Category data-breaches

Amazon Disrupts APT29’s Watering Hole Campaign Utilizing Microsoft Device Code Authentication

On August 29, 2025, in a significant security intervention, Amazon revealed it had identified and dismantled a watering hole campaign orchestrated by the Russia-linked APT29 group. This campaign exploited compromised websites to direct users towards malicious infrastructure, tricking them into authorizing attacker-controlled devices via Microsoft’s device code authentication process. Amazon’s Chief Information Security Officer, CJ Moses, provided insights into the threat. APT29, also known by aliases such as BlueBravo, Cozy Bear, and Midnight Blizzard, is a state-sponsored hacking group linked to Russia’s Foreign Intelligence Service (SVR). Recently, the group has been associated with attacks employing malicious Remote Desktop Protocol (RDP) configurations to target Ukrainian entities and extract sensitive information. As the year progresses, the adversary’s extensive targeting strategies continue to raise concerns.

Amazon Disrupts APT29 Watering Hole Campaign Exploiting Microsoft Device Code Authentication On August 29, 2025, Amazon disclosed its successful intervention in a watering hole campaign linked to the Russian cyber-espionage group APT29. This operation was characterized as opportunistic, aiming to gather intelligence by misleading users through compromised websites. These malicious…

Read More

Amazon Disrupts APT29’s Watering Hole Campaign Utilizing Microsoft Device Code Authentication

On August 29, 2025, in a significant security intervention, Amazon revealed it had identified and dismantled a watering hole campaign orchestrated by the Russia-linked APT29 group. This campaign exploited compromised websites to direct users towards malicious infrastructure, tricking them into authorizing attacker-controlled devices via Microsoft’s device code authentication process. Amazon’s Chief Information Security Officer, CJ Moses, provided insights into the threat. APT29, also known by aliases such as BlueBravo, Cozy Bear, and Midnight Blizzard, is a state-sponsored hacking group linked to Russia’s Foreign Intelligence Service (SVR). Recently, the group has been associated with attacks employing malicious Remote Desktop Protocol (RDP) configurations to target Ukrainian entities and extract sensitive information. As the year progresses, the adversary’s extensive targeting strategies continue to raise concerns.

Webinar: Harmonize Dev, Sec, and Ops Teams with a Unified Playbook

Date: August 29, 2025
Topic: Cloud Security / Generative AI

Imagine this: your team deploys new code, confident everything is perfect. But hidden within is a minor flaw that spirals into a major crisis once it reaches the cloud. Suddenly, hackers infiltrate your system, resulting in costly damages that can amount to millions. Frightening, right? In 2025, the average data breach will set businesses back around $4.44 million globally. A significant portion of these issues arises from app security oversights, such as web attacks that compromise credentials and cause chaos.

If you’re part of the dev, ops, or security teams, you’ve likely experienced this stress—constant alerts, disputes over accountability, and slow fixes. But it doesn’t have to be this way. What if you could detect risks early, from the moment code is written to its operation in the cloud? That’s the power of code-to-cloud visibility, transforming how proactive teams manage app security.

Join our upcoming webinar, “Code-to-Cloud…

Webinar Announcement: Unifying Dev, Sec, and Ops Teams with a Comprehensive Playbook Date: August 29, 2025 Focus: Cloud Security and Generative AI In today’s rapidly evolving digital landscape, even minor coding errors can lead to significant cybersecurity breaches. Imagine deploying new software code with high hopes, only to discover that…

Read More

Webinar: Harmonize Dev, Sec, and Ops Teams with a Unified Playbook

Date: August 29, 2025
Topic: Cloud Security / Generative AI

Imagine this: your team deploys new code, confident everything is perfect. But hidden within is a minor flaw that spirals into a major crisis once it reaches the cloud. Suddenly, hackers infiltrate your system, resulting in costly damages that can amount to millions. Frightening, right? In 2025, the average data breach will set businesses back around $4.44 million globally. A significant portion of these issues arises from app security oversights, such as web attacks that compromise credentials and cause chaos.

