Security Affairs

NOVEMBER 27, 2024

Russian-based cybercrime group RomCom (aka UAT-5647 , Storm-0978 , Tropical Scorpius , UAC-0180, UNC2596 ) exploited two Firefox and Tor Browser zero-day vulnerabilities in recent attacks on users across Europe and North America. . This leads to downloading and executing the RomCom backdoor from C2 servers like journalctd[.]live,

Cybercrime 115

Cybercrime Hacking Government Information Security 115

Security Affairs

MARCH 15, 2025

The attack involves executing a cmd script followed by a PowerShell script, which downloads three executables, including the Amadey botnet and two.NET executables (32-bit and 64-bit). The malware, dubbed PackerE, downloads an encrypted DLL (PackerD1) that employs multiple anti-analysis techniques.

Software 119

Software Cryptocurrency Malware Encryption 119

Security Affairs

OCTOBER 22, 2024

Once executed, it downloads the payload directly into memory. “Once opened, the LNK file executes a Powershell command to download an MSI file from a remote server, renames it as “%AppData%y.msi”, and then executes/installs it using the Microsoft msiexec.exe tool.” lnk” that, once executed, starts the attack chain.

Malware 128

Malware Phishing Ransomware Hacking 128

Security Affairs

JANUARY 5, 2025

The backdoor is distributed through: Phishing emails with themes such as code of conduct to trick users into downloading the malware. Upon executing the archive, it drops a malicious Windows executable, which eventually downloads and executesthe PLAYFULGHOST payloadfrom a remote server. sys driver.

Malware 134

Malware Encryption Phishing Hacking 134

Security Affairs

NOVEMBER 26, 2024

We’ve archived the leak and made it available for download on GitHub.” We've archived the leak and made it available for download on GitHub. ” Yesterday Banshee Stealer, the MacOS-based Malware-as-a-Service infostealer, had their source code leaked online.

Malware 144

Malware Cryptocurrency Encryption Hacking 144

Security Affairs

JUNE 9, 2025

Cyber criminals gain unauthorized access to home networks by either configuring the product with malicious software prior to the users purchase or infecting the device as it downloads required applications that contain backdoors, usually during the set-up process. 3 ” reads the alert published by the FBI. ” BADBOX 2.0

IoT 145

IoT Internet Internet Advertising 145

Security Affairs

MAY 12, 2025

Users seeking free AI video tools unknowingly download Noodlophile Stealer, a new malware that steals browser credentials, crypto wallets, and may install remote access trojans like XWorm. Noodlophile is being sold on cybercrime forums as part of malware-as-a-service schemes, often bundled with tools for credential theft.

Malware 115

Malware Media Cybercrime Scams 115

Security Affairs

MAY 28, 2025

Researchers found a fake Bitdefender site spreading the Venom RAT by tricking users into downloading it as antivirus software. DomainTools Intelligence (DTI) researchers warn of a malicious campaign using a fake website (bitdefender-download[.]com)

Antivirus 124

Antivirus Malware Banking Passwords 124

Security Affairs

MAY 4, 2025

Researchers found 3 malicious Go modules with hidden code that can download payloads to wipe a Linux system’s main disk, making it unbootable. ” The executions of the malicious modules can cause total data loss, major downtime, and severe financial and reputational harm, highlighting the need for strong supply chain security.

Software 114

Software Hacking Malware Cybercrime 114

Security Affairs

JULY 18, 2025

The software can be downloaded from the police website and Europol’s NoMoreRansom site. In November 2024, Russian Phobos ransomware operator Evgenii Ptitsyn, suspected of playing a key role in the ransomware operations, was extradited from South Korea to the US to face cybercrime charges.

Ransomware 132

Ransomware Encryption Malware Cybercrime 132

Security Affairs

MARCH 31, 2025

Russia-linked Gamaredon targets Ukraine with a phishing campaign using troop-related lures to deploy the Remcos RAT via PowerShell downloader. The threat actor is using troop-related lures to deploy the Remcos RAT via PowerShell downloader. Talos researchers warn that Russia-linked APT group Gamaredon (a.k.a.

Phishing 116

Phishing Antivirus Encryption Hacking 116

Security Affairs

DECEMBER 30, 2024

In October 2024, Cisco confirmed that the data posted by the notorious threat actor IntelBroker on a cybercrime forum was stolen from its DevHub environment. At this stage in our investigation, we have determined that a small number of files that were not authorized for public download may have been published.

Data breaches 128

Data breaches Cybercrime Authentication Technology 128

Security Affairs

DECEMBER 21, 2024

” Recently, The Federal Office for Information Security (BSI) announced it had blocked communication between the 30,000 devices infected with the BadBox malware and the C2. BadBox can also download additional payloads, amplifying the risks for the users. .” continues the report “Second, let’s talk volume.

