exe to bypass traditional security defenses, making detection challenging.

Payloads: Frequently observed payloads include infostealers (e.g., Lumma Stealer targeting browser data, credentials, and crypto wallets) and remote access tools (e.g., NetSupport RAT for full system access).

Simplicity and Effectiveness: The campaign's success stems from its simplicity, avoiding zero-day exploits or complex hidden mechanisms, relying instead on user interaction.

Proactive Defense: This campaign underscores the need for robust endpoint detection and response (EDR) solutions capable of behavioral analysis and detection of LOLBin abuse, alongside user education on suspicious CAPTCHA prompts and the dangers of pasting unknown commands.

Further Reading: SecurityOnline.info

Cybercriminals Exploit AI Hype to Spread Malware

Key Insights:

Deceptive Advertising: Thousands of malicious ads have been disseminated, impersonating legitimate AI tools such as Luma AI and Canva Dream Lab. These ads direct users to fraudulent websites designed to mimic authentic AI services.

Malware Deployment: Upon interacting with these fake sites, users are prompted to download a ZIP file containing the STARKVEIL malware dropper. This dropper installs multiple malware components, including GRIMPULL, XWORM, and FROSTRIFT, which are designed to steal sensitive information and establish persistent access to the victim's system.

Information Theft: The deployed malware targets a range of data, including login credentials, cookies, credit card information, and digital wallet contents. Some components, like XWORM, also perform keylogging and screen capture, further compromising user privacy.

Evasion Techniques: The malware employs sophisticated methods to avoid detection, such as using Braille pattern blank characters to obscure file extensions and leveraging legitimate processes for malicious activities.

Further Reading: Google Cloud Blog

Beyond the Kill Chain: How Cybercriminals Invest Their Profits

Key Insights:

Legitimate Business Ventures: Cybercriminals are investing in seemingly lawful enterprises such as restaurants, real estate, and e-commerce platforms. These ventures help launder money while also creating additional income streams.

Ethically Dubious Activities: Some threat actors operate in legal gray zones, selling spyware, monetizing vulnerability research under the guise of security services, or manipulating online traffic for advertising profits.

Criminal Enterprises: Illicit gains are also funneled into traditional criminal operations like counterfeit goods, drug trafficking, and underground gambling, showing how cybercrime supports broader organized crime ecosystems.

Implications for Cybersecurity: Mapping how threat actors reinvest their profits helps threat intelligence teams understand evolving risk models and disrupt the infrastructure supporting ongoing cybercriminal activity.

Further Reading: Sophos News

CFOs Targeted in Sophisticated Spear-Phishing Campaign

Key Insights:

Deceptive Recruitment Emails: The campaign begins with emails impersonating a Rothschild & Co recruiter offering a “strategic opportunity.” Victims are directed to a Firebase-hosted page featuring a custom CAPTCHA to access a malicious file.

Malicious Payload Delivery: After solving the CAPTCHA, users download a ZIP file containing a VBS script. When executed, it installs NetBird and OpenSSH, creates a hidden local admin account, and enables Remote Desktop Protocol (RDP) for persistent attacker access.

Evasion Techniques: The use of custom CAPTCHAs and trusted hosting services helps the attackers bypass traditional security defenses and increases credibility.

Attribution: Some infrastructure overlaps with known nation-state campaigns, but the specific threat actor remains unidentified.

Further Reading: Trellix Blog

Threat Actors Exploit Google Apps Script for Evasive Phishing Attacks

Key Insights:

Abuse of Trusted Services: Google Apps Script, a JavaScript-based platform used for automating Google Workspace tasks, is being exploited to host fake login pages that capture user credentials and send them to attacker-controlled servers.

Evasion of Security Measures: Because the scripts are hosted on Google's own domain, they can bypass traditional email and web filters that typically block suspicious domains.

Sophisticated Phishing Techniques: The phishing emails and login prompts are convincingly designed to mimic legitimate services, making it more likely that targets will engage and provide sensitive information.

Further Reading: BleepingComputer

Cybercriminals Use Fake Booking Sites to Spread AsyncRAT Malware

Key Insights:

Attackers use fake CAPTCHA prompts to manipulate users into executing malware.

The AsyncRAT payload allows for full system access, including surveillance and data theft.

Domains rotate every few days, making detection and blocking more difficult.

Further Reading: Malwarebytes Blog

UNC6040 – Voice Phishing to Salesforce Data Extortion

Key Insights:

Vishing is Key: UNC6040 uses convincing phone calls, often targeting English-speaking employees, to socially engineer access.

Salesforce Data Loader Abuse: They trick victims into authorizing malicious versions of Salesforce Data Loader, gaining broad access to exfiltrate sensitive data.

Lateral Movement: After Salesforce, they use stolen credentials for lateral movement into other cloud platforms like Okta and Microsoft 365.

No Platform Vulnerability: Attacks exploit user trust and process gaps, not inherent Salesforce flaws.

Persistent Threat: Extortion can occur months after the initial intrusion, indicating a patient and persistent threat.

Further Reading: The Cost of a Call: From Voice Phishing to Data Extortion

April 2025 - ExploreSec Cybersecurity Threat Intelligence Newsletter

April 22, 2025

This is a newsletter I create and share with my internal security team. Feel free to grab and do the same.

Camera Off: Akira Deploys Ransomware via Webcam

Akira, a notorious ransomware group, has demonstrated a novel technique by bypassing Endpoint Detection and Response (EDR) tools through the compromise of unsecured webcams. After facing detection while attempting to deploy ransomware on a Windows server, Akira pivoted to target a vulnerable webcam on the victim's network. This device, running a lightweight Linux OS and lacking EDR, allowed the group to deploy Linux-based ransomware successfully. This incident emphasizes the importance of securing IoT devices and enhancing patch management strategies.

Key Insights:

IoT devices, such as webcams, can be used as pivot points for attackers to bypass traditional security tools like EDR.

Akira's adaptability highlights how ransomware groups are evolving and using multiple platforms for attacks.

Organizations should prioritize securing all devices, including IoT, and ensuring comprehensive patch management.

Further Reading: S-RM

Not Just for Developers: How Product and Security Teams Can Use GitHub Copilot

GitHub Copilot is transforming not just development teams but also product and security teams. With its AI-powered code generation, it can assist security teams in identifying vulnerabilities faster and help product teams in generating feature specifications or optimizing documentation. Copilot's integration into the workflow allows these teams to accelerate their tasks and focus more on strategy rather than repetitive tasks, improving efficiency and productivity across the board.

Key Insights:

GitHub Copilot isn't just for coders; it’s valuable for security and product teams too.

It accelerates vulnerability identification and aids in documentation and feature specification.

Teams can leverage AI to improve efficiency and focus on high-impact work.

Further Reading: GitHub Blog

Blink and They're In: How Rapid Phishing Attacks Exploit Weaknesses

Phishing attacks are accelerating, with attackers exploiting weaknesses in systems faster than security teams can respond. In one notable case, attackers gained control of a network in just 48 minutes using social engineering and a flood of spam emails, followed by convincing employees to give remote access. These attacks leverage low-tech tactics, such as using legitimate tools like Microsoft Teams and Quick Assist, to bypass security defenses.

Key Insights:

Attackers are exploiting basic social engineering tactics, such as impersonating IT help desks, to gain control of devices.

Rapid response times (48 minutes in this case) highlight the need for automated security measures.

Preventative measures include verifying help-desk staff interactions and locking down remote access tools like Quick Assist.

Further Reading: ReliaQuest

ACRStealer Infostealer Exploiting Google Docs as C2

ACRStealer, a new type of infostealer, is taking a unique approach by using Google Docs as an intermediary command-and-control (C2) server. Threat actors hide malicious commands within Google Docs files, leveraging Base64 encoding to keep the communication with the C2 server hidden. The infostealer targets a wide range of sensitive information, including browser data, cryptocurrency wallet files, FTP credentials, and even chat program data. This shift in tactics highlights the evolving nature of cybercrime and the need for robust monitoring and secure data handling practices to detect and prevent such attacks.

Key Insights:

ACRStealer uses Google Docs, telegra.ph, and Steam as intermediary C2 servers, making it harder to detect the malware's activity.

The malware targets sensitive data like browser history, cryptocurrency wallet files, and FTP credentials.

It continues to evolve by hiding its communication strings within different services to evade detection.

Further Reading: AhnLab

SecTopRAT Bundled in Chrome Installer Distributed via Google Ads

A new phishing attack is leveraging Google Ads to distribute a fake Google Chrome installer bundled with SecTopRAT, a remote access Trojan (RAT) with stealer capabilities. Users searching for the legitimate Google Chrome installer are led to a malicious Google Sites page, where they unknowingly download the malware disguised as Chrome. The attack bypasses Windows Defender by dynamically retrieving and decrypting the malicious payload, allowing attackers to inject the malware into a legitimate process, giving them control of the victim's system.

Key Insights:

The malware is hidden in a fake Chrome installer, which is distributed through Google Ads and Google Sites.

Once installed, SecTopRAT is deployed, giving attackers remote access and the ability to steal sensitive data.

The attack evades detection by dynamically downloading the malware and using anti-virus evasion techniques.

Further Reading: Malwarebytes

Abusing CSS for Evasion and Tracking: A New Threat

Cybercriminals are increasingly abusing Cascading Style Sheets (CSS) to evade detection and track users. By using techniques like hidden text salting, attackers can insert irrelevant, invisible content into emails to bypass spam filters and email parsers. This method can also be used to track user actions and preferences, even when email clients restrict dynamic content like JavaScript.

These tactics include setting text to invisible properties, manipulating opacity, and hiding content off-screen. Attackers can exploit this for phishing emails and even to fingerprint users based on their system configurations.

Key Insights:

CSS properties like text-indent and opacity are used to conceal malicious content and bypass security measures.

CSS can also be abused for tracking user actions and preferences, allowing for advanced targeting in phishing campaigns.

Security teams should educate employees about these new evasion tactics and strengthen email defenses.

Further Reading: Talos Intelligence

Remote Monitoring and Management (RMM) Tools: Attackers’ First Choice

Cybercriminals are increasingly turning to legitimate Remote Monitoring and Management (RMM) tools as their first-stage payloads in email campaigns. These tools, typically used by IT teams for managing multiple systems remotely, are now being exploited to collect data, steal finances, and deploy additional malware, including ransomware. In 2024, there was a marked shift, with RMM tools like ScreenConnect, Fleetdeck, and Atera replacing traditional loaders and botnets. This trend emphasizes the need for organizations to monitor remote management tools carefully and ensure they are not abused by attackers.

Key Insights:

RMM tools are being used to facilitate cyberattacks by granting attackers remote access to systems.

The use of RMM tools as a first-stage payload is increasing, replacing older attack methods.

Organizations must secure their RMM tools and ensure they are used appropriately.

Further Reading: Proofpoint Blog

ClickFix: The Social Engineering Technique Hackers Use to Manipulate Victims

The ClickFix technique has gained significant traction among cybercriminals due to its ability to manipulate users into executing malicious actions. By using a clever mix of human psychology and obfuscation, attackers deploy this technique to bypass security systems and install malware. The attack typically involves fake CAPTCHA-like elements, tricking victims into clicking on links or downloading malicious files. This technique has become increasingly popular due to its effectiveness in evading traditional detection methods.

Key Insights:

ClickFix uses obfuscation to bypass security measures and execute malicious actions.

Attackers exploit human psychology to trick users into performing actions that compromise security.

Organizations should educate employees on recognizing manipulative tactics like ClickFix and improve multi-layered defenses.

Further Reading: Group-IB Blog

ESET Discovers Zero-Day Exploit in Windows Kernel (CVE-2025-24983)

ESET Research has uncovered a zero-day exploit leveraging the CVE-2025-24983 vulnerability in the Windows Kernel, allowing attackers to elevate their privileges. First observed in the wild in March 2023, this exploit was used in conjunction with the PipeMagic backdoor, compromising targeted systems. The discovery highlights the continued use of kernel vulnerabilities in advanced attacks and the importance of regular patching and security monitoring to protect against zero-day threats.

Key Insights:

The exploit targets a critical Windows Kernel vulnerability (CVE-2025-24983), enabling privilege escalation.

The attack was first observed in March 2023 and delivered through the PipeMagic backdoor.

Organizations must prioritize timely updates and monitoring for signs of this and similar vulnerabilities.

Further Reading: ESET Research on Bluesky

From Data to Defense: Insights from ReliaQuest’s 2025 Annual Threat Report

The 2025 Annual Threat Report from ReliaQuest reveals the rapidly increasing speed of cyberattacks, with attackers moving from initial access to lateral movement in just 48 minutes. AI and automation are now key tools for both attackers and defenders, with organizations needing to integrate AI-driven solutions to keep pace. Phishing remains the primary method of attack, but ransomware tactics are evolving, with more emphasis on data exfiltration rather than encryption. The report offers actionable recommendations, including the need for automated responses, securing remote services, and enhancing logging practices to better track and prevent breaches.

Key Insights:

Attackers now complete lateral movement in 48 minutes, stressing the importance of rapid detection and response.

AI and automation are critical to addressing the evolving cyberthreat landscape.

Ransomware is shifting towards exfiltration and data extortion.

Further Reading: ReliaQuest

Microsoft 365 Targeted in New Phishing, Account Takeover Attacks

New phishing campaigns are leveraging Microsoft 365's infrastructure to conduct account takeover (ATO) attacks, exploiting tenant misconfigurations and using OAuth redirection. One campaign involves attackers sending phishing emails using Microsoft’s own infrastructure, making detection difficult. These emails, masquerading as legitimate Microsoft notifications, direct victims to call centers, bypassing security controls. Another attack uses OAuth apps pretending to be Adobe and DocuSign to steal credentials and deploy malware. Security teams must be vigilant in securing OAuth applications and scrutinizing internal communications.

Key Insights:

Phishing attacks are exploiting Microsoft 365’s infrastructure for ATO attacks.

Attackers use fake support contacts and legitimate-looking emails to trick victims.

OAuth applications masquerading as trusted brands are used for stealing credentials and deploying malware.

Further Reading: SecurityWeek

AI Agent Attacks: A New Threat with Serious Implications

AI agents, like OpenAI's Operator, are being used by attackers to automate cyberattacks such as phishing, malware creation, and setting up attack infrastructure. As these AI tools become more accessible, they lower the entry barrier for cybercriminals, increasing the risk of widespread and damaging attacks.

Key Insights:

AI agents automate complex attacks, including phishing and malware creation.

These tools reduce the effort required for attacks, making them more accessible to cybercriminals.

Organizations should strengthen detection systems and control access to mitigate AI-driven threats.

Further Reading: Symantec Blog

JavaGhost’s Persistent Phishing Attacks From the Cloud

JavaGhost, an active cybercriminal group, has evolved from website defacement to launching sophisticated phishing attacks. They exploit misconfigurations in Amazon Web Services (AWS) environments, leveraging services like Amazon Simple Email Service (SES) to send phishing emails using the infrastructure of compromised organizations. These attacks are particularly insidious, bypassing traditional email protections due to the legitimacy of the sending source. JavaGhost has adapted advanced evasion techniques to obscure their activities, making detection harder for defenders.

Key Insights:

JavaGhost exploits AWS misconfigurations to send phishing emails, bypassing email protections.

They use advanced evasion techniques to obscure their presence in cloud logs.

Organizations must secure AWS environments, restrict IAM permissions, and implement enhanced detection methods.

Further Reading: Unit42 Blog

Buying Browser Extensions: A Dangerous Security Risk

In a recent investigation, it was revealed how attackers are buying up popular browser extensions and using them for malicious purposes. Extensions that started as helpful tools can easily be sold to the highest bidder, transforming into spyware or data harvesters without the original developers or users being notified. This risky practice allows new owners to repurpose permissions, such as tracking browsing behavior or stealing sensitive data, all without any visible changes to the extension’s appearance.

Key Insights:

Extensions can be sold and repurposed for malicious use, including tracking user data or even stealing login credentials.

The process of transferring ownership of extensions is relatively easy, with few security checks from platforms like Google Chrome.

Organizations should actively monitor the extensions in use and verify the legitimacy of any new updates or ownership changes to prevent security risks.

Further Reading: Secure Annex Blog

Menlo Security Report: 130% Increase in Zero-Hour Phishing Attacks and Nearly 600 Incidents of GenAI Fraud

Menlo Security's 2025 State of Browser Security Report reveals a 130% increase in zero-hour phishing attacks and highlights nearly 600 incidents of GenAI fraud. Attackers are using generative AI to impersonate legitimate platforms and manipulate users into disclosing personal information. Additionally, cybercriminals are leveraging sophisticated evasion techniques to bypass traditional security systems. With phishing sites growing by nearly 700% since 2020, organizations must prioritize browser security to mitigate these evolving threats.

Key Insights:

A surge in generative AI-based fraud, with cybercriminals impersonating platforms to steal personal data.

Nearly 1M new phishing sites are created monthly, reflecting a 700% increase since 2020.

Attackers are increasingly exploiting cloud services like AWS and CloudFlare for malicious content hosting.

Further Reading: Menlo Security

Is Firebase Phishing a Threat to Your Organization?

Firebase, a platform commonly used for app development, has been exploited in phishing attacks targeting organizations. Attackers can hijack Firebase’s authentication services to launch phishing campaigns, tricking users into divulging sensitive information. These attacks can be used to steal credentials, and in some cases, manipulate cloud-based services that organizations rely on. With Firebase being a trusted service, users may not immediately recognize these phishing attempts, making it a potent tool for attackers.

Key Insights:

Firebase is being exploited for phishing attacks, often targeting organizations’ authentication systems.

Users may unknowingly fall victim due to Firebase’s trusted reputation.

Organizations need to be aware of how Firebase can be misused and take proactive measures to secure their systems.

Further Reading: Check Point Blog

RansomHub's EDRKillShifter: Unveiling Evolving Ransomware Tactics

ESET's recent research delves into RansomHub, a prominent ransomware-as-a-service (RaaS) group that emerged in early 2024. The study uncovers RansomHub's connections to established gangs like Play, Medusa, and BianLian, highlighting the dynamic nature of ransomware operations. A focal point of the research is EDRKillShifter, a custom tool developed by RansomHub to disable endpoint detection and response (EDR) systems, enhancing the effectiveness of their attacks. This tool exemplifies the evolving sophistication of ransomware tactics, emphasizing the need for advanced security measures to counteract such threats.

Key Insights:

RansomHub's Emergence: Rapidly rose to prominence in 2024, surpassing established ransomware groups in activity.

EDRKillShifter Tool: A custom-developed EDR killer that targets various security solutions to facilitate attacks.

Affiliate Connections: Links between RansomHub and other ransomware gangs, suggesting a fluid and interconnected threat landscape.

Further Reading: ESET Research

Google Announces Sec-Gemini v1: An Experimental AI Model for Cybersecurity

Google has introduced Sec-Gemini v1, an experimental AI model designed to enhance cybersecurity operations. By integrating advanced reasoning capabilities with near real-time cybersecurity knowledge, Sec-Gemini v1 aims to improve tasks such as incident root cause analysis, threat analysis, and understanding vulnerability impacts. The model combines Gemini's AI capabilities with data from sources like Google Threat Intelligence (GTI) and the Open Source Vulnerabilities (OSV) database, resulting in superior performance on key cybersecurity benchmarks. Google is offering Sec-Gemini v1 to select organizations, institutions, professionals, and NGOs for research purposes to foster collaboration in advancing AI-driven cybersecurity solutions.

Key Insights:

Sec-Gemini v1 integrates AI with real-time cybersecurity data to enhance security operations.

The model outperforms others on benchmarks like CTI-MCQ and CTI-Root Cause Mapping.

Google is providing access to Sec-Gemini v1 for research collaborations to advance AI in cybersecurity.

Further Reading: Google Security Blog

Off the Beaten Path: Recent Unusual Malware

Unit 42 researchers have identified several distinctive malware samples exhibiting uncommon characteristics and techniques:

C++/CLI IIS Backdoor: A passive backdoor for Internet Information Services (IIS) developed using C++/CLI—a rarely used programming language in malware development. It employs evasive techniques to facilitate unauthorized access.

Dixie-Playing Bootkit: This bootkit leverages an unsecured kernel driver to install a GRUB 2 bootloader in a highly unconventional way, showing a creative approach to persistence and system control.

ProjectGeass Post-Exploitation Framework: A Windows-based implant of a cross-platform post-exploitation framework written in C++. While not groundbreaking in technique, its atypical structure distinguishes it from mainstream frameworks.

These samples demonstrate the evolving nature of malware and the increasing variety of methods attackers are using to bypass defenses.

Further Reading: Unit 42 Blog

ClickFix: A Deceptive Malware Deployment Technique

Cybercriminals are employing a tactic known as "ClickFix," which masquerades as a CAPTCHA verification to trick users into executing commands that download malware. This scheme prompts users to press a series of keyboard shortcuts—Windows + R, Ctrl + V, and Enter—that open the Run dialog, paste malicious code, and execute it via mshta.exe, a legitimate Windows utility. This method has been used to deliver various malware families, including XWorm, Lumma Stealer, and AsyncRAT.

Key Insights:

ClickFix attacks exploit user actions to bypass security measures, leading to the installation of credential-stealing malware.

Industries such as hospitality and healthcare have been targeted, with attackers impersonating trusted entities like Booking.com.

The attack leverages legitimate Windows functionalities (mshta.exe) to execute malicious code, complicating detection efforts.

Further Reading: Krebs on Security

PoisonSeed Phishing Campaign Targets Email and CRM Providers

The PoisonSeed phishing campaign has been identified targeting email and CRM providers, including Mailchimp, Mailgun, and Zoho, to gain unauthorized access to high-value accounts. Attackers create convincing phishing pages that closely resemble legitimate login portals to harvest user credentials. Once access is obtained, they download email lists for use in cryptocurrency-related spam operations. Notably, security expert Troy Hunt fell victim to such an attack, highlighting the sophistication of these phishing attempts.

Key Insights:

PoisonSeed employs highly convincing phishing pages to compromise accounts of email and CRM service providers.

Compromised accounts are used to disseminate cryptocurrency-related spam, potentially leading to further financial fraud.

Even cybersecurity professionals have been deceived by these tactics, underscoring the need for heightened awareness.

Further Reading: CSO Online

98% Increase in Phishing Campaigns Using Russian (.ru) Domains

Recent analyses have revealed a 98% surge in phishing campaigns hosted on Russian (.ru) top-level domains (TLDs) between December 2024 and January 2025. These campaigns primarily aim to harvest user credentials by employing tactics such as QR codes, auto-redirects, and multi-layered attachments to direct victims to phishing websites. Notably, many of these phishing emails have bypassed security products, including Exchange Online Protection and Barracuda Email Security Gateway.

Key Findings:

1,500 unique .ru domains identified in the campaign.

377 new domains registered with the "bulletproof" registrar R01-RU.

Over 13,000 malicious emails reported.

2.2% of observed emails from .ru domains were phishing attempts.

Average age of a .ru domain used in these attacks is 7.4 days.

