"Space Pirates targets Russian IT firms with new LuckyStrike Agent Malware."

Views expressed in this cybersecurity, cyber crime, and security update are those of the reporters and corrrespondents.  Accessed on 27 February 2025, 1615 UTC.

Content and Source:  Email subscription via https://feedly.com.

 https://feedly.com/i/subscription/feed%2Fhttp%3A%2F%2Fthehackernews.com%2Ffeeds%2Fposts%2Fdefault

Please check link or scroll down to read your selections.  Thanks for joining us today.

Russ Roberts (https://www.hawaiicybersecurityjournal.net).

The Hacker News

210K followers36 articles per week

#security#tech

26

Most popular

Space Pirates Targets Russian IT Firms With New LuckyStrike Agent Malware

3 TTPs

•

66by info@thehackernews.com (The Hacker News) / 2h

The threat actor known as Space Pirates has been linked to a malicious campaign targeting Russian information technology (IT) organizations with a previously undocumented malware called LuckyStrike Agent. The activity was detected in November 2024 by Solar, the cybersecurity arm of Russian state-owned telecom company Rostelecom. It's tracking the activity under the name Erudite Mogwai. The

89% of Enterprise GenAI Usage Is Invisible to Organizations Exposing Critical Security Risks, New Report Reveals

31by info@thehackernews.com (The Hacker News) / 2h

Organizations are either already adopting GenAI solutions, evaluating strategies for integrating these tools into their business plans, or both. To drive informed decision-making and effective planning, the availability of hard data is essential—yet such data remains surprisingly scarce. The “Enterprise GenAI Data Security Report 2025” by LayerX delivers unprecedented insights

New TgToxic Banking Trojan Variant Evolves with Anti-Analysis Upgrades

12 TTPs

•

29by info@thehackernews.com (The Hacker News) / 2h

•

TgToxic Android Trojan evolves capabilities

Cybersecurity researchers have discovered an updated version of an Android malware called TgToxic (aka ToxicPanda), indicating that the threat actors behind it are continuously making changes in response to public reporting. "The modifications seen in the TgToxic payloads reflect the actors' ongoing surveillance of open source intelligence and demonstrate their commitment to enhancing the

Today

Silver Fox APT Uses Winos 4.0 Malware in Cyber Attacks Against Taiwanese Organizations

IoC > 1 IP

•

by info@thehackernews.com (The Hacker News) / 8min

•

18 TTPs

A new campaign is targeting companies in Taiwan with malware known as Winos 4.0 as part of phishing emails masquerading as the country's National Taxation Bureau. The campaign, detected last month by Fortinet FortiGuard Labs, marks a departure from previous attack chains that have leveraged malicious game-related applications. "The sender claimed that the malicious file attached was a list of

Yesterday

PolarEdge Botnet Exploits Cisco and Other Flaws to Hijack ASUS, QNAP, and Synology Devices

IoC > 1 IP

•

85by info@thehackernews.com (The Hacker News) / 6h

•

11 TTPs

•

CVE-2023-20118

A new malware campaign has been observed targeting edge devices from Cisco, ASUS, QNAP, and Synology to rope them into a botnet named PolarEdge since at least the end of 2023. French cybersecurity company Sekoia said it observed the unknown threat actors leveraging CVE-2023-20118 (CVSS score: 6.5), a critical security flaw impacting Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and

Bybit Hack Traced to Safe{Wallet} Supply Chain Attack Exploited by North Korean Hackers

IoC > 1 email address and 1 domain

•

100+by info@thehackernews.com (The Hacker News) / 8h

•

5 TTPs

•

Lazarus Group linked to ByBit hack

The U.S. Federal Bureau of Investigation (FBI) formally linked the record-breaking $1.5 billion Bybit hack to North Korean threat actors, as the company's CEO Ben Zhou declared a "war against Lazarus." The agency said the Democratic People's Republic of Korea (North Korea) was responsible for the theft of the virtual assets from the cryptocurrency exchange, attributing it to a specific cluster