Firmware 143

Firmware Malware Internet Internet 143

Security Affairs

APRIL 7, 2025

Though distinct from groups like Scattered Spider and CryptoChameleon , the attack reflects growing threats in the broader The Com cybercrime ecosystem. They used targeted phishing emails, such as a Sending Privileges Restricted lure, to steal credentials and automate downloads of contact lists.

Scams 77

Scams Cryptocurrency Phishing Cybercrime 77

Security Affairs

FEBRUARY 28, 2025

The malicious code acts as a backdoor allowing attackers to download and install third-party software secretly. Users may also mistakenly believe TV boxes are more secure than smartphones and are less likely to install antivirus software, increasing their risk when downloading third-party apps or unofficial firmware.

Antivirus 68

Antivirus Firmware Encryption Manufacturing 68

Security Affairs

FEBRUARY 24, 2025

CYFIRMA researchers discovered that the SpyLend Android malware was downloaded 100,000 times from the official app store Google Play. The Finance Simplified app is still available on Google Play at the time of this reports publication, with downloads doubling to 100,000 in a week. ” reads the report published by CYFIRMA.

Malware 123

Malware Marketing Hacking Mobile 123

Security Affairs

APRIL 3, 2025

The investigation was led by the State Criminal Police of Bavaria (Bayerisches Landeskriminalamt) and the Bavarian Central Office for the Prosecution of Cybercrime (ZCB) with the support of Europol. “Unlike other known platforms of this kind, Kidflix not only enabled users to download CSAM but also to stream video files.

Cryptocurrency 102

Cryptocurrency Cybercrime Hacking Information Security 102

Security Affairs

NOVEMBER 15, 2024

To extract cookies from Chromium-based browsers, it downloads a module from the C&C to bypass App-Bound encryption. Upon execution, Glove Stealer pretends to search for system errors while secretly contacting a command-and-control (C&C) server to harvest and exfiltrate data. ” reads the report published by Gen Digital.

Encryption 120

Encryption Password Management Cryptocurrency Social Engineering 120

Security Affairs

APRIL 30, 2025

” Nebulous Mantis imitates trusted services like OneDrive to trick victims into downloading infected files, often hosted on Mediafire. Post-infection, a fake PDF triggers an EXE that checks for sandbox evasion markers before downloading further payloads like Keyprov.dll. The APT group uses RomCom malware in multi-stage attacks.

Encryption 105

Encryption Ransomware Malware Phishing 105

Security Affairs

APRIL 14, 2025

“We urge the public to be cautious when downloading packages and to ensure they are from trusted sources to avoid falling victim to such attacks.” . “The authors oftommyboy_h1andtommyboy_h2are likely the same person, publishing multiple malicious packages in a short time. ” concludes the report.

Cryptocurrency 108

Cryptocurrency Hacking Accountability Cybercrime 108

Security Affairs

APRIL 17, 2025

In this attack phase, a PowerShell script downloads an archive from the command-and-control server containing the Node.js In a documented instance, attackers used a ClickFix social engineering tactic to trick users into running a PowerShell command that downloads and installs Node.js runtime and a compiled JavaScript file. components.

Social Engineering 119

Social Engineering Malware Cryptocurrency Engineering 119

Security Affairs

APRIL 16, 2025

” In September, security researchers from G DATA discovered more than two dozen Android mobile phones from different manufacturers already infected by pre-installed malware.

Malware 132

Malware Manufacturing Mobile Spyware 132

Security Affairs

MARCH 10, 2025

com to distribute an infected archive, which had over 40,000 downloads. The above campaign limited itself to distributing a miner, but threat actors could start to use this vector for more complex attacks, including data theft and downloading other malware. Attackers used the malicious site gitrok[.]com

Cryptocurrency 94

Cryptocurrency Malware Social Engineering Antivirus 94

Security Affairs

DECEMBER 26, 2024

” Upon exploiting the vulnerability, the malicious code can inject commands via the ntp parameter, allowing attackers to download Mirai-based malware through HTTP POST requests over port 80, referencing IP Address :80/cfg_system_time.htm in the HTTP Referer header. dyn” for C2 communication.

Manufacturing 92

Manufacturing Malware Firmware IoT 92

Security Affairs

JANUARY 22, 2025

It extracts Python backdoors from ZIP files downloaded via remote SharePoint links and employs techniques associated with the FIN7 threat actor. Once access was established, the attacker used a web browser to download a malicious payload, which was split into parts, reassembled, and unpacked to deploy malware.

