Daily curated cyber threat intelligence for security professionals.
Sourceembracethered.com
Curated
OpenAI’s ChatGPT Operator, a research preview agent, can be exploited through prompt injection to leak personal data. While multi-layered mitigations exist, including user monitoring and confirmation requests, they are not foolproof and can be bypassed by motivated adversaries. This highlights the need for caution when using AI agents with sensitive information and the potential for server-side data access by OpenAI staff.
Sourcewww.securityweek.com
Curated
A new malware family, PathLoader and FinalDraft, is being used in an espionage campaign targeting Windows and Linux systems. FinalDraft, written in C++, uses Outlook via the Microsoft Graph API for communication, enabling data exfiltration, process injection, and file manipulation. The malware includes sandbox evasion capabilities and has been linked to attacks on a South American nation’s Foreign Ministry and compromises in Southeast Asia.
Sourcesocradar.io
Curated
The EagerBee campaign, attributed to the cyber espionage group CoughingDown, targets government entities and Internet Service Providers (ISPs) in the Middle East with sophisticated backdoor attacks. These attacks exploit vulnerabilities, employ social engineering, and utilize advanced backdoor capabilities to gain extensive control over compromised systems. Organizations can defend against such threats by implementing behavioral analysis tools, enhancing user training, maintaining strong patch management, and leveraging comprehensive cybersecurity solutions like SOCRadar’s Threat Hunting, Attack Surface Management, and Cyber Threat Intelligence.
Sourcewww.globalcompliancenews.com
Curated
The European Commission’s Competitiveness Compass, published on January 29, 2025, outlines priorities for the next five years, focusing on innovation, decarbonization, and security. The Commission plans to simplify sustainability reporting obligations, including a new definition of small mid-caps, with a package set to be released on February 26, 2025.
Sourcewww.globalcompliancenews.com
Curated
The AI Act, effective February 2, 2025, mandates AI literacy training for companies deploying AI systems and prohibits practices like manipulative AI and emotion inference in workplaces. Non-compliance could result in substantial fines, emphasizing the importance of early preparation for companies.
Sourcewww.globalcompliancenews.com
Curated
The Personal Data Protection Commission (PDPC) clarified that National Registration Identity Card (NRIC) numbers should not be used as passwords or for authentication purposes. Organizations are advised to phase out practices using NRIC numbers as default passwords and to obtain consent from individuals for their use.
Sourcewww.securityweek.com
Curated
Dutch police seized 127 servers associated with the Zservers bulletproof hosting service, used by cybercriminals including Conti and LockBit. The servers, located in Amsterdam, hosted websites, hacking tools, and stolen data.
Sourceinformationsecuritybuzz.com
Curated
A massive data exposure involving nearly 2.7 billion records linked to Mars Hydro, a China-based manufacturer of IoT-enabled grow lights, highlights ongoing concerns about IoT security and data privacy. The breach, which included sensitive Wi-Fi credentials and device details, underscores the need for stronger security measures in IoT ecosystems. As IoT adoption accelerates, securing connected devices must become a priority to prevent privacy breaches and cyberattacks.
Sourcewww.securityweek.com
Curated
DeepSeek, a Chinese AI startup, has temporarily halted downloads of its chatbot apps in South Korea due to privacy concerns. The South Korean Personal Information Protection Commission found issues with data transparency and potential excessive information collection, prompting government agencies and companies to block the app.
Sourceinformationsecuritybuzz.com
Curated
eSentire’s Threat Response Unit (TRU) uncovered a cyber espionage campaign targeting law firms. The attack, leveraging a legitimate Adobe executable, sideloaded the EarthKapre/RedCurl loader, highlighting the group’s focus on corporate espionage. eSentire recommends employee awareness training, endpoint protection, and threat intelligence to mitigate similar attacks.
Sourcesecurityaffairs.com
Curated
Pro-Russia hacker group NoName057(16) launched a new wave of DDoS attacks on Italian entities, including airports, the Transport Authority, banks, and ports. The attacks, which had a minor impact, were a response to President Mattarella’s statements comparing Russia to the Third Reich. NoName057(16) has been active since March 2022, targeting government and critical infrastructure organizations worldwide.
