Blahalla

EU Sanctions Companies in China, Iran for Cyberattacks

www.darkreading.com · 4 months ago

NULL

Anthropic ban heralds new era of supply chain risk — with no clear playbook

www.csoonline.com · 4 months ago

The Trump administration has designated Anthropic as a supply chain risk and banned its technology from Pentagon assets and other government systems, creating pressure on CISOs to identify, isolate, and potentially remove the model from their environments despite limited visibility into where it is used. A March 6 Pentagon memo requires military components to remove Anthropic products within 180 days and obligates contractors to notify vendors and certify compliance, effectively extending the requirement across the defense industrial base. Enterprises lack comprehensive inventories and AI governance, experts debate whether existing software bills of materials suffice, and removing or replacing embedded models may require code changes, revalidation, and coordination with vendors to avoid disrupting critical systems.

Aura Confirms Data Breach Exposing 900,000 Customer Records

gbhackers.com · 4 months ago

Digital security provider Aura confirmed a data breach affecting approximately 900,000 customer records following a targeted social engineering attack. The incident highlights the ongoing threat of sophisticated phishing campaigns that can bypass technical defenses by exploiting human elements, and Aura immediately initiated its incident response protocol upon detecting unauthorized network activity.

WaterPlum Unleashes “StoatWaffle” Malware in VSCode Supply Chain Attack

gbhackers.com · 4 months ago

A threat group linked to North Korea called WaterPlum, and its Team 8 subgroup, has introduced a new malware strain called StoatWaffle that focuses on developer ecosystems and supply chain attacks. The campaign uses malicious repositories that include a hidden.vscode directory with a crafted tasks.json set to runOn folderOpen, causing VSCode to execute a predefined task when a repository is opened and trusted, and the loader can download or install Node.js and retrieve env.npl and package.json to begin the infection chain. StoatWaffle is modular, deploying a stealer and a remote access trojan that exfiltrates browser credentials, extension data, macOS Keychain items, and system profiling details to command and control endpoints, and it contains awareness for Windows Subsystem for Linux to access Windows user data from WSL.

ScreenConnect Flaw Lets Hackers Steal Machine Keys and Hijack Sessions

gbhackers.com · 4 months ago

There is a critical vulnerability in ConnectWise ScreenConnect remote desktop software that allows attackers to extract server level cryptographic material and hijack active user sessions. The flaw is tracked as CVE-2026-3564 and categorized as CWE-347, carries a CVSS v3.1 base score of 9.0, and affects all ScreenConnect deployments before version 26.1. ConnectWise released ScreenConnect version 26.1 to replace local machine key storage with encrypted storage and active key management, cloud instances have been patched by the vendor and on premise administrators must install the 26.1 update and renew expired maintenance if necessary.

CISA Warns of Zimbra, SharePoint Flaw Exploits; Cisco Zero-Day Hit in Ransomware Attacks

thehackernews.com · 4 months ago

CISA urged government agencies to apply patches for two actively exploited vulnerabilities affecting Synacor Zimbra Collaboration Suite and Microsoft Office SharePoint. The flaws are CVE-2025-66376, a stored cross site scripting issue in the Zimbra Classic user interface exploitable via CSS import directives and fixed in Zimbra versions 10.0.18 and 10.1.13 in November 2025, and CVE-2026-20963, a deserialization of untrusted data vulnerability in SharePoint that can lead to remote code execution and was patched in January 2026. CISA set patch deadlines of April 1, 2026 for CVE-2025-66376 and March 23, 2026 for CVE-2026-20963, and the advisory also noted that Amazon reported Interlock ransomware actors exploited a Cisco firewall zero day tracked as CVE-2026-20131 beginning January 26, 2026.

SnappyClient Implant Blends Remote Access, Data Theft, and Stealth Evasion

gbhackers.com · 4 months ago

A new modular command-and-control implant called SnappyClient has emerged, blending remote access, credential theft, and stealth techniques. It’s delivered through malware like HijackLoader and GhostPulse, targeting Windows systems and cryptocurrency users. SnappyClient evades detection by disabling AMSI scanning and employing process injection techniques, while also utilizing encrypted configurations and a custom TCP protocol. Researchers observed the implant’s operators are financially motivated, focusing on cryptocurrency theft through screenshots and targeted data exfiltration.