Ransomware 98

Ransomware Malware Social Engineering Phishing 98

Security Affairs

MARCH 28, 2025

Clicking the “Download PDF” button leads to a zip payload from MediaFire. Clicking the “Download PDF” button triggers a JavaScript function that checks the browser and platform, then retrieves a Mediafire URL from a PHP file to download a.zip file. contaboserver[.]net.

Banking 92

Banking Phishing Malware Passwords 92

Security Affairs

APRIL 21, 2025

The emails contained links that downloaded a malicious file (wine.zip). GRAPELOADER is a 64-bit DLL (ppcore.dll) used as an initial-stage downloader, triggered via its PPMain function through DLL side-loading by wine.exe. The phishing campaign used domains like bakenhof[.]com com and silry[.]com

Malware 108

Malware Phishing Encryption Hacking 108

Security Affairs

JANUARY 4, 2025

The campaign is still ongoing and the malicious packages collectively totaled more than one thousand downloads. The attack has led to the identification of 20 malicious packages published by three primary authors, with the most downloaded package, @nomicsfoundation/sdk-test , accumulating 1,092 downloads.”

Encryption 137

Encryption Hacking Cybercrime Information Security 137

Security Affairs

FEBRUARY 13, 2025

PCMag cited the case of a gamer who downloaded the game and reported that his accounts were hijacked using stolen cookies. SteamDB estimates that over 800 users may have downloaded the game. According to the website PCMag , the free-to-play game PirateFi was released last week. A few days later, Valve notified impacted users.

Malware 114

Malware Antivirus Accountability Software 114

Security Affairs

MAY 24, 2025

Indicators of SRG activity include unauthorized downloads of tools like Zoho Assist or AnyDesk, external WinSCP/Rclone connections, ransom emails or calls from unnamed groups, and phishing emails about subscriptions urging recipients to call a number to cancel charges. ” concludes the report.

Social Engineering 117

Social Engineering Antivirus Phishing Authentication 117

Security Affairs

MARCH 18, 2025

The commit, falsely attributed to the renovate bot, downloads and executes a script from an external source, using memory forensics to locate and extract secrets. Attackers retroactively altered multiple release tags to point to the same malicious commit, injecting an exploit that dumps memory and extracts sensitive data.

Authentication 120

Authentication Ransomware Firewall Hacking 120

Security Affairs

MARCH 12, 2025

. “The botnet exploits this vulnerability by injecting a payload that downloads and executes a cleartext shell dropper named dropbpb.sh, responsible for downloading the malware binaries and executing them on the compromised device.” 70) via HTTP on port 81. .” 70) via HTTP on port 81.

IoT 77

IoT Malware Encryption DDOS 77

Security Affairs

MARCH 24, 2025

Initially, the group published screenshots of stolen data as proof of the attack, now the whole archive can be downloaded from the leak page. The group said that the waiting period had expired and claimed the theft of 134GB of sensitive data.

Ransomware 107

Ransomware Hacking Social Engineering Manufacturing 107

Security Affairs

JUNE 15, 2025

CISA adds Wazuh, and WebDAV flaws to its Known Exploited Vulnerabilities catalog Exposed eyes: 40,000 security cameras vulnerable to remote hacking Operation Secure: INTERPOL dismantles 20,000+ malicious IPs in major cybercrime crackdown Over 80,000 servers hit as Roundcube RCE bug gets rapidly exploited A flaw could allow recovery of the phone number (..)

Spyware 63

Spyware Data breaches Cybercrime Scams 63

Security Affairs

OCTOBER 29, 2024

The latest patch builds are available for download on mysonicwall.com “ In September, SonicWall warned that the flaw CVE-2024-40766 in SonicOS is now potentially exploited in attacks. The latest patch builds are available for download on mysonicwall.com ,” warns the updated SonicWall advisory.

VPN 133

VPN Ransomware Firewall Internet 133

Security Affairs

OCTOBER 23, 2024

“Afterwards, the attacker downloaded and deployed the SRBMiner cryptominer from GitHub, and started mining to their cryptocurrency wallet and public IP address.” The attacker downloads SRBMiner from GitHub, unzips it into a temporary directory, and deploys it in the /usr/sbin directory. continues the analysis.

Cryptocurrency 122

Cryptocurrency Authentication Hacking Cybercrime 122

Security Affairs

MAY 17, 2025

Avoid clicking links or downloading files from unverified sources. Use a secret word with family to confirm identities and stay secure. To avoid fraud or data loss, never share sensitive info with unknown contacts. Verify identity through trusted channels, especially on new platforms.

Government 127

Government Social Engineering Authentication Accountability 127