Blahalla

Wikipedia hit by self-propagating JavaScript worm that vandalized pages

www.bleepingcomputer.com · 4 months ago

The Wikimedia Foundation experienced a security incident involving a self-propagating JavaScript worm that vandalized Wikipedia pages and modified user scripts. The worm originated from a malicious script uploaded to Russian Wikipedia in March 2024, and was initially executed by a Wikimedia employee account while testing user script functionality. The script spread by injecting malicious code into user and global JavaScript files, affecting approximately 85 users and 3,996 pages. Editing was temporarily restricted while engineers reverted changes and removed the malicious code.

Hackers Used New Exploit Kit to Compromise Thousands of iPhones

www.techrepublic.com · 4 months ago

Google’s Threat Intelligence Group recently uncovered Coruna, a sophisticated iOS exploit kit used to compromise thousands of iPhones between 2025 and 2026. The toolkit contains 23 exploits across five attack chains, targeting devices running iOS versions from September 2019 to December 2023. Coruna was used by multiple threat actors, initially for surveillance, then by a Russian espionage group and later by a financially motivated Chinese group. Key vulnerabilities exploited include CVE-2021-30952, CVE-2023-32409, CVE-2023-32434, CVE-2024-23222, and CVE-2024-23225. Security teams are advised to update devices, enable Lockdown Mode, deploy mobile threat defense solutions, and restrict access to high-risk websites.

Cisco Drops 48 New Firewall Vulnerabilities, 2 Critical

www.darkreading.com · 4 months ago

Cisco has announced 48 vulnerabilities in its firewall products, including Adaptive Security Appliance (ASA), Secure FTD, and Secure Firewall Management Center (FMC). Two vulnerabilities, CVE-2026-20079 and CVE-2026-20131, are classified as critical, potentially allowing attackers to gain root access and execute code. These critical flaws, along with nine others, have received high CVSS scores, raising concerns about potential exploitation and abuse. Experts warn that compromising the FMC could undermine network security controls and allow attackers to modify firewall rules and disable security features. Organizations are urged to update their software and run the Cisco Software Checker to mitigate these risks.

WordPress membership plugin bug exploited to create admin accounts

www.bleepingcomputer.com · 4 months ago

Hackers are actively exploiting a critical vulnerability, CVE-2026-1492, in the User Registration & Membership plugin used by over 60,000 WordPress sites. This flaw allows attackers to create administrator accounts without authentication, granting them full control of a website. Researchers have observed numerous exploitation attempts, and the plugin developer has released version 5.1.3 to address the issue; users should update to the latest version, 5.1.4. The vulnerability represents the most severe disclosed this year for the User Registration & Membership plugin.

FBI arrests suspect linked to $46M crypto theft from US Marshals

www.bleepingcomputer.com · 4 months ago

A U.S. government contractor's son, John Daghita, has been arrested in Saint Martin for allegedly stealing over $46 million in cryptocurrency from the U.S. Marshals Service. Daghita, who also goes by the online handle "Lick," is the son of the CEO of Command Services & Support, a firm managing seized digital assets for the Marshals Service. The stolen funds are reportedly connected to the 2016 Bitfinex hack, involving the theft of 120,000 bitcoins. Blockchain investigator ZachXBT initially uncovered the scheme and reported his findings to authorities after Daghita inadvertently revealed his actions in a Telegram chat.

Ukrainian women fleeing war exploited in multimillion-dollar gambling fraud scheme

therecord.media · 4 months ago

A criminal network in Spain exploited dozens of Ukrainian women displaced by war in a multimillion-dollar gambling fraud scheme. The group recruited women, brought them to Spain, and used them to open bank accounts and obtain credit cards, which were then controlled by the criminals to move illicit funds through online betting platforms. Authorities estimate the network generated roughly 5.5 million dollars in illegal profits and invested some proceeds in luxury real estate. Twelve suspects have been arrested, and searches were conducted in both Spain and Ukraine.

Phobos ransomware leader facing 20 years in prison after pleading guilty to hacking charges

therecord.media · 4 months ago

A Russian national has pleaded guilty to wire fraud charges related to his involvement in the Phobos ransomware gang. Evgenii Ptitsyn, 43, developed and marketed the ransomware, distributing it to affiliates and profiting from their attacks on organizations worldwide. The group, also linked to the 8Base ransomware strain, reportedly collected over $16 million in ransoms since 2019. Authorities have arrested multiple members of the group, and a free decryption tool is available for victims.

