Challenges in Managing Sustainability Data

We Appreciate Your Registration with ISMG

Enhance your profile to remain informed

Source link

Related Posts

Phishing Scheme Exploits UpCrypter in Fake Voicemail Emails to Deploy RAT Payloads

Aug 25, 2025
Malware / Cloud Security

Cybersecurity experts have identified a new phishing scheme utilizing deceptive voicemail and purchase order emails to distribute a malware loader named UpCrypter. According to Fortinet FortiGuard Labs researcher Cara Lin, the campaign employs “carefully crafted emails to deliver malicious URLs linked to convincing phishing pages.” These pages are designed to lure recipients into downloading JavaScript files that serve as droppers for UpCrypter. Since early August 2025, the attacks have predominantly targeted sectors such as manufacturing, technology, healthcare, construction, and retail/hospitality worldwide. Significant infections have been recorded in countries including Austria, Belarus, Canada, Egypt, India, and Pakistan. UpCrypter acts as a conduit for various remote access tools (RATs), including PureHVNC RAT, DCRat (also known as DarkCrystal RAT), and Babylon RAT, allowing attackers to gain complete control over compromised systems.

Docker Addresses Critical Container Escape Vulnerability CVE-2025-9074 with CVSS Score of 9.3

August 25, 2025
Container Security / Vulnerability

Docker has released updates to fix a serious security vulnerability in the Docker Desktop application for Windows and macOS. This security flaw, identified as CVE-2025-9074, has a CVSS score of 9.3 out of 10.0, indicating its severity. The issue has been resolved in version 4.44.3. According to Docker’s advisory from last week, “A malicious container running on Docker Desktop could access the Docker Engine and launch additional containers without needing the Docker socket to be mounted.” This could result in unauthorized access to user files on the host system, and Enhanced Container Isolation (ECI) does not provide mitigation for this vulnerability. Security researcher Felix Boulet notes that the vulnerability stems from a container’s ability to connect to the Docker Engine API at 192.168.65[.]7:2375 without requiring any authentication, which could lead to a scenario where a privileged container can…

UNC6384 Uses Captive Portal Hijacks and Valid Certificates for PlugX Deployment Targeting Diplomats

August 25, 2025
Malware / Cyber Espionage

A threat actor associated with China, known as UNC6384, has been linked to a series of attacks aimed at diplomats in Southeast Asia and various global entities to further Beijing’s strategic goals. “This complex attack chain employs sophisticated social engineering tactics, including the use of legitimate code signing certificates, adversary-in-the-middle (AitM) techniques, and indirect execution methods to bypass detection,” noted Patrick Whitsell from Google’s Threat Intelligence Group (GTIG). UNC6384 is believed to share resources and tactics with the well-known Chinese hacking group Mustang Panda, also identified by multiple aliases such as BASIN, Bronze President, and more. The campaign, identified by GTIG in March 2025, features a captive portal redirect to hijack web traffic and distribute a digitally signed downloader known as STATICPLUGIN. This downloader subsequently facilitates…

ShadowCaptcha Targets WordPress Sites to Distribute Ransomware, Info Stealers, and Crypto Miners

August 26, 2025
Ransomware / Cryptojacking

A significant new campaign has been uncovered, impacting over 100 compromised WordPress sites. This initiative redirects visitors to fake CAPTCHA verification pages employing the ClickFix social engineering technique to disseminate information stealers, ransomware, and cryptocurrency miners. Dubbed ShadowCaptcha by the Israel National Digital Agency, this widespread cybercrime operation, first detected in August 2025, utilizes a combination of social engineering, living-off-the-land binaries (LOLBins), and multi-stage payload delivery to establish and sustain access to targeted systems. Researchers Shimi Cohen, Adi Pick, Idan Beit Yosef, Hila David, and Yaniv Goldman explain, “The ultimate aims of ShadowCaptcha include harvesting sensitive information through credential theft and browser data exfiltration, deploying cryptocurrency miners for illicit gains, and even initiating ransomware outbreaks.” The attacks commence when unsuspecting users visit a compromised site…