Security. In focus.

DeceptiveDevelopment targets freelance developers

DeceptiveDevelopment, a North Korea-aligned activity cluster, targets freelance software developers, particularly those involved in cryptocurrency projects. The attackers use fake recruiter profiles on job-hunting and freelancing sites to send trojanized codebases, disguised as job challenges or bug fixes, containing infostealer malware like BeaverTail and InvisibleFerret. The malware aims to steal cryptocurrency wallets and login information from browsers and password managers.

US Army soldier linked to Snowflake extortion rampage admits breaking the law www.theregister.com/2025/02/2…

A US Army soldier suspected of hacking AT&T and Verizon has admitted leaking online people’s private call records.

Cameron John Wagenius informed a federal court in Seattle, Wednesday, he intends to plead guilty to two counts of unlawfully transferring confidential phone records, with no plea deal in sight. He was cuffed last month aged 20 after being indicted.

In December, US prosecutors had simply claimed Wagenius on November 6 did “knowingly and intentionally sell and transfer, and attempt to sell and transfer, confidential phone records … without prior authorization.”

Updated Shadowpad Malware Leads to Ransomware Deployment www.trendmicro.com/en_us/res…

In November 2024, Trend Micro had two incident response cases in Europe with similar C&C servers and other TTPs, suggesting a single threat actor behind both operations. Both incidents involved Shadowpad, a malware family that has been used by multiple advanced Chinese threat actors to perform espionage.

Hunting for similar TTPs, Trend Micro found a total of 21 companies being targeted with similar malware toolkit in the last 7 months. Nine of them in Europe, eight in Asia, three in the Middle East, and one in South America. Trend Micro found eight different industries being affected, with more than half of the targets being in the Manufacturing industry. They are listed in the Victimology section.

In two cases, the threat actor deployed a ransomware of a previously unreported family. This is an uncommon move for threat actors using Shadowpad, although it has been reported that APT41 used Encryptor RaaS. It is not known why the threat actor deployed the ransomware only for some of the targets that were found.

Phishing attack hides JavaScript using invisible Unicode trick www.bleepingcomputer.com/news/secu…

A new JavaScript obfuscation method utilizing invisible Unicode characters to represent binary values is being actively abused in phishing attacks targeting affiliates of an American political action committee (PAC).

JavaScript developer Martin Kleppe first disclosed the obfuscation technique in October 2024, and its quick adoption in actual attacks highlights how quickly new research becomes weaponized.

The new obfuscation technique exploits invisible Unicode characters, specifically Hangul half-width (U+FFA0) and Hangul full-width (U+3164). Each ASCII character in the JavaScript payload is converted into an 8-bit binary representation, and the binary values (ones and zeros) in it are replaced with invisible Hangul characters.

CISA and FBI: Ghost ransomware breached orgs in 70 countries www.bleepingcomputer.com/news/secu…

CISA and the FBI said attackers deploying Ghost ransomware have breached victims from multiple industry sectors across over 70 countries, including critical infrastructure organizations.

Other industries impacted include healthcare, government, education, technology, manufacturing, and numerous small and medium-sized businesses.

“Beginning early 2021, Ghost actors began attacking victims whose internet facing services ran outdated versions of software and firmware,” CISA, the FBI, and the Multi-State Information Sharing and Analysis Center (MS-ISAC) said in a joint advisory released on Wednesday. “This indiscriminate targeting of networks containing vulnerabilities has led to the compromise of organizations across more than 70 countries, including organizations in China.”

Weathering the storm: In the midst of a Typhoon blog.talosintelligence.com/salt-typh…

Cisco Talos has been closely monitoring reports of widespread intrusion activity against several major U.S. telecommunications companies. The activity, initially reported in late 2024 and later confirmed by the U.S. government, is being carried out by a highly sophisticated threat actor dubbed Salt Typhoon. This blog highlights our observations on this campaign and identifies recommendations for detection and prevention of the actor’s activities.

Public reporting has indicated that the threat actor was able to gain access to core networking infrastructure in several instances and then use that infrastructure to collect a variety of information. There was only one case in which we found evidence suggesting that a Cisco vulnerability (CVE-2018-0171) was likely abused. In all the other incidents we have investigated to date, the initial access to Cisco devices was determined to be gained through the threat actor obtaining legitimate victim login credentials. The threat actor then demonstrated their ability to persist in target environments across equipment from multiple vendors for extended periods, maintaining access in one instance for over three years.

HP adds 15 minutes waiting time for telephone support calls • The Register

HP Inc. is implementing a 15-minute wait time for telephone support calls in several European countries. The goal is to encourage customers to use digital support channels, such as online support and virtual assistants, instead of calling. This change is part of a larger effort to reduce warranty costs and increase digital adoption.

South Korea confirms DeepSeek sent user data to ByteDance - Cyber Daily

South Korea’s data protection watchdog confirmed that DeepSeek, a Chinese AI chatbot, sent user data to its parent company, ByteDance. The watchdog recommended DeepSeek suspend service and make necessary improvements to comply with South Korean data protection legislation. Several countries, including Australia, have banned DeepSeek on government devices due to national security concerns.

