Security Affairs

JULY 18, 2025

The software can be downloaded from the police website and Europol’s NoMoreRansom site. NoMoreRansom warns users to remove the malware first with a reliable antivirus before using the decryptor, or files may be re-encrypted repeatedly. Despite false malware flags from some browsers, tests confirm it works and is safe.

Ransomware 128

Ransomware Encryption Malware Cybercrime 128

Security Affairs

MAY 27, 2025

The first vulnerability, CVE-2024-57727 (CVSS score of 7.5), is an unauthenticated path traversal issue allowing attackers to download arbitrary files from the server. At the end of January, researchers from security firm Arctic Wolf reported a campaign targeting SimpleHelp servers.

Ransomware 104

Ransomware Software Retail Data breaches 104

Security Affairs

MARCH 30, 2025

It creates secure tunnels for threat actors via SSH, proxies, and encrypted keys, enabling covert system access. BusyBox enables threat actors to perform various functions such as download and execute payloads on compromised devices.” It acts as a rootkit, dropper, backdoor, bootkit, proxy, and tunneler.

Malware 121

Malware Authentication Encryption Cybersecurity 121

Security Affairs

MAY 5, 2025

“The campaign leveraged fake CAPTCHA verification pages (ClickFix/KongTuke lures) to trick users into executing a copied PowerShell command, which downloaded and ran MintsLoader” The experts observed other infection chains that used fake invoice files (e.g., “Fattura####.js”)

Malware 126

Malware Phishing Threat Reports Encryption 126

Security Affairs

JANUARY 4, 2025

The campaign is still ongoing and the malicious packages collectively totaled more than one thousand downloads. The attack has led to the identification of 20 malicious packages published by three primary authors, with the most downloaded package, @nomicsfoundation/sdk-test , accumulating 1,092 downloads.”

Encryption 134

Encryption Hacking Cybercrime Information Security 134

Security Affairs

DECEMBER 16, 2024

Serbian authorities also extensively and illegitimately used the Cellebrite extraction suite to download personal data from the phones of journalists and protest organizers. Evidence, including the spywares installation during BIA interviews, attributes these surveillance campaigns with high confidence to the BIA and Serbian government.

Spyware 105

Spyware Surveillance Technology Mobile 105

Security Affairs

APRIL 30, 2025

The RAT supports advanced evasion techniques, including living-off-the-land ( LOTL ) tactics and encrypted command and control (C2) communications. ” Nebulous Mantis imitates trusted services like OneDrive to trick victims into downloading infected files, often hosted on Mediafire. . ” continues the report.

Encryption 101

Encryption Ransomware Malware Phishing 101

Security Affairs

DECEMBER 26, 2024

The experts pointed out that this Mirai variant has been modified to use improved encryption algorithms. The malware maintains persistence using a cron job that downloads a shell script from “hailcocks[.]ru.” TheMiraivariant incorporates ChaCha20 and XOR decryption algorithms. ” reads the analysis published by Akamai.

Manufacturing 89

Manufacturing Malware Firmware IoT 89

Security Affairs

MARCH 10, 2025

com to distribute an infected archive, which had over 40,000 downloads. Its configuration is Base64-encoded and encrypted with AES-CBC. The above campaign limited itself to distributing a miner, but threat actors could start to use this vector for more complex attacks, including data theft and downloading other malware.

Cryptocurrency 92

Cryptocurrency Malware Social Engineering Antivirus 92

Security Affairs

MARCH 24, 2025

Initially, the group published screenshots of stolen data as proof of the attack, now the whole archive can be downloaded from the leak page. ” The group uses an ARCrypter ransomware variant, derived from Babuks leaked code , to encrypt files after infiltrating a network.

Ransomware 103

Ransomware Hacking Social Engineering Healthcare 103

Security Affairs

MARCH 28, 2025

Attackers also employ encrypted or password-protected files to evade security detection. Clicking the “Download PDF” button leads to a zip payload from MediaFire. Attackers use Contabo-hosted links to deliver obfuscated Visual Basic scripts and disguised EXE payloads for credential theft. contaboserver[.]net.

Banking 88

Banking Phishing Malware Passwords 88

Security Affairs

APRIL 21, 2025

The emails contained links that downloaded a malicious file (wine.zip). GRAPELOADER is a 64-bit DLL (ppcore.dll) used as an initial-stage downloader, triggered via its PPMain function through DLL side-loading by wine.exe. The phishing campaign used domains like bakenhof[.]com com and silry[.]com

Malware 106

Malware Phishing Encryption Hacking 106

Security Affairs

MARCH 12, 2025

. “The botnet exploits this vulnerability by injecting a payload that downloads and executes a cleartext shell dropper named dropbpb.sh, responsible for downloading the malware binaries and executing them on the compromised device.” It processes encrypted data over a RAW socket, limiting further analysis.