If you’re part of the dev, ops, or security teams, you’ve likely experienced this stress—constant alerts, disputes over accountability, and slow fixes. But it doesn’t have to be this way. What if you could detect risks early, from the moment code is written to its operation in the cloud? That’s the power of code-to-cloud visibility, transforming how proactive teams manage app security.

Join our upcoming webinar, “Code-to-Cloud…

Malicious Actors Exploit Velociraptor Forensic Tool to Launch Visual Studio Code for C2 Tunneling

Cybersecurity experts have highlighted a recent cyber attack involving the misuse of Velociraptor, an open-source endpoint monitoring and digital forensic tool. This incident showcases the ongoing trend of leveraging legitimate software for nefarious purposes. According to a report from the Sophos Counter Threat Unit Research Team, the attackers employed Velociraptor to download and execute Visual Studio Code, likely aimed at establishing a tunnel to a command-and-control (C2) server they controlled. While the use of legitimate remote monitoring and management (RMM) tools is not new in cyber threats, the adoption of Velociraptor represents a significant shift, allowing attackers to gain a foothold without deploying their own malware. Further investigation into the attack has revealed that the perpetrators exploited Wind…

Attackers Exploit Velociraptor Forensic Tool to Deploy Visual Studio Code for Command-and-Control Tunneling On August 30, 2025, cybersecurity experts unveiled a concerning cyber attack involving the exploitation of Velociraptor, an open-source endpoint monitoring and digital forensic tool. This incident highlights a troubling trend where legitimate software is misused for nefarious…

Read More

Malicious Actors Exploit Velociraptor Forensic Tool to Launch Visual Studio Code for C2 Tunneling

Cybersecurity experts have highlighted a recent cyber attack involving the misuse of Velociraptor, an open-source endpoint monitoring and digital forensic tool. This incident showcases the ongoing trend of leveraging legitimate software for nefarious purposes. According to a report from the Sophos Counter Threat Unit Research Team, the attackers employed Velociraptor to download and execute Visual Studio Code, likely aimed at establishing a tunnel to a command-and-control (C2) server they controlled. While the use of legitimate remote monitoring and management (RMM) tools is not new in cyber threats, the adoption of Velociraptor represents a significant shift, allowing attackers to gain a foothold without deploying their own malware. Further investigation into the attack has revealed that the perpetrators exploited Wind…

Rethinking Browser Security: Addressing the Threats Posed by Scattered Spider

As businesses increasingly rely on browser-based operations, security teams are confronted with escalating cyber threats. Today, over 80% of security incidents stem from web applications accessed through browsers like Chrome, Edge, and Firefox. A particularly agile adversary known as Scattered Spider (also identified as UNC3944, Octo Tempest, or Muddled Libra) has emerged, targeting sensitive data within these browsers. Unlike infamous cybercriminal groups such as Lazarus Group, Fancy Bear, and REvil, Scattered Spider has honed its methods over the past two years, focusing on the human element and browser environments. If critical information—like your calendar, login credentials, or security tokens—resides in your browser tabs, Scattered Spider is poised to seize it. This article will delve into the attack techniques employed by Scattered Spider and outline strategies to defend against them.

When Browsers Become the Attack Surface: Rethinking Security for Scattered Spider As businesses increasingly rely on web-based operations, security professionals are confronted with a mounting array of cyber threats. A startling statistic reveals that over 80% of security incidents now stem from web applications accessed through popular browsers such as…

Read More

Rethinking Browser Security: Addressing the Threats Posed by Scattered Spider

As businesses increasingly rely on browser-based operations, security teams are confronted with escalating cyber threats. Today, over 80% of security incidents stem from web applications accessed through browsers like Chrome, Edge, and Firefox. A particularly agile adversary known as Scattered Spider (also identified as UNC3944, Octo Tempest, or Muddled Libra) has emerged, targeting sensitive data within these browsers. Unlike infamous cybercriminal groups such as Lazarus Group, Fancy Bear, and REvil, Scattered Spider has honed its methods over the past two years, focusing on the human element and browser environments. If critical information—like your calendar, login credentials, or security tokens—resides in your browser tabs, Scattered Spider is poised to seize it. This article will delve into the attack techniques employed by Scattered Spider and outline strategies to defend against them.

