Government and Malware - Cyber Security Informer

Perfectl Malware

Schneier on Security

OCTOBER 14, 2024

Perfectl in an impressive piece of malware: The malware has been circulating since at least 2021. The researchers are calling the malware Perfctl, the name of a malicious component that surreptitiously mines cryptocurrency. The naming convention is one of the many ways the malware attempts to escape notice of infected users.

Malware

Malware Cryptocurrency Government Internet

Delivering Malware Through Abandoned Amazon S3 Buckets

Schneier on Security

FEBRUARY 12, 2025

The TL;DR is that this time, we ended up discovering ~150 Amazon S3 buckets that had previously been used across commercial and open source software products, governments, and infrastructure deployment/update pipelines—and then abandoned. ”, we naively thought to ourselves. But there’s a second dimension to this attack.

Malware

Malware Software Government Internet

Oops: DanaBot Malware Devs Infected Their Own PCs

Krebs on Security

MAY 22, 2025

government today unsealed criminal charges against 16 individuals accused of operating and selling DanaBot , a prolific strain of information-stealing malware that has been sold on Russian cybercrime forums since 2018. DanaBot’s features, as promoted on its support site. Image: welivesecurity.com. Today, the U.S.

Malware

Malware Cybercrime Government Banking

Notorious Malware, Spam Host “Prospero” Moves to Kaspersky Lab

Krebs on Security

FEBRUARY 28, 2025

“If you need a server for a botnet, for malware, brute, scan, phishing, fakes and any other tasks, please contact us,” BEARHOST’s ad on one forum advises. A fake browser update page pushing mobile malware. And BEARHOST has been cultivating its reputation since at least 2019. Image: Intrinsec.

Malware

Malware Antivirus DDOS Software

FBI deleted China-linked PlugX malware from over 4,200 US computers

Security Affairs

JANUARY 14, 2025

The FBI has removed Chinese PlugX malware from over 4,200 computers in networks across the United States, the U.S. The Justice Department and FBI, along with international partners, announced they deleted PlugX malware from thousands of infected computers worldwide as part of a multi-month law enforcement operation.

Malware

Malware Government Hacking Cybersecurity

FBI: Spike in Hacked Police Emails, Fake Subpoenas

Krebs on Security

NOVEMBER 9, 2024

The Federal Bureau of Investigation (FBI) is urging police departments and governments worldwide to beef up security around their email systems, citing a recent increase in cybercriminal services that use hacked police email accounts to send unauthorized subpoenas and customer data requests to U.S.-based based technology companies.

Hacking

Hacking Accountability Government Social Engineering

Google Sues the Badbox Botnet Operators

Schneier on Security

JULY 23, 2025

malware on them, to create a backdoor and abuse them for large-scale fraud and other illicit schemes. It’s a private company stepping into a regulatory void left by governments. These devices lack Google’s security protections, and the perpetrators pre-installed the Badbox 2.0 Slashdot thread.

Government

Government Software Malware Hacking

Russia-linked RomCom group targeted Ukrainian government agencies since late 2023

Security Affairs

OCTOBER 17, 2024

Russia-linked threat actor RomCom targeted Ukrainian government agencies and Polish entities in cyber attacks since late 2023. The group uses multiple tools and malware languages (GoLang, C++, RUST, LUA) to establish long-term access for espionage, possibly followed by ransomware deployment for disruption and profit.

Government

Government Malware Cyber Attacks Ransomware

Earth Kurma APT is actively targeting government and telecommunications orgs in Southeast Asia

Security Affairs

APRIL 28, 2025

Earth Kurma APT carried out a sophisticated campaign against government and telecommunications sectors in Southeast Asia. Trend Research exposed the Earth Kurma APT campaign targeting Southeast Asias government and telecom sectors. Earth Kurma particularly targeted the Philippines, Vietnam, Thailand, and Malaysia.

Telecommunications

Telecommunications Government Malware Hacking

Poland probes Pegasus spyware abuse under the PiS government

Security Affairs

DECEMBER 3, 2024

Poland probes Pegasus spyware abuse under the PiS government; ex-security chief Piotr Pogonowski arrested to testify before parliament. Poland’s government has been investigating the alleged misuse of Pegasus spyware by the previous administration and arrested the former head of Poland’s internal security service Piotr Pogonowski.