Industries Targeted:

Business and Economy (36.09%)

Financial Services (12.44%)

News & Media (8.27%)

Health and Medicine (5.6%)

Government (4.51%)

Further Reading: KnowBe4 Blog

Pharmacist Allegedly Used Keyloggers to Spy on Coworkers at Maryland Hospital

A former pharmacist at the University of Maryland Medical Center is accused of secretly installing keylogging software on nearly 400 hospital computers over a decade. The class-action lawsuit claims he accessed coworkers’ login credentials, personal files, and even activated webcams in patient exam rooms. The hospital is also being sued for allegedly failing to detect or respond to the breach in a timely manner.

Key Insights:

Keyloggers were reportedly used to steal credentials and access private communications.

The software was allegedly installed across hundreds of hospital systems without detection.

The incident underscores the importance of monitoring for insider threats and unauthorized software.

Further Reading: The Record

April 2025 - ExploreSec Cybersecurity Awareness Newsletter

April 22, 2025

This is a monthly newsletter I put together for an internal security awareness program. Feel Free to grab and use for your own program.

Macs Targeted by Infostealers in New Era of Cyberthreats

A new wave of cyberattacks is targeting Mac users with infostealers, malicious programs designed to steal sensitive data like passwords and credit card details. Infostealers have traditionally targeted Windows devices, but in recent years, cybercriminals have turned their attention to Macs. One such threat, Poseidon, is the most active infostealer on Mac today, stealing data from over 160 cryptocurrency wallets, web browsers, and password managers. Cybercriminals use malvertising to deliver these threats, making it crucial for Mac users to be cautious when downloading software and visiting unfamiliar websites.

Key Insights:

Poseidon and other infostealers are now targeting Macs, stealing sensitive data such as passwords and cryptocurrency wallet info.

Malicious advertising (malvertising) is being used to trick users into downloading infostealers instead of desired software.

Macs are becoming a key target for cybercriminals, and users must exercise caution and implement strong security measures.

Further Reading: Malwarebytes

Google Now Allows Digital Fingerprinting of Its Users

In a shift from its earlier stance, Google has started allowing digital fingerprinting of its users, a practice that could raise significant privacy concerns. This method collects various pieces of data—such as operating system, browser type, IP address, and plugins—to create a unique identifier for users, even when cookies are cleared. While this allows advertisers to track users across sites, it also bypasses the limitations of cookie-blocking tools.

Key Insights:

Digital fingerprinting creates a unique ID for users based on their browser and device characteristics.

This technique enables tracking even after cookies are cleared, circumventing privacy protections.

Users can take steps to counteract fingerprinting by using privacy-focused browsers, VPNs, and browser extensions.

Further Reading: Malwarebytes Blog

FTC Reports $12.5 Billion in Fraud Losses in 2024

The Federal Trade Commission (FTC) has revealed a staggering increase in fraud-related losses, with reported damages reaching $12.5 billion in 2024. This surge is driven by a combination of online scams, phishing, and identity theft, with a notable increase in fraud targeting older adults and specific industries. As scammers continue to refine their techniques, organizations must remain vigilant and proactive in educating employees and customers on how to recognize and avoid these threats.

Key Insights:

Fraud losses in 2024 hit $12.5 billion, with a significant increase in online scams and identity theft.

Older adults and certain sectors are being disproportionately targeted.

Organizations must enhance education efforts and improve customer protection measures to mitigate the growing threat.

Further Reading: FTC Press Release

DeepSeek Found to Be Sharing User Data with TikTok Parent Company ByteDance

DeepSeek, an AI app, has been caught secretly sharing user data with ByteDance, the parent company of TikTok. The South Korean Personal Information Protection Commission (PIPC) uncovered that DeepSeek automatically transmitted user data every time the app was accessed, doing so without user consent. This data-sharing practice raises serious concerns about privacy, particularly in light of the ongoing scrutiny surrounding ByteDance’s handling of user data. South Korea has removed DeepSeek from app stores and is considering stronger regulations on foreign companies in the country.

Key Insights:

DeepSeek was found transmitting user data to ByteDance servers without user consent.

This app highlights growing concerns about data privacy in AI technologies.

South Korea has taken action by removing the app and considering stronger regulations on foreign tech companies.

Further Reading: Malwarebytes

Beware of DeepSeek Hype: It's a Breeding Ground for Scammers

As DeepSeek, an AI language model from China, gains popularity, cybercriminals are capitalizing on its rise with various scams targeting unsuspecting users. Fake websites, malicious developer tools, phishing on social media, and fraudulent investment schemes are being used to trick individuals into disclosing sensitive data or making financial losses. Scammers are even leveraging DeepSeek's name to promote fake cryptocurrency tokens and fake pre-IPO shares.

Key Insights:

Scammers are using fake websites and social media accounts to impersonate DeepSeek and steal user data.

Malicious Python packages were uploaded to PyPI, disguised as DeepSeek developer tools, to steal sensitive information.

Individuals and businesses must be cautious when downloading tools, verify sources, and implement strong security practices.

Further Reading: SecurityWeek

Predatory App Downloaded 100,000 Times from Google Play Store Steals Data, Uses It for Blackmail

A malicious financial app, "Finance Simplified," has been downloaded over 100,000 times from the Google Play Store. This app, which belongs to the SpyLoan family, promises attractive loan terms but steals sensitive data such as contacts, call logs, and photos. Once the data is collected, the app uses it for blackmail, especially targeting users who fail to make loan payments. Although the app has been removed from the store, it continues to run on affected devices, collecting sensitive data in the background. Users are advised to change passwords, enable two-factor authentication, and monitor their identity for any misuse.

Key Insights:

The app, masquerading as a loan provider, collects personal data for blackmail purposes.

Although removed from the Google Play Store, the app still runs on affected devices.

Users should take immediate steps to secure their data by changing passwords and enabling two-factor authentication.

Further Reading: Malwarebytes

Microsoft 365 Targeted in New Phishing, Account Takeover Attacks

Key Insights:

Phishing attacks are exploiting Microsoft 365’s infrastructure for ATO attacks.

Attackers use fake support contacts and legitimate-looking emails to trick victims.

OAuth applications masquerading as trusted brands are used for stealing credentials and deploying malware.

Further Reading: SecurityWeek

The Epochalypse Project: Addressing the 2038 Bug

The Epochalypse Project is raising awareness about the 2038 bug, a critical vulnerability in 32-bit timestamp systems that will impact billions of devices worldwide starting January 19, 2038. The bug could cause major disruptions across industries, from healthcare to energy management, due to systems misinterpreting dates and malfunctioning. As the 2038 deadline approaches, the project aims to bring attention to this issue and develop solutions before it becomes a widespread problem.

Key Insights:

The bug affects embedded devices and systems like medical equipment, IoT devices, and transportation infrastructure.

If unaddressed, it could cause critical system failures, including banking and security disruptions.

The project encourages global collaboration to identify and fix vulnerable systems before 2038.

Further Reading: Epochalypse Project

Is Firebase Phishing a Threat to Your Organization?

Key Insights:

Firebase is being exploited for phishing attacks, often targeting organizations’ authentication systems.

Users may unknowingly fall victim due to Firebase’s trusted reputation.

Organizations need to be aware of how Firebase can be misused and take proactive measures to secure their systems.

Further Reading: Check Point Blog

Evolution of Sophisticated Phishing Tactics: The QR Code Phenomenon

Unit 42 researchers have observed a surge in phishing attacks leveraging QR codes, a tactic known as "quishing." Attackers embed malicious URLs within QR codes in documents that mimic legitimate services like DocuSign or Adobe Acrobat Sign. When scanned, these QR codes direct users to phishing sites designed to harvest credentials. Notably, some campaigns employ legitimate website redirection mechanisms and Cloudflare Turnstile for user verification, enhancing their credibility and evading security detection. These attacks have been widespread across the U.S. and Europe, impacting industries such as medical, automotive, education, energy, and finance. Unit 42

Key Insights:

Quishing Tactics: Embedding phishing URLs in QR codes increases the likelihood of users accessing malicious sites, especially when personal devices with potentially weaker security are used.

Advanced Evasion Techniques: Utilizing legitimate redirection mechanisms and services like Cloudflare Turnstile allows attackers to bypass traditional security measures. Unit 42

Targeted Industries: A broad range of sectors, including medical, automotive, education, energy, and finance, have been affected, indicating the widespread applicability of this tactic. Unit 42

Further Reading: Unit 42 Blog

Tax-Themed Phishing Campaigns Surge Ahead of U.S. Tax Day

As the April 15 tax deadline nears, Microsoft Threat Intelligence has observed a rise in phishing campaigns exploiting tax-related themes to steal credentials and deploy malware. These attacks use social engineering to impersonate IRS notices or tax document requests and incorporate tactics like QR codes, URL shorteners, and cloud-based file sharing to evade detection. Legitimate services, including Microsoft infrastructure, are being abused to enhance credibility and avoid filters.

Key Insights:

Attackers are using tax season as a lure for phishing, often impersonating tax authorities or financial institutions.

Tactics include QR codes, shortened URLs, and links to legitimate cloud storage to bypass security tools.

Abuse of trusted platforms increases the likelihood of successful compromise.

Further Reading: Microsoft Security Blog

ClickFix: A Deceptive Malware Deployment Technique

Key Insights:

ClickFix attacks exploit user actions to bypass security measures, leading to the installation of credential-stealing malware.

Industries such as hospitality and healthcare have been targeted, with attackers impersonating trusted entities like Booking.com.

The attack leverages legitimate Windows functionalities (mshta.exe) to execute malicious code, complicating detection efforts.

Further Reading: Krebs on Security

Pharmacist Allegedly Used Keyloggers to Spy on Coworkers at Maryland Hospital

Key Insights:

Keyloggers were reportedly used to steal credentials and access private communications.

The software was allegedly installed across hundreds of hospital systems without detection.

The incident underscores the importance of monitoring for insider threats and unauthorized software.

Further Reading: The Record

March 2025 - ExploreSec Cybersecurity Threat Intelligence Newsletter

March 14, 2025

This is a monthly newsletter that I share internally with our Cybersecurity team. Feel free to take and use for your own team. Created with the help of ChatGPT.

Exploring Q4 2024 Brand Phishing Trends: Microsoft Remains the Top Target as LinkedIn Makes a Comeback

In the final quarter of 2024, Microsoft continued to be the most targeted brand in phishing campaigns, but LinkedIn made a significant comeback, appearing as a top target for the first time in years. Phishing actors are increasingly leveraging trusted brands to deceive users, with attacks designed to steal sensitive credentials and install malware. Organizations must continue to strengthen defenses against these brand impersonation attacks to protect their users and data.

Key Insights:

Microsoft remains the primary target in brand phishing campaigns, with attackers frequently using its name to trick users into disclosing credentials.

LinkedIn’s resurgence as a phishing target highlights the shifting tactics of cybercriminals, who are capitalizing on platforms that users trust.

Organizations need to implement strong anti-phishing measures, including employee training and advanced detection tools, to defend against these evolving threats.

Further Reading: Checkpoint Blog

Threat Actors Still Leveraging Legit RMM Tool ScreenConnect for Persistence in Cyberattacks

Cybercriminals are continuing to exploit the legitimate remote monitoring and management (RMM) tool, ScreenConnect, to maintain persistence in cyberattacks. Threat actors are using social engineering to lure victims into installing altered versions of ScreenConnect, which gives them control over victims’ systems. This tool is particularly used to target sensitive data, with specific campaigns focused on Social Security recipients. The attacks are facilitated through bulletproof hosting providers, making it challenging to trace and mitigate these threats.

Key Insights:

ScreenConnect is being used by threat actors to gain persistent access to victims’ systems.

Malicious versions of the software are being disguised as legitimate files, such as eStatements from the Social Security Administration.

Social engineering tactics are employed to trick users into installing compromised software.

Bulletproof hosting providers are being used to shelter malicious activities, making them harder to disrupt.

Further Reading: Silent Push

Hackers Spoof Microsoft ADFS Login Pages to Steal Credentials

Hackers are spoofing Microsoft Active Directory Federation Services (ADFS) login pages to steal user credentials. This attack leverages the trust users have in Microsoft’s secure login page by creating fake versions that closely resemble the original. Once victims enter their credentials, the attackers steal the information for malicious purposes. This highlights the importance of verifying login pages and using multi-factor authentication to protect against such credential theft.

Key Insights:

Hackers are creating fake versions of Microsoft ADFS login pages to capture user credentials.

These attacks rely on users trusting the Microsoft login page, making them difficult to detect.

Multi-factor authentication (MFA) and vigilant scrutiny of login pages can help prevent successful credential theft.

Further Reading: BleepingComputer

Racing the Clock: Outpacing Accelerating Attacks

In 2024, cyberattack speeds surged, with the average breakout time dropping to just 48 minutes, a 22% reduction from the previous year. Key factors behind this acceleration include more efficient Ransomware-as-a-Service (RaaS) operations, a rise in infostealers, and the use of AI-powered penetration testing tools. As attacks become faster, organizations must enhance their security measures to match the pace of threat actors, leveraging automation and AI to reduce response times and contain attacks before they spread.

Key Insights:

Breakout time—the time from initial access to lateral movement—has decreased to 48 minutes, making it crucial to respond quickly.

Infostealers and IABs (Initial Access Brokers) are driving faster breaches by providing quick access to compromised systems.

Automation and AI-driven tools are essential for organizations to respond to attacks more efficiently and minimize damage.

Further Reading: ReliaQuest

VidSpam: A New Threat Emerges as Bitcoin Scams Evolve from Images to Video

Bitcoin scams targeting mobile users are evolving with attackers now using video-based spam (VidSpam) to deceive victims. These scammers are sending small video file attachments to lure individuals into fraudulent schemes. The videos often direct recipients to high-pressure WhatsApp groups where personal information or money is extracted. This evolution from image-based scams to video content marks a troubling trend in mobile security.

Key Insights:

Attackers are using small video files (e.g., 14KB .3gp files) to promote Bitcoin scams through multimedia messages.

The video attachments encourage victims to join WhatsApp groups where scammers use pressure tactics to steal money or data.

As scammers refine their tactics, VidSpam is expected to increase, targeting unsuspecting mobile users.

Further Reading: Proofpoint

January 2025’s Most Wanted Malware: FakeUpdates Continues to Dominate

FakeUpdates malware remains the top threat in January 2025, continuing its dominance in the malware landscape. This malware is primarily distributed through fake software updates that users are tricked into downloading. Once installed, it can enable attackers to take control of the system and steal sensitive information. The persistence of FakeUpdates emphasizes the need for cautious behavior when downloading updates and a heightened focus on secure software practices.

Key Insights:

FakeUpdates continues to lead as one of the most used malware types, delivered through fake update prompts.

This malware is often disguised as legitimate updates, compromising systems and exfiltrating data.

Users should avoid downloading updates from unverified sources and ensure they only install software from trusted vendors.

Further Reading: Checkpoint Blog

Using Genuine Business Domains and Legitimate Services to Harvest Credentials

Cybercriminals are increasingly using legitimate business domains and services to conduct credential harvesting attacks. By spoofing well-known companies and mimicking their email communications, attackers deceive users into providing their login information. These tactics often involve using business-looking email addresses and phishing links that lead to fake login pages. This trend underscores the need for businesses and consumers to be cautious when interacting with unsolicited messages.

Key Insights:

Phishing attacks are increasingly using trusted business domains and services to trick users into disclosing credentials.

Attackers mimic legitimate emails to create fake login pages that steal sensitive information.

Users should be cautious of unsolicited messages and verify the authenticity of any login requests by visiting official websites directly.

Further Reading: KnowBe4 Blog

Protect Your Data: Russian Spear-Phishing Targets Microsoft 365 Accounts

A new spear-phishing campaign linked to Russian threat actors is targeting Microsoft 365 users. The attackers use highly customized phishing emails that appear legitimate, aiming to steal login credentials and gain unauthorized access to sensitive information. With Microsoft 365 being a prime target, organizations should enhance their security by training users to recognize phishing attempts and implementing advanced security measures, including multi-factor authentication.

Key Insights:

Russian threat actors are targeting Microsoft 365 accounts using personalized spear-phishing emails.

These attacks aim to steal credentials, putting sensitive data at risk.

Organizations should deploy multi-factor authentication and conduct regular security awareness training to protect against these threats.

Further Reading: KnowBe4 Blog

New Xerox Printer Flaws Could Let Attackers Capture Windows Active Directory Credentials

Critical vulnerabilities have been found in Xerox VersaLink printers, allowing attackers to potentially capture Windows Active Directory credentials via pass-back attacks. These flaws, affecting firmware versions 57.69.91 and earlier, enable attackers to manipulate printer configurations and redirect authentication credentials. Successful exploitation could allow lateral movement within an organization's network, compromising servers and file systems. Immediate patching and enhanced security measures, such as strong admin passwords and disabling remote access, are advised.

Key Insights:

Xerox VersaLink printers are vulnerable to attacks that can capture Windows Active Directory credentials.

Exploiting these vulnerabilities requires physical or remote access to the printer's control interface.

Organizations should patch printers immediately, enforce strong passwords, and limit access to vulnerable settings.

Further Reading: The Hacker News

ClickFix vs. Traditional Download in New DarkGate Campaign

A new malvertising campaign has been observed using two different methods to deliver the DarkGate malware: the ClickFix technique and traditional file downloads. The ClickFix method involves a fake CAPTCHA-like page that tricks users into executing a malicious command, while the traditional approach uses a fake software download disguised as a legitimate app. Both methods ultimately deliver the DarkGate malware, highlighting the adaptability of threat actors in refining delivery techniques.

Key Insights:

The ClickFix method tricks users into running malicious code by mimicking a CAPTCHA process.

The traditional download method uses fake installers to distribute malware.

Both methods successfully deliver DarkGate, with the ClickFix technique possibly yielding higher success rates.

Further Reading: Malwarebytes

Russian Phishing Campaigns Exploit Signal's Device-Linking Feature

Russian phishing campaigns are exploiting the device-linking feature of the Signal messaging app to compromise user accounts. Attackers use malicious QR codes to trick targets into linking their Signal account to an attacker-controlled device, allowing them to monitor private conversations without fully compromising the target's device. This method has been observed in both large-scale campaigns and targeted attacks, especially against military personnel and high-value targets.

Key Insights:

Attackers use malicious QR codes to link Signal accounts to their devices, enabling undetected access to encrypted communications.

These phishing techniques often involve impersonating legitimate resources, such as group invitations or app instructions.

Signal users are advised to update the app, check linked devices regularly, and enable two-factor authentication for added protection.

Further Reading: BleepingComputer

Phishing Attack Hides JavaScript Using Invisible Unicode Trick

A new phishing attack technique is using invisible Unicode characters to hide malicious JavaScript. This approach involves obfuscating binary values within JavaScript payloads by replacing them with invisible Hangul characters, making the script appear empty. When executed, a proxy retrieves and reconstructs the original code. The attack is particularly difficult to detect, as it uses anti-debugging techniques and avoids triggering security scanners by exploiting whitespace. The campaign targets affiliates of a political action committee, employing highly personalized tactics.

Key Insights:

The phishing attack uses invisible Unicode characters to obfuscate JavaScript payloads, making detection more challenging.

Anti-debugging techniques are employed to avoid analysis and redirect attackers if they detect delays in execution.

The attack is highly personalized and can evade security scanners by using empty spaces and encoding methods.

Further Reading: BleepingComputer

New Facebook Copyright Infringement Phishing Campaign

A new phishing campaign has been detected targeting Facebook users with fake copyright infringement notices. The attackers use deceptive emails that appear to come from Facebook, claiming that users have violated copyright laws. The emails contain links to fake Facebook pages that prompt users to enter personal information, including passwords. This campaign highlights the ongoing threat of phishing attacks that impersonate trusted platforms like Facebook.

Key Insights:

The phishing emails mimic Facebook's notifications about copyright violations to trick users into sharing sensitive data.

Victims are directed to fake pages designed to capture their credentials.

Users should be cautious about unsolicited emails and verify the authenticity of any official communications by visiting Facebook directly.

Further Reading: Check Point Blog

University Site Cloned to Evade Ad Detection, Distributes Fake Cisco Installer

A recent malicious campaign involved cloning a German university website to evade ad detection, distributing a fake Cisco AnyConnect installer. The attackers leveraged a Google ad to direct users to a fraudulent site designed to mimic a legitimate university page, with the goal of deploying the NetSupport RAT. The malware, disguised as a Cisco update, was signed with a valid certificate and allowed attackers to remotely access infected systems.

Key Insights:

Attackers cloned a university website to evade detection, delivering a fake Cisco installer via a Google ad.

The malware, NetSupport RAT, was hidden in a digitally signed installer and granted remote access to attackers.

Users should exercise caution when downloading software, especially from sponsored ads, and verify the authenticity of the source.

Further Reading: Malwarebytes

How Hunting for Vulnerable Drivers Unraveled a Widespread Attack

An investigation into vulnerable drivers revealed a widespread attack exploiting these weaknesses to gain unauthorized access. Attackers used outdated or unpatched drivers to deploy malware and maintain persistence within compromised systems, bypassing traditional security measures. This emphasizes the need for regular updates and comprehensive vulnerability management to safeguard against such threats.

Key Insights:

Attackers exploited outdated drivers to gain system access and deploy malware.

The attack allowed persistent control over systems, evading detection.

Regular driver updates and vulnerability assessments are crucial for preventing similar attacks.

Further Reading: Check Point Blog

2024 Account Takeover Statistics

Proofpoint’s latest research highlights the alarming prevalence of account takeover (ATO) attacks, which are now among the most common cyberattack types. These attacks involve threat actors gaining control of legitimate user accounts to execute malicious activities, including data breaches and fraud. The findings underscore the importance of strong authentication and continuous monitoring to prevent unauthorized access and protect sensitive data.

Key Insights:

ATO attacks remain a leading threat, with significant consequences for organizations and users.

Gaining access to legitimate accounts allows attackers to bypass security measures and execute more damaging attacks.

Organizations should prioritize multi-factor authentication and robust monitoring to mitigate ATO risks.

Further Reading: Proofpoint

DeepSeek Lure Used to Spread Malware

A new DeepSeek campaign uses CAPTCHA-like pages to distribute malware. Attackers use fake CAPTCHA challenges to lure users into executing malicious code, evading detection by appearing harmless. The campaign primarily targets users who are tricked into downloading and running the malware. This attack illustrates how cybercriminals are exploiting popular web features to deliver malicious payloads.

Key Insights:

The malware is delivered through fake CAPTCHA-like pages, making it seem legitimate.

Attackers use this method to bypass security filters and trick users into downloading harmful software.

Regular security updates and cautious behavior when interacting with unfamiliar websites can help mitigate such threats.

Further Reading: Zscaler Blog

Botnet Targets Basic Auth in Microsoft 365 Password Spray Attacks

A large botnet, consisting of over 130,000 compromised devices, is conducting password-spray attacks against Microsoft 365 accounts. The attackers are using Basic Authentication to evade Multi-Factor Authentication (MFA) protections, exploiting plaintext credentials to access accounts without triggering alerts. This method targets accounts with weak or leaked passwords and bypasses security measures that typically protect interactive sign-ins. Organizations are urged to disable Basic Auth, enforce MFA, and implement Conditional Access Policies (CAP) to protect against these attacks.

Key Insights:

The botnet targets Basic Authentication to bypass MFA and gain unauthorized access.

Attackers use stolen credentials to conduct widespread password-spray attacks on Microsoft 365 accounts.

Disabling Basic Auth and enabling MFA are critical defenses against this type of attack.