Israel Hacked Traffic Cameras in Iran

www.schneier.com · 4 months ago

Reports indicate Israel hacked traffic cameras in Iran. The hacking allegedly aided in the killing of Iranian leadership. The New York Times has published a report detailing this broader intelligence operation. The incident has resulted in the potential for more hard-line figures to assume leadership positions.

Cisco issues emergency patches for critical firewall vulnerabilities

www.csoonline.com · 4 months ago

Cisco has released emergency security patches to address critical vulnerabilities in its firewall products. The most significant issues are two “perfect 10” vulnerabilities, CVE-2026-20079 and CVE-2026-20131, found in the Secure Firewall Management Center software. These flaws allow unauthenticated attackers to gain remote root access through the web management interface. The update also resolves 46 other CVEs, including six rated as “high,” with vulnerabilities impacting the VPN web server and potentially causing denial-of-service states.

Women’s History Month: Encouraging women in cybersecurity at every career stage

www.microsoft.com · 4 months ago

false

Credential Protection for AI Agents: The Phantom Token Pattern

nono.sh · 4 months ago

A new system called nono protects AI coding agents by preventing them from directly handling sensitive API credentials. Instead of directly providing keys, agents receive temporary tokens that are validated and replaced by a proxy. The system offers features like proxy-based authentication, domain filtering, and 1Password integration, alongside security measures like constant-time comparison and memory wiping. A less secure alternative, --env-credential, is available when proxying isn't possible.

Software Development Practices Help Enterprises Tackle Real-Life Risks

www.darkreading.com · 4 months ago

false

Demand for AI Data Centers Sends Prospectors Hunting for Land and Power

www.nytimes.com · 4 months ago

false

The Smart Home Never Quite Worked. Now It’s Getting an A.I. Reboot.

www.nytimes.com · 4 months ago

false

Anthropic CEO Calls OpenAI’s Military Messaging ‘Straight Up Lies’

www.techrepublic.com · 4 months ago

false

Malicious AI Assistant Extensions Harvest LLM Chat Histories

www.microsoft.com · 4 months ago

Malicious browser extensions impersonating AI assistant tools have been identified as harvesting user data from platforms like ChatGPT and DeepSeek. Approximately 900,000 installations are reported, impacting over 20,000 enterprise tenants. These extensions collect URLs and AI chat content, potentially exposing sensitive information, and were distributed through the Chrome Web Store for use with both Google Chrome and Microsoft Edge. Microsoft Defender XDR detections are available to help identify and mitigate this threat.

Preparing for the Quantum Era: Post-Quantum Cryptography Webinar for Security Leaders

thehackernews.com · 4 months ago

Attackers are collecting encrypted data now with the intent to decrypt it later using quantum computers, a tactic called “harvest now, decrypt later.” Security leaders are advised to prepare for this future threat by transitioning to quantum-resistant encryption methods, such as hybrid cryptography combining traditional algorithms with quantum-resistant algorithms like ML-KEM. Organizations should identify sensitive data, understand current encryption usage, and implement hybrid cryptographic strategies. A webinar will discuss practical steps and how to build a quantum-ready security strategy.

Cisco Confirms Active Exploitation of Two Catalyst SD-WAN Manager Vulnerabilities

thehackernews.com · 4 months ago

Cisco has confirmed active exploitation of vulnerabilities in its Catalyst SD-WAN Manager software. Two vulnerabilities, CVE-2026-20122 and CVE-2026-20128, are currently being targeted. CVE-2026-20122 allows for arbitrary file overwrites while CVE-2026-20128 enables information disclosure. Users are advised to immediately update to a fixed software release and implement security best practices to mitigate the risk.

Google says 90 zero-days were exploited in attacks last year

www.bleepingcomputer.com · 4 months ago

Google’s Threat Intelligence Group reports 90 zero-day vulnerabilities were exploited in attacks last year, a 15% increase from 2024. The vulnerabilities primarily targeted enterprise software and operating systems, with memory safety issues accounting for a significant portion. Microsoft was the most targeted vendor, and commercial spyware vendors are now the largest users of these vulnerabilities. Google anticipates zero-day exploitation will remain high due to the increasing use of AI tools.