Spyware

Spyware Government Surveillance Hacking

U.S. Offered $10M for Hacker Just Arrested by Russia

Krebs on Security

DECEMBER 4, 2024

government indicted Matveev as a top ransomware purveyor a year later, offering $10 million for information leading to his arrest. Last week, the Russian government reportedly arrested Matveev and charged him with creating malware used to extort companies. government’s “Wanted” poster for him.

Cybercrime

Cybercrime Ransomware Cryptocurrency Government

PXA Stealer: New Malware Targets Governments and Education Across Europe and Asia

Penetration Testing

NOVEMBER 17, 2024

Cisco Talos recently identified a sophisticated cyber campaign targeting sensitive information in government and educational sectors across Europe and Asia.

Education

Education Government Malware Cybersecurity

News alert: CyTwist launches threat detection engine tuned to identify AI-driven malware in minutes

The Last Watchdog

JANUARY 7, 2025

Ramat Gan, Israel, January 7th, 2025, CyberNewswire — CyTwist , a leader in advanced next-generation threat detection solutions, has launched its patented detection engine to combat the insidious rise of AI-generated malware. Evasion: AI-generated threats mimic human behavior, complicating detection for security teams.

Threat Detection

Threat Detection Engineering Malware Artificial Intelligence

Ransomhub ransomware gang claims the hack of Mexican government Legal Affairs Office

Security Affairs

NOVEMBER 21, 2024

Mexico’s president announced the government is investigating an alleged ransomware hack that targeted the administration’s legal affairs office. The authorities launched an investigation after the ransomware gang Ransomhub claimed the attack and published samples of personal information from a database of government.

Government

Government Hacking Ransomware Insurance

XDigo Malware Exploits Windows LNK Flaw in Eastern European Government Attacks

The Hacker News

JUNE 23, 2025

Cybersecurity researchers have uncovered a Go-based malware called XDigo that has been used in attacks targeting Eastern European governmental entities in March 2025.

Malware

Malware Government Cybersecurity

Russia-linked APT28 use Signal chats to target Ukraine official with malware

Security Affairs

JUNE 24, 2025

Russia-linked group APT28 uses Signal chats as an attack vector to phish Ukrainian officials with new malware strains. Russia-linked cyberespionage group APT28 is targeting Ukrainian government officials using Signal chats to deliver two new types of malware, tracked as BeardShell and SlimAgent.

Malware

Malware Encryption Phishing Government

SECURITY AFFAIRS MALWARE NEWSLETTER – ROUND 15

Security Affairs

OCTOBER 13, 2024

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape. Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape. Over 300,000!

Malware

Malware DDOS Cryptocurrency Education

Russia's COLDRIVER Targets Western Entities with 'LOSTKEYS' Malware

SecureWorld News

MAY 9, 2025

Google's Threat Intelligence Group (GTIG) has identified a new malware strain, dubbed "LOSTKEYS," attributed to the Russian state-sponsored hacking group COLDRIVER. The introduction of LOSTKEYS signifies a strategic shift towards deploying malware for direct data exfiltration.

Malware

Malware Social Engineering Government Engineering

Rhysida Ransomware gang claims the hack of the Government of Peru

Security Affairs

MAY 3, 2025

The Rhysida Ransomware gang claims the hack of the Government of Peru, the gang breached Gob.pe, the Single Digital Platform of the Peruvian State. The Rhysida ransomware gang claims responsibility for hacking the Government of Peru, breaching Gob.pe, which is the country’s official digital platform.

Government

Government Hacking Ransomware Healthcare

FBI, Dutch Police Disrupt ‘Manipulaters’ Phishing Gang

Krebs on Security

JANUARY 31, 2025

The FBI and authorities in The Netherlands this week seized dozens of servers and domains for a hugely popular spam and malware dissemination service operating out of Pakistan. The proprietors of the service, who use the collective nickname “ The Manipulaters ,” have been the subject of three stories published here since 2015.