Further Reading: BleepingComputer

New Undetectable Batch Script Uses PowerShell and Visual Basic to Install XWorm

A new undetectable malware campaign uses a highly obfuscated Batch script to deliver the XWorm RAT or AsyncRAT. The script employs PowerShell and Visual Basic Script (VBS) to bypass security tools and download the malware. Once executed, the script establishes persistence and exfiltrates data via Telegram’s API. This campaign marks a significant evolution in fileless attacks, leveraging AI-generated code and cloud-based C2 to evade detection.

Key Insights:

The malware uses a Batch script, PowerShell, and VBS to download XWorm or AsyncRAT.

Obfuscation and environmental checks make the attack difficult to detect by security tools.

Telegram’s API is used to exfiltrate system data, blending malicious traffic with legitimate communications.

AI tools may have assisted in generating the code, increasing sophistication and evasion tactics.

Further Reading: GBHackers

Chinese Hackers Target Hospitals by Spoofing Medical Software

A new phishing campaign has been discovered where Chinese hackers are targeting hospitals by spoofing medical software, including fake updates for health-related applications. The hackers use these fake updates to deliver malware, gaining access to sensitive healthcare data. Hospitals and healthcare organizations are urged to be cautious of unsolicited software updates and to ensure they are obtaining updates from official sources.

Key Insights:

Attackers are spoofing medical software updates to distribute malware in healthcare organizations.

The campaign targets sensitive healthcare data, with phishing emails disguised as software updates.

Healthcare organizations should verify software updates and ensure they come from trusted sources.

Further Reading: KnowBe4 Blog

GreyNoise 2025 Mass Internet Exploitation Report: Attackers Are Moving Faster Than Ever — Are You Ready?

The 2025 Mass Internet Exploitation Report reveals a dramatic increase in the speed and scale of cyberattacks, with attackers exploiting vulnerabilities faster than security teams can respond. In 2024, automated exploitation of known vulnerabilities was rampant, with legacy flaws from as far back as the 1990s being targeted alongside new threats. The most commonly exploited vulnerabilities were in home routers and IoT devices, which are often overlooked in traditional security strategies. To stay ahead of this rapidly evolving threat, executives must prioritize real-time intelligence and adapt patching and defense strategies to address both old and new vulnerabilities.

Key Insights:

Attackers are automating vulnerability exploitation, surpassing traditional patching strategies.

Legacy vulnerabilities are still prime targets, with some dating back decades.

Ransomware groups are using mass exploitation to gain access, making real-time threat intelligence a necessity for effective defense.

Further Reading: GreyNoise

Threat Spotlight: Inside the World’s Fastest Rising Ransomware Operator — BlackLock

BlackLock, a rapidly rising ransomware-as-a-service (RaaS) operator, has gained prominence for its custom malware and unique data-leak tactics. By Q4 2024, it had become the seventh most active ransomware group, using double extortion to encrypt data and steal sensitive information. BlackLock’s sophisticated leak site and the rapid expansion of its affiliate network via the Russian-language RAMP forum highlight its threat to organizations globally. Executives should prioritize enhancing defense strategies against evolving ransomware threats, including securing third-party access and increasing employee awareness about spear-phishing tactics.

Key Insights:

Custom malware and bespoke ransomware distinguish BlackLock from competitors, making it harder for security tools to detect and defend against.

The data-leak site uses unique tricks to pressure victims into paying ransoms before assessing the full scope of the breach.

BlackLock’s growing influence on the RAMP forum indicates a well-established network that supports its global ransomware activities.

Further Reading: ReliaQuest

Black Basta and Cactus Ransomware Groups Add BackConnect Malware to Their Arsenal

Black Basta and Cactus ransomware groups have expanded their attack methods by incorporating BackConnect malware. This malware creates an outbound connection, which enables attackers to remotely control compromised systems, bypassing security measures designed to block inbound attacks. By integrating BackConnect into their operations, these groups can maintain access to systems even after initial detection, facilitating long-term exploitation. Organizations must strengthen defenses to detect and block this new tactic and limit the potential damage.

Key Insights:

BackConnect malware allows attackers to maintain persistent access through outbound connections.

This technique enables ransomware groups to bypass detection and continue exploiting compromised systems.

Organizations should improve detection capabilities to identify and block BackConnect traffic.

Further Reading: Trend Micro

Scammers Mailing Ransom Letters While Posing as BianLian Ransomware

A new scam has emerged where fraudsters are mailing fake ransom letters to businesses, posing as the notorious BianLian ransomware group. The letters, claiming to be from BianLian, demand large Bitcoin ransoms, threatening to release sensitive data if payment is not made within 10 days. However, cybersecurity experts quickly identified multiple red flags: inconsistencies in the language, uncharacteristic delivery via physical mail, and no evidence of data breaches. This scheme aims to exploit the fear and reputation of a known ransomware group for financial gain.

Key Insights:

Scammers are impersonating BianLian ransomware to demand Bitcoin payments via physical mail.

The letters use fear tactics, mimicking legitimate ransomware practices, but with numerous inconsistencies.

Organizations should educate employees on recognizing such scams and ensure cybersecurity defenses are up to date.

Further Reading: HackRead

March 2025 - ExploreSec Cybersecurity Awareness newsletter

March 13, 2025

This is a security awareness focused newsletter that I share internally. Feel free to grab and use for your own internal security awareness program. Created with help from ChatGPT.

Personal Information Compromised in Grubhub Data Breach

A recent data breach at Grubhub has compromised personal information of millions of users. The breach exposed sensitive details such as names, email addresses, and passwords, leading to potential risks of identity theft and fraud. Customers are urged to change their passwords and monitor their accounts for any unusual activity. This incident highlights the importance of securing user data and staying vigilant after a breach.

Key Insights:

Grubhub's recent data breach exposed sensitive personal information, including names and email addresses.

Customers should change passwords and monitor accounts for suspicious activity to protect against identity theft.

This breach underscores the need for stronger data protection measures and proactive security practices in handling consumer information.

Further Reading: SecurityWeek

Beware of Lazarus LinkedIn Recruiting Scam

A new LinkedIn recruiting scam linked to the Lazarus Group is targeting professionals with fake job offers. The scam lures victims into sharing personal information or downloading malicious files, ultimately leading to data theft or malware infections. As the threat actor behind this campaign is known for cyber espionage and financial theft, users must remain cautious when interacting with unsolicited job offers on LinkedIn.

Key Insights:

The Lazarus Group is behind a LinkedIn recruiting scam aimed at stealing personal information and spreading malware.

The scam involves fake job offers that seem legitimate, tricking victims into revealing sensitive details.

Users should verify job offers before engaging and avoid downloading files or clicking links from unknown sources.

Further Reading: GBHackers

Love Gone Phishy: Check Point Research Exposes Valentine’s Day Cyber Threats

Check Point Research has uncovered a rise in phishing campaigns during the Valentine's season, targeting users with fake promotions, gifts, and love-related messages. These attacks are exploiting the festive period to lure victims into clicking malicious links or sharing sensitive information. This underscores the importance of maintaining cybersecurity practices during high-traffic times like holidays.

Key Insights:

Phishing campaigns around Valentine's Day are using romantic themes to deceive users into revealing personal information.

These threats often involve fake websites or links promising deals and gifts, leading to credential theft or malware infection.

Consumers should be cautious when clicking on unsolicited links, especially during holiday seasons, and verify offers from trusted sources.

Further Reading: Check Point Blog

Fake Etsy Invoice Scam Tricks Sellers into Sharing Credit Card Information

A new scam targeting Etsy sellers involves fake invoices that appear to come from Etsy's support team. These fraudulent invoices contain links that lead to a phishing page, designed to steal credit card information. Sellers are urged to carefully examine the sender’s email address and to avoid clicking links in suspicious emails. Etsy never requires credit card information for verification purposes, and any such request should be treated as a red flag.

Key Insights:

The scam begins with a fake invoice sent via email, often with a PDF attachment that appears legitimate.

Fraudulent websites closely mimic Etsy’s design but ask for sensitive data, including credit card information.

Sellers should avoid clicking on email links and should visit Etsy’s official site directly to verify any account requests.

Further Reading: Malwarebytes

Using Genuine Business Domains and Legitimate Services to Harvest Credentials

Key Insights:

Phishing attacks are increasingly using trusted business domains and services to trick users into disclosing credentials.

Attackers mimic legitimate emails to create fake login pages that steal sensitive information.

Users should be cautious of unsolicited messages and verify the authenticity of any login requests by visiting official websites directly.

Further Reading: KnowBe4 Blog

Phishing for Love: A Sharp Surge in Valentine’s Day-Themed Scams

As Valentine's Day approaches, scammers are leveraging love-themed phishing attacks to deceive users into clicking malicious links or revealing personal information. These scams often appear as romantic gift offers, fake delivery notices, or enticing deals, tricking individuals into providing sensitive data or making fraudulent payments. This surge in phishing tactics highlights the need for extra caution during the holiday season.

Key Insights:

Valentine’s Day scams are using themed messages to entice victims into sharing personal information or clicking on malicious links.

These scams often come in the form of fake gift offers, e-cards, and package delivery notifications.

Users should avoid clicking on unsolicited links and verify offers before engaging with any communications.

Further Reading: KnowBe4 Blog

Tips for Detecting Real-time Deepfakes: A Guide to Staying One Step Ahead

As deepfake technology becomes more sophisticated, it’s increasingly important to know how to identify fake videos and images in real-time. These manipulated media files are often used for scams, misinformation, or even social engineering attacks. The blog offers practical tips for detecting deepfakes, such as examining inconsistencies in video and audio quality, checking metadata, and verifying the source of the content. With deepfakes becoming more prevalent, staying informed about these techniques can help protect against digital manipulation.

Key Insights:

Real-time detection of deepfakes is critical as they are being used in a variety of attacks.

Signs to look for include mismatched lighting, unnatural facial movements, and inconsistencies in audio.

Verifying sources and cross-checking information are essential steps in detecting fake content.

Further Reading: KnowBe4 Blog

Protect Your Data: Russian Spear-Phishing Targets Microsoft 365 Accounts

Key Insights:

Russian threat actors are targeting Microsoft 365 accounts using personalized spear-phishing emails.

These attacks aim to steal credentials, putting sensitive data at risk.

Organizations should deploy multi-factor authentication and conduct regular security awareness training to protect against these threats.

Further Reading: KnowBe4 Blog

New Facebook Copyright Infringement Phishing Campaign

Key Insights:

The phishing emails mimic Facebook's notifications about copyright violations to trick users into sharing sensitive data.

Victims are directed to fake pages designed to capture their credentials.

Users should be cautious about unsolicited emails and verify the authenticity of any official communications by visiting Facebook directly.

Further Reading: Check Point Blog

Phishing Kit Abuses Open Graph to Target Social Media Users

A new phishing kit takes advantage of the Open Graph protocol, which is commonly used to display rich media on social media platforms, to deceive users. The kit allows attackers to embed phishing links into seemingly harmless social media posts, making it more difficult for users to identify fraudulent content. By manipulating Open Graph data, the scam appears legitimate, drawing users into phishing sites that steal personal information.

Key Insights:

The phishing kit abuses Open Graph to embed malicious links in social media posts, creating fake but convincing content.

This tactic makes it harder for users to detect phishing attempts on social media.

Users should be cautious about clicking links in social media posts, especially if they appear unfamiliar or too good to be true.

Further Reading: KnowBe4 Blog

Phishing Campaign Disguises as ChatGPT Subscription

A new phishing campaign is using ChatGPT subscriptions as a cover to steal user credentials. The attackers send emails offering a fake ChatGPT subscription, prompting users to enter their personal and payment information. This method exploits the popularity of ChatGPT and preys on users' trust. Security measures, such as verifying subscription details and avoiding unsolicited emails, can help prevent falling victim to this scam.

Key Insights:

Attackers are using fake ChatGPT subscription offers to steal personal and financial information.

The phishing emails mimic legitimate communications, making them harder to detect.

Users should verify subscription offers directly on trusted platforms and avoid clicking on links in unsolicited emails.

Further Reading: Broadcom

DeepSeek Lure Used to Spread Malware

Key Insights:

The malware is delivered through fake CAPTCHA-like pages, making it seem legitimate.

Attackers use this method to bypass security filters and trick users into downloading harmful software.

Regular security updates and cautious behavior when interacting with unfamiliar websites can help mitigate such threats.

Further Reading: Zscaler Blog

Chinese Hackers Target Hospitals by Spoofing Medical Software

Key Insights:

Attackers are spoofing medical software updates to distribute malware in healthcare organizations.

The campaign targets sensitive healthcare data, with phishing emails disguised as software updates.

Healthcare organizations should verify software updates and ensure they come from trusted sources.

Further Reading: KnowBe4 Blog

Scanning for Trouble: Behind the Scenes of Our QR Code Phishing Demo

The KnowBe4 team explores the mechanics of QR code phishing in their latest demo, showcasing how attackers are using QR codes to direct victims to phishing sites. The demo reveals the ease with which malicious actors can create seemingly harmless QR codes that lead to fraudulent sites, designed to steal personal information. By understanding the techniques used in these phishing campaigns, organizations can better educate employees and defend against such attacks.

Key Insights:

QR code phishing is becoming more common, with attackers using them to bypass traditional email filtering techniques.

Malicious QR codes often lead victims to fake login pages where sensitive data is harvested.

Organizations should educate employees on the risks of scanning unsolicited QR codes and implement strong security measures.

Further Reading: KnowBe4 Blog

How Phished Data Turns into Apple & Google Wallets

Phishing campaigns are evolving, with cybercriminals now using phished data to load stolen payment card information directly into Apple and Google Wallets. These scams often involve SMS messages impersonating services like the USPS or toll operators, tricking users into entering payment details. Once victims provide their information and verification codes, their data is linked to mobile wallets controlled by attackers. This advancement in carding techniques highlights the growing risks of mobile payment systems and the need for heightened security measures.

Key Insights:

Cybercriminals use phishing to steal payment information, converting it into mobile wallets for fraud.

These phishing schemes often involve spoofed messages and real-time interaction with human operators.

Attackers can use "ghost tap" technology to make fraudulent purchases from a distance using NFC technology.

Further Reading: Krebs on Security

February 2025 - ExploreSec Cybersecurity Threat Intelligence Newsletter

January 31, 2025

This is a monthly newsletter that I share internally with our Cybersecurity team. Feel free to take and use for your own team. Created with the help of ChatGPT.

ModeLeak Vulnerabilities in Google's Vertex AI Platform

Palo Alto Networks' Unit 42 team has uncovered two critical vulnerabilities, collectively termed "ModeLeak," within Google's Vertex AI platform. These flaws could enable attackers to escalate privileges and exfiltrate sensitive machine learning (ML) models, including fine-tuned large language model (LLM) adapters.

Key Insights:

Privilege Escalation via Custom Jobs: Attackers can exploit custom job permissions to gain unauthorized access to data services within a project, leading to potential exposure of sensitive information.

Model Exfiltration through Malicious Models: By deploying a poisoned model, adversaries can exfiltrate other fine-tuned models in the environment, risking proprietary data and custom optimizations.

Google has addressed these vulnerabilities by implementing fixes in the Vertex AI platform. Organizations utilizing Vertex AI should review their security protocols to ensure protection against similar threats.

Further Reading: Unit 42 Blog

Black Basta Ransomware Adopts Advanced Social Engineering Tactics

The Black Basta ransomware group has recently enhanced its attack strategies by incorporating sophisticated social engineering techniques, including email bombing, QR code phishing, and the deployment of custom malware payloads.

Key Developments:

Email Bombing: Attackers inundate targets with excessive emails by subscribing their addresses to numerous mailing lists. This tactic overwhelms victims and increases the likelihood of interaction with subsequent malicious communications.

Impersonation via Microsoft Teams: Threat actors pose as IT support personnel, contacting victims through Microsoft Teams to establish trust and facilitate the installation of remote access tools.

QR Code Phishing: Malicious QR codes are sent to victims, directing them to phishing sites designed to harvest credentials or deploy additional malware.

Custom Malware Deployment: The group utilizes bespoke tools such as KNOTWRAP (a memory-only dropper) and KNOTROCK (a .NET-based utility) to execute ransomware payloads stealthily.

Further Reading: The Hacker News

North Korean IT Workers Infiltrating Global Companies

Recent investigations have uncovered that operatives from the Democratic People's Republic of Korea (DPRK) are securing remote IT positions in international companies under false identities. These individuals channel their earnings to fund North Korea's weapons programs, posing significant security and compliance risks to employers.

Key Insights:

Use of False Identities: North Korean IT workers often utilize stolen or fabricated identities to obtain employment, making detection challenging.

Revenue Generation for DPRK: Earnings from these positions are funneled back to North Korea, supporting its sanctioned weapons development initiatives.

Potential for Insider Threats: Beyond financial implications, these operatives may have access to sensitive company data, increasing the risk of intellectual property theft and cyber espionage.

Further Reading: Unit 42 Blog

North Korean IT Workers Linked to Phishing Attacks via Malicious Video Conferencing Apps

Unit 42 researchers have identified a cluster of North Korean IT operatives, designated as CL-STA-0237, involved in phishing attacks that deploy malware through counterfeit video conferencing applications. Operating primarily from Laos, these individuals have secured positions in various companies, leveraging their roles to further malicious activities.

Key Insights:

Malware Distribution: The group utilizes fraudulent video conferencing platforms to disseminate malware, notably the BeaverTail and InvisibleFerret remote access trojans, compromising systems during supposed job interview processes.

Global Reach: By infiltrating organizations worldwide, these operatives support North Korea's illicit endeavors, including its weapons of mass destruction and ballistic missile programs.

Evolving Tactics: The shift from merely seeking income to engaging in aggressive malware campaigns indicates a significant escalation in their operational strategies.

Further Reading: Unit 42 Blog

Surge in 'ClickFix' Social Engineering Attacks

Cybersecurity researchers have identified a significant increase in the use of a social engineering tactic known as "ClickFix." This method deceives users into copying and pasting malicious commands into their systems, leading to malware infections.

Key Developments:

Deceptive Error Messages: Attackers present fake error dialogs, prompting users to execute provided commands to resolve non-existent issues.

Malware Delivery: By following these instructions, users inadvertently run scripts that download and install malware such as Lumma Stealer and AsyncRAT.

Global Impact: Campaigns employing ClickFix techniques have targeted organizations worldwide, with notable incidents involving fake GitHub security notifications and counterfeit software updates.

Further Reading: Proofpoint Blog

Malicious Ads Deliver SocGholish Malware to Kaiser Permanente Employees

A recent cyberattack has targeted Kaiser Permanente employees through malicious advertisements on Google Search, leading to the distribution of SocGholish malware.

Key Developments:

Malicious Advertisements: Threat actors placed deceptive ads mimicking Kaiser Permanente's HR portal to lure employees searching for benefits and payroll information.

Compromised Website Redirects: Clicking the fraudulent ad redirected users to a compromised website, bellonasoftware[.]com, which briefly displayed a phishing page before prompting a fake browser update.

SocGholish Malware Deployment: The fake browser update led to the download of "Update.js," a malicious script associated with the SocGholish malware campaign, designed to collect system information and potentially allow human operators to execute further malicious actions.

This incident highlights the evolving tactics of cybercriminals in exploiting trusted platforms like Google Ads to distribute malware.

Further Reading: Malwarebytes Blog

DarkGate Malware Leveraging Vishing via Microsoft Teams

Recent analyses have identified a concerning trend in which cybercriminals are deploying DarkGate malware through vishing (voice phishing) attacks conducted via Microsoft Teams.

Key Developments:

Social Engineering Tactics: Attackers impersonate employees from known client organizations during Microsoft Teams calls, convincing victims to download remote desktop applications like AnyDesk.

Malware Deployment: Once remote access is established, DarkGate malware is installed, enabling threat actors to execute malicious commands, gather system information, and maintain persistent access.

Operational Impact: Although some attacks have been thwarted before data exfiltration, the initial breach underscores vulnerabilities in user awareness and the potential for significant security incidents.

Further Reading: Trend Micro Research

Sophisticated Phishing Campaigns Exploit Trusted Platforms

Recent analyses have uncovered advanced phishing campaigns targeting employees across multiple industries and jurisdictions. These operations employ sophisticated techniques to bypass Secure Email Gateways (SEGs) and exploit trusted platforms, creating highly convincing schemes to deceive victims and steal their credentials.

Key Developments:

Exploitation of Trusted Platforms: Attackers leverage familiar platforms and services to enhance the credibility of their phishing attempts, making it more challenging for victims to identify fraudulent communications.

Bypassing Secure Email Gateways (SEGs): The campaigns utilize advanced methods to evade detection by SEGs, allowing malicious emails to reach employees' inboxes undetected.

Wide-Ranging Targets: Over 30 companies across 12 industries and 15 jurisdictions have been affected, indicating a broad and indiscriminate approach by the threat actors.

Further Reading: Group-IB Blog

Top Cyber Attacker Techniques (August–October 2024)

Recent analyses have identified key cyber attacker tactics, techniques, and procedures (TTPs) observed between August 1 and October 31, 2024.

Key Developments:

Phishing Incidents: Phishing accounted for 46% of all customer incidents during this period, indicating a significant rise likely due to high employee turnover and the accessibility of phishing kits.

Prevalent Malware: "SocGholish" and "LummaC2" emerged as the most frequently observed malware in customer environments, highlighting their widespread use in recent attacks.

Cloud Services Alerts: There was a 20% increase in cloud services alerts, correlating with the rising adoption of cloud accounts and associated security challenges.

Ransomware Activity: Despite a slowdown in "LockBit" ransomware activity due to law enforcement actions and a loss of affiliate trust, it remains a key player. Meanwhile, "RansomHub" is rising rapidly due to its attractive ransomware-as-a-service (RaaS) model. The U.S., manufacturing sector, and professional, scientific, and technical services (PSTS) sector are primary targets amidst an overall increase in ransomware attacks.

Initial Access Broker (IAB) Activity: IAB activity increased by 16%, heavily targeting U.S.-based organizations, possibly due to perceived financial capabilities stemming from cyber insurance.

Insider Threat Content: A 7% rise in insider threat discussions on cybercrime forums was noted, driven by significant financial incentives, underscoring the growing complexity of cybersecurity challenges.

Impersonating Domain Alerts: There was a 6% increase in alerts related to impersonating domains, indicating ongoing reliance on simple techniques to capture credentials and data.

Further Reading: ReliaQuest Blog

Phishing Attacks Double in 2024

Recent analyses reveal a significant surge in phishing activities throughout 2024, with overall phishing messages increasing by 202% in the latter half of the year. Notably, credential phishing attacks have escalated by 703% during the same period.

Key Developments:

Prevalence of Zero-Day URLs: Approximately 80% of malicious links identified are zero-day threats—newly created URLs designed to evade traditional detection methods.

Diversification of Attack Vectors: While link-based phishing remains predominant, there is a notable increase in text-based threats, such as business email compromise (BEC) and invoice scams, as well as file-based threats employing techniques like HTML smuggling.

Expansion Beyond Email: Phishing attacks are increasingly targeting multiple platforms, including SMS, LinkedIn, and Microsoft Teams, indicating a shift towards multichannel approaches.

