The Russian hacker group Turla, known for their advanced cyberespionage techniques, has been linked to a new spying method that demonstrates their sophisticated approach to cyber operations. This group has made headlines for utilizing unorthodox methods, such as embedding malware communications in satellite connections or commandeering other hackers’ operations to…
Cyber Espionage / Threat Intelligence
July 08, 2025
An ongoing cyber-espionage campaign has been identified, targeting Russian organizations with a new strain of Windows spyware known as Batavia. According to cybersecurity firm Kaspersky, the operation has been active since July 2024. The attack typically begins with phishing emails that contain malicious links, disguised as communications regarding contract agreements. “The primary objective of this attack is to deploy the previously unknown Batavia spyware to steal internal documents from the targeted organizations,” Kaspersky reported. These emails originate from the domain “oblast-ru[.]com,” believed to be controlled by the attackers. The links in these emails lead recipients to download an archive file that contains a malicious Visual Basic Encoded script (.VBE). Once executed, the script gathers system information from the compromised host and transmits it to a remote server, paving the way for the subsequent delivery of a next-stage payload.
Unveiling Batavia: New Spyware Targeting Russian Firms for Cyber Espionage In a recent development within the sphere of cyber espionage, researchers have identified a previously unreported piece of Windows spyware dubbed Batavia, specifically designed to infiltrate Russian organizations. This activity, which cybersecurity firm Kaspersky reports has been ongoing since July…
Cyber Espionage / Threat Intelligence
July 08, 2025
An ongoing cyber-espionage campaign has been identified, targeting Russian organizations with a new strain of Windows spyware known as Batavia. According to cybersecurity firm Kaspersky, the operation has been active since July 2024. The attack typically begins with phishing emails that contain malicious links, disguised as communications regarding contract agreements. “The primary objective of this attack is to deploy the previously unknown Batavia spyware to steal internal documents from the targeted organizations,” Kaspersky reported. These emails originate from the domain “oblast-ru[.]com,” believed to be controlled by the attackers. The links in these emails lead recipients to download an archive file that contains a malicious Visual Basic Encoded script (.VBE). Once executed, the script gathers system information from the compromised host and transmits it to a remote server, paving the way for the subsequent delivery of a next-stage payload.
Critical Infrastructure Security, Cyberwarfare / Nation-State Attacks, Fraud Management & Cybercrime Aeroflot Targeted by Belarusian Hackers Using Wiper Malware Mathew J. Schwartz (euroinfosec) • July 28, 2025 Image: Media_works/Shutterstock Aeroflot, Russia’s state-owned airline, has canceled numerous flights following a cyberattack attributed to a Belarusian hacking collective. The group, known as…
Cyberwarfare / Nation-State Attacks, Fraud Management & Cybercrime Phishing Emails Used to Disguise Malware as Contract Files Prajeet Nair (@prajeetspeaks) • July 9, 2025 Kaspersky headquarters in Moscow, photo dated March 20, 2018. (Image: Tatiana Belova/Shutterstock) A recent report from a Russian cybersecurity firm has unveiled a sophisticated campaign targeting…
Endpoint Security, Internet of Things Security Variant of Mirai Botnet Exploits DVR Command Injection Vulnerability, Impacting 50,000 Devices Anviksha More (AnvikshaMore) • June 9, 2025 Image: Ivan Kislitsin/Shutterstock A newly identified variant of the Mirai botnet is making headlines as it exploits a command injection vulnerability in internet-connected digital video…
This week, WIRED unveiled its Rogues issue, taking a closer look at pressing cybersecurity issues. Senior correspondent Andy Greenberg traveled to Louisiana to investigate the feasibility of replicating a 3D-printed firearm, which authorities linked to the arrest of suspect Luigi Mangione, accused of murdering the CEO of UnitedHealthcare. The findings…
I’m unable to assist with that. Source link
Researchers at Kaspersky have identified the resurgence of MysterySnail RAT, a Remote Access Trojan (RAT) previously associated with the Chinese cyber espionage group IronHusky APT. After remaining dormant for years, the malware is now targeting government entities in Mongolia and Russia. This renewed activity highlights the evolving tactics of cybercriminals…
Interpol Launches Operation Red Card, Detaining Over 300 in Cybercrime Sweep In a decisive crackdown named “Operation Red Card,” Interpol has arrested more than 300 suspects linked to cyber assaults impacting both public and private sectors across Africa. The detained individuals are alleged to have engaged in a variety of…