New iOS Exploit Uses Advanced iPhone Hacking Tools to Steal Personal Data

gbhackers.com · 4 months ago

Google’s Threat Intelligence Group has identified a sophisticated iOS exploit called DarkSword, active since November 2023, that compromises devices running iOS 18.4 through 18.7. The exploit chain relies entirely on JavaScript and has been used by multiple threat actors, including state-sponsored groups, to target individuals in Saudi Arabia, Turkey, Malaysia, and Ukraine. The exploit leverages six vulnerabilities, including CVE-2025-31277, CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520, to deploy malware such as GHOSTKNIFE, GHOSTSABER, and GHOSTBLADE for data theft. Apple has patched these vulnerabilities in iOS 26.3, and users are strongly encouraged to update their devices immediately.

From virtio-snd 0-Day to Hypervisor Escape: Exploiting QEMU with an Uncontrolled Heap Overflow

osec.io · 4 months ago

Researchers have found a guest-to-host escape vulnerability in QEMU stemming from a heap overflow in the virtio-snd device. The vulnerability combines issues like under-allocated buffers and a lack of bounds checking, allowing attackers to trigger out-of-bounds writes and corrupt memory. The exploit uses VFS extended attributes for heap shaping and leverages glibc’s allocator to gain control and ultimately achieve arbitrary code execution on the host machine. This zero-day vulnerability affects QEMU commit ece408818d27f745ef1b05fb3cc99a1e7a5bf580 and glibc 2.43.

Cisco Firewall Zero-Day Actively Exploited to Deliver Interlock Ransomware

gbhackers.com · 4 months ago

Security researchers have discovered a zero-day vulnerability in Cisco Secure Firewall Management Centre software being actively exploited by the Interlock ransomware group. The flaw, tracked as CVE-2026-20131, allows unauthenticated attackers to execute arbitrary code and gain root privileges. Attackers have been leveraging this vulnerability since January 26, 2026, to compromise enterprise environments and deploy ransomware, along with custom remote access trojans and a memory-resident webshell. Affected organizations are urged to immediately apply security patches and thoroughly review their networks for suspicious activity.

Silicon Valley Bet on War. The Bets Are Paying Off.

www.nytimes.com · 4 months ago

false

[Tool] I built a CVE visualization tool for fun (VulnPath) -- would love and appreciate any feedback from this community!

vulnpath.vercel.app · 4 months ago

The website VulnPath is currently under development. It aims to provide a visualizer for Common Vulnerabilities and Exposures, or CVEs. A feature for looking up CVE information will be available soon. Users can provide their email address to receive updates about the website's launch.

GlassWorm: Part 5 -- xorshift obfuscation, Chrome HMAC bypass, and cryptowallet seed phrase theft

codeberg.org · 4 months ago

false

Ubtuntu 24.04+ Snapd Local Privilege Escalation (CVE-2026-3888)

blog.qualys.com · 4 months ago

A critical Local Privilege Escalation vulnerability, CVE-2026-3888, has been identified in Ubuntu Desktop versions 24.04 and later. The flaw allows an attacker to gain root access by exploiting an interaction between snap-confine and systemd-tmpfiles, requiring a 10-30 day window. Additionally, a race condition was found in the uutils coreutils package within Ubuntu 25.10, but was mitigated before release through collaboration with the Ubuntu Security Team. Organizations should update snapd to patched releases to address the vulnerability.

Smashing Security podcast #459: This clever scam nearly hijacked a tech CEO’s Apple ID

grahamcluley.com · 4 months ago

A sophisticated scam almost compromised the Apple ID of WordPress co-founder Matt Mullenweg, utilizing MFA fatigue, convincing support calls, and a deceptive phishing page. Concerns are also rising regarding the anonymity of data held by the UK Biobank, where de-identified health records may be vulnerable. Additionally, a Chief Information Security Officer was sentenced to eight hours at an RSA expo floor as punishment for a security breach. A DOGE employee stole Social Security data, while a foreign hacker compromised files held by the FBI.

CVE-2026-32746 GNU telnetd Buffer Overflow PoC - Critical (9.8)

pwn.guide · 4 months ago

A critical pre-authentication buffer overflow vulnerability, CVE-2026-32746, affects GNU InetUtils telnetd versions up to 2.7 and derived implementations using the BSD SLC codebase. The vulnerability lies in the LINEMODE handler, where an attacker can send crafted SLC suboptions to overflow a 108-byte buffer, corrupting memory and potentially enabling arbitrary code execution. Exploitation requires sending numerous crafted triplets during option negotiation, without authentication. Mitigation involves disabling telnet service or restricting access and awaiting a patch.