Further Reading: Infosecurity Magazine

Surge in Phishing Attacks via New Top-Level Domains

Recent analyses reveal a significant increase in phishing attacks, with a 40% rise observed in the year ending August 2024. A substantial portion of this growth is attributed to the exploitation of new generic top-level domains (gTLDs) such as .shop, .top, and .xyz, which are favored by cybercriminals due to their low registration costs and minimal verification requirements.

Key Developments:

Disproportionate Use in Cybercrime: Although new gTLDs constitute only 11% of the market for new domains, they account for approximately 37% of reported cybercrime domains between September 2023 and August 2024.

Attraction to Low-Cost Registrations: Registrars offering domain registrations for less than $1, with little to no identity verification, are particularly appealing to spammers and scammers seeking to conduct malicious activities anonymously.

ICANN's Expansion Plans: Despite the misuse of these new gTLDs, the Internet Corporation for Assigned Names and Numbers (ICANN) is proceeding with plans to introduce additional gTLDs, potentially broadening the landscape for cybercriminal activities.

Further Reading: Krebs on Security

Surge in Suspicious Domain Registrations Exploiting High-Profile Events

Recent analyses have identified a significant increase in suspicious domain registration campaigns exploiting high-profile events, such as the 2024 Summer Olympics in Paris.

Key Developments:

Event-Driven Domain Registrations: Threat actors register deceptive domains containing event-specific keywords to mimic official websites, aiming to deceive users seeking legitimate information.

Exploitation of Public Interest: Cybercriminals leverage global events to attract large audiences, using fraudulent domains to distribute malware, conduct phishing attacks, or sell counterfeit merchandise.

Indicators of Malicious Activity: Monitoring domain registrations, DNS traffic, URL patterns, and textual characteristics can help identify and mitigate these threats.

Further Reading: Unit 42 Blog

Zloader Malware Adopts DNS Tunneling for Stealthier C2 Communications

Recent analyses have identified that the Zloader malware, a modular Trojan based on the leaked Zeus source code, has incorporated DNS tunneling into its command-and-control (C2) communication methods.

Key Developments:

DNS Tunneling Implementation: Zloader now employs a custom protocol over DNS, utilizing IPv4 to tunnel encrypted TLS network traffic. This technique enables the malware to conceal its C2 communications within standard DNS queries and responses, making detection more challenging.

Enhanced Anti-Analysis Features: The latest version of Zloader includes improved anti-analysis capabilities, such as environment checks and API import resolution algorithms, to evade malware sandboxes and static detection methods.

Interactive Shell Capability: Zloader has introduced an interactive shell that supports over a dozen commands, potentially facilitating hands-on keyboard activity by threat actors during attacks.

Further Reading: Zscaler Blog

Cybercriminals Exploit Fake CAPTCHAs to Distribute Malware

Recent analyses have identified a deceptive tactic where cybercriminals use fake CAPTCHA pages to distribute malware, exploiting users' trust in these verification systems.

Key Developments:

Malicious Redirects: Users visiting compromised websites are redirected to fraudulent CAPTCHA pages that closely mimic legitimate services like Google and CloudFlare.

Clipboard Hijacking: These fake CAPTCHAs silently copy malicious commands to the user's clipboard via JavaScript, prompting them to execute these commands unknowingly through the Windows Run prompt.

Malware Installation: Executing the copied commands leads to the installation of malware, including information stealers and remote-access trojans (RATs), which can extract sensitive data and provide persistent access to compromised systems.

Further Reading: ReliaQuest Blog

Threat Actors Exploit LDAP for Network Enumeration

Recent analyses have identified that both nation-state and cybercriminal threat actors are leveraging the Lightweight Directory Access Protocol (LDAP) to perform network enumeration within Active Directory environments.

Key Developments:

Abuse of LDAP Attributes: Attackers utilize LDAP queries to extract sensitive information, such as user accounts, group memberships, and permissions, facilitating lateral movement and privilege escalation within compromised networks.

Use of Enumeration Tools: Tools like BloodHound and its data collector, SharpHound, are commonly employed to map Active Directory structures, identifying potential attack paths and high-value targets.

Detection Challenges: Distinguishing between legitimate and malicious LDAP activity is difficult due to the high volume of benign LDAP traffic in typical network environments, complicating efforts to detect and mitigate these attacks.

Further Reading: Unit 42 Blog

'Araneida' Web Hacking Service Linked to Turkish IT Firm

Recent investigations have uncovered that 'Araneida,' a cloud-based web hacking service, is utilizing a cracked version of Acunetix—a commercial web application vulnerability scanner—to facilitate cyberattacks. Notably, this service has been traced back to a Turkish information technology firm.

Key Developments:

Exploitation of Cracked Software: Araneida employs an unauthorized version of Acunetix, enabling users to perform offensive reconnaissance, extract user data, and identify exploitable vulnerabilities on target websites.

Proxy Integration for Anonymity: The service incorporates a robust proxy network, allowing scans to originate from a diverse pool of IP addresses, thereby concealing the true source of the activity.

Cybercriminal Promotion: Advertised on multiple cybercrime forums and boasting a Telegram channel with nearly 500 subscribers, Araneida has been linked to the compromise of over 30,000 websites within six months. One user claimed to have purchased a luxury vehicle using proceeds from payment card data obtained through the service.

Connection to Turkish IT Firm: Investigations reveal that the domain araneida[.]co, operational since February 2023, is associated with an individual employed as a senior software developer at Bilitro Yazilim, an IT firm based in Ankara, Turkey.

Further Reading: Krebs on Security

LLMs Employed to Obfuscate Malicious JavaScript

Recent analyses have revealed that adversaries are leveraging large language models (LLMs) to obfuscate malicious JavaScript code, enhancing its ability to evade detection mechanisms.

Key Developments:

Automated Code Obfuscation: Attackers utilize LLMs to iteratively transform malicious JavaScript through techniques such as variable renaming, dead code insertion, and whitespace removal, without altering the code's functionality.

Evasion of Detection Tools: These LLM-generated variants can bypass traditional detection tools, including static analysis models, by producing natural-looking code that is harder to identify as malicious.

Scalability of Attacks: The use of LLMs enables the creation of numerous unique malware variants at scale, increasing the difficulty for security systems to detect and mitigate these threats effectively.

Further Reading: Unit 42 Blog

Mobile Phishing Attacks Employ New Tactics to Evade Security Measures

Recent analyses have identified a novel social engineering tactic targeting mobile banking users. Attackers are leveraging Progressive Web Apps (PWAs) and WebAPKs to distribute phishing websites disguised as legitimate applications, effectively bypassing traditional security warnings and app store vetting processes.

Key Insights:

Exploitation of PWAs and WebAPKs: Unlike traditional apps, these malicious PWAs and WebAPKs are essentially phishing websites packaged to look like legitimate applications. This means they do not exhibit the typical behaviors or characteristics associated with malware, making detection more challenging.

Bypassing Security Measures: Their ability to bypass traditional security warnings of a mobile operating system, and total sidestepping of app store vetting processes, is particularly concerning. This allows attackers to distribute malicious content without triggering standard security alerts.

Anticipated Increase in Sophistication: It is anticipated that more sophisticated and varied phishing campaigns utilizing PWAs and WebAPKs will emerge, unless mobile platforms change their approach towards them.

Further Reading: KnowBe4 Blog

January 2025 - Cybersecurity Threat Intelligence Newsletter

January 9, 2025

This is a monthly newsletter that I share internally with our Cybersecurity team. Feel free to take and use for your own team. Created with the help of ChatGPT.

ModeLeak Vulnerabilities in Google's Vertex AI Platform

Key Insights:

Privilege Escalation via Custom Jobs: Attackers can exploit custom job permissions to gain unauthorized access to data services within a project, leading to potential exposure of sensitive information.

Model Exfiltration through Malicious Models: By deploying a poisoned model, adversaries can exfiltrate other fine-tuned models in the environment, risking proprietary data and custom optimizations.

Further Reading: Unit 42 Blog

Black Basta Ransomware Adopts Advanced Social Engineering Tactics

Key Developments:

Email Bombing: Attackers inundate targets with excessive emails by subscribing their addresses to numerous mailing lists. This tactic overwhelms victims and increases the likelihood of interaction with subsequent malicious communications.

Impersonation via Microsoft Teams: Threat actors pose as IT support personnel, contacting victims through Microsoft Teams to establish trust and facilitate the installation of remote access tools.

QR Code Phishing: Malicious QR codes are sent to victims, directing them to phishing sites designed to harvest credentials or deploy additional malware.

Custom Malware Deployment: The group utilizes bespoke tools such as KNOTWRAP (a memory-only dropper) and KNOTROCK (a .NET-based utility) to execute ransomware payloads stealthily.

Further Reading: The Hacker News

North Korean IT Workers Infiltrating Global Companies

Key Insights:

Use of False Identities: North Korean IT workers often utilize stolen or fabricated identities to obtain employment, making detection challenging.

Revenue Generation for DPRK: Earnings from these positions are funneled back to North Korea, supporting its sanctioned weapons development initiatives.

Potential for Insider Threats: Beyond financial implications, these operatives may have access to sensitive company data, increasing the risk of intellectual property theft and cyber espionage.

Further Reading: Unit 42 Blog

North Korean IT Workers Linked to Phishing Attacks via Malicious Video Conferencing Apps

Key Insights:

Malware Distribution: The group utilizes fraudulent video conferencing platforms to disseminate malware, notably the BeaverTail and InvisibleFerret remote access trojans, compromising systems during supposed job interview processes.

Global Reach: By infiltrating organizations worldwide, these operatives support North Korea's illicit endeavors, including its weapons of mass destruction and ballistic missile programs.

Evolving Tactics: The shift from merely seeking income to engaging in aggressive malware campaigns indicates a significant escalation in their operational strategies.

Further Reading: Unit 42 Blog

Surge in 'ClickFix' Social Engineering Attacks

Key Developments:

Deceptive Error Messages: Attackers present fake error dialogs, prompting users to execute provided commands to resolve non-existent issues.

Malware Delivery: By following these instructions, users inadvertently run scripts that download and install malware such as Lumma Stealer and AsyncRAT.

Global Impact: Campaigns employing ClickFix techniques have targeted organizations worldwide, with notable incidents involving fake GitHub security notifications and counterfeit software updates.

Further Reading: Proofpoint Blog

Malicious Ads Deliver SocGholish Malware to Kaiser Permanente Employees

A recent cyberattack has targeted Kaiser Permanente employees through malicious advertisements on Google Search, leading to the distribution of SocGholish malware.

Key Developments:

Malicious Advertisements: Threat actors placed deceptive ads mimicking Kaiser Permanente's HR portal to lure employees searching for benefits and payroll information.

Compromised Website Redirects: Clicking the fraudulent ad redirected users to a compromised website, bellonasoftware[.]com, which briefly displayed a phishing page before prompting a fake browser update.

SocGholish Malware Deployment: The fake browser update led to the download of "Update.js," a malicious script associated with the SocGholish malware campaign, designed to collect system information and potentially allow human operators to execute further malicious actions.

This incident highlights the evolving tactics of cybercriminals in exploiting trusted platforms like Google Ads to distribute malware.

Further Reading: Malwarebytes Blog

DarkGate Malware Leveraging Vishing via Microsoft Teams

Recent analyses have identified a concerning trend in which cybercriminals are deploying DarkGate malware through vishing (voice phishing) attacks conducted via Microsoft Teams.

Key Developments:

Social Engineering Tactics: Attackers impersonate employees from known client organizations during Microsoft Teams calls, convincing victims to download remote desktop applications like AnyDesk.

Malware Deployment: Once remote access is established, DarkGate malware is installed, enabling threat actors to execute malicious commands, gather system information, and maintain persistent access.

Operational Impact: Although some attacks have been thwarted before data exfiltration, the initial breach underscores vulnerabilities in user awareness and the potential for significant security incidents.

Further Reading: Trend Micro Research

Sophisticated Phishing Campaigns Exploit Trusted Platforms

Key Developments:

Exploitation of Trusted Platforms: Attackers leverage familiar platforms and services to enhance the credibility of their phishing attempts, making it more challenging for victims to identify fraudulent communications.

Bypassing Secure Email Gateways (SEGs): The campaigns utilize advanced methods to evade detection by SEGs, allowing malicious emails to reach employees' inboxes undetected.

Wide-Ranging Targets: Over 30 companies across 12 industries and 15 jurisdictions have been affected, indicating a broad and indiscriminate approach by the threat actors.

Further Reading: Group-IB Blog

Top Cyber Attacker Techniques (August–October 2024)

Recent analyses have identified key cyber attacker tactics, techniques, and procedures (TTPs) observed between August 1 and October 31, 2024.

Key Developments:

Phishing Incidents: Phishing accounted for 46% of all customer incidents during this period, indicating a significant rise likely due to high employee turnover and the accessibility of phishing kits.

Prevalent Malware: "SocGholish" and "LummaC2" emerged as the most frequently observed malware in customer environments, highlighting their widespread use in recent attacks.

Cloud Services Alerts: There was a 20% increase in cloud services alerts, correlating with the rising adoption of cloud accounts and associated security challenges.

Ransomware Activity: Despite a slowdown in "LockBit" ransomware activity due to law enforcement actions and a loss of affiliate trust, it remains a key player. Meanwhile, "RansomHub" is rising rapidly due to its attractive ransomware-as-a-service (RaaS) model. The U.S., manufacturing sector, and professional, scientific, and technical services (PSTS) sector are primary targets amidst an overall increase in ransomware attacks.

Initial Access Broker (IAB) Activity: IAB activity increased by 16%, heavily targeting U.S.-based organizations, possibly due to perceived financial capabilities stemming from cyber insurance.

Insider Threat Content: A 7% rise in insider threat discussions on cybercrime forums was noted, driven by significant financial incentives, underscoring the growing complexity of cybersecurity challenges.

Impersonating Domain Alerts: There was a 6% increase in alerts related to impersonating domains, indicating ongoing reliance on simple techniques to capture credentials and data.

Further Reading: ReliaQuest Blog

Phishing Attacks Double in 2024

Key Developments:

Prevalence of Zero-Day URLs: Approximately 80% of malicious links identified are zero-day threats—newly created URLs designed to evade traditional detection methods.

Diversification of Attack Vectors: While link-based phishing remains predominant, there is a notable increase in text-based threats, such as business email compromise (BEC) and invoice scams, as well as file-based threats employing techniques like HTML smuggling.

Expansion Beyond Email: Phishing attacks are increasingly targeting multiple platforms, including SMS, LinkedIn, and Microsoft Teams, indicating a shift towards multichannel approaches.

Further Reading: Infosecurity Magazine

Surge in Phishing Attacks via New Top-Level Domains

Key Developments:

Disproportionate Use in Cybercrime: Although new gTLDs constitute only 11% of the market for new domains, they account for approximately 37% of reported cybercrime domains between September 2023 and August 2024.

Attraction to Low-Cost Registrations: Registrars offering domain registrations for less than $1, with little to no identity verification, are particularly appealing to spammers and scammers seeking to conduct malicious activities anonymously.

ICANN's Expansion Plans: Despite the misuse of these new gTLDs, the Internet Corporation for Assigned Names and Numbers (ICANN) is proceeding with plans to introduce additional gTLDs, potentially broadening the landscape for cybercriminal activities.

Further Reading: Krebs on Security

Surge in Suspicious Domain Registrations Exploiting High-Profile Events

Recent analyses have identified a significant increase in suspicious domain registration campaigns exploiting high-profile events, such as the 2024 Summer Olympics in Paris.

Key Developments:

Event-Driven Domain Registrations: Threat actors register deceptive domains containing event-specific keywords to mimic official websites, aiming to deceive users seeking legitimate information.

Exploitation of Public Interest: Cybercriminals leverage global events to attract large audiences, using fraudulent domains to distribute malware, conduct phishing attacks, or sell counterfeit merchandise.

Indicators of Malicious Activity: Monitoring domain registrations, DNS traffic, URL patterns, and textual characteristics can help identify and mitigate these threats.

Further Reading: Unit 42 Blog

Zloader Malware Adopts DNS Tunneling for Stealthier C2 Communications

Key Developments:

DNS Tunneling Implementation: Zloader now employs a custom protocol over DNS, utilizing IPv4 to tunnel encrypted TLS network traffic. This technique enables the malware to conceal its C2 communications within standard DNS queries and responses, making detection more challenging.

Enhanced Anti-Analysis Features: The latest version of Zloader includes improved anti-analysis capabilities, such as environment checks and API import resolution algorithms, to evade malware sandboxes and static detection methods.

Interactive Shell Capability: Zloader has introduced an interactive shell that supports over a dozen commands, potentially facilitating hands-on keyboard activity by threat actors during attacks.

Further Reading: Zscaler Blog

Cybercriminals Exploit Fake CAPTCHAs to Distribute Malware

Recent analyses have identified a deceptive tactic where cybercriminals use fake CAPTCHA pages to distribute malware, exploiting users' trust in these verification systems.

Key Developments:

Malicious Redirects: Users visiting compromised websites are redirected to fraudulent CAPTCHA pages that closely mimic legitimate services like Google and CloudFlare.

Clipboard Hijacking: These fake CAPTCHAs silently copy malicious commands to the user's clipboard via JavaScript, prompting them to execute these commands unknowingly through the Windows Run prompt.

Malware Installation: Executing the copied commands leads to the installation of malware, including information stealers and remote-access trojans (RATs), which can extract sensitive data and provide persistent access to compromised systems.

Further Reading: ReliaQuest Blog

Threat Actors Exploit LDAP for Network Enumeration

Key Developments:

Abuse of LDAP Attributes: Attackers utilize LDAP queries to extract sensitive information, such as user accounts, group memberships, and permissions, facilitating lateral movement and privilege escalation within compromised networks.

Use of Enumeration Tools: Tools like BloodHound and its data collector, SharpHound, are commonly employed to map Active Directory structures, identifying potential attack paths and high-value targets.

Detection Challenges: Distinguishing between legitimate and malicious LDAP activity is difficult due to the high volume of benign LDAP traffic in typical network environments, complicating efforts to detect and mitigate these attacks.

Further Reading: Unit 42 Blog

'Araneida' Web Hacking Service Linked to Turkish IT Firm

Key Developments:

Exploitation of Cracked Software: Araneida employs an unauthorized version of Acunetix, enabling users to perform offensive reconnaissance, extract user data, and identify exploitable vulnerabilities on target websites.

Proxy Integration for Anonymity: The service incorporates a robust proxy network, allowing scans to originate from a diverse pool of IP addresses, thereby concealing the true source of the activity.

Cybercriminal Promotion: Advertised on multiple cybercrime forums and boasting a Telegram channel with nearly 500 subscribers, Araneida has been linked to the compromise of over 30,000 websites within six months. One user claimed to have purchased a luxury vehicle using proceeds from payment card data obtained through the service.

Connection to Turkish IT Firm: Investigations reveal that the domain araneida[.]co, operational since February 2023, is associated with an individual employed as a senior software developer at Bilitro Yazilim, an IT firm based in Ankara, Turkey.

Further Reading: Krebs on Security

LLMs Employed to Obfuscate Malicious JavaScript

Recent analyses have revealed that adversaries are leveraging large language models (LLMs) to obfuscate malicious JavaScript code, enhancing its ability to evade detection mechanisms.

Key Developments:

Further Reading: Unit 42 Blog

Mobile Phishing Attacks Employ New Tactics to Evade Security Measures

Key Insights:

Exploitation of PWAs and WebAPKs: Unlike traditional apps, these malicious PWAs and WebAPKs are essentially phishing websites packaged to look like legitimate applications. This means they do not exhibit the typical behaviors or characteristics associated with malware, making detection more challenging.

Bypassing Security Measures: Their ability to bypass traditional security warnings of a mobile operating system, and total sidestepping of app store vetting processes, is particularly concerning. This allows attackers to distribute malicious content without triggering standard security alerts.

Anticipated Increase in Sophistication: It is anticipated that more sophisticated and varied phishing campaigns utilizing PWAs and WebAPKs will emerge, unless mobile platforms change their approach towards them.

Further Reading: KnowBe4 Blog

January 2025 - Security Awareness Newsletter

January 8, 2025

This is a security awareness focused newsletter that I share internally. Feel free to grab and use for your own internal security awareness program. Created with help from ChatGPT.

FBI Shares Strategies to Combat AI-Driven Fraud Schemes

The Federal Bureau of Investigation (FBI) has issued a public service announcement highlighting the increasing use of generative artificial intelligence (AI) by cybercriminals to enhance the sophistication and believability of fraud schemes. These AI-powered tactics are being employed across various fraudulent activities, including romance scams, investment fraud, and job recruitment cons.

Internet Crime Complaint Center

Key Insights:

Enhanced Deception: Generative AI enables criminals to produce highly convincing text, images, audio, and video content, making fraudulent communications appear legitimate and more persuasive.

Voice Cloning: Advanced AI techniques allow for the cloning of voices, which can be used in schemes such as impersonating family members in distress to solicit money or sensitive information.

Synthetic Identities: AI-generated images and profiles are utilized to create fake identities on social media platforms, facilitating social engineering attacks and spear-phishing campaigns.

Recommendations:

Verify Communications: Be cautious of unsolicited messages, especially those requesting personal information or financial transactions. Confirm the authenticity of such communications through direct and reliable channels.

Establish Verification Protocols: Develop secret codes or phrases with family members and trusted contacts to authenticate identities during unexpected or urgent requests.

Limit Personal Information Sharing: Be mindful of the personal data shared on social media and other public platforms, as it can be exploited to craft personalized and convincing scams.

Staying informed about the evolving tactics of AI-driven fraud is crucial in safeguarding personal and financial information.

Further Reading: BleepingComputer Article

Black Basta Ransomware Adopts Advanced Social Engineering Tactics

Key Developments:

Email Bombing: Attackers inundate targets with excessive emails by subscribing their addresses to numerous mailing lists. This tactic overwhelms victims and increases the likelihood of interaction with subsequent malicious communications.

Impersonation via Microsoft Teams: Threat actors pose as IT support personnel, contacting victims through Microsoft Teams to establish trust and facilitate the installation of remote access tools.

QR Code Phishing: Malicious QR codes are sent to victims, directing them to phishing sites designed to harvest credentials or deploy additional malware.

Further Reading: The Hacker News

Phishing Attacks Target Employee Payroll Accounts

Cybercriminals are increasingly launching phishing attacks aimed at hijacking employee payroll accounts. These schemes often involve fraudulent emails that appear to originate from Human Resources or payroll departments, requesting employees to update or verify their direct deposit information. Unsuspecting employees who comply may inadvertently provide attackers with access to their payroll accounts, leading to unauthorized changes and financial theft.

Key Insights:

Impersonation of Internal Departments: Attackers craft emails that convincingly mimic internal communications from HR or payroll, exploiting employees' trust in these departments.

Urgency and Deception: Messages often convey a sense of urgency, such as impending payroll issues, to prompt quick action without thorough scrutiny.

Credential Harvesting: Links within these emails direct employees to counterfeit login pages designed to capture their credentials, granting attackers unauthorized access.

Further Reading: KnowBe4 Blog

Surge in 'ClickFix' Social Engineering Attacks

Key Developments:

Deceptive Error Messages: Attackers present fake error dialogs, prompting users to execute provided commands to resolve non-existent issues.

Malware Delivery: By following these instructions, users inadvertently run scripts that download and install malware such as Lumma Stealer and AsyncRAT.