IoT 73

IoT Malware Encryption DDOS 73

SecureList

DECEMBER 18, 2024

3:8092/sdc.exe In some reverse shell incidents, we also found traces of Revenge RAT ( 48210CA2408DC76815AD1B7C01C1A21A ) being run through the PowerShell process: powershell.exe -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::LoadFile('C:Users<username>Downloads <exe_name> exe').EntryPoint.Invoke($null,

Encryption 84

Encryption Passwords Accountability Ransomware 84

Security Affairs

APRIL 25, 2025

Kaspersky notified Korea Internet & Security Agency (KrCERT/CC), the researchers discovered that threat actor exploited a one-day vulnerability in Innorix Agent for lateral movement. The attackers used multiple hacking tools and malware, including ThreatNeedle , Agamemnon downloader, wAgent , SIGNBT, and COPPERHEDGE.

Malware 93

Malware Software Encryption Hacking 93

Security Affairs

JUNE 9, 2025

“The request contains a malicious command that is a single-line shell script which downloads and executes an ARM32 binary on the compromised machine.” The latest DVR-focused variant is also built on Mirai’s foundation but introduces new features like RC4 string encryption, anti-virtual machine checks, and anti-emulation tactics.

IoT 137

IoT Firmware Malware Architecture 137

Security Affairs

FEBRUARY 28, 2025

The malicious code acts as a backdoor allowing attackers to download and install third-party software secretly. Users may also mistakenly believe TV boxes are more secure than smartphones and are less likely to install antivirus software, increasing their risk when downloading third-party apps or unofficial firmware.

Antivirus 64

Antivirus Firmware Encryption Manufacturing 64

Security Affairs

JUNE 24, 2025

. “nuto has deemed WhatsApp a high-risk to users due to the lack of transparency in how it protects user data, absence of stored data encryption, and potential security risks involved with its use,” reads an email sent by Chief Administrative Officer and obtained by Axios. ” continues the email. .”

Government 96

Government Spyware Encryption Mobile 96

Security Affairs

MAY 26, 2025

Researchers observed that the attackers relied on standard Linux tools like wget and curl to download an encrypted version of the Sliver backdoor. Using tools like mysqldump and Bash scripts downloaded from paste sites, the attackers extracted LDAP configs, Office 365 credentials, and metadata on managed devices.

Mobile 92

Mobile Telecommunications Authentication Healthcare 92

Security Affairs

OCTOBER 29, 2024

The latest patch builds are available for download on mysonicwall.com “ In September, SonicWall warned that the flaw CVE-2024-40766 in SonicOS is now potentially exploited in attacks. The latest patch builds are available for download on mysonicwall.com ,” warns the updated SonicWall advisory.

VPN 129

VPN Ransomware Firewall Internet 129

Security Affairs

MARCH 31, 2025

CoffeeLoader is a sophisticated malware that uses numerous techniques to bypass security solutions, Zscaler ThreatLabz warns. Zscaler ThreatLabz discovered CoffeeLoader, a malware family active since September 2024, that uses multiple techniques to evade endpoint security while downloading second-stage payloads.

Malware 80

Malware Encryption Antivirus Marketing 80

Security Affairs

JUNE 18, 2025

Attackers exploit CVE-2025-3248 in Langflow servers to deliver Flodrix botnet via downloader scripts, Trend Research reports. Attackers exploit the flaw to run scripts on Langflow servers, downloading and installing Flodrix malware. Once satisfied, they download and execute the Flodrix botnet malware from a remote server.

DDOS 110

DDOS Malware Encryption Hacking 110

Security Affairs

FEBRUARY 3, 2025

The software skimmer encrypts stolen data using AES-256-CBC, generating a unique key and IV for each request. The encrypted data, along with the key and IV, is sent to a server controlled by attackers. The stolen information includes billing addresses, credit card details, phone numbers, and email addresses. .”

Encryption 86

Encryption Software Hacking Cybercrime 86

Security Affairs

JANUARY 28, 2025

The first vulnerability, CVE-2024-57727 (CVSS score of 7.5), is an unauthenticated path traversal issue allowing attackers to download arbitrary files from the server. Researchers from security firm Arctic Wolf now report that an ongoing campaign is targeting SimpleHelp servers.