Navigating Security Tradeoffs of AI Agents

unit42.paloaltonetworks.com · 4 months ago

The rise of AI agents, like Clawdbot, presents new security challenges alongside increased productivity. Attackers may target open-source AI ecosystems or exploit an organization’s internal AI agents, potentially compromising models, connectors, and dependencies. Security measures include scanning model files, using trusted remote servers for Model Context Protocols, and implementing strict access controls to limit agent privileges and prevent data breaches. Organizations should prioritize simple, regularly reviewed security policies and treat agents as potentially rogue employees to mitigate risk and protect against unintentional harm.

Aura confirms data breach exposing 900,000 marketing contacts

www.bleepingcomputer.com · 4 months ago

Identity protection company Aura has confirmed a data breach impacting nearly 900,000 customer records. The incident stemmed from a voice phishing attack on an employee, exposing names, email addresses, home addresses, and phone numbers. Threat group ShinyHunters claimed responsibility and leaked the stolen data after negotiations failed, though Aura states that Social Security Numbers, account passwords, and financial information were not compromised. Aura is conducting an internal review and notifying affected individuals.

C2 Implant 'SnappyClient' Targets Crypto Wallets

www.darkreading.com · 4 months ago

Researchers have identified a new command-and-control (C2) implant called SnappyClient, which is used to steal cryptocurrency and maintain persistent access to compromised systems. The malware employs techniques to evade detection, including bypassing Microsoft’s Antimalware Scan Interface and using ChaCha20-Poly1305 encryption for C2 communications. Attackers use a modular malware loader, HijackLoader, to deliver SnappyClient, and have previously distributed malware like RedLine Stealer and Danabot using it. SnappyClient can steal data from multiple browsers and establish remote shell access, indicating it is intended for long-term operations.

DarkSword: iPhone Exploit Kit Serves Spies & Thieves Alike

www.darkreading.com · 4 months ago

A new exploit chain called DarkSword is actively targeting iPhones running iOS versions 18.4 through 18.7, compromising devices to steal data and potentially gain financial gain. The chain utilizes vulnerabilities including CVE-2025-31277, CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520 to achieve remote code execution and data exfiltration. Attackers have targeted users in Saudi Arabia, Turkey, Malaysia, and Ukraine, and the toolkit’s accessibility suggests a growing secondary market for iOS exploits. Experts recommend continuous security validation and prompt software updates to mitigate the risk.

Roundcube Webmail: three more sanitizer bypasses enable email tracking and phishing

nullcathedral.com · 4 months ago

There are three HTML sanitizer bypasses in Roundcube Webmail that allow SMIL animation values and by attributes to load remote resources, unquoted body background values to inject CSS via the url function, and position fixed important to create full viewport phishing overlays. These vulnerabilities affect versions prior to 1.5.14, 1.6.14, and 1.7-rc5 and were disclosed on March 18, 2026, with a CVE pending, and prior exploitation of CVE-2024-37383 is noted. The SMIL and background bypasses defeat block remote images to enable open tracking, IP logging, browser fingerprinting, and timed beacons, while the position fixed important bypass enables phishing overlays that can impersonate Roundcube login prompts. All three issues were fixed in Roundcube 1.5.14, 1.6.14, and 1.7-rc5 by adding element and attribute validation, rejecting improperly formed data image URIs that are not valid base64, and changing the position check to detect fixed as a substring.

CISA orders feds to patch Zimbra XSS flaw exploited in attacks

www.bleepingcomputer.com · 4 months ago

The Cybersecurity and Infrastructure Security Agency has directed U.S. government agencies to address a security vulnerability in the Zimbra Collaboration Suite. This high-severity cross-site scripting flaw, identified as CVE-2025-66376, allows attackers to potentially hijack user sessions and steal data. Zimbra servers have been frequently targeted by attackers, including the Russian state-backed Winter Vivern group, who have exploited past vulnerabilities to compromise numerous servers. CISA urges all organizations to patch the flaw promptly, referencing Binding Operational Directive 22-01.