Sourcesocradar.io
Curated
SOCRadar’s Dark Web Team uncovered several cyber threats, including an alleged data breach at Swiss Medical in Argentina, a sophisticated Binance phishing panel, and a zero-day exploit for Magento. Other findings include unauthorized VPN access to a U.S. ISP, a leak of stolen credit card logs, and a Dark Web service allegedly designed to ban WhatsApp accounts.
Sourcewww.tripwire.com
Curated
Ransomware attacks are evolving rapidly, necessitating proactive cybersecurity measures. Organizations can combat these threats through techniques like threat intelligence, behavioral analysis, network segmentation, deception technology, and zero trust frameworks. By implementing these strategies, organizations can bolster their defenses and stay ahead of attackers
Sourcethehackernews.com
Curated
A new Golang-based backdoor, possibly of Russian origin, uses Telegram for command-and-control communications. The malware, still under development, employs an open-source library for Telegram Bot API interaction, supporting four commands, including executing PowerShell commands and relaunching itself.
Sourcewww.csoonline.com
Curated
Ransomware gangs are accelerating their operations, with an average time-to-ransom (TTR) of 17 hours, down from days or weeks in the past. This trend is driven by a focus on data theft extortion, particularly among groups targeting small and midsize businesses, and improvements in endpoint detection and response tools. While TTR is a useful metric, the number of malicious actions taken by attackers within the compromised environment also provides valuable insights into their tactics and objectives.
Sourcewww.csoonline.com
Curated
Enterprise security leaders face mounting pressure to protect their global IT supply chains against threats and a complex regulatory landscape. Understanding risks, maintaining a diversified supply chain, implementing robust risk assessment, and monitoring compliance obligations are crucial steps to mitigate these risks. Security leaders must collaborate with legal, privacy, and compliance teams to stay informed about regional events and adapt to changing regulations and geopolitical tensions.
Sourcewww.cybersecurity-insiders.com
Curated
Samsung enhances its Knox Security Ecosystem with Post Quantum Cryptography (PQC) to protect against quantum computing-enabled cyberattacks. The new PQC-powered security feature will initially be available to Galaxy S25 series and higher-end models running One UI 7.
Published
RansomHub Never Sleeps Episode 1: The evolution of modern ransomware www.group-ib.com/blog/rans…
RansomHub emerged in early February 2024 as a Ransomware-as-a-Service (RaaS) coinciding with the closure of ALPHV’s operations. ALPHV shut down its infrastructure following the significant fallout from a disruptive attack on Change Healthcare.
During ongoing law enforcement actions targeting the ALPHV and LockBit ransomware groups, RansomHub strategically launched its partnership program. This effort was analyzed by Group-IB in August 2024, as noted earlier in this blog.
Group-IB’s Threat Intelligence and Digital Forensics and Incident Response (DFIR) teams found that RansomHub capitalized on the void left by its disrupted competitors, focusing on recruiting affiliates from the now-defunct LockBit and ALPHV groups. The group actively sought new members through direct messaging and posts on underground forums like RAMP, XSS, and Exploit.in.
Published
Crypto Scam Revenue 2024: Pig Butchering Grows Nearly 40% YoY as Fraud Industry Leverages AI and Increases in Sophistication www.chainalysis.com/blog/2024…
According to Chainalysis metrics today, it looks like 2024 saw a drop in scam revenue; however, 2024 was likely a record year as these figures are lower-bound estimates based on inflows to the scam addresses Chainalysis identified up to today. A year from now, these totals will be higher, as Chainalysis identifies more illicit addresses and incorporate their historic activity into the estimates.
Since 2020, Chainalysis' annual estimates of scam activity have grown by an average of 24% between annual reporting periods. Assuming a similar growth rate between now and next year’s Crypto Crime Report, Chainalysis annual totals for 2024 could surpass the $12 billion threshold.
In the last few years, crypto fraud and scams have continued to increase in sophistication, as the fraud ecosystem becomes more professionalized. Operations like Huione Guarantee, a peer-to-peer (P2P) marketplace, offer a host of illicit services that support pig butchering scamming operations and serve as a one-stop-shop for scammers’ needs. These services range from the technology infrastructure required to initiate scams to money laundering services for obfuscating illicit activity and cashing out.
