admin

admin

  • Joined: September 10, 2024
  • Articles: 4794

SideWinder APT Launches Covert Multi-Stage Assault on Middle East and Africa

October 17, 2024
Malware / Cyber Espionage

An advanced persistent threat (APT) known as SideWinder, with suspected links to India, has initiated a wave of attacks targeting high-profile organizations and critical infrastructure in the Middle East and Africa. This group, also referred to as APT-C-17, Baby Elephant, Hardcore Nationalist, Leafperforator, Rattlesnake, Razor Tiger, and T-APT-04, may initially appear low-skilled due to its reliance on publicly available exploits, malicious LNK files, scripts, and common remote access tools (RATs). However, Kaspersky researchers Giampaolo Dedola and Vasily Berdnikov suggest that their true capabilities become evident upon closer examination of their operational tactics. The group’s targets include government and military sectors, logistics, telecommunications, financial institutions, universities, and oil trading firms in countries such as Bangladesh, Djibouti, Jordan, and Malaysia.

SideWinder APT Targets Middle East and Africa in Cohesive Multi-Stage Attacks October 17, 2024 Recent reports indicate that an advanced persistent threat (APT) group, identified as SideWinder, is actively executing a series of sophisticated cyberattacks against notable infrastructures and organizations…

Spike in Erlang/OTP SSH Exploits Following April Patch

Critical Infrastructure Security, Governance & Risk Management, Operational Technology (OT) Surge in Attacks Targeting Operational Technology Networks Prajeet Nair (@prajeetspeaks) • August 13, 2025 Image: Ivan Kislitsin/Shutterstock Researchers report a notable surge in exploitation attempts against a critical vulnerability in…

LangSmith Vulnerability Risks Exposure of OpenAI Keys and User Data through Malicious Agents

June 17, 2025
Category: Vulnerability / LLM Security

Cybersecurity experts have revealed a recently fixed security flaw in the LangChain’s LangSmith platform that could be exploited to obtain sensitive information, including API keys and user prompts. The vulnerability, assigned a CVSS score of 8.8 out of 10.0, is codenamed AgentSmith by Noma Security. LangSmith serves as an observability and evaluation tool for developing, testing, and monitoring large language model (LLM) applications, including those created using LangChain. Additionally, it features a LangChain Hub that acts as a repository for publicly available prompts, agents, and models.

“This newly discovered vulnerability targeted unsuspecting users who adopted agents containing pre-configured malicious proxy servers uploaded to the ‘Prompt Hub,'” noted researchers Sasi Levi and Gal Moyal in a report shared with The Hacker News. “Once adopted, the malicious proxy discreetly intercepted all user communications…”

Security Flaw in LangSmith Could Compromise OpenAI Keys and User Data In a recent disclosure, cybersecurity researchers have unveiled a significant vulnerability within the LangSmith platform, a tool integral to the development and monitoring of large language model (LLM) applications.…

TA829 and UNK_GreenSec Collaborate on Strategies and Infrastructure in Ongoing Malware Campaigns

July 01, 2025
Cyber Espionage / Vulnerability

Cybersecurity experts have identified striking tactical parallels between the threat actors behind the RomCom RAT and a group observed deploying a loader named TransferLoader. Enterprise security firm Proofpoint is tracking this activity back to a group recognized as UNK_GreenSec, alongside the RomCom RAT actors, referred to as TA829. This group is also known by multiple aliases, including CIGAR, Nebulous Mantis, Storm-0978, Tropical Scorpius, UAC-0180, UAT-5647, UNC2596, and Void Rabisu. According to Proofpoint’s findings, UNK_GreenSec emerged during their investigation of TA829, with notable similarities in infrastructure, delivery tactics, landing pages, and email lure themes. TA829 stands out in the threat landscape for its capacity to engage in both espionage and financially motivated attacks. This hybrid group, aligned with Russia, has been linked to the exploitation of zero-day vulnerabilities in Mozilla software.

TA829 and UNK_GreenSec Collaborate in Ongoing Malware Operations July 1, 2025 Cyber Espionage / Vulnerability Recently, cybersecurity analysts have identified notable tactical parallels between the malicious activities of two distinct threat actor groups: one associated with the RomCom Remote Access…

Qilin Ransomware Introduces “Call Lawyer” Feature to Increase Pressure on Victims for Higher Ransoms

June 20, 2025
Ransomware / Cybercrime

The operators of the Qilin ransomware-as-a-service (RaaS) platform have unveiled a new “Call Lawyer” feature intended to pressure victims into paying larger ransoms. This strategic move comes as the group ramps up its activities to capitalize on the decline of competing cybercriminals. According to Israeli cybersecurity firm Cybereason, this feature is integrated into the affiliate panel, allowing affiliates to present legal counsel offers to victims.

This development marks a resurgence in Qilin’s operations at a time when other once-dominant ransomware factions, such as LockBit, Black Cat, and others, have faced sudden shutdowns and operational issues. Active since October 2022 and also known as Gold Feather and Water Galura, Qilin has emerged as a significant player in the ransomware landscape.

Data from dark web leak sites reveals that Qilin was responsible for 72 attacks in April 2025 and an estimated 55 in May, placing it behind only Safepay (72) and Luna Moth (67) in activity.

Qilin Ransomware Introduces “Call Lawyer” Feature to Boost Pressure on Victims June 20, 2025 In a notable shift within the landscape of ransomware attacks, the Qilin ransomware-as-a-service (RaaS) group has recently added a new feature aimed at compelling victims to…