⚡ Weekly Summary: Exploited WhatsApp Vulnerability, Docker Flaw, Salesforce Incident, Fake CAPTCHAs, Spyware App & More

Date: Sep 01, 2025
Category: Cybersecurity News / Hacking

In the evolving landscape of cybersecurity, threats often stem from interconnected vulnerabilities rather than isolated attacks. A single overlooked update or misused account can lead to significant breaches. This week’s updates illustrate how attackers are merging tactics, leveraging stolen access, unpatched software, and innovative methods to escalate from minor entry points to major risks. For security professionals, the takeaway is clear: the real threat often lies in the interplay of various small vulnerabilities rather than a single, major flaw.

⚡ Threat of the Week

WhatsApp Addresses Actively Exploited Vulnerability — WhatsApp has patched a security issue affecting its messaging applications for Apple iOS and macOS, which appears to have been exploited alongside a recently reported Apple flaw in targeted zero-day attacks. The vulnerability, identified as CVE-2025-55177, involves inadequate authorization for linked device synchronization messages. The Meta-owned company…

Weekly Cybersecurity Recap: WhatsApp Exploit, Docker Vulnerability, Salesforce Breach, and More In today’s interconnected digital landscape, cybersecurity incidents are increasingly characterized by a complex web of vulnerabilities rather than isolated threats. Recent events underscore the necessity for vigilance; a single overlooked update or compromised account can create a precarious situation,…

Read More

⚡ Weekly Summary: Exploited WhatsApp Vulnerability, Docker Flaw, Salesforce Incident, Fake CAPTCHAs, Spyware App & More

Date: Sep 01, 2025
Category: Cybersecurity News / Hacking

In the evolving landscape of cybersecurity, threats often stem from interconnected vulnerabilities rather than isolated attacks. A single overlooked update or misused account can lead to significant breaches. This week’s updates illustrate how attackers are merging tactics, leveraging stolen access, unpatched software, and innovative methods to escalate from minor entry points to major risks. For security professionals, the takeaway is clear: the real threat often lies in the interplay of various small vulnerabilities rather than a single, major flaw.

⚡ Threat of the Week

WhatsApp Addresses Actively Exploited Vulnerability — WhatsApp has patched a security issue affecting its messaging applications for Apple iOS and macOS, which appears to have been exploited alongside a recently reported Apple flaw in targeted zero-day attacks. The vulnerability, identified as CVE-2025-55177, involves inadequate authorization for linked device synchronization messages. The Meta-owned company…

Silver Fox Exploits Microsoft-Signed WatchDog Driver to Distribute ValleyRAT Malware

Date: September 2, 2025
Categories: Financial Fraud / Endpoint Protection

The threat actor known as Silver Fox has been linked to the exploitation of a previously undetected vulnerable driver associated with WatchDog Anti-malware. This attack, classified as a Bring Your Own Vulnerable Driver (BYOVD) incident, aims to neutralize security solutions on compromised systems.

The specific driver involved, “amsdk.sys” (version 1.0.600), is a 64-bit, validly signed Windows kernel device driver believed to be based on the Zemana Anti-Malware SDK. According to an analysis by Check Point, “This driver, created using the Zemana Anti-Malware SDK, was Microsoft-signed, not included in the Microsoft Vulnerable Driver Blocklist, and evaded detection by community initiatives such as LOLDrivers.”

The attack employs a dual-driver approach, utilizing a known vulnerable Zemana driver (“zam.exe”) for Windows 7 systems, while leveraging the undetected WatchDog driver for Windows 10 and 11 environments. The WatchDog Anti-malware driver has been identified as containing multiple vulnerabilities.

Silver Fox Exploits Microsoft-Signed WatchDog Driver for ValleyRAT Malware Deployment In a concerning development within the cybersecurity landscape, the threat actor operating under the alias Silver Fox has been linked to the exploitation of an undisclosed vulnerable driver associated with WatchDog Anti-malware. This activity represents a sophisticated Bring Your Own…

Read More

Silver Fox Exploits Microsoft-Signed WatchDog Driver to Distribute ValleyRAT Malware

Date: September 2, 2025
Categories: Financial Fraud / Endpoint Protection

The threat actor known as Silver Fox has been linked to the exploitation of a previously undetected vulnerable driver associated with WatchDog Anti-malware. This attack, classified as a Bring Your Own Vulnerable Driver (BYOVD) incident, aims to neutralize security solutions on compromised systems.