Published
Subnautica 2 Fake Playtest Links Sent as Part of Malicious Campaign www.bitdefender.com/en-us/blo…
Subnautica 2 developers raised the alarm on a malicious campaign trying to take advantage of players by tricking them into believing they were enrolling in a playtest. Subnautica 2, a game developed by Unknown Worlds Entertainment studio, is still in the works. A critical step in the development process is allowing players to get access to the game when it’s not yet finished so the studio can make needed adjustments.
Usually, a handful of players get access to the game, after the studio makes some announcement in advance. Malicious actors figured out this is a good way to trick people into accessing dangerous links, especially since Subnautica 2 is a highly anticipated game.
According to a GamesRadar report, Steam players received invitations, seemingly from the actual game developers to join the playtest session. Of course, this never happens and companies don’t reach out to individual players.
Published
New FinalDraft malware abuses Outlook mail service for stealthy comms www.bleepingcomputer.com/news/secu…
A new malware called FinalDraft has been using Outlook email drafts for command-and-control communication in attacks against a ministry in a South American country.
The attacks were discovered by Elastic Security Labs and rely on a complete toolset that includes a custom malware loader named PathLoader, the FinalDraft backdoor, and multiple post-exploitation utilities.
The abuse of Outlook, in this case, aims to achieve covert communications, allowing the attackers to perform data exfiltration, proxying, process injection, and lateral movement while leaving minimal possible traces.
Sourcewww.techspot.com
Curated
SanDisk unveiled a new PCIe 5.0 SSD that achieves blistering speeds of 14,500 MB/s read and 14,000 MB/s write while consuming only 7 watts of power. The drive, powered by Silicon Motion’s SM2508 controller, will launch in Q2 2025 with capacities ranging from 512GB to 4TB.
Published
Police risk losing society’s trust in fight against cybercrime, warns Europol chief therecord.media/eurpol-ch…
Law enforcement agencies risk losing the trust of the societies they protect unless those societies understand why new powers are needed to tackle surging levels of cybercrime, Europol’s chief warned on Thursday.
Speaking at the Munich Cyber Security Conference, Catherine De Bolle — who took the reins at the agency in 2018 — defended law enforcement’s need to be able to lawfully access encrypted data amid controversy over one such attempt by the United Kingdom.
She said that digital criminality had not just been growing in volume year-on-year but also “in its complexity and the impact it has on the lives of millions of citizens,” and as the perpetrators of these crimes are increasingly able to abuse traditional telecoms infrastructure alongside “high-tech crime tools and darkweb marketplaces” there was also a need to improve the capabilities of the agencies tackling those criminals.
But “should law enforcement be enabled to address these cases at scale, there is a risk of losing society’s trust in law enforcement and in state institutions at large,” said De Bolle.
Published
Texas investigating DeepSeek for violating data privacy law therecord.media/texas-inv…
Texas on Friday announced it is investigating the Chinese AI company DeepSeek for allegedly violating the state’s data privacy law.
Attorney General Ken Paxton’s office also has requested relevant documents from Google and Apple, seeking their “analysis” of the inexpensive and open source DeepSeek app and asking what documentation they required from DeepSeek before they made the app publicly available for download on their app stores.
“DeepSeek appears to be no more than a proxy for the CCP [Chinese Communist Party] to undermine American AI dominance and steal the data of our citizens,” Paxton said in a statement. “That’s why I’m announcing a thorough investigation and calling on Google and Apple to cooperate immediately by providing all relevant documents related to the DeepSeek app.”
Published
Malicious PirateFi game infects Steam users with Vidar malware www.bleepingcomputer.com/news/secu…
A free-to-play game named PirateFi in the Steam store has been distributing the Vidar infostealing malware to unsuspecting users.
The title was present in the Steam catalog for almost a week, between February 6th and February 12th, and was downloaded by up to 1,500 users. The distribution service is sending notices to potentially impacted users, advising them to reinstall Windows out of an abundance of caution.
PirateFi was released on Steam last week by Seaworth Interactive, and received positive reviews. It is described as a survival game set in a low-poly world involving base building, weapon crafting and food gathering.