The Collapse of Predictive Security in the Age of Machine-Speed Attacks

www.securityweek.com · 4 months ago

The timeframe for predicting and preventing cyberattacks has significantly diminished due to the industrialization of cybercrime and the efficiency of Internet access brokers. Attackers are now rapidly exploiting vulnerabilities, often within days of disclosure, leading to a shift from predictive to preemptive security strategies. This preemptive approach emphasizes reducing attacker opportunities, prioritizing risk based on business impact, and reinforcing basic security hygiene like multi-factor authentication and credential rotation. Ransomware attacks are increasing, with a 46.4% rise in leak posts between 2024 and 2025.

Silicon Valley Musters Behind-the-Scenes Support for Anthropic

www.nytimes.com · 4 months ago

false

ConnectWise patches new flaw allowing ScreenConnect hijacking

www.bleepingcomputer.com · 4 months ago

ConnectWise is warning ScreenConnect users about a critical vulnerability, tracked as CVE-2026-3564, that allows attackers to potentially gain unauthorized access. The flaw involves the cryptographic signature verification process and affects versions prior to 26.1. While there is no evidence of widespread exploitation, researchers have observed attempts to abuse machine keys, and previous attacks have leveraged similar vulnerabilities like CVE-2025-3935. ConnectWise recommends upgrading to version 26.1 and implementing additional security measures to protect sensitive data.

Autonomous Offensive Security Firm XBOW Raises $120M at $1B+ Valuation

www.securityweek.com · 4 months ago

XBOW, an autonomous offensive security firm, has secured 120 million dollars in Series C funding, achieving a valuation exceeding 1 billion dollars. The company’s AI-powered platform continuously identifies and validates software vulnerabilities, operating at machine speed to mirror modern development cycles and potential AI-driven attacks. This investment will support expansion, product innovation, and international growth, allowing XBOW to provide security teams with reproducible proof of vulnerabilities and reduce false positives. Founded by the creator of GitHub Copilot, XBOW aims to accelerate the capabilities of security experts through automation.

OFAC Sanctions DPRK IT Worker Network Funding WMD Programs Through Fake Remote Jobs

thehackernews.com · 4 months ago

false

Ransomware gang exploits Cisco flaw in zero-day attacks since January

www.bleepingcomputer.com · 4 months ago

The Interlock ransomware gang has been exploiting a zero-day vulnerability in Cisco’s Secure Firewall Management Center software since late January. This vulnerability, identified as CVE-2026-20131, allows unauthenticated attackers to remotely execute code as root. Cisco patched the flaw on March 4, 2026, after Amazon’s threat intelligence team discovered the exploitation. Interlock, which surfaced in September 2024, has claimed responsibility for attacks on several organizations, and recently deployed a new malware strain called Slopoly.

Apple Rolls Out Real-Time Security Fixes Across iPhone, iPad, and Mac

www.techrepublic.com · 4 months ago

Apple has introduced Background Security Improvements, a new system designed to address vulnerabilities in real time. This system targets specific software components like Safari and its WebKit engine, which powers most iPhone browsers. A cross-origin issue in the Navigation API has been resolved, impacting CVE-2026-20643. Users can ensure automatic installation of these fixes through device settings.

Interlock Ransomware Exploits Cisco FMC Zero-Day CVE-2026-20131 for Root Access

thehackernews.com · 4 months ago

The Interlock ransomware group is actively exploiting a critical zero-day vulnerability in Cisco Secure Firewall Management Center Software, identified as CVE-2026-20131. This vulnerability allows unauthenticated attackers to gain root access and execute code. Amazon Threat Intelligence discovered the exploitation thanks to a threat actor's operational security mistake, revealing their attack chain, which includes custom trojans, reconnaissance scripts, and tools for obscuring origins. Security experts advise immediate patching, security assessments, and implementing defense-in-depth strategies.

Observability for AI Systems: Strengthening visibility for proactive risk detection

www.microsoft.com · 4 months ago

false

Cloud Security Startup Native Exits Stealth With $42 Million in Funding

www.securityweek.com · 4 months ago

false

CVE PoC Search

watchstack.io · 4 months ago

A search engine has identified over thirty thousand vulnerabilities with proof of concept exploits. Several vulnerabilities allow for remote code execution, including CVE-2026-25769 in Wazuh cluster deserialization, CVE-2026-3086 in a GStreamer codec parser, and CVE-2025-66398 in a Signal K Server. Other identified issues include denial of service, information disclosure, and authorization bypass vulnerabilities, affecting products like Linksys routers, Tenda access points, and Firefox. Exploits generally require authentication, although some are pre-authentication.