Software 70

Software Passwords Accountability Encryption 70

Security Affairs

FEBRUARY 14, 2025

The first vulnerability, CVE-2024-57727 (CVSS score of 7.5), is an unauthenticated path traversal issue allowing attackers to download arbitrary files from the server. Researchers from security firm Arctic Wolf now report that an ongoing campaign is targeting SimpleHelp servers. 6, 2025: Horizon3.I

Passwords 61

Passwords Software Accountability Risk 61

Security Affairs

FEBRUARY 5, 2025

The malicious apps were downloaded more than 242,000 times from Google Play. ” The component communicates with C2 servers and execute commands from an encrypted GitLab file. The experts noted that the malware-laced apps were also distributed through official stores.

Malware 70

Malware Cryptocurrency Mobile Encryption 70

Security Affairs

APRIL 5, 2025

The Port confirmed that an unauthorized actor accessed and encrypted parts of their computer systems, disrupting key services like baggage handling, check-in kiosks, ticketing, Wi-Fi, and parking. The Port holds very little information about airport or maritime passengers, and systems processing payments were not affected.”

Data breaches 96

Data breaches Ransomware Cyber Attacks Healthcare 96

Security Affairs

JULY 9, 2025

Once opened, the disguised executable established persistence using a scheduled task and connected to a C2 server to send system information, receive commands, download additional payloads. The archive contained a disguised executable (notflog.exe) with a PDF icon to trick users into running malware.

Malware 114

Malware Phishing Passwords Encryption 114

Security Affairs

JULY 7, 2025

” Clicking the link included in the phishing messages downloads a VBE script that collects system info and retrieves a malware file (WebView.exe) from the attacker’s domain. It also downloads a new malware stage ( javav.exe ) and sets a startup shortcut to launch it on reboot, continuing the infection cycle.

Spyware 92

Spyware Malware Phishing Encryption 92

Security Affairs

APRIL 24, 2025

The feature blocks chat exports, auto-media downloads, and the use of messages in AI features, ensuring conversations stay private and within the app. “When the setting is on, you can block others from exporting chats, auto-downloading media to their phone, and using messages for AI features. .”

Media 92

Media Encryption Hacking Accountability 92

IT Security Guru

DECEMBER 26, 2024

Here are some of the ways enterprise browsers help safeguard remote work: Data Security and Protection Remote work demands robust data protection. Enterprise browsers deliver, offering end-to-end encryption for online information. These secure tools shield against phishing, malware, and other digital threats.

Phishing 62

Phishing Authentication Technology Malware 62

Security Affairs

MARCH 13, 2025

Upon execution, the spyware retrieves an encrypted configuration from Firebase Firestore, controlling activation and the C2 server address. KoSpy communicates with its C2 servers through two request types: one for downloading plugins and another for retrieving surveillance configurations.

Spyware 78

Spyware Surveillance Encryption Malware 78

Security Affairs

JULY 7, 2025

” Clicking the link included in the phishing messages downloads a VBE script that collects system info and retrieves a malware file (WebView.exe) from the attacker’s domain. It also downloads a new malware stage ( javav.exe ) and sets a startup shortcut to launch it on reboot, continuing the infection cycle.

Spyware 74

Spyware Malware Phishing Encryption 74

Security Affairs

APRIL 27, 2025

vip to download AES-encrypted data, which, once decrypted, revealed password spray targets. Over the past year, Microsoft Threat Intelligence researchers observed a threat actor, tracked as Storm-1977, using AzureChecker.exe to launch password spray attacks against cloud tenants in the education sector. nodefunction[.]vip

Education 73

Education Passwords Accountability Encryption 73

Security Affairs

DECEMBER 12, 2024

Microsoft also assesses that in January 2024, Secret Blizzard used the backdoor of Storm-1837, a Russia-based threat actor, to download the Tavdig and KazuarV2 backdoors on a target device in Ukraine. Amadey bots encoded system data to communicate with the C2 at [link] , attempting to download two plugins, cred64.dll dll and clip64.dll

Cybercrime 49

Cybercrime Malware Hacking Cryptocurrency 49

Security Affairs

DECEMBER 20, 2024

Tianfeng worked at Sichuan Silence Information Technology Co., The malware stole data and encrypted files to block remediation attempts. It was designed to download payloads intended to exfiltrate XG Firewall-resident data. The attackers exploited an SQL injection zero-day vulnerability to gain access to exposed XG devices.

Firewall 63

Firewall Authentication Passwords Accountability 63

Security Affairs

DECEMBER 11, 2024

Tianfeng worked at Sichuan Silence Information Technology Co., The malware stole data and encrypted files to block remediation attempts. “Guan and his co-conspirators worked at the offices of Sichuan Silence Information Technology Co. It was designed to download payloads intended to exfiltrate XG Firewall-resident data.

Firewall 76

Firewall Hacking Malware Encryption 76