UK healthcare giant HCRG confirms hack after ransomware gang claims theft of sensitive data | TechCrunch

HCRG Care Group, a prominent UK healthcare provider, is investigating a cybersecurity incident after the Medusa ransomware group claimed responsibility for stealing over two terabytes of sensitive data. The stolen data includes personal information, medical records, financial records, and government identification documents.

Managed healthcare defense contractor to pay $11 million over alleged cyber failings therecord.media/managed-h…

A federal contractor that supports the U.S. military’s healthcare system will pay $11 million to the government to settle allegations that it lied about meeting federal cybersecurity standards — the latest penalty levied on a contractor as part of a 2021 initiative to root out cyber-related fraud.

Health Net Federal Services (HNFS) and its parent company Centene Corporation agreed to pay the $11.2 million fine, although they dispute some of the allegations.

According to prosecutors, between 2015 and 2018 the company — which administered the Tricare healthcare program for 22 states — “falsely certified compliance” with certain cybersecurity controls required of federal contractors. The company allegedly failed to scan for known vulnerabilities in a timely fashion and to address security flaws on its networks.

The Justice Department also accused the company of ignoring internal and third-party reports about risks on its networks related to things like patch management, password policies, end-of-life hardware and software and configuration settings.

Cracked Garry’s Mod, BeamNG.drive games infect gamers with miners www.bleepingcomputer.com/news/secu…

A large-scale malware campaign dubbed “StaryDobry” has been targeting gamers worldwide with trojanized versions of cracked games such as Garry’s Mod, BeamNG.drive, and Dyson Sphere Program.

These titles are top-rated games with hundreds of thousands of ‘overwhelmingly positive’ reviews on Steam, making them good targets for malicious activity.

It’s worth noting that a laced Beamng mod was reportedly used as the initial access vector for a hack at Disney in June 2024. According to Kaspersky, the StaryDobry campaign started in late December 2024 and ended on January 27, 2025. It mostly impacted users from Germany, Russia, Brazil, Belarus, and Kazakhstan.

Ecuador’s legislature says hackers attempted to access confidential information therecord.media/ecuador-n…

Ecuador’s legislature, the National Assembly, reported that it suffered two cyberattacks on Monday aimed at disrupting its systems and accessing sensitive data.

The assembly said in a statement that it was able to quickly “identify and counteract the situation” but did not provide further details about the impact of the incident or the threat actor behind it.

“We are alerting citizens and public institutions that these attacks attempt to breach confidential information,” the assembly said, adding that it would “take all necessary measures to protect it.”

The attack on Ecuador’s legislature occurred just a week after the Latin American country held its general election, in which right-wing President Daniel Noboa failed to secure an outright majority. This outcome forced a runoff in April against his left-wing challenger, Luisa González. Noboa questioned the first-round results, saying they showed “irregularities.”

How Phished Data Turns into Apple & Google Wallets krebsonsecurity.com/2025/02/h…

Carding — the underground business of stealing, selling and swiping stolen payment card data — has long been the dominion of Russia-based hackers. Happily, the broad deployment of more secure chip-based payment cards in the United States has weakened the carding market. But a flurry of innovation from cybercrime groups in China is breathing new life into the carding industry, by turning phished card data into mobile wallets that can be used online and at main street stores.

Ford Merrill works in security research at SecAlliance, a CSIS Security Group company. Merrill has been studying the evolution of several China-based smishing gangs, and found that most of them feature helpful and informative video tutorials in their sales accounts on Telegram. Those videos show the thieves are loading multiple stolen digital wallets on a single mobile device, and then selling those phones in bulk for hundreds of dollars apiece.

Merrill said one common way criminal groups in China are cashing out with these stolen mobile wallets involves setting up fake e-commerce businesses on Stripe or Zelle and running transactions through those entities — often for amounts totaling between $100 and $500.

Signals of Trouble: Multiple Russia-Aligned Threat Actors Actively Targeting Signal Messenger cloud.google.com/blog/topi…

Google Threat Intelligence Group (GTIG) has observed increasing efforts from several Russia state-aligned threat actors to compromise Signal Messenger accounts used by individuals of interest to Russia’s intelligence services. While this emerging operational interest has likely been sparked by wartime demands to gain access to sensitive government and military communications in the context of Russia’s re-invasion of Ukraine, we anticipate the tactics and methods used to target Signal will grow in prevalence in the near-term and proliferate to additional threat actors and regions outside the Ukrainian theater of war.

Signal’s popularity among common targets of surveillance and espionage activity—such as military personnel, politicians, journalists, activists, and other at-risk communities—has positioned the secure messaging application as a high-value target for adversaries seeking to intercept sensitive information that could fulfil a range of different intelligence requirements.