The specific driver involved, “amsdk.sys” (version 1.0.600), is a 64-bit, validly signed Windows kernel device driver believed to be based on the Zemana Anti-Malware SDK. According to an analysis by Check Point, “This driver, created using the Zemana Anti-Malware SDK, was Microsoft-signed, not included in the Microsoft Vulnerable Driver Blocklist, and evaded detection by community initiatives such as LOLDrivers.”

The attack employs a dual-driver approach, utilizing a known vulnerable Zemana driver (“zam.exe”) for Windows 7 systems, while leveraging the undetected WatchDog driver for Windows 10 and 11 environments. The WatchDog Anti-malware driver has been identified as containing multiple vulnerabilities.

Ukrainian Network FDN3 Conducts Widespread Brute-Force Attacks on SSL VPN and RDP Devices

Date: Sep 02, 2025
Category: Cyber Attack / Botnet

Cybersecurity experts have identified a Ukrainian IP network engaging in extensive brute-force and password spraying campaigns against SSL VPN and RDP devices between June and July 2025. The operations are traced back to the Ukraine-based autonomous system FDN3 (AS211736), according to French cybersecurity firm Intrinsec. “We have high confidence that FDN3 is part of a larger malicious infrastructure that includes two other Ukrainian networks, VAIZ-AS (AS61432) and ERISHENNYA-ASN (AS210950), as well as a Seychelles-based system, TK-NET (AS210848),” the report stated. “All of these were allocated in August 2021 and frequently exchange IPv4 prefixes to bypass blocklisting and sustain their abusive operations.” AS61432 currently announces a single prefix, 185.156.72[.]0/24, while AS210950 has two prefixes: 45.143.201[.]0/24 and 185.193.89[.]0/24. These autonomous systems were allocated in May…

Ukrainian Network FDN3 Targets SSL VPN and RDP Devices with Coordinated Brute-Force Attacks On September 2, 2025, cybersecurity experts reported significant brute-force and password spraying campaigns linked to a Ukrainian IP network known as FDN3 (AS211736). These attacks were specifically aimed at SSL VPN and Remote Desktop Protocol (RDP) devices…

Read More

Ukrainian Network FDN3 Conducts Widespread Brute-Force Attacks on SSL VPN and RDP Devices

Date: Sep 02, 2025
Category: Cyber Attack / Botnet

Cybersecurity experts have identified a Ukrainian IP network engaging in extensive brute-force and password spraying campaigns against SSL VPN and RDP devices between June and July 2025. The operations are traced back to the Ukraine-based autonomous system FDN3 (AS211736), according to French cybersecurity firm Intrinsec. “We have high confidence that FDN3 is part of a larger malicious infrastructure that includes two other Ukrainian networks, VAIZ-AS (AS61432) and ERISHENNYA-ASN (AS210950), as well as a Seychelles-based system, TK-NET (AS210848),” the report stated. “All of these were allocated in August 2021 and frequently exchange IPv4 prefixes to bypass blocklisting and sustain their abusive operations.” AS61432 currently announces a single prefix, 185.156.72[.]0/24, while AS210950 has two prefixes: 45.143.201[.]0/24 and 185.193.89[.]0/24. These autonomous systems were allocated in May…

Researchers Raise Alarm Over MystRodX Backdoor Utilizing DNS and ICMP Triggers for Covert Control

Sep 02, 2025 – Cyber Espionage / Network Security

Cybersecurity experts have revealed a new stealthy backdoor named MystRodX, designed to capture sensitive information from compromised systems. According to a report from QiAnXin XLab, “MystRodX is a typical backdoor developed in C++, featuring capabilities such as file management, port forwarding, reverse shell, and socket management.” The report highlights that MystRodX distinguishes itself from standard backdoors through its exceptional stealth and versatility. Also referred to as ChronosRAT, this malware was initially documented by Palo Alto Networks Unit 42 last month, linked to a threat activity cluster named CL-STA-0969, which shows connections to a China-based cyber espionage group called Liminal Panda. Its stealthy nature is enhanced by multiple layers of encryption that obscure both the source code and payloads, while its flexibility allows it to dynamically activate different functionalities based on configuration settings, including the choice between TCP or HTTP for network communication.