2026 Browser Data Reveals Major Enterprise Security Blind Spots

www.bleepingcomputer.com · 4 months ago

A recent report reveals the browser has become the most critical and least protected control point for enterprises, particularly with the rise of AI-native browsers and copilots. Employees are increasingly using AI tools within browsers, often bypassing formal governance and exposing sensitive data like source code and financial information. Attackers are exploiting this shift, using techniques like phishing and malicious browser extensions to bypass traditional security controls. The report highlights a need for enhanced browser-based visibility and control to address these evolving risks.

Google: Half of 2025’s 90 Exploited Zero-Days Aimed at Enterprises

www.securityweek.com · 4 months ago

Google's Threat Intelligence Group reported 90 zero-day vulnerabilities were exploited in 2025, a slight increase from previous years. Enterprises are facing a growing threat, with nearly half of these vulnerabilities impacting enterprise technologies. Commercial surveillance vendors were the leading threat actors, exploiting 15 vulnerabilities, while state-sponsored groups, particularly those linked to China, accounted for 12. Google anticipates artificial intelligence will play an increasing role in both attack and defense strategies in 2026.

HPD (Hex Packet Decoder) now have AI feature – looking for feedback

hpd.gasmi.net · 4 months ago

false

Google says 90 zero-days exploited in 2025 as commercial vendor activity grows

therecord.media · 4 months ago

Google's Threat Intelligence Group reports a significant increase in zero-day exploits, tracking 90 in 2025, compared to 78 in 2024. Commercial surveillance vendors are increasingly exploiting zero-days, often targeting mobile devices and browsers to sell intrusion tools. State-sponsored groups, particularly those from China, prioritize exploiting edge devices and security appliances, with Chinese groups being the most prolific users of zero-day vulnerabilities. Exploits were attributed to vulnerabilities such as CVE-2025-21590, CVE-2025-0282, CVE-2025-61882, CVE-2025-61884, and CVE-2025-8088.

‘We’re not trying to remake the economy’: FTC’s Mufarrige charts new course on tech enforcement

therecord.media · 4 months ago

false

Coruna iOS exploit kit moved from spy tool to mass criminal campaign in under a year

www.csoonline.com · 4 months ago

Researchers at Google and iVerify have uncovered a sophisticated iOS exploit kit called Coruna, initially used by a commercial surveillance company, then by a suspected Russian espionage group, and now by Chinese cybercriminals. The kit targets iPhones running iOS 13.0 through iOS 17.2.1, exploiting 23 vulnerabilities to deliver a payload, Plasmagrid, designed to steal cryptocurrency wallet credentials by targeting applications like MetaMask and scanning for seed phrases. This incident highlights a thriving secondary market for zero-day exploits and underscores the need for stronger mobile security measures beyond traditional device management. Users are urged to update to the latest iOS version and enable Lockdown Mode if possible.

LatAm Now Faces 2x More Cyberattacks Than US

www.darkreading.com · 4 months ago

Latin America is experiencing a significant surge in cyberattacks, averaging nearly three thousand weekly threats compared to just under fifteen hundred in the United States. Cyberattacks involving ransomware, infostealers, banking malware, and botnets are notably more prevalent in Latin America. Email remains a primary attack vector in Latin America, unlike the United States where web-based attacks dominate, likely due to lower cyber awareness and uneven security investments in the region. A recent supply chain incident at Brazilian fintech provider C&M Software, involving insider threat and ransomware (Dragonforce), highlights the vulnerability of even larger organizations.

2,622 Valid Certificates Exposed: A Google-GitGuardian Study Maps Private Key Leaks to Real-World Risk

blog.gitguardian.com · 4 months ago

Researchers from GitGuardian and Google have identified a significant problem: leaked private keys are being used to secure valid TLS certificates, often protecting major organizations. Since 2021, approximately one million private keys have been leaked, mapping to over 140,000 certificates, with 2,600 remaining valid as of September 2025. A disclosure campaign revealed a concerning lack of response from organizations and Certificate Authorities, highlighting a widespread misunderstanding of the risks and inadequate revocation practices. The research emphasizes the need for shorter key lifetimes, preventing key reuse, and implementing better blacklisting procedures to protect against data interception and impersonation.

ThreatsDay Bulletin: DDR5 Bot Scalping, Samsung TV Tracking, Reddit Privacy Fine & More

thehackernews.com · 4 months ago

Reddit has been fined by U.K. regulators for improperly handling children’s data. Texas is restricting Samsung’s data collection practices for smart TVs, while NATO has approved iPhones and iPads for classified use. Phishing attacks are increasingly sophisticated, employing techniques like infrastructure abuse and spoofed email chains to target users and steal credentials. Experts caution against the risks of over-relying on AI coding tools and warn that new AI models can deanonymize internet users.