Global Impact: Campaigns employing ClickFix techniques have targeted organizations worldwide, with notable incidents involving fake GitHub security notifications and counterfeit software updates.

Further Reading: Proofpoint Blog

AI-Driven Investment Scams Proliferate via Social Media

Cybercriminals are increasingly leveraging artificial intelligence (AI) and social media platforms to perpetrate sophisticated investment scams, leading to significant financial and data losses among victims worldwide.

Key Insights:

AI-Generated Deception: Scammers utilize AI to create convincing video testimonials featuring fabricated endorsements from celebrities and financial experts, enhancing the credibility of fraudulent investment schemes.

Social Media Malvertising: Fraudulent advertisements are disseminated through social media channels, often mimicking legitimate company posts or news outlets, to lure potential investors into the scam.

Phishing Tactics: Victims are directed to counterfeit websites designed to harvest personal information under the guise of investment opportunities, leading to identity theft and unauthorized financial transactions.

Recommendations:

Verify Authenticity: Scrutinize investment opportunities, especially those encountered through social media, by researching the offering entity and seeking independent financial advice.

Be Skeptical of High Returns: Exercise caution with schemes promising unusually high or guaranteed returns, as these are common indicators of fraudulent activity.

Protect Personal Information: Avoid sharing sensitive data through unsolicited links or forms; ensure websites are legitimate and secure before providing any personal details.

Staying informed and exercising due diligence are crucial in safeguarding against these evolving AI-driven investment scams.

Further Reading: The Hacker News

Security Alert: Fake Brand Collaboration Scams Targeting YouTube Creators

Cybercriminals are increasingly targeting YouTube content creators by impersonating reputable brands and offering fraudulent collaboration opportunities. These sophisticated phishing campaigns aim to distribute malware, leading to the theft of sensitive information and unauthorized access to creators' systems.

Key Insights:

Impersonation of Trusted Brands: Attackers craft convincing emails that appear to originate from well-known companies, proposing enticing partnership deals to lure creators into their scheme.

Malware Delivery via Documents: The fraudulent offers include attachments, such as contracts or promotional materials, often delivered through password-protected files hosted on platforms like OneDrive to evade detection.

Theft of Sensitive Information: Once the malware is installed, it can steal login credentials, financial data, and grant attackers remote access to the victim's system, compromising both personal and channel security.

Further Reading: CloudSEK Blog

Malicious Ads Deliver SocGholish Malware to Kaiser Permanente Employees

A recent cyberattack has targeted Kaiser Permanente employees through malicious advertisements on Google Search, leading to the distribution of SocGholish malware.

Key Developments:

Malicious Advertisements: Threat actors placed deceptive ads mimicking Kaiser Permanente's HR portal to lure employees searching for benefits and payroll information.

Compromised Website Redirects: Clicking the fraudulent ad redirected users to a compromised website, bellonasoftware[.]com, which briefly displayed a phishing page before prompting a fake browser update.

SocGholish Malware Deployment: The fake browser update led to the download of "Update.js," a malicious script associated with the SocGholish malware campaign, designed to collect system information and potentially allow human operators to execute further malicious actions.

This incident highlights the evolving tactics of cybercriminals in exploiting trusted platforms like Google Ads to distribute malware.

Further Reading: Malwarebytes Blog

Threat Actors Exploit LinkedIn to Target Job Seekers

Cybercriminals are increasingly leveraging LinkedIn to deceive job seekers through sophisticated employment scams. By creating fake recruiter profiles, often enhanced with AI-generated images, these threat actors craft personalized messages that appear to offer legitimate job opportunities. The objective is to lure victims into clicking on malicious links that lead to phishing sites designed to harvest personal information or deploy malware.

Key Insights:

Personalized Deception: Scammers tailor messages based on the victim's professional background, making the fraudulent offers appear credible and enticing.

Advanced Phishing Techniques: The use of AI-generated recruiter profiles and convincing communication strategies increases the likelihood of victims engaging with malicious content.

Exploitation of LinkedIn Features: By abusing LinkedIn's InMail feature, attackers can reach users outside their immediate network, broadening the scope of potential targets.

Further Reading: KnowBe4 Blog

Cybercriminals Impersonate KnowBe4 in Phishing Attacks

Cybercriminals are impersonating KnowBe4 by sending fraudulent emails that closely mimic legitimate "Please Complete Assigned Training" notifications. These deceptive emails aim to trick recipients into clicking malicious links or downloading harmful attachments, potentially compromising personal and organizational security.

Key Insights:

Sophisticated Mimicry: The phishing emails are designed to closely resemble authentic KnowBe4 training notifications, making it challenging for recipients to distinguish between legitimate and fraudulent communications.

Malicious Intent: Interacting with the links or attachments in these emails can lead to malware infections, unauthorized access to sensitive information, or other security breaches.

Targeted Deception: By exploiting the trust associated with KnowBe4's brand, attackers increase the likelihood of recipients falling victim to the scam.

Further Reading: KnowBe4 Blog

Malicious Advertisements Pose Growing Threat to Internet Users

Cybercriminals are increasingly utilizing malicious advertisements, or "malvertising," to distribute malware and conduct phishing attacks. These deceptive ads often appear as legitimate sponsored content on search engine results pages, making it challenging for users to distinguish between safe and harmful links.

Key Insights:

Prevalence of Malvertising: Malicious actors pay search engines to display their harmful URLs as sponsored ads, which are prominently positioned above legitimate search results. This tactic increases the likelihood of user engagement with malicious content.

Deceptive Appearances: These ads are crafted to closely mimic legitimate websites or services, often using familiar branding and language to deceive users into clicking on them.

Potential Consequences: Interacting with malvertising can lead to malware infections, unauthorized access to personal information, and financial loss.

Further Reading: KnowBe4 Blog

Mobile Phishing Campaign Targets Job Seekers

Cybercriminals are impersonating recruiters to target job seekers with phony employment offers. Researchers at Zimperium warn that a phishing campaign is targeting Android phones to deliver the Antidot banking trojan.

Key Insights:

Sophisticated Social Engineering: Attackers masquerade as job recruiters or HR representatives from well-known organizations, sending well-crafted phishing emails that purport to come from real companies, informing recipients that they’ve been selected to advance in the hiring process.

Malware Delivery: Victims are enticed to download a malicious application, leading to the installation of the Antidot banking trojan on their Android devices.

Credential Theft: Once installed, the malware enables a broad set of malicious actions, including credential theft of banking, cryptocurrency, and other critical applications.

Further Reading: KnowBe4 Blog

Phishing Scam Mimics Employment Termination Notices

Cybercriminals are deploying phishing attacks that impersonate employment termination notices to exploit individuals' fear of job loss. These deceptive emails appear to be official communications from human resources departments, complete with authentic-looking logos and case numbers, urging immediate action to avoid "serious legal consequences."

Key Insights:

Deceptive Emails: The phishing emails are designed to closely resemble legitimate employment termination notices, making it challenging for recipients to distinguish between authentic and fraudulent communications.

Malware Distribution: Clicking on the provided link directs victims to a fake Microsoft webpage that prompts the download of malicious software. This malware can steal sensitive information, including banking credentials, leading to significant financial and personal repercussions.

Exploiting Emotional Triggers: By preying on the fear of job loss, attackers increase the likelihood of recipients reacting hastily and clicking on malicious links without proper scrutiny.

Further Reading: KnowBe4 Blog

Malicious Google Ads Exploit Printer Troubleshooting Searches

Cybercriminals are exploiting Google Ads to target users seeking solutions for printer issues, particularly those involving HP and Canon devices.

Key Insights:

Deceptive Advertisements: Scammers purchase Google Ads that appear as legitimate tech support for printer drivers, luring users into clicking on malicious links.

Fake Installation Processes: Upon visiting these fraudulent sites, users encounter a simulated driver installation that culminates in a fabricated error message, warning that further attempts may damage the printer and void its warranty.

Phony Tech Support: The error message prompts users to initiate a live chat, connecting them with scammers posing as tech support representatives, who may then attempt to extract personal information or payments.

Further Reading: KnowBe4 Blog

Phishing Attack Exploits Google Calendar to Bypass Spam Filters

Cybercriminals are leveraging Google Calendar invites to conduct phishing attacks that evade spam filters. By sending fraudulent meeting invitations, they prompt recipients to click on malicious links embedded within the event details.

Key Insights:

Exploitation of Trusted Services: Attackers utilize legitimate Google services, such as Calendar and Forms, to enhance the credibility of their phishing attempts, making detection more challenging.

Evasion of Security Measures: By originating from trusted platforms, these phishing messages can bypass traditional email security filters, increasing the likelihood of reaching potential victims.

Deceptive Tactics: The fraudulent invitations often include links disguised as legitimate actions, such as viewing event details or confirming attendance, which redirect to malicious sites designed to harvest user credentials.

Further Reading: BleepingComputer

Smart Devices in Homes Pose Privacy and Security Risks

Recent analyses have highlighted the potential privacy and security vulnerabilities associated with the increasing presence of smart devices in households. These devices, while offering convenience, can be exploited by malicious actors to compromise personal information and security.

Checkpoint Blog

Key Insights:

Unauthorized Access: Smart devices, such as cameras and voice assistants, can be manipulated to monitor activities within homes without the owner's consent.

Data Exploitation: Information collected by these devices may be accessed or intercepted by unauthorized parties, leading to potential misuse of personal data.

Regulatory Challenges: The rapid adoption of smart technology has outpaced the development of comprehensive regulations, leaving consumers vulnerable to emerging threats.

Further Reading: Check Point Blog

Cybercriminals Exploit Fake CAPTCHAs to Distribute Malware

Recent analyses have identified a deceptive tactic where cybercriminals use fake CAPTCHA pages to distribute malware, exploiting users' trust in these verification systems.

Key Developments:

Malicious Redirects: Users visiting compromised websites are redirected to fraudulent CAPTCHA pages that closely mimic legitimate services like Google and CloudFlare.

Clipboard Hijacking: These fake CAPTCHAs silently copy malicious commands to the user's clipboard via JavaScript, prompting them to execute these commands unknowingly through the Windows Run prompt.

Malware Installation: Executing the copied commands leads to the installation of malware, including information stealers and remote-access trojans (RATs), which can extract sensitive data and provide persistent access to compromised systems.

Further Reading: ReliaQuest Blog

Data Breach at American Addiction Centers Affects Over 422,000 Individuals

American Addiction Centers (AAC), a leading provider of substance abuse treatment services, has reported a data breach impacting more than 422,000 individuals.

Key Details:

Incident Timeline: The breach was detected on September 26, 2024, with unauthorized access occurring several days prior.

Compromised Information: Exfiltrated data includes names, addresses, phone numbers, dates of birth, Social Security numbers, health insurance details, and medical record identifiers. Notably, treatment information and payment card data were not affected.

Threat Actor Involvement: The Rhysida ransomware group has claimed responsibility, alleging the theft of approximately 2.8 terabytes of data.

Notification and Support: AAC has begun notifying affected individuals and is offering 12 months of free credit monitoring services.

Further Reading: SecurityWeek

Sophisticated Phishing Scams Lead to Significant Cryptocurrency Losses

Recent incidents have highlighted advanced phishing attacks where cybercriminals impersonate legitimate services to gain unauthorized access to individuals' cryptocurrency wallets, resulting in substantial financial losses.

Key Insights:

Impersonation of Trusted Entities: Attackers pose as representatives from reputable organizations, such as Google or cryptocurrency platforms, to deceive victims into believing their accounts are compromised.

Manipulation of Security Features: Victims receive seemingly legitimate security alerts and prompts, which are actually orchestrated by the attackers to facilitate unauthorized account access.

Exploitation of Stored Sensitive Information: Once access is obtained, cybercriminals search for stored sensitive data, such as cryptocurrency wallet seed phrases, enabling them to transfer funds without detection.

Further Reading: Krebs on Security

Mobile Phishing Attacks Employ New Tactics to Evade Security Measures

Key Insights:

Exploitation of PWAs and WebAPKs: Unlike traditional apps, these malicious PWAs and WebAPKs are essentially phishing websites packaged to look like legitimate applications. This means they do not exhibit the typical behaviors or characteristics associated with malware, making detection more challenging.

Bypassing Security Measures: Their ability to bypass traditional security warnings of a mobile operating system, and total sidestepping of app store vetting processes, is particularly concerning. This allows attackers to distribute malicious content without triggering standard security alerts.

Anticipated Increase in Sophistication: It is anticipated that more sophisticated and varied phishing campaigns utilizing PWAs and WebAPKs will emerge, unless mobile platforms change their approach towards them.

Further Reading: KnowBe4 Blog

'James Bond-Style' Scams Lead to Significant Financial Losses

Recent reports have highlighted a surge in sophisticated scams where fraudsters impersonate trusted entities, such as law enforcement or intelligence agencies, to deceive victims into believing they are involved in international criminal activities.

Key Insights:

Deceptive Communication: Scammers contact individuals, claiming to be from reputable organizations like Amazon, the U.S. Post Office, or law enforcement agencies, alleging the victim's involvement in global criminal schemes.

Manipulative Tactics: Victims are coerced into withdrawing large sums of money from personal accounts under the guise of protecting their funds from criminal misuse. They are instructed to hand over cash to individuals posing as law enforcement agents, who then abscond with the money.

Significant Financial Impact: These scams have led to substantial financial losses for victims, with little to no chance of recovery once the funds are handed over.

Further Reading: KnowBe4 Blog

December 2024 - Healthcare Executive Leadership Cybersecurity Newsletter

December 9, 2024

These are the stories I shared internally with my leadership. Feel free to take and use for your own leadership. Created with help from ChatGPT.

New Professional Liability Insurance for CISOs

In response to the increasing legal scrutiny faced by Chief Information Security Officers (CISOs), Crum & Forster has introduced a professional liability insurance policy tailored specifically for these executives. Traditionally, directors and officers (D&O) liability policies have not encompassed CISOs, leaving them vulnerable to personal financial risks in the event of cybersecurity incidents.

Key Features of the Policy:

Comprehensive Coverage: Protects against claims of negligence or inadequate work arising from cybersecurity services.

Flexible Acquisition: Available for purchase by organizations on behalf of their CISOs or directly by the CISOs themselves.

Extended Protection: Covers consulting activities for the organization and its subsidiaries, as well as external engagements, including pro bono IT security work.

Further Reading: CyberScoop Article

Bipartisan Effort to Enhance Healthcare Cybersecurity

On November 22, 2024, Senators Bill Cassidy (R-LA), Mark Warner (D-VA), John Cornyn (R-TX), and Maggie Hassan (D-NH) introduced the Health Care Cybersecurity and Resiliency Act of 2024. This bipartisan legislation aims to bolster cybersecurity measures within the healthcare sector, addressing the increasing threats to patient data and healthcare operations.

Help Center

Key Provisions:

Grant Funding: Allocates resources to healthcare entities for enhancing cyberattack prevention and response capabilities.

Training Initiatives: Provides cybersecurity best practices training to healthcare institutions.

Support for Rural Providers: Offers tailored guidance to rural health clinics on breach prevention and resilience strategies.

Interagency Coordination: Improves collaboration between the Department of Health and Human Services (HHS) and the Cybersecurity and Infrastructure Security Agency (CISA) for effective cyberattack responses.

Regulatory Modernization: Updates Health Insurance Portability and Accountability Act (HIPAA) regulations to incorporate current cybersecurity best practices.

Incident Response Planning: Mandates the development and implementation of a cybersecurity incident response plan by the HHS Secretary.

Implications for Healthcare Organizations: This legislation underscores the critical need for robust cybersecurity frameworks within healthcare institutions. Executive leaders should proactively assess their organization's cybersecurity posture, ensuring alignment with emerging standards and readiness to leverage potential federal support. Embracing these initiatives will not only protect sensitive patient information but also enhance operational resilience against cyber threats.

Further Reading: Senate HELP Committee Press Release

December 2024 - Security Awareness Newsletter

December 6, 2024

This is a security awareness focused newsletter that I share internally. Feel free to grab and use for your own internal security awareness program.

Copyright Infringement Phishing Scams Targeting Facebook Business Users

Cybercriminals are targeting Facebook business and advertising account users, especially in regions like Taiwan, with phishing emails that falsely claim copyright infringement. These emails urge recipients to download a file (disguised as a PDF), which actually installs information-stealing malware on the victim’s device. This tactic aims to harvest sensitive information from users who trust the email’s legal-sounding message.

Key Points:

Target Audience: Facebook business and advertising account users.

Phishing Tactic: Emails posing as copyright infringement notices.

Malware Delivery: Malicious files masquerading as PDFs that contain infostealers.

Further Reading: Cisco Talos Report on Copyright Infringement Phishing Lure

Beware of 'Phish 'n' Ships': Fake Online Stores Stealing Your Money and Data

Cybercriminals are increasingly creating fraudulent online shops that mimic legitimate retailers to deceive consumers into providing payment information and personal data. These fake websites often offer enticing deals on popular products, luring unsuspecting shoppers into making purchases. Once payment details are entered, the scammers steal the information, leading to financial loss and potential identity theft.

How to Protect Yourself:

Verify Website Authenticity: Before making a purchase, ensure the website is legitimate by checking the URL for misspellings or unusual domain extensions.

Look for Secure Connections: Ensure the website uses HTTPS, indicating a secure connection.

Research the Seller: Look for reviews and ratings from other customers to confirm the retailer's credibility.

Be Cautious of Unrealistic Deals: If an offer seems too good to be true, it likely is.

Further Reading: Human Security

Beware of DocuSign-Inspired Invoice Scams

Cybercriminals are leveraging DocuSign’s Envelopes API to distribute highly realistic fake invoices impersonating trusted brands like Norton and PayPal. These malicious emails come from legitimate DocuSign domains, bypassing security filters and appearing authentic. Attackers aim to have recipients e-sign the document, which can authorize unauthorized payments.

What You Can Do:

Always verify invoice details directly with the company rather than clicking links within emails.

Look out for unexpected requests, even from trusted services.

Educate your team about this tactic and report suspicious invoices immediately.

Further Reading: Bleeping Computer

Mobile Ad Data Enables Widespread Surveillance

Recent investigations reveal that commercial services are exploiting mobile advertising data to track individuals' daily movements without their consent. By collecting data from widely-used mobile apps and websites, these services can monitor personal locations, posing significant privacy risks.

Protect Your Privacy:

Limit App Permissions: Only grant apps the permissions they genuinely need.

Review Privacy Settings: Regularly check and adjust your device's privacy settings to control data sharing.

Stay Informed: Be aware of how your data is collected and used by the apps and services you utilize.

Further Reading: Krebs on Security

Phishing Scams Targeting Booking.com Users

Recent reports highlight a surge in phishing attacks exploiting Booking.com accounts. Cybercriminals are compromising hotel partner accounts to access customer booking details, subsequently sending fraudulent messages that appear legitimate. These messages often request additional information or payments, aiming to deceive users into providing sensitive data or transferring funds.

Protect Yourself:

Verify Communications: Always confirm the authenticity of messages by contacting the hotel or Booking.com directly through official channels.

Avoid Unsolicited Links: Do not click on links or download attachments from unexpected emails or messages.

Enable Two-Factor Authentication (2FA): Activate 2FA on your Booking.com account to add an extra layer of security.

Further Reading: Krebs on Security

North Korean IT Workers Infiltrating Western Companies

Recent investigations have uncovered a concerning trend: North Korean IT professionals are securing remote positions in Western companies, including those in the United States, by using stolen identities and sophisticated social engineering tactics. This strategy enables them to bypass international sanctions and funnel earnings back to North Korea, potentially funding illicit activities.

Key Insights:

Identity Theft: These individuals often use stolen or fabricated identities to pose as qualified candidates from various countries.

Advanced Techniques: They employ generative AI tools to craft convincing resumes and perform well in interviews, making detection challenging.

Financial Implications: Earnings from these positions are redirected to support North Korea's sanctioned programs, including its weapons development initiatives.

Further Reading: Zscaler Security Research

Surge in Eventbrite-Based Phishing Attacks

Recent analyses by Perception Point have identified a significant increase in phishing campaigns exploiting Eventbrite's scheduling platform. Between July and October 2024, these attacks escalated by 900%, with cybercriminals sending deceptive emails from 'noreply[@]events[.]eventbrite[.]com' to distribute malicious content.

Key Insights:

Legitimate Appearance: Utilizing Eventbrite's legitimate email domain allows attackers to bypass standard security filters, making the phishing emails appear authentic to recipients.

Malicious Payloads: The emails often contain links or attachments designed to harvest credentials or deploy malware upon interaction.

Targeted Entities: While the attacks are widespread, they predominantly focus on organizations that frequently use event management platforms, increasing the likelihood of successful exploitation.

Further Reading: KnowBe4 Blog

Phishing Campaign Impersonates OpenAI to Steal Financial Information

Cybercriminals are currently conducting a phishing campaign that impersonates OpenAI to deceive users into providing their financial details. The fraudulent emails inform recipients that their ChatGPT subscription payment has been declined, prompting them to click a link to update their payment method.

Key Insights:

Deceptive Tactics: The emails are designed to appear legitimate, leveraging OpenAI's branding to gain user trust.

Malicious Links: Clicking the provided link directs users to a fake payment page intended to capture sensitive financial information.

Widespread Targeting: This campaign is part of a broader trend where attackers exploit the popularity of AI tools to launch phishing attacks.

Further Reading: KnowBe4 Blog

Corrupted Word Documents in Novel Phishing Campaign

A newly identified phishing campaign exploits Microsoft's Word file recovery feature by using intentionally corrupted Word documents as email attachments. These documents evade detection by security solutions due to their damaged state, but Word can still recover and open them.

Key Insights:

The Lure: Emails impersonate payroll and HR departments, with themes like employee bonuses and benefits. The attachments appear as corrupted files but can be repaired by Word.

Malicious QR Codes: Upon recovery, the documents prompt users to scan a QR code branded with company logos. Scanning leads to phishing sites designed to steal Microsoft login credentials.

Detection Challenges: Most attachments used in this campaign avoid detection on platforms like VirusTotal, as they contain no active malicious code, just deceptive QR codes.

Attack Effectiveness: By exploiting overlooked document recovery mechanisms, this method bypasses traditional email security filters, increasing the likelihood of reaching victims.

Further Reading: BleepingComputer Article

Cybercriminals Exploit Search Engine Results to Promote Phishing Pages

Cybercriminals are increasingly employing search engine poisoning to elevate malicious phishing sites in search results, deceiving users into divulging sensitive information. Researchers at Malwarebytes discovered that a search for "KeyBank login" on Bing displayed a counterfeit KeyBank login page above the official site.

Key Insights:

Manipulated Search Results: Attackers optimize malicious sites to appear prominently in search results, making them seem legitimate and increasing the likelihood of user interaction.

Phishing Tactics: These fraudulent pages mimic authentic login portals, aiming to harvest users' credentials and personal data.

Broader Implications: This tactic, known as SEO poisoning, extends beyond banking sites, potentially affecting various sectors and services.

Further Reading: KnowBe4 Blog

Attackers Exploit Corrupted Files to Evade Detection

Cybersecurity researchers have identified a novel phishing campaign that utilizes intentionally corrupted Microsoft Office documents and ZIP archives to bypass email security measures. These corrupted files evade antivirus scans and email filters, yet can be opened by users through built-in recovery features in applications like Microsoft Word and WinRAR.

