While other state-sponsored cyber threat activity has recently surged, MuddyWater, an Iranian threat group affiliated with the Ministry of Intelligence (MOIS), has consistently targeted Israel and its allies with a barrage of cyberattacks since the onset of the Israeli-Hamas War.
CRYSTALRAY, a newly discovered threat actor, utilizes multiple open-source software (OSS) to grow its credential stealing and cryptomining operations. Researchers first identified this threat actor in February by tracking their use of the OSS SSH-Snake... Click to learn more.
A joint international cybersecurity advisory from across 8 countries, including the U.S., warns of the recently observed tactics used by the Chinese state-sponsored APT40, also known as Kryptonite Panda, GINGHAM TYPHOON, Leviathan, and Bronze Mohawk.
In March, researchers discovered Eldorado, a new ransomware-as-a-service (RaaS). A Russian-speaking representative of Eldorado posted on the RAMP forums to advertise the malicious program and recruit penetration testers to join the group. Eldorado appears to be standalone.
The Cybersecurity and Infrastructure Security Agency (CISA) has collaborated with the Australian Signals Directorate’s Australian Cyber Security Centre (ASD's ACSC) to release an advisory outlining a People's Republic of China (PRC) state-sponsored cyber threat group.
There has been an observed escalation of various state-sponsored cyber threat actors' activities. Recently exposed activity by Russian and Chinese-backed hacking groups indicates that the cyber threat landscape has been permanently altered.
Researchers have been tracking the activity of a newly discovered threat actor group, Unfurling Hemlock, that may have been active for a while due to finding similar characteristics in older campaigns. These threat actors have distributed over 50,000 malware samples.
LokiBot, an infostealing malware that targets Android and Windows devices, was first spotted in 2015. LokiBot is a trojan primarily distributed through innocuous-appearing files. Once installed, LokiBot uses a keylogger to monitor desktop activity and steal sensitive information.
Using social media or other messaging platforms, fraudsters posing as lawyers representing fictitious law firms may contact scam victims and offer their services, claiming to have the authorization to investigate fund recovery cases. Click to read more.
Multiple vulnerabilities have been discovered in MOVEit products, which could allow for authentication bypass. Successful exploitation of these vulnerabilities could allow for an attacker to bypass authentication. An attacker could then view, change, or delete data.