YGGtorrent — Fin de partie [French]

yggleak.top · 4 months ago

There was a comprehensive compromise of YGGtorrent infrastructure exposing source code, server configurations, logs and databases containing about 6.6 million user accounts with emails and SHA 512 password hashes, one million torrents, 28 million peers and roughly 16.6 gigabytes of exfiltrated data. Monetization and laundering operations were documented, including a paid Turbo Mode charging 86 euros, estimated revenues between 5 and 8.5 million euros, automated payment proxy domains using a CardsShield WooCommerce plugin, multiple payment processors and conversion to cryptocurrency with mixing via Tornado Cash. Operational weaknesses included an exposed unauthenticated SphinxQL service, FastCGI cross user and PHP FPM escalation vectors, a CloudPanel vulnerability tracked as CVE-2024-44765, and an attempted PHP CGI argument injection exploit identified as CVE-2024-4577 which failed during assessment.

Europol: Großer Markt für gestohlene Daten geschlossen

www.csoonline.com · 4 months ago

Europol coordinated an international operation to shut down Leakbase, a major online marketplace for stolen data. The platform, based in Amsterdam, had over 142,000 registered users worldwide and was described as a central hub for cybercrime. Law enforcement agencies in 14 countries conducted raids targeting key users of the platform. Authorities warn that stolen data is often resold and used for various types of fraud.

New MongoDB Vulnerability Allows Attackers to Crash Servers, Exposing Critical Data

gbhackers.com · 4 months ago

A high-severity denial-of-service vulnerability, CVE-2026-25611, has been discovered in MongoDB versions 7.0, 8.0, and 8.2. Attackers can exploit this flaw by sending crafted packets that trick the server into allocating excessive memory, potentially crashing the server. The vulnerability affects any MongoDB deployment with compression enabled and requires no authentication, impacting over 200,000 exposed instances. Patches are available in versions 7.0.29, 8.0.18, and 8.2.4, and users are urged to upgrade immediately.

LastPass Review: Features, Pricing, Security, and Who It’s Best For

www.techrepublic.com · 4 months ago

false

Threat Actors Exploit Fake Claude Code Downloads to Deploy Infostealer Malware

gbhackers.com · 4 months ago

Threat actors are exploiting interest in Anthropic’s Claude Code tools by creating fake download pages that distribute infostealer malware. Attackers use compromised domains and lure developers with fake installers, which then execute a lightweight infostealer via the Windows HTML Application Host, mshta.exe. This method allows attackers to steal credentials, browser data, and system information without complex malware. Security professionals should monitor mshta.exe activity, as it can be a key indicator of compromise in data theft operations.

Russian Ransomware Operator Pleads Guilty in US

www.securityweek.com · 4 months ago

A Russian national, Evgenii Ptitsyn, has pleaded guilty in the United States to charges related to his involvement in the Phobos ransomware operation. Ptitsyn was arrested in South Korea and extradited to the US, facing up to 20 years in prison for wire fraud conspiracy. He assisted with the sale, distribution, and operation of the ransomware, which targeted over 1,000 organizations worldwide and resulted in over 16 million dollars in ransom payments. Authorities have been actively dismantling the Phobos operation, with recent arrests including a suspected affiliate in Poland.

Police dismantle major phishing platform blamed for attacks on hospitals and schools

therecord.media · 4 months ago

International law enforcement agencies have dismantled Tycoon 2FA, a phishing-as-a-service platform that targeted over 500,000 organizations worldwide. The service allowed criminals to bypass multi-factor authentication and steal login credentials, impacting hospitals, schools, and other institutions. Authorities seized over 330 domains used to operate the platform, which sent tens of millions of phishing emails monthly. Microsoft estimates Tycoon 2FA was involved in about 62% of phishing attempts they blocked.

PoC Exploit for Cisco SD-WAN 0-Day Vulnerability Now Released, Actively Exploited in the Wild

gbhackers.com · 4 months ago

A critical zero-day vulnerability, CVE-2026-20127, is actively being exploited in Cisco Catalyst SD-WAN infrastructure, affecting the Controller and Manager. The vulnerability allows unauthenticated attackers to bypass authentication and gain administrative privileges. Threat actors linked to UAT-8616 are exploiting this flaw, sometimes escalating privileges further by leveraging CVE-2022-20775 after downgrading the system’s software version. A public proof-of-concept exploit has been released, significantly increasing the risk to critical infrastructure sectors.