Phishing

Phishing Cybercrime Advertising Malware

U.S. Offers $10M bounty for info on RedLine malware creator and state hackers

Security Affairs

JUNE 6, 2025

offers up to $10M for info on state hackers linked to RedLine malware and its creator, Maxim Rudometov, tied to attacks on U.S. The bounty is part of the US DoS’s Rewards for Justice program , which offers payouts for tips on foreign government hackers targeting U.S. infrastructure. ” reads the U.S.

Malware

Malware Identity Theft Passwords Government

Russia-linked APT29 targets European diplomatic entities with GRAPELOADER malware

Security Affairs

APRIL 21, 2025

Russia-linked group APT29 targeted diplomatic entities across Europe with a new malware loader codenamed GRAPELOADER. The phishing emails either led to malware delivery via GRAPELOADER or redirected to the Ministry’s real website to appear legitimate. The malware is highly targeted and leaves no traces of the next-stage payload.

Malware

Malware Phishing Encryption Hacking

GhostContainer: Kaspersky Uncovers Stealthy Backdoor Infiltrating Government & High-Tech Exchange Servers

Penetration Testing

JULY 17, 2025

The post GhostContainer: Kaspersky Uncovers Stealthy Backdoor Infiltrating Government & High-Tech Exchange Servers appeared first on Daily CyberSecurity.

Government

Government Cybersecurity Malware

Mobile malware evolution in 2024

SecureList

MARCH 3, 2025

million attacks involving malware, adware or unwanted mobile software were prevented. million malware, adware or unwanted software attacks targeting mobile devices. Some time later, the user received a phishing link to download malware disguised as a shipment tracking app. A total of 1.1 A total of 1.1

Mobile

Mobile Malware Adware Banking

State-Backed HazyBeacon Malware Uses AWS Lambda to Steal Data from SE Asian Governments

The Hacker News

JULY 15, 2025

Governmental organizations in Southeast Asia are the target of a new campaign that aims to collect sensitive information by means of a previously undocumented Windows backdoor dubbed HazyBeacon.

Government

Government Malware

Microsoft Fix Targets Attacks on SharePoint Zero-Day

Krebs on Security

JULY 21, 2025

government and partners in Canada and Australia are investigating the hack of SharePoint servers, which provide a platform for sharing and managing documents. Microsoft notes the weakness applies only to SharePoint Servers that organizations use in-house, and that SharePoint Online and Microsoft 365 are not affected.

Hacking

Hacking Government Internet Internet

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 44

Security Affairs

MAY 4, 2025

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape io_uring Is Back, This Time as a Rootkit I StealC You: Tracking the Rapid Changes To StealC Interesting WordPress Malware Disguised as Legitimate Anti-Malware Plugin Using Trusted Protocols Against You: Gmail as a C2 (..)

Malware

Malware Cybercrime Government Hacking

Critical Infrastructure Seeing Benefits of Government Program, CISA Says

Security Boulevard

JANUARY 14, 2025

The post Critical Infrastructure Seeing Benefits of Government Program, CISA Says appeared first on Security Boulevard.

Government

Government Security Awareness Risk Malware

Government contractor Conduent disclosed a data breach

Security Affairs

APRIL 16, 2025

The business services provider Conduent told the SEC a January cyberattack exposed personal data, including names and Social Security numbers. The business services provider Conduent revealed that personal information, including names and Social Security numbers, was stolen in a January cyberattack.

Data breaches

Data breaches Government Cyber Insurance Business Services

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 41

Security Affairs

APRIL 13, 2025

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Lazarus Expands Malicious npm Campaign: 11 New Packages Add Malware Loaders and Bitbucket Payloads BadBazaar: iOS and Android Surveillanceware by Chinas APT15 Used to Target Tibetans and Uyghurs GOFFEE continues to attack (..)

Malware

Malware Spyware Government Ransomware

Zanubis in motion: Tracing the active evolution of the Android banking malware

SecureList

MAY 28, 2025

Once these permissions are granted, the malware gains extensive capabilities that allow its operators to steal the user’s banking data and credentials, as well as perform remote actions and control the device without the user’s knowledge. Join us in this blogpost as we take a closer look at the malware’s evolution over time.