Marquis: Ransomware gang stole data of 672K people in cyberattack

www.bleepingcomputer.com · 4 months ago

A Texas-based financial services provider, Marquis, experienced a ransomware attack in August 2025 that impacted over 670,000 individuals. The attack began after threat actors compromised a SonicWall firewall, leading to the theft of sensitive personal and financial data. Marquis is currently facing multiple class action lawsuits and has filed a lawsuit against SonicWall alleging gross negligence. The SonicWall breach, disclosed in September 2025, potentially affected customers with cloud backup services, and has been linked to a state-sponsored hacking group.

‘DarkSword’ iOS Exploit Kit Used by State-Sponsored Hackers, Spyware Vendors

www.securityweek.com · 4 months ago

Security researchers have identified DarkSword, a sophisticated iOS exploit kit used by a Russian state-sponsored hacking group, UNC6353, and commercial spyware vendors. This kit targets six vulnerabilities to achieve full device compromise with minimal user interaction, often through watering hole attacks. The exploit chain leverages vulnerabilities including CVE-2025-31277, CVE-2025-43529, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520, and CVE-2026-20700. Hundreds of millions of iPhones are potentially vulnerable, and users are advised to update to the latest iOS versions.

Google Sits Pretty as A.I. Rivals Compete for Pentagon Favor

www.nytimes.com · 4 months ago

false

'Claudy Day’ Trio of Flaws Exposes Claude Users to Data Theft

www.darkreading.com · 4 months ago

Researchers have uncovered a series of flaws in Anthropic's Claude AI agent, enabling a chain attack dubbed "Claudy Day" that can compromise user data. Attackers can embed malicious instructions in a URL, making it appear as a legitimate search result, then silently extract sensitive information or trigger actions on behalf of the user. The attack exploits invisible prompt injections, a data exfiltration channel through the Anthropic Files API, and an open redirect vulnerability. Anthropic has addressed the prompt injection flaw and is working on other issues; restricting AI tool access and requiring user approval before tool usage are recommended security measures.

Virtual Summit Today: Supply Chain & Third-Party Risk Summit

www.securityweek.com · 4 months ago

false

EU Sanctions Chinese, Iranian Firms Supporting Hacking Operations

www.securityweek.com · 4 months ago

The European Union has imposed sanctions on five entities and two individuals for involvement in hacking activities. Targeted are two Chinese companies, Integrity Technology Group and Anxun Information Technology, accused of providing tools and services to state-sponsored hacking groups like Flax Typhoon and offering hacking-for-hire services. Also sanctioned is the Iranian hacking group Emennet Pasargad, linked to Iran’s Islamic Revolutionary Guard Corps, which has been implicated in attacks against Sweden and influence operations targeting the 2020 US presidential election. The sanctions aim to address threats to EU member states and their foreign policy objectives.

~72% of companies report incomplete recovery after incidents - insights from 80 SEC disclosures

www.dukesecurity.ai · 4 months ago

Duke Security has compiled a database of cybersecurity incidents. The database uses artificial intelligence to categorize incidents and provides additional context. It currently contains 80 incidents, spanning various sectors. The database tracks business continuity outcomes and details methods, assets, and impact.

The Refund Fraud Economy: Exploiting Major Retailers and Payment Platforms

www.bleepingcomputer.com · 4 months ago

Refund fraud has evolved into a structured underground marketplace where techniques are sold like digital products. Fraudsters exploit customer service processes and payment dispute systems to manipulate refund policies, often claiming items were never received or disputing legitimate charges. This activity is costing retailers billions of dollars annually, with approximately 15% of returns estimated to be fraudulent. Researchers found tutorials and services are sold online, enabling even novices to participate in schemes like "refund without return" and "goods swapping."