Police dismantles online gambling ring exploiting Ukrainian women

www.bleepingcomputer.com · 4 months ago

Spanish and Ukrainian law enforcement have dismantled a criminal organization exploiting war-displaced Ukrainian women in an online gambling scheme. The group recruited vulnerable women, facilitated their travel to Spain, and controlled their bank accounts to launder approximately 4.75 million euros. The criminals used stolen identities from over 5000 citizens across 17 nationalities to place bets on online gambling platforms and generate fraudulent profits. Authorities arrested 12 suspects and seized assets including vehicles, computers, and bank accounts in multiple countries.

RingH23 Threat Actors Target MacCMS and CDN Infrastructure with New Arsenal

gbhackers.com · 4 months ago

Threat actors linked to the Funnull cybercrime group are using a new Linux toolkit called RingH23 to compromise MacCMS video sites and hijack CDN infrastructure. Attackers are poisoning MacCMS’s update channel and infiltrating GoEdge-based CDNs to inject malicious JavaScript and redirect users to scam sites. The toolkit includes components like officebin (Badredis2s), module.so (Badnginx2s), and libutilkeybd.so (Badhide2s) for backdoors, JavaScript injection, and rootkit functionality. Security professionals are advised to audit MacCMS deployments, inspect CDN environments, and consider migrating away from vulnerable platforms.

Cisco Warns of More Catalyst SD-WAN Flaws Exploited in the Wild

www.securityweek.com · 4 months ago

Cisco has reported that two vulnerabilities in its Catalyst SD-WAN Manager are currently being exploited. These flaws include CVE-2026-20128, an information disclosure vulnerability, and CVE-2026-20122, which allows for arbitrary file overwrites. The exploitation involves chaining these vulnerabilities with others, including CVE-2026-20127 and CVE-2022-20775. Cybersecurity agencies attribute these attacks to threat actors UAT-8616 and UAT-9686.

Dust Specter Targets Iraqi Officials with New SPLITDROP and GHOSTFORM Malware

thehackernews.com · 4 months ago

A threat actor, tracked as Dust Specter and suspected to have ties to Iran, is targeting Iraqi government officials through a sophisticated cyber campaign. The attacks use impersonation of Iraq's Ministry of Foreign Affairs to deliver malware, including SPLITDROP, TWINTASK, TWINTALK, and GHOSTFORM. The malware uses techniques like geofencing, in-memory PowerShell execution, and even generative AI, along with compromised Iraqi government infrastructure, to evade detection and establish persistence. The campaign also utilizes social engineering tactics similar to ClickFix attacks, with fake Google Forms and Cisco Webex invitations.

Europol schließt riesigen Markt für gestohlene Daten

www.csoonline.com · 4 months ago

Europol and law enforcement agencies have shut down Leakbase, an online marketplace for stolen data. The platform, based in Amsterdam, had approximately 142,000 registered users worldwide and facilitated the trade of compromised data. Investigations, which began in the Netherlands in 2023 and involved multiple countries including Germany and the United States, resulted in around 100 raids targeting key users. Authorities warn that such platforms fuel cybercrime and enable fraudulent activities.

DPRK Hackers Target Crypto Firms, Steal Keys and Cloud Assets in Coordinated Attacks

gbhackers.com · 4 months ago

North Korean-linked threat actors are targeting cryptocurrency firms in a coordinated campaign. Attackers exploit the React2Shell vulnerability (CVE-2025-55182) to gain initial access and subsequently compromise AWS and Kubernetes environments. They steal source code, private keys, and credentials, including sensitive data from Terraform state files, and exfiltrate proprietary exchange logic via container images. Command and control uses a licensed VShell server and Fast Reverse Proxy for covert tunneling, with infrastructure hosted in South Korea.

Hacked App Part of US/Israeli Propaganda Campaign Against Iran

www.schneier.com · 4 months ago

Iranians received notifications on their phones shortly after explosions, with messages appearing to originate from a hacked prayer-timing app called BadeSaba Calendar, which has over 5 million downloads. The messages began with the phrase "Help has arrived" and were delivered rapidly. Security experts suspect a government operation, potentially involving the US or Israel. No group has yet claimed responsibility for the apparent hack.