Banking

Banking Malware Encryption Energy and Utilities

New Ghostwriter campaign targets Ukrainian Government and opposition activists in Belarus

Security Affairs

FEBRUARY 26, 2025

A Ghostwriter campaign using a new variant of PicassoLoader targets opposition activists in Belarus, and Ukrainian military and government organizations. SentinelLABS observed a new Ghostwriter campaign targeting Belarusian opposition activists and Ukrainian military and government entities with a new variant of PicassoLoader.

Government

Government Cyber threats Phishing Malware

When Getting Phished Puts You in Mortal Danger

Krebs on Security

MARCH 27, 2025

Many successful phishing attacks result in a financial loss or malware infection. Researchers at the security firm Silent Push mapped a network of several dozen phishing domains that spoof the recruitment websites of Ukrainian paramilitary groups, as well as Ukrainian government intelligence sites. The website legiohliberty[.]army

Phishing

Phishing Government Engineering DDOS

Russian-Aligned TAG-110 Targets Tajikistan Governments with Stealthy Cyber-Espionage

Penetration Testing

MAY 25, 2025

Recorded Futures Insikt Group has uncovered a new cyber-espionage campaign by Russia-aligned threat actor TAG-110 targeting public sector The post Russian-Aligned TAG-110 Targets Tajikistan Governments with Stealthy Cyber-Espionage appeared first on Daily CyberSecurity.

Government

Government Cybersecurity Phishing Malware

US charged Dual Russian and Israeli National as LockBit Ransomware developer

Security Affairs

DECEMBER 22, 2024

The ransomware gang and its affiliates targeted hospitals, schools, nonprofit organizations, critical infrastructure, and government and law-enforcement agencies. Panev and other developers were tasked to create and maintain the malware and infrastructure, while affiliates executed attacks and extorted ransoms, splitting the proceeds.

Ransomware

Ransomware Small Business Antivirus Malware

North Korean Konni APT Targets Ukraine with Malware to track Russian Invasion Progress

The Hacker News

MAY 13, 2025

The North Korea-linked threat actor known as Konni APT has been attributed to a phishing campaign targeting government entities in Ukraine, indicating the threat actor's targeting beyond Russia. Enterprise security firm Proofpoint said the end goal of the campaign is to collect intelligence on the "trajectory of the Russian invasion." "The

Malware

Malware Phishing Government

Sophos details five years of China-linked threat actors’ activity targeting network devices worldwide

Security Affairs

NOVEMBER 2, 2024

Sophos, with the help of other cybersecurity firms, government, and law enforcement agencies investigated the cyber attacks and attributed them multiple China-linked APT groups, such as Volt Typhoon , APT31 and APT41 / Winnti. Researchers observed the attackers monitoring network communications and stealing credentials from the victims.

Firmware

Firmware Government Firewall Malware

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 51

Security Affairs

JUNE 29, 2025

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Ransomware Gangs Collapse as Qilin Seizes Control Dissecting a Python Ransomware distributed through GitHub repositories SparkKitty, SparkCat’s little brother: A new Trojan spy found in the App Store and Google Play (..)

Malware

Malware Spyware Cyber Attacks Technology

The U.S. House banned WhatsApp on government devices due to security concerns

Security Affairs

JUNE 24, 2025

House has banned WhatsApp on government devices due to data security concerns. In February, Meta announced that it had discovered and dismantled a malware campaign via WhatsApp that targeted journalists and civil society members with the Paragon spyware (aka Graphite). ” continues the email.

Government

Government Spyware Encryption Mobile

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 53

Security Affairs

JULY 13, 2025

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Datacarry Ransomware DRAT V2: Updated DRAT Emerges in TAG-140’s Arsenal Batavia spyware steals data from Russian organizations Taking SHELLTER: a commercial evasion framework abused in- the- wild Open Source Malware (..)

Malware

Malware Spyware Scams Ransomware

The “free money” trap: How scammers exploit financial anxiety

Malwarebytes

MARCH 19, 2025

” Whether it’s a so-called “subsidy program,” a “government grant,” or a “relief card,” these scams all share the same underlying goalto manipulate people into giving away their personal information, orworsetheir hard-earned cash. .” ” “482 Spots Remaining! gov domains).