Key Insights:

Evasion Techniques: The corrupted state of these attachments prevents security tools from properly scanning them, allowing malicious emails to reach users' inboxes undetected.

User Interaction: When users attempt to open these corrupted files, applications prompt them to recover the content, leading to the display of malicious elements such as QR codes.

Malicious Outcomes: Scanning the embedded QR codes can redirect users to phishing websites designed to steal credentials or deploy malware.

This tactic highlights the continuous evolution of phishing strategies aimed at circumventing security defenses and exploiting user trust in application recovery features.

Further Reading: The Hacker News

December 2024 - Threat Intelligence Newsletter

December 5, 2024

This is a monthly newsletter that I share internally with our Cybersecurity team. Feel free to take and use for your own team. Created with the help of ChatGPT.

Google’s New SAIF Risk Assessment Tool for AI Security

Google has introduced the Secure AI Framework (SAIF) Risk Assessment tool to help organizations proactively identify and mitigate security risks in their AI systems. This interactive tool assesses key areas such as training data integrity, access controls, and defenses against adversarial inputs. Upon completion, organizations receive a tailored report outlining specific vulnerabilities and recommended mitigation strategies, reinforcing the need for robust security measures as AI systems become more prevalent.

Further Reading: Google Blog on SAIF Risk Assessment

Session Cookie Theft Bypasses MFA Protections

The FBI has issued a warning about cybercriminals exploiting stolen session cookies to hijack email accounts, effectively bypassing Multi-Factor Authentication (MFA) safeguards. These "Remember-Me" cookies, typically valid for 30 days, store session IDs that authenticate users without repeated logins. If intercepted, attackers can impersonate users, gaining unauthorized access to email accounts and sensitive information.

Mitigation Strategies:

Monitor Account Activity: Stay vigilant for unfamiliar login attempts or unauthorized changes.

Implement Robust Security Measures: Utilize endpoint protection solutions to detect and prevent malware that could steal session cookies.

Further Reading: Malwarebytes

Sophos Reports Sophisticated China-Based Threats Targeting Network Perimeters

Sophos recently uncovered a five-year cyber espionage campaign by China-based groups, including APT31 and APT41, that targeted network edge devices like firewalls. These attackers used zero-day vulnerabilities and custom malware to infiltrate and persist within critical infrastructure across the Indo-Pacific region, including energy suppliers, government agencies, and telecommunications. Advanced tactics include stealth operations, sabotaging firewall telemetry, and deploying an early version of a UEFI bootkit on firewall devices.

Key Insights:

Critical Infrastructure Targeting: Attackers focused on high-value assets, compromising essential services.

Advanced Persistence Tactics: Use of rootkits and stealth malware for long-term access.

Importance of Edge Device Security: Firewalls and perimeter defenses remain primary entry points for these threats.

Further Reading: Sophos News

Preparing for Emerging AI Risks

The latest Unit 42 Threat Frontier report highlights the evolving risks associated with generative AI (GenAI) in cybersecurity. As threat actors increasingly explore AI tools to enhance attack methods, traditional defenses like Zero Trust architectures remain essential, but additional AI-focused defenses are becoming critical. The report also emphasizes the growing issue of "Shadow AI," or the unauthorized use of AI tools within organizations, which poses unique security challenges.

Key Insights:

Shadow AI Risk: Unauthorized use of AI tools within organizations increases security vulnerabilities.

AI-Specific Defenses: Integrating AI-focused security measures early in development is essential for robust protection.

Continued Importance of Traditional Defenses: Zero Trust and other established architectures are still effective but need AI-specific adaptations.

Further Reading: Unit 42 - Palo Alto Networks

Extortion Actor's EDR Bypass Attempt Unveiled

Unit 42 recently investigated an extortion incident where threat actors attempted to bypass Endpoint Detection and Response (EDR) systems using a tool named "disabler.exe." This tool, derived from the publicly available EDRSandBlast, aimed to unhook EDR hooks in both user-mode libraries and kernel-mode, facilitating unauthorized access. The attackers utilized rogue systems with outdated Cortex XDR agents to test their methods, inadvertently exposing their toolkit and operations. This exposure allowed Unit 42 to trace the tool's sale on cybercrime forums and identify one of the threat actors involved.

Unit 42

Key Insights:

Advanced Evasion Techniques: Attackers are employing sophisticated tools to disable security mechanisms, highlighting the need for robust and up-to-date EDR solutions.

Operational Exposure: Testing malicious tools in uncontrolled environments can inadvertently reveal threat actor methodologies and identities.

Community Vigilance: Monitoring cybercrime forums and sharing intelligence are crucial for preempting and mitigating such threats.

Further Reading: Unit 42 - Palo Alto Networks

Surge in Fake Emergency Data Requests

The FBI has issued a warning to U.S. organizations about a rise in fraudulent emergency data requests (EDRs) by cybercriminals. These malicious actors compromise government email accounts to impersonate law enforcement, exploiting the urgency of EDRs to obtain sensitive user information from service providers without legal oversight.

Key Insights:

Tactics: Cybercriminals gain access to official email accounts, enabling them to submit convincing EDRs to companies, thereby bypassing standard legal procedures.

Motivations: The harvested data is often used for further criminal activities, including identity theft, financial fraud, and targeted cyberattacks.

Indicators of Compromise: Unusual or unexpected data requests, especially those marked as urgent, should be scrutinized for authenticity.

Recommendations:

Verification Protocols: Implement strict verification processes for all data requests, including direct confirmation with the requesting agency through known contact points.

Employee Training: Educate staff on the prevalence of fake EDRs and establish clear procedures for handling such requests.

Monitoring and Reporting: Continuously monitor for suspicious data requests and report any fraudulent attempts to the appropriate authorities.

Staying vigilant against these deceptive tactics is crucial to safeguarding sensitive information and maintaining trust with users.

Further Reading: SecurityWeek

The Credential Abuse Cycle

Recent analyses have highlighted the escalating threat of credential abuse, where cybercriminals exploit stolen usernames and passwords to infiltrate networks and access sensitive data. This cycle comprises three key stages: theft, trade, and exploitation.

Key Insights:

Credential Theft: Attackers acquire credentials through data breaches, malware (notably infostealers), and social engineering.

Underground Trading: Stolen credentials are sold on cybercriminal forums, specialized marketplaces, and messaging platforms like Telegram.

Exploitation: With these credentials, threat actors conduct account takeovers, credential stuffing, and valid account abuse, leading to data breaches and financial losses.

Further Reading: ReliaQuest Blog

Rise in SVG-Based Phishing Attacks

Cybercriminals are increasingly utilizing Scalable Vector Graphics (SVG) files in phishing emails to bypass security filters and deliver malicious content. Unlike traditional image formats, SVG files can contain embedded scripts, allowing attackers to execute malicious code when the file is opened.

Key Insights:

Evasion Techniques: SVG files are often overlooked by email security systems, enabling malicious payloads to reach recipients undetected.

Embedded Malware: Attackers embed JavaScript within SVG files to initiate redirects to phishing sites or to download malware onto the victim's device.

Increased Prevalence: There is a notable uptick in phishing campaigns leveraging SVG attachments, highlighting the need for heightened vigilance.

Further Reading: Bleeping Computer

2024 CWE Top 25 Most Dangerous Software Weaknesses Released

The Common Weakness Enumeration (CWE) has published its 2024 list of the Top 25 Most Dangerous Software Weaknesses. This annual compilation identifies the most prevalent and critical vulnerabilities that can lead to severe security breaches, including system takeovers, data theft, and application disruptions.

Key Highlights:

Top Vulnerabilities: The list features critical weaknesses such as Cross-Site Scripting (CWE-79), Out-of-Bounds Write (CWE-787), and SQL Injection (CWE-89).

Data Insights: The 2024 list is based on an analysis of 31,770 CVE Records, providing a comprehensive overview of current software security challenges.

Resource for Mitigation: The CWE Top 25 serves as a valuable resource for developers and security professionals to prioritize mitigation efforts and enhance software security practices.

Further Reading: CWE Top 25 Most Dangerous Software Weaknesses

Analysis of CISA's 2023 Top Exploited Vulnerabilities

The Cybersecurity and Infrastructure Security Agency (CISA) has released its 2023 report on the most routinely exploited vulnerabilities, providing critical insights into the threat landscape. An in-depth analysis by VulnCheck offers additional perspectives on these vulnerabilities, emphasizing their exploitation patterns and associated threat actors.

Key Insights:

Exploit Availability: Out of the 15 vulnerabilities highlighted, 14 have eight or more publicly available proof-of-concept (POC) exploits, indicating a high risk of exploitation.

Weaponized Exploits: Thirteen vulnerabilities have weaponized exploits, with five being weaponized before any public evidence of exploitation emerged.

Threat Actor Activity: Sixty named threat actors are linked to 13 of these vulnerabilities. Notably, North Korea's Silent Chollima group targeted nine of the listed vulnerabilities.

Detection Coverage: VulnCheck provides Initial Access artifacts for 12 of the 15 vulnerabilities, aiding defenders in identifying and mitigating potential threats.

Further Reading: VulnCheck Blog

Surge in Eventbrite-Based Phishing Attacks

Key Insights:

Legitimate Appearance: Utilizing Eventbrite's legitimate email domain allows attackers to bypass standard security filters, making the phishing emails appear authentic to recipients.

Malicious Payloads: The emails often contain links or attachments designed to harvest credentials or deploy malware upon interaction.

Targeted Entities: While the attacks are widespread, they predominantly focus on organizations that frequently use event management platforms, increasing the likelihood of successful exploitation.

Further Reading: KnowBe4 Blog

Large-Scale Phishing Campaign Deploys Rhadamanthys Stealer v0.7

Check Point Research has identified a significant phishing operation utilizing the latest version of the Rhadamanthys Stealer, known as Rhadamanthys.07. This campaign, dubbed "CopyRh(ight)adamantys," impersonates legitimate companies to distribute malware under the guise of copyright infringement notices.

Checkpoint Blog

Key Insights:

Phishing Tactics: Attackers send emails from Gmail accounts, alleging copyright violations on the recipient's social media pages, prompting them to download a file that initiates the malware infection.

Global Reach: The campaign targets individuals and organizations across multiple continents, with approximately 70% of impersonated companies belonging to the entertainment, media, technology, and software sectors.

Malware Capabilities: Rhadamanthys.07 includes features such as AI-powered optical character recognition (OCR) modules, enhancing its ability to extract data from infected machines.

Further Reading: Check Point Blog

Corrupted Word Documents in Novel Phishing Campaign

Key Insights:

The Lure: Emails impersonate payroll and HR departments, with themes like employee bonuses and benefits. The attachments appear as corrupted files but can be repaired by Word.

Malicious QR Codes: Upon recovery, the documents prompt users to scan a QR code branded with company logos. Scanning leads to phishing sites designed to steal Microsoft login credentials.

Detection Challenges: Most attachments used in this campaign avoid detection on platforms like VirusTotal, as they contain no active malicious code, just deceptive QR codes.

Attack Effectiveness: By exploiting overlooked document recovery mechanisms, this method bypasses traditional email security filters, increasing the likelihood of reaching victims.

Further Reading: BleepingComputer Article

Surge in Infostealer Malware Exploiting Innovative Attack Vectors

In October 2024, Check Point Research identified a significant increase in infostealer malware activity, with cybercriminals employing advanced tactics to infiltrate systems and exfiltrate sensitive data.

Key Insights:

Prevalent Malware Families: The top threats included FakeUpdates, impacting 6% of organizations worldwide, followed by Androxgh0st at 5%, and AgentTesla at 4%.

Innovative Attack Vectors: Threat actors are leveraging sophisticated methods, such as malicious advertisements in search results—a tactic known as "malvertising"—to distribute infostealers. This approach enhances the legitimacy of malicious links, increasing the likelihood of user engagement.

Global Impact: The widespread distribution of these malware families underscores the necessity for organizations to adopt proactive and adaptive security measures to counter evolving cyber threats.

Further Reading: Check Point Blog

Attackers Exploit Corrupted Files to Evade Detection

Key Insights:

Evasion Techniques: The corrupted state of these attachments prevents security tools from properly scanning them, allowing malicious emails to reach users' inboxes undetected.

User Interaction: When users attempt to open these corrupted files, applications prompt them to recover the content, leading to the display of malicious elements such as QR codes.

Malicious Outcomes: Scanning the embedded QR codes can redirect users to phishing websites designed to steal credentials or deploy malware.

This tactic highlights the continuous evolution of phishing strategies aimed at circumventing security defenses and exploiting user trust in application recovery features.

Further Reading: The Hacker News

November 2024 Executive Leadership Cybersecurity Newsletter

November 12, 2024

This is a monthly newsletter I put together for our executive team with a lean towards healthcare. Created with help from ChatGPT.

Ransomware Threats Surge Globally in 2023

Summary: The 2023 Global Ransomware Incident Map highlights a 73% rise in ransomware attacks, targeting sectors like healthcare and finance. Cybercriminals are increasingly using "big game hunting" tactics, exploiting vulnerabilities such as the MOVEit flaw. This trend underscores the urgent need for businesses to bolster cybersecurity defenses and improve incident response strategies.

Further reading: Institute for Security and Technology.

AI Risks in the Workplace

A recent study by CybSafe revealed that 38% of workers are sharing sensitive information with AI tools, often without their employer's knowledge. This raises significant security concerns, especially since over half of employees have not received training on safe AI use. With the growing reliance on AI, it's crucial for executives to implement clear guidelines and provide training on secure AI practices to mitigate the risk of data breaches and protect intellectual property.

Further reading: CybSafe - AI Security Risks.

North Korean IT Worker Incident Highlights Hiring Risks

A recent cyberattack on a company underscores the dangers of unknowingly hiring North Korean operatives. The organization accidentally hired a North Korean IT worker who accessed sensitive data and demanded a ransom. This highlights the need for stringent vetting in remote hiring practices, especially as North Korea increasingly infiltrates global companies.

Recommended Protections:

Implement strict identity verification for remote workers.

Conduct thorough background checks with global databases.

Regularly monitor employee network activity for unusual behavior.

Further reading: GBHackers - North Korean IT Worker Incident.

Healthcare Supply Chain Attacks on the Rise

A recent Proofpoint report reveals that 68% of healthcare workers have faced a supply chain cyberattack, with 82% of these incidents affecting patient care.

Key Insights:

68% of healthcare workers report supply chain cyberattacks.

82% of incidents resulted in disruptions to patient care.

Attacks cause delays in procedures and increase patient risks.

Ransomware and business email compromise are growing threats.

Further reading: Security Magazine - Supply Chain Attacks.

Change Healthcare Breach – Key Insights and Implications

In February 2024, Change Healthcare experienced a substantial ransomware attack, compromising the personal, financial, and medical information of approximately 100 million Americans. This incident highlights critical vulnerabilities within the healthcare sector and raises concerns about protecting patient data.

Key Insights:

Breach Scope: Sensitive data, including Social Security numbers, medical records, and billing information, was exposed, impacting millions of patients.

Financial Impact: UnitedHealth Group, Change Healthcare’s parent company, incurred breach-related costs totaling $2.457 billion, including $1.521 billion in direct response expenses.

Ransom Payment: Change Healthcare paid a $22 million ransom to the BlackCat ransomware group in an attempt to prevent further data exposure.

Further Reading: Change Healthcare Breach Hits 100M Americans – Krebs on Security

November 2024 Threat Intelligence Newsletter

November 11, 2024

This is a monthly newsletter I put together for our internal security team with a lean towards phishing and healthcare. Created with help from ChatGPT.

Fake Job Applications Deliver Dangerous Malware

Summary: A spear-phishing campaign is targeting HR professionals with fake job applications containing the More_eggs malware. Operated by the Golden Chickens group as part of a Malware-as-a-Service (MaaS) platform, More_eggs is a sophisticated backdoor used by multiple threat actors to infiltrate corporate networks.

Key Insights (Technical):

Delivery Method: The malware is delivered via malicious Windows Shortcut files (.LNK files) disguised as resumes. When opened, these files execute scripts without raising suspicion.

Execution Technique: The attack leverages living-off-the-land binaries (LOLBins) like wscript.exe to run malicious JavaScript code, bypassing traditional security measures.

Capabilities:

Backdoor Access: Establishes a stealthy backdoor for persistent access.

Payload Deployment: Can download and execute additional malware modules, including ransomware or credential stealers.

Reconnaissance: Gathers system information and can move laterally within the network.

Command and Control (C2): Communicates with C2 servers over HTTP/S protocols, using encrypted channels to evade detection.

Avoidance of Detection: Uses legitimate Windows processes to mask malicious activities, making it harder for security solutions to detect the intrusion.

For further details, read the full article on The Hacker News.

New Ransomware Strain Targeting Healthcare

The U.S. Department of Health and Human Services (HHS) issued a warning about a new ransomware strain, Trinity, which is actively targeting the healthcare sector. Trinity uses techniques like encrypting data and demanding ransoms within 24 hours. It has connections to other ransomware families such as Venus and 2023Lock.

Technical Key Insights:

Exploits Remote Desktop Protocol (RDP) and open ports

Uses privilege escalation to gain higher access

Encrypts critical systems rapidly after infiltration

Further reading: The Record - Trinity Ransomware Alert.

Emerging Cybersecurity Threats Highlighted in HP Wolf Security Report

The September 2024 HP Wolf Security Threat Insights Report identifies key trends in cyberattacks, including a surge in document-based malware, with 61% of threats delivered via email attachments. Attackers are increasingly using malicious archives and PDFs to bypass detection, leveraging techniques like HTML smuggling and exploiting vulnerabilities in outdated software. Threat actors are also using Generative AI to write sophisticated malware, such as AsyncRAT.

Key Insights:

39% of threats delivered in archives

Rise in AI-generated malware

Increased exploitation of known vulnerabilities

Further reading: HP Wolf Security Threat Insights Report.

North Korean IT Worker Incident Highlights Hiring Risks

Recommended Protections:

Implement strict identity verification for remote workers.

Conduct thorough background checks with global databases.

Regularly monitor employee network activity for unusual behavior.

Further reading: GBHackers - North Korean IT Worker Incident.

User-Centric Security Design Inspired by Disney

A recent article from KnowBe4 discusses how organizations can improve security by observing how employees naturally work, similar to Disney’s strategy of observing guests before building paths. The concept of "desire paths" shows that security controls should be designed around actual workflows, reducing friction and improving compliance. By aligning security with user behavior, organizations can mitigate risky workarounds and foster a more secure environment.

Further reading: KnowBe4 - Security Highways.

Healthcare Supply Chain Attacks on the Rise

A recent Proofpoint report reveals that 68% of healthcare workers have faced a supply chain cyberattack, with 82% of these incidents affecting patient care.

Key Insights:

68% of healthcare workers report supply chain cyberattacks.

82% of incidents resulted in disruptions to patient care.

Attacks cause delays in procedures and increase patient risks.

Ransomware and business email compromise are growing threats.

Further reading: Security Magazine - Supply Chain Attacks.

Microsoft’s Deceptive Honeypot Strategy Targets Phishers

Microsoft has launched a clever security strategy by creating fake Azure tenants to lure phishing attackers into honeypots. These realistic tenant environments mimic legitimate setups, tricking attackers into interacting with them. This allows Microsoft to gather valuable intelligence on phishing methods and infrastructure, which can be used to strengthen defenses and share with the wider security community. By engaging with these fake environments, phishers waste time while Microsoft gains crucial insights.

Further reading: BleepingComputer - Microsoft Honeypots.

Mobile-First Cyber Attacks on the Rise

Cyber attackers are increasingly adopting a "mobile-first" strategy, as highlighted by a new report from Zimperium. With 83% of phishing sites now targeting mobile devices and a 13% rise in mobile malware, employees’ personal devices pose a growing risk to organizations. As more employees use their smartphones for work-related tasks, organizations need to bolster mobile security and educate employees on safe practices through security awareness training.

Further reading: KnowBe4 - Mobile-First Attack Strategy.

Cybercriminals Exploiting Steam for Malware Distribution

A recent investigation highlights how cybercriminals are using Steam profiles to exploit a technique called Dead Drop Resolver (DDR) to hide Command and Control (C2) addresses within user profiles. Attackers have leveraged well-known infostealers like Vidar, Lumma, and MetaStealer to extract sensitive data from infected systems by using platforms like Steam and Telegram to evade detection.

Technical Key Insights:

Attackers embed C2 addresses in Steam profiles.

Infostealers target credentials and system data.

Use of obfuscated code and stolen certificates.

Further reading: RT Solar Blog. <---- .ru site

Rise in Phishing Attacks with AI and Impersonation Tactics

A new report from KnowBe4 reveals a 28% rise in phishing attacks during Q2 2024, with 89% of attacks involving brand impersonation. Cybercriminals are increasingly using AI-powered phishing toolkits, making it easier for less-skilled attackers to execute sophisticated campaigns. Commodity phishing attacks, primarily using hyperlinks, have surged, overwhelming organizations' defenses. With impersonation tactics being a dominant trend, organizations must enhance defenses against these evolving threats.

Key Insights:

28% increase in phishing attacks in Q2 2024.

89% of phishing emails involve impersonation.

Commodity phishing attacks up 2,700% compared to normal baselines.

Further reading: KnowBe4 Report.

Phishing-as-a-Service Platform "Sniper Dz" Exposed

A recent investigation reveals the rise of the phishing-as-a-service (PhaaS) platform "Sniper Dz," which is responsible for over 140,000 phishing websites. The platform offers phishing templates targeting major brands and hides malicious content behind proxy servers to evade detection. Additionally, attackers can exfiltrate credentials to centralized servers controlled by Sniper Dz. This growing platform enables less-skilled attackers to launch sophisticated phishing attacks with ease.

Further reading: Unit 42 - Sniper Dz PhaaS.

Dark Angels Ransomware Group Exposed

A recent investigation uncovers the stealth tactics of the Dark Angels ransomware group, which targets high-value systems with Babuk and RagnarLocker-based ransomware. Their techniques include double extortion, data exfiltration, and selective ransomware deployment to minimize detection.

Technical Key Insights:

Uses Babuk ransomware on Windows and RagnarLocker variants on Linux/ESXi servers.

Employs double extortion tactics, stealing data before encryption.

Leverages encrypted communication channels to evade detection.

Further reading: Zscaler - Dark Angels Ransomware Group.

North Korean IT Worker Fraud

SecureWorks reports that North Korean IT workers are fraudulently obtaining remote jobs to access sensitive systems and generate revenue for the regime. These individuals disguise their identities, use VPNs to hide their location, and exploit company resources once hired.

Key Insights:

Perform thorough background checks on freelance and remote candidates.

Monitor network access for unusual activity, especially from VPNs.

Educate hiring managers on this growing threat.

Further Reading: Fraudulent North Korean IT Worker Schemes

Health Care and Social Assistance Sector at Risk

Cyber threats in the Health Care and Social Assistance sector are intensifying, with phishing and social engineering attacks being the most prevalent. Organizations need to prioritize automation and Digital Risk Protection strategies to defend against these sophisticated threats.

Key Insights:

51.55% of incidents are phishing attacks using spearphishing links.

24.76% of attacks exploit public-facing applications.