Security architecture question: controlling system authority when sensor trust degrades

burakoktenli-ai.github.io · 4 months ago

The HMAA Simulation Dashboard assesses an authority engine's safety and reliability through various simulations and validations. The system uses a tiered authority structure, with escalating pressure and sensor confidence influencing decision-making. Simulations validate monotonicity, tier reachability, and hysteresis effectiveness, alongside tests for sensor jamming, environment denial, and self-destruction protocols. The system incorporates fault-tolerant controls, including hysteresis to prevent authority oscillation under noise, and employs a seeded random number generator to ensure reproducibility of results.

Where Multi-Factor Authentication Stops and Credential Abuse Starts

thehackernews.com · 4 months ago

Multi-factor authentication, or MFA, isn't always enough to protect Windows environments from attackers. Many Windows logons, such as those occurring during interactive logins, RDP access, and through SMB, bypass MFA controls and rely on Active Directory authentication. Attackers exploit vulnerabilities like NTLM authentication, Kerberos ticket abuse, and compromised service accounts to gain unauthorized access, often moving laterally within a network. Security teams should focus on strengthening password policies, blocking compromised credentials, reducing reliance on legacy protocols, and regularly auditing service accounts to mitigate these risks.

62 people indicted by Taiwanese prosecutors over ties to cyber scam company Prince Group

therecord.media · 4 months ago

Taiwanese prosecutors have indicted 62 individuals and 13 companies linked to the Prince Group for involvement in cyber scam operations. The group, led by Chen Zhi, allegedly laundered at least 339 million dollars into Taiwan, using stolen funds to purchase assets. The operation, which spanned multiple countries and involved human trafficking and extortion, targeted victims in the U.S., Europe, and China. Authorities have seized approximately 174 million dollars in assets, and Chen Zhi has been extradited to China.

LeakBase Cybercrime Forum Shut Down, Suspects Arrested

www.securityweek.com · 4 months ago

Law enforcement has dismantled the LeakBase cybercrime forum, a platform active since 2021. The forum, which had roughly 142,000 registered users, facilitated the trade of stolen data like account credentials, payment card information, and bank details. During Operation Leak, authorities seized the forum's database and arrested suspects following house searches and user identification. Europol highlighted a unique trust-based system within the forum and noted a rule prohibiting data related to Russia.

Critical pac4j-jwt Authentication Bypass Vulnerability Allows Attackers to Impersonate Any User

gbhackers.com · 4 months ago

A critical vulnerability, tracked as CVE-2026-29000, has been identified in the pac4j-jwt Java authentication library. This flaw allows attackers to bypass authentication and impersonate users, including administrators, by crafting unsigned tokens and exploiting a misplaced null check. The vulnerability impacts deployments using RSA-encrypted tokens and the JwtAuthenticator configuration, allowing attackers to forge tokens with arbitrary claims. Users are urged to update to version 4.5.9 or newer for the 4.x line, 5.7.9 or newer for the 5.x branch, or 6.3.3 or newer for the 6.x line.

Cisco flags more SD-WAN flaws as actively exploited in attacks

www.bleepingcomputer.com · 4 months ago

Cisco has identified several actively exploited security vulnerabilities in its Catalyst SD-WAN Manager software. Two flaws, CVE-2026-20122, an arbitrary file overwrite, and CVE-2026-20128, an information disclosure, are currently being exploited. A critical authentication bypass vulnerability, CVE-2026-20127, has been exploited since 2023, enabling attackers to introduce malicious devices into networks, and CISA has issued directives for federal agencies to address this issue. Additionally, Cisco recently patched vulnerabilities in its Secure Firewall Management Center software, including CVE-2026-20079 and CVE-2026-20131.

APT28-Linked Campaign Deploys BadPaw Loader and MeowMeow Backdoor in Ukraine

thehackernews.com · 4 months ago

Researchers have identified a new cyber campaign targeting Ukrainian entities, attributed with moderate confidence to the APT28 threat actor. The attack begins with a phishing email leading to a ZIP archive containing a lure document disguised as a border crossing appeal. This triggers the deployment of a.NET-based loader called BadPaw, which then downloads and runs a sophisticated backdoor named MeowMeow, allowing remote PowerShell command execution and file system manipulation. The malware incorporates decoy mechanisms, including a cat-themed GUI that displays a message when triggered independently, to evade detection and mislead analysis.