Scams

Scams Government Identity Theft Phishing

Russia-linked ColdRiver used LostKeys malware in recent attacks

Security Affairs

MAY 9, 2025

Since early 2025, Russia-linked ColdRiver has used LostKeys malware to steal files in espionage attacks on Western governments and organizations. Google’s Threat Intelligence Group discovered LOSTKEYS, a new malware used by Russia-linked APT COLDRIVER , in recent attacks to steal files and gather system info.

Malware

Malware Government Hacking Phishing

News alert: SpyCloud study shows gaps in EDR, antivirus — 66% of malware infections missed

The Last Watchdog

APRIL 7, 2025

Despite advanced AI detection and telemetry analysis offered in todays EDR solutions, modern infostealer malware is designed to evade even the most sophisticated defenses, using tactics like polymorphic malware, memory-only execution, and exploitation of zero-day vulnerabilities or outdated software.

Antivirus

Antivirus Malware Cybercrime Identity Theft

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 35

Security Affairs

MARCH 2, 2025

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape.

Malware

Malware IoT Architecture Cryptocurrency

Perfectl Malware

Delivering Malware Through Abandoned Amazon S3 Buckets

Trending Sources

Oops: DanaBot Malware Devs Infected Their Own PCs

Notorious Malware, Spam Host “Prospero” Moves to Kaspersky Lab

FBI deleted China-linked PlugX malware from over 4,200 US computers

FBI: Spike in Hacked Police Emails, Fake Subpoenas

Google Sues the Badbox Botnet Operators

Russia-linked RomCom group targeted Ukrainian government agencies since late 2023

Earth Kurma APT is actively targeting government and telecommunications orgs in Southeast Asia

Poland probes Pegasus spyware abuse under the PiS government

U.S. Offered $10M for Hacker Just Arrested by Russia

PXA Stealer: New Malware Targets Governments and Education Across Europe and Asia

News alert: CyTwist launches threat detection engine tuned to identify AI-driven malware in minutes

Ransomhub ransomware gang claims the hack of Mexican government Legal Affairs Office

XDigo Malware Exploits Windows LNK Flaw in Eastern European Government Attacks

Russia-linked APT28 use Signal chats to target Ukraine official with malware

SECURITY AFFAIRS MALWARE NEWSLETTER – ROUND 15

Russia's COLDRIVER Targets Western Entities with 'LOSTKEYS' Malware

Rhysida Ransomware gang claims the hack of the Government of Peru

FBI, Dutch Police Disrupt ‘Manipulaters’ Phishing Gang

U.S. Offers $10M bounty for info on RedLine malware creator and state hackers

Russia-linked APT29 targets European diplomatic entities with GRAPELOADER malware

GhostContainer: Kaspersky Uncovers Stealthy Backdoor Infiltrating Government & High-Tech Exchange Servers

Mobile malware evolution in 2024

State-Backed HazyBeacon Malware Uses AWS Lambda to Steal Data from SE Asian Governments

Microsoft Fix Targets Attacks on SharePoint Zero-Day

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 44

Critical Infrastructure Seeing Benefits of Government Program, CISA Says

Government contractor Conduent disclosed a data breach

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 41

Zanubis in motion: Tracing the active evolution of the Android banking malware

New Ghostwriter campaign targets Ukrainian Government and opposition activists in Belarus

When Getting Phished Puts You in Mortal Danger

Russian-Aligned TAG-110 Targets Tajikistan Governments with Stealthy Cyber-Espionage

US charged Dual Russian and Israeli National as LockBit Ransomware developer

North Korean Konni APT Targets Ukraine with Malware to track Russian Invasion Progress

Sophos details five years of China-linked threat actors’ activity targeting network devices worldwide

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 51

The U.S. House banned WhatsApp on government devices due to security concerns

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 53

The “free money” trap: How scammers exploit financial anxiety

Russia-linked ColdRiver used LostKeys malware in recent attacks

News alert: SpyCloud study shows gaps in EDR, antivirus — 66% of malware infections missed

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 35

Stay Connected