Blogs

The Horns and Hooves campaign, active since March 2023, has targeted over 1,000 victims with phishing emails containing JavaScript payloads that deploy sophisticated RAT malware like NetSupport RAT and BurnsRAT. This attack primarily targets private users, retailers, and service businesses in Russia, leveraging remote access tools for data theft, ransomware, and malware deployment.

Over 8 million Android users across nine countries have been impacted by SpyLoan malware embedded in loan apps downloaded from the Google Play Store. These apps exploit user trust, financial desperation, and intrusive permissions to harvest sensitive data, leading to extortion, harassment, and financial loss.

Bologna Football Club 1909 has confirmed a ransomware attack by the RansomHub gang, resulting in the theft and public release of sensitive data. The leaked information includes sponsorship contracts, financial records, and personal data of players, employees, and fans, emphasizing the rising cyber threat to sports organizations.

Hackers have leveraged the popular Godot game engine to spread GodLoader malware, infecting over 17,000 systems within three months. By exploiting Godot’s scripting language and packaging capabilities, cybercriminals bypass detection and deliver payloads like the XMRig crypto miner. This attack highlights the need for vigilance within open-source communities and enhanced protection against malware disguised as legitimate tools.

Researchers have discovered "Bootkitty," the first-ever UEFI bootkit targeting Linux systems. Although currently a proof-of-concept, this development signals a critical shift in the UEFI threat landscape, historically dominated by Windows-focused attacks. Bootkitty demonstrates advanced capabilities, including bypassing Secure Boot protocols and disabling kernel integrity checks, emphasizing the need for robust cybersecurity measures to protect Linux environments.

A Russia-aligned cybercrime group, RomCom, has leveraged two zero-day vulnerabilities in Firefox and Windows to deploy its backdoor malware, RomCom RAT, in a series of sophisticated attacks. These vulnerabilities allow remote code execution with no user interaction, escalating the threat posed by this group in both espionage and cybercrime operations.

We are thrilled to announce that NPAV (Net Protector Antivirus) has been awarded the prestigious AV-Test Advanced Threat Protection (ATP) Certificate, a testament to our cutting-edge capabilities in defending against today’s most sophisticated cyber threats.

The recent ransomware attack on Blue Yonder, a leading supply chain management firm, has caused significant disruptions to grocery store operations in the UK. The incident highlights the vulnerability of supply chain systems and the cascading impact on essential services like retail and logistics.

Russian-linked cyber espionage group TAG-110, using the custom malware tools HATVIBE and CHERRYSPY, has targeted government agencies, human rights organizations, and research institutions across Europe and Asia. This campaign, tied to geopolitical objectives, highlights the growing threats posed by Russian hybrid warfare tactics in the cyber domain.

Chinese APT groups, including the notorious Gelsemium, are targeting Linux systems with new backdoors like WolfsBane and FireWood. These advanced malware families exploit Linux vulnerabilities for data exfiltration, system control, and stealthy espionage, marking a significant shift in attack strategies as Windows security becomes more robust.

Hackers are exploiting a technique called Ghost Tap, leveraging NFCGate to steal funds via mobile payment systems like Google Pay and Apple Pay. By relaying stolen NFC data, criminals conduct fraudulent transactions worldwide without needing physical access to victim devices. This alarming development underscores the need for heightened cybersecurity measures for mobile payment platforms.

The Helldown ransomware, derived from LockBit 3.0, has expanded its attack scope to include VMware and Linux systems. Targeting critical industries such as IT, telecommunications, and healthcare, the ransomware exploits vulnerabilities in Zyxel firewalls and virtualized infrastructures. With aggressive tactics like double extortion and data encryption, Helldown poses a significant threat while showing signs of ongoing evolution.

A new fraud campaign led by the Chinese threat actor SilkSpecter is leveraging 4,700 fake e-commerce websites to steal payment card details and personal information. These sites mimic popular brands and utilize legitimate payment processors like Stripe to deceive victims.

A new ransomware strain, Ymir, is causing alarm with its unique memory exploitation tactics to evade detection. This advanced ransomware, following an initial breach via RustyStealer malware, recently hit a corporate network in Colombia, signaling the growing complexity and sophistication of ransomware strategies that target high-value corporate credentials.

Amazon has confirmed an employee data breach following the massive MOVEit cyberattacks, after threat actor "Nam3L3ss" leaked over 2.8 million lines of employee data, including contact details and office locations, stolen through a third-party vendor. This attack is part of a larger breach that has impacted dozens of global companies through a vendor exploit.

A new method in cyberattacks uses ZIP file concatenation to deliver malicious payloads undetected. By leveraging differences in ZIP parser handling, attackers can hide trojans in ZIP files, targeting unsuspecting users via phishing emails disguised as legitimate notices.

The newly discovered SteelFox malware leverages a vulnerable driver to escalate privileges, enabling it to steal sensitive data and mine cryptocurrency on Windows machines. Distributed through cracked software on forums and torrent sites, SteelFox presents significant risks to users of popular programs like AutoCAD, JetBrains, and Foxit PDF Editor.

Microsoft has officially launched Windows Server 2025, bringing a host of exciting new features and improvements for businesses looking to leverage cutting-edge technology for their infrastructure. Available from November 1st, 2024, Windows Server 2025 delivers significant advancements in virtualization, security, and storage. 

A dangerous new Android banking malware, dubbed ToxicPanda, has infected over 1,500 devices by bypassing security measures and exploiting Android’s accessibility features to facilitate fraudulent money transfers. With roots in the TgToxic malware, ToxicPanda is suspected to be the work of a Chinese-speaking threat actor targeting bank customers in Europe and Latin America.

The newly emerged Interlock ransomware is designed to specifically target FreeBSD servers, exploiting the OS's prevalence in critical infrastructure environments. This ransomware operation, active since late September 2024, has already compromised several organizations, using a unique FreeBSD-based encryptor to execute double-extortion attacks, leaving critical services vulnerable.