Stately Taurus Activity in Southeast Asia Links to Bookworm Malware

Stately Taurus, a threat actor, has been linked to the Bookworm malware family, a connection previously unknown. This link was discovered through infrastructure overlaps and the use of a unique shellcode loading technique involving UUID strings. Bookworm, known for its modular design, has remained largely unchanged since its initial discovery in 2015, showcasing its adaptability and continued use by Stately Taurus.

‘Darcula’ Phishing Kit Can Now Impersonate Any Brand

Darcula, a phishing-as-a-service platform, is launching version 3 with a new feature that allows users to impersonate any brand online. The platform scrapes and exports HTML, images, and style sheets from any URL, enabling users to create convincing phishing pages with customizable forms. Darcula also offers anti-detection measures, performance metrics, and the ability to generate digital images of stolen credit cards, making it a sophisticated and expensive tool for scammers.

Happy Information Governance Day | Data Protection Report

Information governance is becoming increasingly important, driven by factors like cyber incidents, data minimization, and regulatory pressure. Companies are recognizing the benefits of good information governance, including mitigating risks and improving data management. Norton Rose Fulbright has established a unified legal practice to address the convergence of these issues.

Inside A LockBit Ransomware Attack: A Firsthand Account Of Financial And Security Fallout

A company faced a LockBit ransomware attack, encrypting critical files and impacting global operations. The incident response team, led by Nigel Sampson, identified the attack, isolated the network, and began recovery efforts. Despite the challenges, including compromised backups and a lack of visibility, the team successfully rebuilt systems and negotiated with the threat actors, ultimately restoring operations.

Understanding OWASP’s Top 10 list of non-human identity critical risks | CSO Online

OWASP’s new Top 10 list highlights the security risks associated with non-human identities (NHIs), which outnumber human identities in organizations. The list includes risks such as improper offboarding, secret leakage, and overprivileged NHIs, which can lead to data breaches and lateral movement. Mitigations include implementing standardized offboarding processes, using ephemeral credentials, and enforcing the principle of least privilege.

Ghost Ransomware targeting Obsolete IT Systems - Cybersecurity Insiders

Ghost Ransomware, active since 2021, targets businesses with outdated systems, frequently changing tactics and rebranding. Organizations are advised to prioritize cybersecurity measures like regular backups and MFA to mitigate these evolving threats.

Darktrace Report Highlights The Growing Power Of MaaS, Sneaky Evasion Tactics

Darktrace’s 2024 Annual Threat Report highlights the growing influence of Cybercrime-as-a-Service (CaaS), particularly Malware-as-a-Service (MaaS), which now accounts for 57% of detected threats. Cybercriminals are increasingly employing stealthy tactics, such as Remote Access Trojans (RATs) and Living-off-the-Land (LOTL) techniques, to evade detection and exploit vulnerabilities in edge devices and trusted platforms. The report underscores the need for modern security solutions that can adapt to these evolving attack patterns.

300% increase in endpoint malware detections - Help Net Security

Endpoint malware detections increased by 300% in Q3 2024, driven by social engineering tactics exploiting legitimate websites and documents. Threat actors are increasingly using OneNote files to deliver Qbot and exploiting WordPress vulnerabilities to host malicious downloads. Cryptominers are also on the rise, capitalizing on the resurgence of cryptocurrency popularity.

thehackernews.com/2025/02/m…

Microsoft has addressed two critical vulnerabilities: CVE-2025-21355 (Bing Remote Code Execution) and CVE-2025-24989 (Power Pages Elevation of Privilege), both rated highly on the CVSS scale.

www.darkreading.com/ics-ot-se…

Mike Burgess, director-general of ASIO, warns of ‘acute’ foreign threats to Australia’s critical infrastructure, highlighting military espionage and cyber sabotage from authoritarian regimes.

Google’s new policy tracks all your devices with no opt-out | Digital Trends

Google’s recent decision to allow device fingerprinting for targeted advertising highlights the complex trade-offs between privacy and digital advertising needs. The policy, effective February 2025, enables advertisers to collect detailed device data—such as IP addresses, screen resolution, OS versions, and behavioral signals like mouse movements—to build persistent user profiles. Unlike cookies, fingerprinting creates dynamic identifiers from hardware and software attributes, making tracking harder to detect or block. Google argues this approach adapts to modern platforms (e.g., smart devices) where cookies fail, while supporting fraud detection and “privacy-centric” advertising frameworks.

Privacy advocates counter that fingerprinting erodes user control, as profiles persist even when cookies are disabled or deleted. Critics argue the technique aggregates uniquely identifiable data points (e.g., battery levels, installed fonts) that bypass consent mechanisms, raising GDPR compliance concerns. The move also contradicts Google’s 2019 opposition to fingerprinting as antithetical to user choice. While Google asserts data anonymization, regulators warn the method creates opaque tracking ecosystems with risks of misuse by third parties. This shift underscores the broader challenge of balancing ad-driven business models with ethical data practices—a debate likely to influence both regulatory action and consumer trust in connected devices.