Automation reduces incident containment time to 1 minute, compared to 2 hours 34 minutes for manual responses.

Further Reading: ReliaQuest Health Care Threat Landscape

AI-Driven Malware and Persistent Ransomware Threats

Check Point's Global Threat Index for September 2024 highlights the rising use of AI in malware creation, with AsyncRAT becoming one of the top threats. AI-powered scripts are being used to deliver malware like AsyncRAT through techniques such as HTML smuggling, showcasing how threat actors with limited technical skills can now leverage AI to create sophisticated attacks. This evolution underscores the need for organizations to adopt proactive security strategies.

In addition, RansomHub, a rebranded Ransomware-as-a-Service group, continues to dominate the ransomware scene, accounting for 17% of reported attacks. Other prominent malware families include FakeUpdates, targeting organizations worldwide, and Androxgh0st, which exploits vulnerabilities across platforms.

Key Insights:

51.55% of the most prevalent malware was related to phishing campaigns, with AI-driven techniques emerging.

RansomHub remains the top ransomware group with a significant global impact.

Joker leads mobile malware, targeting Android users via SMS theft and premium service fraud.

Further Reading: Check Point Threat Intelligence Report

Trinity Ransomware Hits Healthcare Sector

The Trinity ransomware group is targeting healthcare organizations with double-extortion tactics, gaining access through phishing emails and software vulnerabilities. This ransomware not only encrypts data but also steals it, pressuring victims to pay or risk exposure of sensitive information. Two healthcare providers have already been attacked, with 330GB of data compromised from a U.S.-based provider.

Key Insights:

Double extortion tactics increase the urgency for victims to pay.

Initial access often occurs through phishing or vulnerabilities.

Healthcare is a prime target due to critical operations needing quick recovery.

Further Reading: Trinity Ransomware Targets Healthcare

Threat Intelligence Update: Black Basta’s Social Engineering Tactics via Microsoft Teams

The Black Basta ransomware group has employed a sophisticated social engineering campaign targeting organizations through Microsoft Teams. By signing user emails up for multiple spam sources, Black Basta overwhelms the target with unwanted messages. Threat actors then contact the user, impersonating IT support and offering assistance with the email flood. During this call, the attacker convinces the user to install remote access software like Quick Assist or AnyDesk, providing them unauthorized access to the network. Once inside, the attackers can harvest credentials and potentially deploy ransomware.

Key Insights:

Attackers use a flood of spam emails to distract and stress targets.

Impersonation of IT support builds credibility and increases the chance of remote access.

This tactic highlights the need for training employees to verify unexpected IT requests and avoid downloading unapproved software.

Further Reading: ReliaQuest Blog on Black Basta's Techniques

Q3 2024 Ransomware Trends

The ReliaQuest Q3 2024 ransomware report highlights significant shifts in the ransomware landscape, with new groups gaining prominence and using sophisticated tactics to escalate their attacks. RansomHub has overtaken LockBit as the most active group, experiencing an 800% rise in postings from Q1 to Q3. Their growth is attributed to aggressive recruiting and lucrative profit-sharing, which has drawn affiliates from other disrupted groups. This group, along with Play ransomware, continues to exploit vulnerabilities in VPNs and public-facing applications, demonstrating the persistent risk posed by unpatched systems.

Key Insights:

RansomHub’s Rapid Rise: RansomHub posted 195 times in Q3, an 800% increase from Q1, leveraging a 90/10 profit-sharing model to attract affiliates.

Expansion into ESXi Environments: Play ransomware’s new Linux variant targets VMware ESXi servers, broadening its impact across platforms.

High-Risk Sectors: Professional services, healthcare, and manufacturing sectors are top targets due to potential operational disruptions.

Vulnerability Exploits: Attackers frequently gain access through unpatched VPNs and other internet-facing applications, emphasizing the need for timely patch management.

Further Reading: ReliaQuest Q3 Ransomware Report

Update: Q3 2024 Brand Phishing Trends

Check Point Research’s Q3 2024 report reveals that Microsoft continues as the most impersonated brand in phishing attacks, accounting for 61% of brand phishing attempts. Apple (12%) and Google (7%) follow, with new additions Alibaba and Adobe rounding out the top 10. These attacks commonly target the technology, social media, and banking sectors, as cybercriminals exploit brand familiarity to deceive users and capture credentials or payment information. Notably, new phishing sites targeting WhatsApp and Alibaba highlight the evolving strategies of threat actors seeking to exploit user trust.

Key Insights:

Microsoft Dominance: Microsoft phishing attempts made up 61% of brand impersonation attacks, with Apple and Google also highly targeted.

Sector Focus: Technology and social networks were the most impersonated sectors, followed by banking.

Evolving Phishing Tactics: Phishing websites like whatsapp-io.com and alibabashopvip.com show attackers adapting to impersonate new brands.

Further Reading: Check Point’s Q3 2024 Brand Phishing Report.

Global Surge in Cyber Attacks in Q3 2024

Check Point’s Q3 2024 report highlights a significant 75% increase in global cyber attacks compared to last year, with each organization facing an average of 1,876 weekly attacks. Sectors most impacted include Education/Research (3,828 weekly attacks), Government/Military (2,553), and Healthcare (2,434), reflecting the increased focus on these industries. Africa saw the highest regional attack rate, averaging 3,370 weekly, up 90% from 2023, while North America experienced the most ransomware attacks, making up 57% of incidents worldwide. Manufacturing was the top ransomware target, followed by Healthcare and Retail/Wholesale.

Key Insights:

Attack Growth by Sector: The Hardware Vendor industry had the largest increase in attacks, surging by 191%.

Regional Hotspots: Africa, Latin America, and Europe saw the steepest rises, with Europe experiencing an 86% year-over-year spike.

Ransomware Targets: The Manufacturing sector accounted for 30% of ransomware incidents, underscoring cybercriminals' focus on high-disruption industries.

Further Reading: Check Point Q3 2024 Report.

North Korean Cybercriminal Infiltrates UK Company

A UK-based organization recently suffered a breach after inadvertently hiring a North Korean cybercriminal posing as a remote IT worker. Once hired, the attacker used insider access to extract sensitive information and eventually demanded a ransom for its non-disclosure. This case highlights the importance of strict hiring processes for remote roles and enhanced security practices.

Key Insights:

Vetting Remote Employees: Conduct rigorous background checks to confirm credentials.

Data Security: Monitor access and behavior for early threat detection.

Remote Work Risks: Be mindful of cyber threats exploiting virtual roles.

Further Reading: KnowBe4 Article; KnowBe4 10 Hiring Updates

Partnership Between Scattered Spider and RansomHub

ReliaQuest reports a new collaboration between the Scattered Spider and RansomHub groups, merging advanced social engineering skills with network-compromising expertise to target enterprises globally. The partnership leverages RansomHub's effective 90/10 profit-sharing model, attracting experienced threat actors from disrupted groups. This collaboration allows attackers to target critical virtual infrastructures, such as ESXi servers, which host key applications, enabling high-impact ransomware attacks that pressure victims to pay swiftly.

Key Insights:

Targeting of ESXi Servers: These servers, often running multiple virtual machines, are attractive for ransomware attacks as they disrupt operations across organizations.

Social Engineering Tactics: Scattered Spider's expertise in impersonating IT staff aids in gaining unauthorized access to organizational networks.

Rising Threat of RansomHub: RansomHub has rapidly gained dominance, surpassing groups like LockBit, indicating a strategic shift in ransomware collaborations and effectiveness.

For more details, explore the full article at ReliaQuest.

Social Engineering Exploits Valid Accounts

Recent incidents highlight how threat actors are compromising legitimate accounts through social engineering tactics. By manipulating individuals into divulging sensitive information or performing specific actions, attackers gain unauthorized access to systems and data. This method often involves impersonating trusted entities or creating convincing scenarios to deceive targets.

Key Insights:

Impersonation Tactics: Attackers frequently pose as IT support or company executives to extract credentials.

Phishing Campaigns: Sophisticated emails and messages are crafted to appear authentic, luring recipients into providing access details.

Insider Threats: Compromised accounts can be used to launch further attacks within an organization, making detection challenging.

Further Reading: KnowBe4 Article on Social Engineering Exploits.

North Korean Group Adopts Play Ransomware

Unit 42 has identified that the North Korean state-sponsored threat group, Jumpy Pisces (also known as Andariel), has begun collaborating with the Play ransomware group, Fiddling Scorpius. This marks a significant shift in Jumpy Pisces' tactics, moving from traditional cyber espionage to active participation in ransomware operations. The group gained initial access to networks via compromised user accounts, deploying tools like Sliver and their custom malware, DTrack, to facilitate lateral movement and persistence. This collaboration underscores the evolving ransomware landscape, where nation-state actors are increasingly engaging in financially motivated cybercrime.

Key Insights:

Tactical Shift: Jumpy Pisces is now utilizing existing ransomware infrastructures, indicating a move towards financial cybercrime.

Advanced Tools: The group employs sophisticated tools such as Sliver and DTrack for network infiltration and persistence.

Global Targeting: Their activities are expected to target a wide range of victims worldwide, necessitating heightened vigilance.

Further Reading: Unit 42 Article on Jumpy Pisces and Play Ransomware.

Key Cyber Threat Actors in 2024

ReliaQuest's recent analysis identifies five prominent cyber threat actors significantly impacting the cybersecurity landscape in 2024:

RansomHub: Emerging as a dominant ransomware group, RansomHub has surpassed previous leaders like LockBit and ALPHV, posing substantial risks to organizations globally.

IntelBroker: As the acting administrator of BreachForums, IntelBroker oversees activities on one of the largest English-language cybercriminal forums, facilitating various malicious operations.

APT41: A Chinese state-affiliated group, APT41 continues to engage in espionage activities, targeting sectors such as healthcare, telecommunications, and finance.

APT29: Known for its sophisticated espionage campaigns, this Russian state-affiliated group remains active in infiltrating governmental and private sector networks.

KillSec: Originally aligned with the "Anonymous" hacktivist collective, KillSec has recently shifted towards financially motivated ransomware activities, increasing its threat profile.

Further Reading: ReliaQuest Article on Critical Threat Actors.

Halloween’s Digital Threats of 2024

Halloween brings tales of horror, but in 2024, some of the scariest threats come from the digital realm. Cybercriminals are increasingly using advanced tools to target individuals and organizations with new forms of AI-driven malware, IoT exploits, and social engineering tricks that play on our trust.

Key Insights:

AI-Powered Attacks: These cyber “ghosts” can adapt to evade detection, making attacks like spear-phishing and deepfakes more convincing.

IoT Vulnerabilities: Over 20,000 vulnerable IoT devices, including cameras and routers, have become entry points for attackers, posing risks to privacy and security.

Social Media Exploitation: Personal data scraped from social platforms is being weaponized for phishing and blackmail, creating "digital dossiers" for targeted attacks.

Fake Calls and Malware: Scammers posing as bank representatives are using fake calls to steal sensitive information, a trick that’s led to an increase in identity theft and financial loss.

Dating Apps and Location Data: Privacy risks on dating apps, including inadvertent location sharing, are turning digital encounters into real-life safety concerns.

Further Reading: Check Point’s guide on Halloween Cyber Threats.

November 2024 Cybersecurity Awareness Newsletter

November 8, 2024

This is a newsletter I share internally as part of our internal security awareness program. Feel free to take and use in your organization. Created with help from ChatGPT

Fake Job Applications Deliver Dangerous Malware

Summary: A spear-phishing campaign has been targeting HR professionals with malicious job applications. Attackers use fake resumes containing More_eggs malware, a backdoor designed to steal credentials. This malware, part of a Malware-as-a-Service (MaaS) platform operated by the Golden Chickens group, can be used by multiple threat actors. The attack chain involves malicious Windows shortcut (LNK) files that initiate the infection upon execution, allowing attackers to perform reconnaissance and drop additional payloads.

Key Insight: Be cautious when handling job applications, especially those involving downloadable files from unknown sources.

For further details, read the full article on The Hacker News.

Data Privacy Risks in Connected Cars

Modern connected vehicles collect vast amounts of data, including driving habits, location, and even biometric information like voice commands. A recent analysis by CHOICE reveals that many popular car brands share this data with third-party companies, raising privacy concerns. Brands like Kia, Hyundai, and Tesla collect and share voice and video data, while others gather driving behaviors. This highlights the importance of understanding your car’s data collection practices and opting out where possible.

Further reading: CHOICE - Connected Cars Tracking Your Data.

North Korean Hackers Targeting Job Seekers

A new campaign by North Korean hackers is targeting job seekers, particularly in the tech industry, according to a recent report. Hackers impersonate recruiters on platforms like LinkedIn, luring individuals into downloading malware disguised as video conferencing tools. The malware is designed to steal cryptocurrency and sensitive corporate data, posing risks to both individuals and organizations. Job seekers should remain cautious when interacting with unsolicited offers and recruiters.

Further reading: KnowBe4 - North Korean Hackers.

Election Season and Cybersecurity Concerns

As the 2024 election season progresses, a recent Malwarebytes survey reveals that 74% of respondents consider it a risky time for personal information. Fears of scams, privacy breaches, and cyber interference are high, with 52% of people expressing concern about falling prey to scams through political ads. Many are taking precautions, such as using two-factor authentication and password managers, to secure their data.

Key Insights:

74% view election season as risky for personal data.

52% fear scams via political ads.

Increased adoption of security practices like two-factor authentication.

Further reading: Malwarebytes - Election Season Raises Fears.

North Korean IT Worker Incident Highlights Hiring Risks

Recommended Protections:

Implement strict identity verification for remote workers.

Conduct thorough background checks with global databases.

Regularly monitor employee network activity for unusual behavior.

Further reading: GBHackers - North Korean IT Worker Incident.

Mobile-First Cyber Attacks on the Rise

Further reading: KnowBe4 - Mobile-First Attack Strategy.

Microsoft Spoofing Threats on the Rise

A recent report from Harmony Email & Collaboration highlights over 5,000 fake Microsoft emails targeting organizations within a single month. These emails, often impersonating legitimate administrators, use sophisticated obfuscation techniques, making it difficult for users to detect. The risks include account takeovers, ransomware, and data theft.

Further reading: Check Point Blog.

New VPN Credential Attack Uses Sophisticated Social Engineering

A recent attack uncovered by security researchers targets organizations using VPNs through a combination of social engineering, fake login sites, and phone calls. Attackers impersonate a helpdesk, direct users to a spoofed VPN login page, and steal credentials. They also prompt users for multi-factor authentication (MFA) codes to gain access to corporate networks. This attack highlights the importance of user vigilance and strong security training.

Attack Chain:

Impersonation of helpdesk.

Directs victim to fake VPN login page.

Steals credentials and MFA codes.

Further reading: KnowBe4 - New VPN Credential Attack.

Operation Kaerb Takedown

Operation Kaerb successfully dismantled iServer, a Phishing-as-a-Service platform responsible for facilitating mobile credential theft targeting nearly half a million victims. iServer enabled low-skilled criminals to unlock stolen phones by phishing for user credentials. This takedown is a reminder of the evolving tactics cybercriminals use and underscores the importance of staying vigilant against mobile-focused phishing attacks.

Further Reading: Operation Kaerb on KnowBe4

Sextortion Scams on the Rise

Our team has recently been targeted by sextortion scams, where attackers use publicly available information to create threatening messages designed to elicit fear and urgency. These scams often appear more credible by including personal details. If you receive such a message, avoid engagement or payment—report it to our security team immediately by using the suspicious email button in Outlook.

Further Reading: KnowBe4 Article on Sextortion Scams.

Update: Q3 2024 Brand Phishing Trends

Key Insights:

Microsoft Dominance: Microsoft phishing attempts made up 61% of brand impersonation attacks, with Apple and Google also highly targeted.

Sector Focus: Technology and social networks were the most impersonated sectors, followed by banking.

Evolving Phishing Tactics: Phishing websites like whatsapp-io.com and alibabashopvip.com show attackers adapting to impersonate new brands.

Further Reading: Check Point’s Q3 2024 Brand Phishing Report.

North Korean Cybercriminal Infiltrates UK Company

Key Insights:

Vetting Remote Employees: Conduct rigorous background checks to confirm credentials.

Data Security: Monitor access and behavior for early threat detection.

Remote Work Risks: Be mindful of cyber threats exploiting virtual roles.

Further Reading: KnowBe4 Article; KnowBe4 10 Hiring Updates

North Korean Threat Actors Pose as Recruiters to Target Job Seekers

Palo Alto Networks' Unit 42 recently uncovered a campaign in which North Korean threat actors pose as recruiters to lure tech job seekers into downloading malware disguised as legitimate communication tools. Known as the "Contagious Interview" campaign, this operation involves malware variants like BeaverTail and InvisibleFerret, which are capable of stealing credentials, exfiltrating sensitive files, and targeting cryptocurrency wallets. Victims are approached on professional platforms like LinkedIn, and then directed to install fake interview applications that serve as a conduit for malware.

Key Insights:

Sophisticated Impersonation Tactics: Attackers convincingly impersonate recruiters and use realistic job offers to build trust with targets.

Multifunctional Malware: The malware used can harvest browser passwords, access cryptocurrency wallets, and install backdoors, enhancing its threat potential.

Organizational Risk: Beyond individual targets, successful infections on company devices can lead to broader data breaches within organizations.

As remote work and digital hiring continue to rise, it’s critical to validate the legitimacy of recruiters and avoid downloading unverified software for job interviews.

Further Reading: Unit 42 Report on North Korean Recruitment Tactics

Pig Butchering Scams Target Job Seekers

Proofpoint has identified a new twist in cryptocurrency fraud, known as "Pig Butchering," targeting job seekers. Scammers posing as recruiters lure victims into fake job roles, eventually guiding them to invest in fraudulent cryptocurrency platforms. Victims see initial "profits" to build trust, but ultimately lose their entire investment. These scams often begin on social media, moving to platforms like WhatsApp or Telegram for further manipulation.

Further Reading: Proofpoint Article.

Foreign Disinformation on U.S. Hurricanes

Recent intelligence shows that operatives from Russia, China, and Cuba have spread false information about U.S. hurricanes to deepen political divides. AI-generated images and misleading posts claimed federal relief was denied or funds were diverted to foreign conflicts, aiming to erode trust in U.S. disaster response. Be cautious of divisive narratives or unverified disaster images on social media, as they may be part of coordinated disinformation efforts.

Further Reading: NBC News Article.

Social Engineering Exploits Valid Accounts

Key Insights:

Impersonation Tactics: Attackers frequently pose as IT support or company executives to extract credentials.

Phishing Campaigns: Sophisticated emails and messages are crafted to appear authentic, luring recipients into providing access details.

Insider Threats: Compromised accounts can be used to launch further attacks within an organization, making detection challenging.

Further Reading: KnowBe4 Article on Social Engineering Exploits.

Major Data Breach at Change Healthcare Affects 100 Million Americans

In February 2024, Change Healthcare, a leading U.S. healthcare technology company, experienced a significant ransomware attack that compromised the personal, financial, and medical information of approximately 100 million individuals. The breach disrupted healthcare services nationwide, highlighting vulnerabilities in the sector's cybersecurity defenses.

Key Insights:

Scope of Breach: The attack exposed sensitive data, including medical records, billing information, and personal identifiers such as Social Security numbers and driver's license details.

Financial Impact: UnitedHealth Group, Change Healthcare's parent company, reported direct breach response costs of $1.521 billion and total cyberattack impacts of $2.457 billion.

Ransom Payment: The company paid a $22 million ransom to the BlackCat ransomware group in an attempt to secure the stolen data.

Further Reading: Change Healthcare Breach Hits 100M Americans – Krebs on Security

Student Loan Phishing Scams Targeting Millions

Cybercriminals are exploiting confusion around student loan forgiveness with a surge in phishing emails targeting millions of Americans. These emails use advanced techniques to look legitimate and bypass email filters, making them harder to detect.

What You Can Do to Stay Safe:

Watch for Red Flags: Be cautious with emails related to student loans, especially those asking for immediate action or personal information. Verify any claims by contacting your loan service provider directly.

Check the Source: Always look closely at the sender’s email address. Official communication will come from verified addresses, not random or suspicious-looking senders.

Enable Multi-Factor Authentication (MFA): Use MFA on your financial accounts for extra security, making it harder for attackers to gain access if they obtain your credentials.

Be Prepared: Know how to report a suspicious email in your email system, and don’t hesitate to delete anything that seems off.

Further Reading: Check Point Blog.

Security Awareness Newsletter - October 2024

October 18, 2024

This is a newsletter I share internally as part of our internal security awareness program. Feel free to take and use in your organization. Created with help from ChatGPT

Spamouflage: State-Linked Influence Operations Target U.S. Elections

Summary: A Chinese state-linked influence operation, Spamouflage, is ramping up efforts to sway U.S. political discourse ahead of the 2024 election. By posing as U.S. voters and using AI-generated content, they spread divisive narratives on social media about sensitive issues like gun control and racial inequality. These tactics highlight the importance of vigilance against foreign influence campaigns and fake online personas.

Key Insight: Verify online sources and stay aware of potential influence operations.

Further Reading: Graphika Report

Lazarus Hackers Target Job Seekers with Malware-Laden Job Offers

Summary: The Lazarus Group is actively targeting job seekers, particularly those in blockchain-related fields, by disguising malware within fake job offers. The group utilizes platforms like LinkedIn, Upwork, and Telegram to distribute malicious software, including the "BeaverTail" malware, which steals credentials and cryptocurrency wallet data. Job seekers should be cautious of unsolicited job offers and avoid downloading unfamiliar files.

Key Insight: Always verify job offers and avoid downloading files from unknown sources.

Further Reading: GBHackers Article

Foreign Influence Operations Target U.S. 2024 Election

Summary: U.S. intelligence officials warn of increased influence operations from Russia, China, and Iran aimed at U.S. voters ahead of the 2024 election. These operations, while not yet disrupting voting infrastructure, spread disinformation through media, PR firms, and American influencers. A recent U.S. indictment highlights Russia's attempts to covertly funnel pro-Russian narratives into right-wing media, signaling the need for heightened vigilance as the election approaches.

Key Insight: Stay alert to disinformation and foreign influence in political content.

Further Reading: CyberScoop Article

Lowe's Employees Targeted by Google Ads Phishing Campaign

Summary: Lowe's employees were recently targeted by a phishing attack using fraudulent Google ads mimicking the MyLowesLife portal. Attackers designed fake login pages to steal employee credentials. This highlights the dangers of using search engines to access work-related sites. Employees should be reminded to avoid clicking on sponsored links and instead bookmark legitimate sites to protect against phishing attacks.

Tip: Always access work portals through bookmarks or trusted URLs, not through search engines.

Further Reading: Malwarebytes Blog

Email Breaches at Welcome Health & United Way of Connecticut

Summary: Welcome Health and United Way of Connecticut reported email account breaches compromising sensitive data. At Welcome Health, patient information and contractor Social Security numbers were exposed, while a phishing attack on United Way's employee email compromised data of up to 8,039 patients. Both organizations have responded with enhanced security measures and offered credit monitoring to affected individuals.

Further Reading: HIPAA Journal

False Claims of Hacked Voter Data Intended to Undermine U.S. Elections

Summary: The FBI and CISA have issued a joint public service announcement warning about false claims of hacked voter information. Foreign actors may spread disinformation to erode public confidence in U.S. elections, especially by exaggerating claims of compromised voter data. The agencies urge citizens to critically evaluate such claims and remind that much voter information is public.