Cybersecurity Experts Raise Alarm Over MystRodX Backdoor Utilizing DNS and ICMP for Discreet Control September 2, 2025 Cyber Espionage / Network Security Cybersecurity experts have recently unveiled MystRodX, a sophisticated backdoor designed to stealthily infiltrate systems and extract sensitive information. According to a report from QiAnXin XLab, MystRodX operates using…

Read More

Researchers Raise Alarm Over MystRodX Backdoor Utilizing DNS and ICMP Triggers for Covert Control

Sep 02, 2025 – Cyber Espionage / Network Security

Cybersecurity experts have revealed a new stealthy backdoor named MystRodX, designed to capture sensitive information from compromised systems. According to a report from QiAnXin XLab, “MystRodX is a typical backdoor developed in C++, featuring capabilities such as file management, port forwarding, reverse shell, and socket management.” The report highlights that MystRodX distinguishes itself from standard backdoors through its exceptional stealth and versatility. Also referred to as ChronosRAT, this malware was initially documented by Palo Alto Networks Unit 42 last month, linked to a threat activity cluster named CL-STA-0969, which shows connections to a China-based cyber espionage group called Liminal Panda. Its stealthy nature is enhanced by multiple layers of encryption that obscure both the source code and payloads, while its flexibility allows it to dynamically activate different functionalities based on configuration settings, including the choice between TCP or HTTP for network communication.

Lazarus Group Enhances Malware Toolkit with PondRAT, ThemeForestRAT, and RemotePE

Sep 02, 2025
Malware / Threat Intelligence

The North Korea-linked threat actor, Lazarus Group, has been linked to a social engineering campaign that distributes three new cross-platform malware variants: PondRAT, ThemeForestRAT, and RemotePE. This attack, observed by NCC Group’s Fox-IT in 2024, specifically targeted an organization within the decentralized finance (DeFi) sector, resulting in the breach of an employee’s system.

“As the actor accessed the internal network, they utilized various RATs along with other tools to collect credentials and establish proxy connections,” noted Yun Zheng Hu and Mick Koomen. “Subsequently, the attacker transitioned to a more stealthy RAT, indicating a potential progression in their attack strategy.”

The attack began with the threat actor impersonating a current employee of a trading firm via Telegram and using counterfeit websites resembling Calendly and Picktime to arrange a meeting with the target. Although the initial steps were…

Lazarus Group Enhances Malware Capabilities with New Tools: PondRAT, ThemeForestRAT, and RemotePE On September 2, 2025, cybersecurity researchers revealed that the Lazarus Group, a North Korean-affiliated threat actor, has expanded its malware toolkit. This development includes the introduction of three distinct pieces of cross-platform malware: PondRAT, ThemeForestRAT, and RemotePE. The…

Read More

Lazarus Group Enhances Malware Toolkit with PondRAT, ThemeForestRAT, and RemotePE

Sep 02, 2025
Malware / Threat Intelligence

The North Korea-linked threat actor, Lazarus Group, has been linked to a social engineering campaign that distributes three new cross-platform malware variants: PondRAT, ThemeForestRAT, and RemotePE. This attack, observed by NCC Group’s Fox-IT in 2024, specifically targeted an organization within the decentralized finance (DeFi) sector, resulting in the breach of an employee’s system.

“As the actor accessed the internal network, they utilized various RATs along with other tools to collect credentials and establish proxy connections,” noted Yun Zheng Hu and Mick Koomen. “Subsequently, the attacker transitioned to a more stealthy RAT, indicating a potential progression in their attack strategy.”

The attack began with the threat actor impersonating a current employee of a trading firm via Telegram and using counterfeit websites resembling Calendly and Picktime to arrange a meeting with the target. Although the initial steps were…