EncryptHub exploits CVE-2025–26633 with social engineering and rogue MSC files, delivering Fickle Stealer malware.
Category: cybercrime/malcode – Page 110
Taiwan Web Servers Breached by UAT-7237 Using Customized Open-Source Hacking Tools
UAT-7237 exploits unpatched Taiwan servers using SoundBill, Cobalt Strike, and SoftEther VPN for persistent control.
U.S. Sanctions Garantex and Grinex Over $100M in Ransomware-Linked Illicit Crypto Transactions
U.S. sanctions Garantex, successor Grinex, after $100M illicit crypto flow fuels ransomware and sanctions evasion.
Hackers Found Using CrossC2 to Expand Cobalt Strike Beacon’s Reach to Linux and macOS
CrossC2-enabled attacks from Sept–Dec 2024 target Linux, overlap with ransomware, bypass EDR for stealth.
New Android Malware Wave Hits Banking via NFC Relay Fraud, Call Hijacking, and Root Exploits
Defend against PhantomCard, SpyBanker, and KernelSU exploits—secure banking, block NFC fraud, and stop Android malware today.
New PS1Bot Malware Campaign Uses Malvertising to Deploy Multi-Stage In-Memory Attacks
PS1Bot malvertising campaign uses in-memory PowerShell attacks since early 2025, enabling stealth data theft.
Webinar: What the Next Wave of AI Cyberattacks Will Look Like — And How to Survive
AI-driven deepfakes, bots, and synthetic identities overwhelm legacy defenses, making identity the key to stopping breaches.
Charon Ransomware Hits Middle East Sectors Using APT-Level Evasion Tactics
The threat actor behind the activity, according to Trend Micro, exhibited tactics mirroring those of advanced persistent threat (APT) groups, such as DLL side-loading, process injection, and the ability to evade endpoint detection and response (EDR) software.
The DLL side-loading techniques resemble those previously documented as part of attacks orchestrated by a China-linked hacking group called Earth Baxia, which was flagged by the cybersecurity company as targeting government entities in Taiwan and the Asia-Pacific region to deliver a backdoor known as EAGLEDOOR following the exploitation of a now-patched security flaw affecting OSGeo GeoServer GeoTools.
“The attack chain leveraged a legitimate browser-related file, Edge.exe (originally named cookie_exporter.exe), to sideload a malicious msedge.dll (SWORDLDR), which subsequently deployed the Charon ransomware payload,” researchers Jacob Santos, Ted Lee, Ahmed Kamal, and Don Ovid Ladore said.
Cybercrime Groups ShinyHunters, Scattered Spider Join Forces in Extortion Attacks on Businesses
An ongoing data extortion campaign targeting Salesforce customers may soon turn its attention to financial services and technology service providers, as ShinyHunters and Scattered Spider appear to be working hand in hand, new findings show.
“This latest wave of ShinyHunters-attributed attacks reveals a dramatic shift in tactics, moving beyond the group’s previous credential theft and database exploitation,” ReliaQuest said in a report shared with The Hacker News.
These include the use of adoption of tactics that mirror those of Scattered Spider, such as highly-targeted vishing (aka voice phishing) and social engineering attacks, leveraging apps that masquerade as legitimate tools, employing Okta-themed phishing pages to trick victims into entering credentials during vishing, and VPN obfuscation for data exfiltration.
Hacking our way out of the universe
From Descartes to The Matrix, the idea that reality might be a simulation has long fascinated and terrified humanity. Elon Musk recently argued that the simulation hypothesis is most likely true. But if that’s the case, might there be a way to escape back to the real world? Join leading computer scientist Roman Yampolskiy as he argues that if we are living in a simulation, we can also hack our way out of it.