New DarkSword iOS exploit used in infostealer attack on iPhones

www.bleepingcomputer.com · 4 months ago

A new exploit kit called Darksword is being used to target iPhones running iOS versions 18.4 through 18.6.2, with researchers linking the attacks to a likely Russian threat actor. The kit exploits known vulnerabilities, tracked as CVE-2025-31277, CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520, that have since been patched by Apple. Darksword attacks begin in the Safari browser and steal a wide range of data, including cryptocurrency wallet information, passwords, photos, and messages. Users are advised to update to iOS 26.3.1 and enable Lockdown Mode to mitigate the risk.

Shadow AI Risk: How SaaS Apps Are Quietly Enabling Massive Breaches

www.securityweek.com · 4 months ago

A new report reveals a significant rise in SaaS application attacks, with a 490% increase year-over-year, often involving the compromise of sensitive data. Organizations average 140 AI-enabled SaaS environments, creating opportunities for attackers to exploit interconnected systems, as demonstrated by the Salesloft Drift incident affecting over 700 organizations, including security firms. The report highlights "shadow AI", AI usage within SaaS apps often unknown to IT departments, as a major contributor to risk, emphasizing the need for improved identity-based security and continuous oversight to prevent cascading breaches. Experts predict 2026 may see a worsening of SaaS security incidents.

Manifold Raises $8 Million for AI Detection and Response

www.securityweek.com · 4 months ago

false

Nordstrom's email system abused to send crypto scams to customers

www.bleepingcomputer.com · 4 months ago

Nordstrom customers recently received fraudulent emails promoting a cryptocurrency scam, disguised as a St. Patrick’s Day promotion. The messages promised to double cryptocurrency deposits within two hours, creating a sense of urgency. The emails originated from a legitimate Nordstrom company email address, indicating a possible security breach through an Okta SSO to Salesforce compromise. Nordstrom has warned customers to disregard the unauthorized messages and verified that they will not request cryptocurrency transactions.

FancyBear Server Leak Exposes Stolen Credentials, 2FA Secrets, NATO Targets

gbhackers.com · 4 months ago

A Russian state-sponsored threat actor, APT28/FancyBear, inadvertently exposed a command and control server containing stolen credentials, 2FA secrets, and operational logs. The server, located at 203.161.50[.]145, was accessible for approximately 500 days due to a basic operational security failure. The compromised data included over 2,800 emails, 240 credential sets, and targeted government and military entities in Ukraine, Romania, Bulgaria, Greece, Serbia, and North Macedonia. The exposed toolkit leveraged JavaScript payloads injected into Roundcube and SquirrelMail, enabling credential theft and persistent email forwarding.

UIDAI Introduces Bug Bounty Program to Strengthen Aadhaar Defenses

gbhackers.com · 4 months ago

The Unique Identification Authority of India has launched a bug bounty program to strengthen the security of the Aadhaar system. Twenty experienced security researchers will assess the UIDAI website, the myAadhaar portal, and the Secure QR Code application for vulnerabilities. Researchers will report findings through responsible disclosure channels and receive financial rewards based on the severity of the discovered flaws, which are classified as Critical, High, Medium, or Low. UIDAI has partnered with ComOlho IT Private Limited to manage the program and augment existing security measures.

How to Follow the Game, Even When You Can’t See It Live

www.nytimes.com · 4 months ago

false

Researchers: Meta, TikTok Steal Personal & Financial Info When Users Click Ads

www.darkreading.com · 4 months ago

Social media companies like Meta and TikTok are collecting extensive user data through tracking pixels embedded in advertisers' websites. These pixels gather personally identifying information, credit card details, and shopping behavior, often without users' explicit consent or knowledge, even when users indicate they don’t want their data shared. This practice raises concerns about potential violations of data privacy laws like GDPR and CCPA, and advertisers who use these pixels may face legal repercussions. Both Meta and TikTok have responded to inquiries but have not yet provided formal comments.

SideWinder Espionage Campaign Expands Across Southeast Asia

www.darkreading.com · 4 months ago

The SideWinder threat group, linked to India, has expanded its cyber-espionage operations from South Asia to Southeast Asia, including Indonesia and Thailand. They utilize phishing, stolen credentials, and rapidly changing infrastructure to maintain persistent access to government institutions, telecommunications networks, and strategic sectors. The group employs tactics like DLL hijacking and dynamic configuration data retrieval to evade detection and quickly redeploy infrastructure. Researchers recommend organizations move beyond indicator-based defenses to focus on repeatedly blocking the group’s tactics, techniques, and procedures.