Key Insight: Stay vigilant against disinformation campaigns designed to sow distrust in election processes.

Further Reading: CISA Announcement

Beware of Parking Payment Scams Involving Fake QR Codes

Summary: Drivers in the UK are being targeted by scammers who place fake QR codes on parking machines. These codes lead to fraudulent websites designed to steal payment information. The RAC warns drivers to avoid using unfamiliar QR codes and instead rely on cash, card, or official apps for parking payments. This "quishing" scam has been reported across multiple UK regions, with an increasing number of incidents.

Key Insight: Be cautious when scanning QR codes, especially in public places like parking machines.

Further Reading: RAC News

Florida Healthcare Data Leak Exposes Thousands of Doctors and Hospitals

Summary: A data breach at MNA Healthcare exposed sensitive information of over 14,000 healthcare workers and 10,000 hospitals, including encrypted Social Security Numbers, addresses, and job details. The breach, caused by a misconfigured database, increases risks of identity theft and fraud. Healthcare professionals and institutions are advised to enhance cybersecurity measures, monitor financial accounts, and consider identity theft protection.

Further Reading: Cybersecurity News

New Sextortion Scam Uses Photos of Victims' Homes

Summary: A recent wave of sextortion scams has taken a more personalized approach, including photos of victims' homes in threatening emails. Scammers claim to have recorded compromising footage through malware and demand Bitcoin payments to avoid releasing the videos. The photos are often pulled from online mapping services to increase intimidation. To stay safe, avoid responding to such emails, keep webcams covered when not in use, and report incidents to law enforcement.

Further Reading: Krebs on Security

Google Password Manager Now Syncs Passkeys Across Devices

Summary: Google Password Manager now automatically syncs passkeys across Windows, macOS, Linux, Android, and ChromeOS devices. Passkeys, which use biometrics like fingerprints and facial recognition, offer a more secure alternative to passwords. With this update, passkeys are encrypted and accessible on all devices, enhancing security and convenience for users. Google has also introduced a new PIN feature to ensure end-to-end encryption for synchronized data.

Further Reading: BleepingComputer Article

FTC Report Exposes Surveillance by Social Media and Streaming Giants

Summary: The FTC has released a report revealing that major social media and video streaming platforms engage in extensive data collection and surveillance of users, including children and teens. The report highlights inadequate privacy protections and raises concerns about the use of data for targeted advertising. The FTC recommends stronger privacy laws, data minimization, and enhanced safeguards for younger users.

Key Insight: Ensure your social media use is mindful of privacy risks, and review settings to limit data sharing.

Further Reading: FTC Report

Operation Overload: A Disinformation Threat Targeting U.S. Elections

Summary: Operation Overload, a Russia-linked disinformation campaign, is ramping up efforts targeting U.S. voters ahead of the 2024 presidential election. The operation uses AI-generated fake content, such as fabricated TikTok videos and doctored news articles, to spread false narratives. Recent emails aimed at smearing Vice President Kamala Harris highlight the evolving tactics. It's critical for newsrooms and voters to remain vigilant and fact-check claims.

Key Insight: Be cautious of AI-generated content that mimics legitimate sources to manipulate public opinion.

Further Reading: CheckFirst Report

Phishing Attack Uses Two-Step Approach to Evade Detection

Summary: A new phishing attack leverages a two-step process, using legitimate platforms like Microsoft Office Forms as an intermediary to evade detection. After clicking the phishing email link, users are directed to a legitimate form before being redirected to a fake login page designed to steal credentials. This sophisticated approach helps attackers bypass security filters by exploiting trusted platforms.

Key Insight: Be cautious of phishing links that utilize legitimate services as intermediaries before redirecting to malicious sites.

Further Reading: KnowBe4 Blog

Investment Scam Losses Surge Six-Fold Since 2021

Summary: The Better Business Bureau reports a six-fold increase in losses from investment scams since 2021. Scammers frequently exploit dating platforms and hacked social media accounts to lure victims into fraudulent cryptocurrency schemes. Victims are often promised high returns on investments, only to lose significant amounts of money. Common red flags include promises of guaranteed returns, little-known cryptocurrencies, and requests to share wallet details.

Key Insight: Be cautious of unsolicited investment offers and avoid sharing cryptocurrency wallet details with unverified individuals.

Further Reading: KnowBe4 Blog

HR-Related Phishing Tactics on the Rise

Summary: Threat actors are using HR-related phishing emails, posing as internal messages like "Updated Employee Handbook," to trick employees into clicking malicious links. These attacks often lead victims to fake login pages that steal their credentials. The emails appear legitimate, making it crucial for employees to be extra cautious with HR communications and verify any unusual requests directly with their HR department.

Key Insight: Always verify HR-related emails before clicking links or providing sensitive information.

Further Reading: Cofense Blog

Foreign Influence Operations Using AI to Target U.S. Elections

Summary: According to a recent ODNI election security update, foreign actors—primarily Russia and Iran—are increasingly using AI-generated content to influence U.S. voters. These actors are deploying manipulated media across various formats, including text, images, audio, and video, to spread disinformation and fuel divisive political narratives. As Election Day approaches, U.S. citizens should be vigilant about AI-generated content and misinformation campaigns.

Key Insight: Verify sources and be cautious of sensationalized or divisive media, especially content that seems AI-generated.

Further Reading: ODNI Election Security Update

Expert Tips to Identify Phishing Links

Summary: Phishing attacks are becoming more sophisticated, but there are key ways to spot phishing links. Security experts advise checking for suspicious URLs with complex characters, paying attention to redirect chains, and inspecting page titles or missing favicons. Attackers also abuse CAPTCHA and Cloudflare checks to mask phishing attempts. Tools like ANY.RUN’s Safebrowsing can help safely analyze suspicious links before engaging with them.

Key Insight: Always inspect URLs carefully and use tools to analyze suspicious links in a safe environment.

Further Reading: The Hacker News

The Dangerous Intersection Between Cybercrime and Harm Groups

Summary: A recent investigation reveals that some cybercriminals involved in ransomware attacks are also tied to violent online communities. These groups, often targeting young people, manipulate victims into self-harm or harming others. They use platforms like Telegram and Discord to coordinate harassment and extortion, demonstrating the increasing overlap between cybercrime and real-world violence.

Key Insights:

Cybercriminals are also involved in harm groups.

Young people are often victims of online manipulation.

Cybercrime is increasingly crossing into physical violence.

Cyber Predators Exploit Healthcare Vulnerabilities with Ransomware and Data Theft

Summary: Cybercriminals are increasingly targeting healthcare organizations, exploiting weaknesses to steal patient data and extort hospitals via ransomware attacks. These criminals collaborate through darknet marketplaces, offering ransomware-as-a-service, and trading access to compromised healthcare systems. With attacks up 32% globally in 2024, healthcare remains a prime target due to its valuable data and often outdated security infrastructure.

Key Insights:

Healthcare sees an average of 2,018 attacks weekly, with APAC and Latin America hit hardest.

Ransomware-as-a-service empowers less experienced criminals.

Hospitals face high risks due to the critical nature of their operations.

Beware of Funeral Streaming Scams on Facebook

Summary: Scammers are exploiting Facebook by creating fake funeral streaming groups, tricking grieving families into providing credit card information to view a supposed service. These fraudulent groups use the deceased's images to appear legitimate and direct users to malicious websites requesting payment. This scheme preys on vulnerable people, often at their most emotional moments.

Key Insights:

Fake funeral streaming pages ask for credit card details.

Scammers use social media to create convincing, emotional traps.

Stay vigilant and verify event details before engaging.

Phishing Campaign Exploits Google Apps Script for Sophisticated Attacks

Summary: A new phishing campaign manipulates Google Apps Script macros to target users across multiple languages. The phishing emails falsely claim to provide “account details” and include links to malicious pages mimicking legitimate Google services. Victims are tricked into disclosing sensitive information, leading to data theft and operational disruption.

Key Insights:

Attack uses Google’s infrastructure to appear legitimate.

Affected users may disclose sensitive data via a deceptive Google Apps Script URL.

Advanced email filtering, real-time URL scanning, and phishing awareness training are crucial defenses.

For more details, visit Checkpoint Research.

New Windows PowerShell Phishing Campaign Highlights Serious Risks

Summary: A recently discovered phishing campaign uses GitHub-themed emails to trick recipients into launching PowerShell commands, enabling the download of password-stealing malware. The attack uses social engineering techniques, disguising itself as a CAPTCHA verification process. By exploiting PowerShell’s automation capabilities, attackers gain unauthorized access to credentials stored on victims' systems.

Key Insights:

Attack targets GitHub users but could be adapted for broader use.

Exploits PowerShell to execute malicious commands.

Vigilance and disabling unnecessary PowerShell access are crucial defenses.

For more, visit Krebs on Security.

Phishing Attacks Exploit Content Creation and Collaboration Platforms

Summary: A recent phishing campaign abuses popular content creation and collaboration tools to trick users into clicking malicious links. Cybercriminals use legitimate-looking posts and documents with embedded phishing URLs, leading to credential theft through fake login pages. These attacks have been seen in both business and educational environments.

Key Insights:

Phishing emails from trusted platforms contain hidden threats.

Common platforms include design tools and document-sharing services.

Users should be cautious of unexpected links and suspicious login requests.

For more information, visit KnowBe4.

Scammers Exploit Virtual Shopping Lists to Target Walmart Customers

Summary: Cybercriminals are using Walmart’s virtual shopping list feature to scam customers by embedding fake customer support numbers. Clicking these links, often promoted via malicious ads, leads users to scammers who impersonate law enforcement or bank employees. Victims are coerced into transferring funds, often under false threats of legal consequences.

Key Insights:

Scammers misuse legitimate platforms like Walmart's shopping lists.

Ads can redirect to fake support numbers.

Stay vigilant of scare tactics and unsolicited requests for money.

For more details, visit KnowBe4.

Cyber Threats Looming for the 2024 U.S. Election

Summary: As the 2024 U.S. election approaches, cyber threats from nation-state actors, hacktivists, and cybercriminals are expected to rise. These include disinformation campaigns, phishing attacks, and attacks on electoral infrastructure. Businesses should brace for phishing campaigns and SEO poisoning targeting politically charged topics.

Key Insights:

Nation-state groups may conduct hack-and-leak operations and influence campaigns.

Expect a surge in phishing attacks and scams using election-related themes.

Businesses should implement advanced cybersecurity measures to mitigate risks.

For more details, visit ReliaQuest.

Timeshare Scam Linked to Mexican Drug Cartel Targets U.S. Owners

Summary: The FBI has issued a warning about a telemarketing scam targeting timeshare owners, linked to the Jalisco New Generation drug cartel. Scammers posing as buyers lure victims into paying advance fees for fraudulent timeshare sales. The funds are used to finance other cartel activities. Victims are often reluctant to report the scam due to fear or embarrassment.

Key Insights:

Scammers pose as buyers offering above-market prices.

Victims lose thousands in fraudulent fees.

Report scams to authorities to prevent further harm.

For more details, visit Krebs on Security.

Phishing Threat Intelligence Newsletter for October 2024

October 18, 2024

This is a monthly newsletter I put together for our internal security team with a lean towards phishing and healthcare. Created with help from ChatGPT.

Phishing via Google Ads Targets Lowe’s Employees

Summary: Interesting technicque to watch. A recent malvertising campaign targeted Lowe’s employees by impersonating the company’s employee portal through fraudulent Google ads. Threat actors used phishing pages that closely resembled the legitimate MyLowesLife site to steal login credentials. These attacks underline the need for caution when clicking on sponsored links, especially for accessing internal portals.

Key Insight: Avoid using search engines to access internal portals—bookmark them instead to reduce exposure to phishing.

Further Reading: Malwarebytes Blog

Emerging Phishing Threats: Typosquatting and Brand Impersonation Trends

Summary: Zscaler's research uncovers a growing trend in phishing attacks involving typosquatting and brand impersonation. Attackers are increasingly mimicking popular brands using lookalike domains to trick users into divulging sensitive information.

Key Insights:

Over 10,000 malicious domains detected between February and July 2024.

Google, Microsoft, and Amazon are the top impersonated brands.

Attackers use free TLS certificates to evade detection.

Sectors like Internet Services and Online Shopping are prime targets.

For more details, visit Zscaler's blog.

Suspected Espionage Campaign Delivers “Voldemort” Malware

Summary: Proofpoint researchers identified a sophisticated espionage campaign distributing custom malware named "Voldemort." This campaign used advanced techniques like abusing Google Sheets for command and control (C2) and targeting organizations globally by impersonating tax authorities. The malware, likely tied to an APT actor, has intelligence-gathering capabilities and is suspected of espionage rather than financial gain.

Key Insights:

Targeted over 70 organizations across multiple sectors.

Abuses Windows file protocols and advanced C2 mechanisms.

For more details, visit Proofpoint's blog.

Scattered Spider Targets Insurance and Financial Sectors Using Cloud Ransomware

Summary: The Scattered Spider group has intensified its ransomware attacks on the insurance and financial industries, leveraging cloud vulnerabilities and phishing campaigns to compromise high-privileged accounts. The group uses social engineering tactics, including SIM swapping, smishing, and cloud credential theft, to gain unauthorized access. Their advanced techniques, combined with partnerships like BlackCat, have made them a formidable threat to cloud-based infrastructures.

Further Reading: EclecticIQ Blog

Top Cyber Attacker Techniques: May-July 2024 Insights

Summary: ReliaQuest’s report from May to July 2024 highlights the growing threat of phishing, accounting for 37% of incidents. The “SocGholish” malware, delivered via fake browser updates, remains widespread. Additionally, exposed credentials make up 88.75% of alerts, posing significant risks. Key sectors targeted by ransomware include manufacturing and tech. To defend against these threats, organizations should enhance multi-factor authentication, monitor user behavior, and deploy rapid response measures.

Key Insights:

Phishing remains a top threat.

Credential exposure is a major risk.

Ransomware is heavily targeting manufacturing and tech sectors.

Further Reading: ReliaQuest Blog

Unveiling RECORDSTEALER: A Persistent Infostealer Targeting Sensitive Data

Summary: RECORDSTEALER (Raccoon Stealer V2) is a malware targeting sensitive information like passwords, payment data, and cryptocurrency wallets. It infects systems through malvertising and fake downloads, focusing on web browsers for data exfiltration. RECORDSTEALER’s infrastructure has been disrupted, but related malware such as VIDAR and STEALC are still active.

Key Insights:

Uses browser exploits for credential harvesting.

Communicates with command-and-control servers using encrypted channels.

Evades detection via obfuscation and process injection.

Further Reading: Google Cloud Blog

Splinter: A New Post-Exploitation Red Team Tool

Summary: Splinter, a post-exploitation tool developed in Rust, allows for remote command execution, file uploads, and process injection. It uses encrypted HTTPS for command-and-control (C2) communication, making it harder to detect. Initially built for red team operations, the tool's misuse poses significant risks to compromised systems.

Technical Key Insights:

Splinter supports process injection into system processes.

Uses encrypted C2 channels for communication.

Built with Rust for enhanced performance and cross-platform compatibility.

Further Reading: Unit 42 Article

Supershell Malware Targeting Linux SSH Servers

Summary: Supershell, a Go-based backdoor, is being deployed on Linux SSH servers through brute-force attacks. Once installed, it provides attackers with remote access via a reverse shell, enabling them to hijack systems and deploy additional payloads like cryptocurrency miners.

Key Insights:

Uses reverse shell for remote control.

Exploits weak SSH credentials via brute-force attacks.

Can execute additional malicious payloads, such as XMRig miners.

Written in Go, enhancing cross-platform capabilities.

Further Reading: AhnLab ASEC Report

Cybercriminals Exploit Legitimate Software with CAMO Techniques

Summary: ReliaQuest's latest findings reveal the growing use of legitimate IT tools by cybercriminals in "Commercial Applications, Malicious Operations" (CAMO). These tools, such as PDQ Deploy and SoftPerfect, are used for spreading ransomware, exfiltrating data, and evading detection by blending into normal network operations. This trend complicates incident detection and response.

Key Insights:

CAMO tools can bypass detection by leveraging legitimate system capabilities.

Attackers use trusted tools to move laterally and exfiltrate data.

Network segmentation, monitoring, and whitelisting can mitigate these threats.

Further Reading: ReliaQuest Blog

Phishing Attack Uses Two-Step Approach to Evade Detection

Key Insight: Be cautious of phishing links that utilize legitimate services as intermediaries before redirecting to malicious sites.

Further Reading: KnowBe4 Blog

Surge in Malicious Links Marks 133% Increase in Q1 2024

Summary: Phishing attacks using malicious links surged by 133% in the first quarter of 2024, as attackers shift away from traditional attachments to evade detection. Links allow attackers to obfuscate malicious content and use redirects, CAPTCHA, and legitimate services to conceal their payloads. This growing trend emphasizes the need for organizations to enhance email security and continuously train employees to spot suspicious links.

Further Reading: KnowBe4 Blog

HR-Related Phishing Tactics Grow More Sophisticated

Summary: Threat actors are increasingly using HR-related phishing emails, disguised as official company communications, to trick employees into providing credentials. These phishing attacks often use urgent subjects like “Revised Employee Handbook,” leading victims to a fake Microsoft login page. Attackers use the stolen credentials for further exploitation. The campaign evades email security platforms by leveraging legitimate-looking content and psychological manipulation.

Further Reading: Cofense Blog

Inc Ransom Attack: Advanced Extortion Techniques Emerge

Summary: The Inc Ransom group uses advanced techniques like data exfiltration without encryption, exploiting firewall vulnerabilities and hiding within legitimate network traffic using tools like Impacket and PowerShell. By deploying Rclone for data transfer, they evade detection while pressuring victims through extortion. The report includes details on a recent attack against a healthcare organization.

Technical Key Insights:

Use of Rclone for stealth data exfiltration.

Abuse of firewall vulnerabilities for initial access.

Impacket and PowerShell used to blend into legitimate traffic.

Data theft replaces encryption in the extortion strategy.

Further Reading: ReliaQuest Blog

RansomHub Reigns, Meow Ransomware Surges in August 2024

Summary: RansomHub leads ransomware threats, targeting Windows, macOS, Linux, and VMware ESXi systems using sophisticated encryption techniques. Meanwhile, Meow ransomware shifts focus from encryption to selling stolen data on leak marketplaces, employing the ChaCha20 encryption algorithm. Both groups aggressively target exposed RDP configurations and vulnerable systems.

Technical Analysis:

RansomHub uses robust encryption across multi-platform environments, complicating recovery.

Meow exploits ChaCha20 for file encryption and omits .exe files, leveraging leak sites for extortion.

Both utilize exposed RDP ports for initial access.

Further Reading: Checkpoint Blog

Phishing-as-a-Service Platform Sniper Dz Gains Traction with Unique Tactics

Summary: The Sniper Dz Phishing-as-a-Service (PhaaS) platform has facilitated the creation of over 140,000 phishing websites. It offers pre-made phishing templates targeting major brands, leveraging public proxy servers and SaaS platforms to evade detection. Sniper Dz uses unique obfuscation techniques, enabling phishing campaigns to bypass traditional security measures while collecting stolen credentials.

Key Insights:

Sniper Dz uses proxy servers to hide phishing activities, making detection more difficult.

Phishers can easily launch campaigns targeting popular services without needing technical expertise.

Integrating proxy detection mechanisms and monitoring SaaS usage can help identify such attacks.

Further Reading: Unit42 Article

DragonForce Ransomware: Advanced Tactics and Affiliate Program

Summary: DragonForce, using both LockBit and ContiV3 forks, targets critical sectors through its RaaS affiliate program. The ransomware employs sophisticated tactics like BYOVD to disable EDR/XDR systems, coupled with SystemBC for persistence and lateral movement. Affiliates can customize attacks using the builder to encrypt files, terminate security processes, and evade detection through advanced anti-analysis features. Mimikatz and Cobalt Strike are used for credential harvesting and system reconnaissance.

Key Technical Insights:

BYOVD: Drivers like TrueSight.sys and RentDrv.sys disable security.

RSA-1024 & Salsa20 encryption for ransomware payloads.

Use of PowerShell and Cobalt Strike for malware execution and persistence.

Further Reading: Group-IB Blog

RDP Brute-Force Attacks

Summary: Remote Desktop Protocol (RDP) brute-force attacks remain a high-risk method for attackers to gain unauthorized access to networks. Cybercriminals exploit weak/default credentials and exposed RDP ports using automated tools, making it a preferred method for both nation-state and cybercriminal groups. Attackers can use compromised access for data theft, deploying ransomware, or selling credentials on dark web forums.

Technical Highlights:

Attackers use tools like Hydra and Medusa for brute-forcing RDP.

RDP exploits involve enumeration via port scans and credential stuffing.

Initial access brokers often sell RDP access for further attacks.

Defense Recommendations:

Use strong, unique passwords and multi-factor authentication.

Limit RDP exposure to the internet, utilizing VPN and firewalls.

Implement rate-limiting and robust monitoring to detect unusual RDP activity.

For more details, you can visit ReliaQuest's article on RDP Brute-Force Attacks.

New Phishing Tactic Exploits HTTP Headers for Stealthy Redirects

Summary: Attackers are using a new technique involving HTTP response headers to automatically redirect users to phishing pages. The tactic leverages compromised websites, making the phishing links appear legitimate. This technique is particularly challenging to detect and has been observed in phishing campaigns targeting various industries.

Key Insights:

HTTP headers are manipulated for silent phishing page redirects.

Attackers pre-populate victim data (like email addresses) to enhance credibility.

Detection is difficult, requiring heightened user vigilance and advanced security monitoring.

For more details, visit KnowBe4.

Cyber Predators Exploit Healthcare Vulnerabilities with Ransomware and Data Theft

Key Insights:

Healthcare sees an average of 2,018 attacks weekly, with APAC and Latin America hit hardest.

Ransomware-as-a-service empowers less experienced criminals.

Hospitals face high risks due to the critical nature of their operations.

Phishing Campaign Exploits Google Apps Script for Sophisticated Attacks

Key Insights:

Attack uses Google’s infrastructure to appear legitimate.

Affected users may disclose sensitive data via a deceptive Google Apps Script URL.

Advanced email filtering, real-time URL scanning, and phishing awareness training are crucial defenses.

For more details, visit Checkpoint Research.

New Windows PowerShell Phishing Campaign Highlights Serious Risks

Key Insights:

Attack targets GitHub users but could be adapted for broader use.

Exploits PowerShell to execute malicious commands.

Vigilance and disabling unnecessary PowerShell access are crucial defenses.

For more, visit Krebs on Security.

Phishing Attacks Exploit Content Creation and Collaboration Platforms

Key Insights:

Phishing emails from trusted platforms contain hidden threats.

Common platforms include design tools and document-sharing services.

Users should be cautious of unexpected links and suspicious login requests.

For more information, visit KnowBe4.

Cyber Threats Looming for the 2024 U.S. Election

Key Insights:

Nation-state groups may conduct hack-and-leak operations and influence campaigns.

Expect a surge in phishing attacks and scams using election-related themes.

Businesses should implement advanced cybersecurity measures to mitigate risks.

For more details, visit ReliaQuest.