Hackers Exploited Krpano Framework Flaw to Inject Spam Ads on 350+ Websites

IoC > 1 domain

•

64by info@thehackernews.com (The Hacker News) / 22h

•

9 TTPs

A cross-site scripting (XSS) vulnerability in a virtual tour framework has been weaponized by malicious actors to inject malicious scripts across hundreds of websites with the goal of manipulating search results and fueling a spam ads campaign at scale. Security researcher Oleg Zaytsev, in a report shared with The Hacker News, said the campaign – dubbed 360XSS – affected over 350 websites,

Leaked Black Basta Ransomware Chat Logs Reveal Inner Workings and Internal Conflicts

20 TTPs

•

61by info@thehackernews.com (The Hacker News) / 1d

More than a year's worth of internal chat logs from a ransomware gang known as Black Basta have been published online in a leak that provides unprecedented visibility into their tactics and internal conflicts among its members. The Russian-language chats on the Matrix messaging platform between September 18, 2023, and September 28, 2024, were initially leaked on February 11, 2025, by an

SOC 3.0 - The Evolution of the SOC and How AI is Empowering Human Talent

41by info@thehackernews.com (The Hacker News) / 1d

Organizations today face relentless cyber attacks, with high-profile breaches hitting the headlines almost daily. Reflecting on a long journey in the security field, it’s clear this isn’t just a human problem—it’s a math problem. There are simply too many threats and security tasks for any SOC to manually handle in a reasonable timeframe. Yet, there is a solution. Many refer to it as SOC 3.0—an

New Linux Malware ‘Auto-Color’ Grants Hackers Full Remote Access to Compromised Systems

9 TTPs

•

100+by info@thehackernews.com (The Hacker News) / 1d

Universities and government organizations in North America and Asia have been targeted by a previously undocumented Linux malware called Auto-Color between November and December 2024, according to new findings from Palo Alto Networks Unit 42. "Once installed, Auto-color allows threat actors full remote access to compromised machines, making it very difficult to remove without specialized

Three Password Cracking Techniques and How to Defend Against Them

42by info@thehackernews.com (The Hacker News) / 1d

Passwords are rarely appreciated until a security breach occurs; suffice to say, the importance of a strong password becomes clear only when faced with the consequences of a weak one. However, most end users are unaware of just how vulnerable their passwords are to the most common password-cracking methods. The following are the three common techniques for cracking passwords and how to

CERT-UA Warns of UAC-0173 Attacks Deploying DCRat to Compromise Ukrainian Notaries

13 TTPs

•

49by info@thehackernews.com (The Hacker News) / 1d

The Computer Emergency Response Team of Ukraine (CERT-UA) on Tuesday warned of renewed activity from an organized criminal group it tracks as UAC-0173 that involves infecting computers with a remote access trojan named DCRat (aka DarkCrystal RAT). The Ukrainian cybersecurity authority said it observed the latest attack wave starting in mid-January 2025. The activity is designed to target the

Malicious PyPI Package "automslc" Enables 104K+ Unauthorized Deezer Music Downloads

IoC > 1 domain and 1 IP

•

67by info@thehackernews.com (The Hacker News) / 1d

•

Command and Control (Enterprise TA0011)

Cybersecurity researchers have flagged a malicious Python library on the Python Package Index (PyPI) repository that facilitates unauthorized music downloads from music streaming service Deezer. The package in question is automslc, which has been downloaded over 104,000 times to date. First published in May 2019, it remains available on PyPI as of writing. "Although automslc, which has been

Feb 25, 2025

CISA Adds Microsoft and Zimbra Flaws to KEV Catalog Amid Active Exploitation

2 TTPs

•

63by info@thehackernews.com (The Hacker News) / 1d

•

CISA adds critical Microsoft Zimbra flaws

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday placed two security flaws impacting Microsoft Partner Center and Synacor Zimbra Collaboration Suite (ZCS) to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The vulnerabilities in question are as follows - CVE-2024-49035 (CVSS score: 8.7) - An improper access control

LightSpy Expands to 100+ Commands, Increasing Control Over Windows, macOS, Linux, and Mobile

5 TTPs

•

54by info@thehackernews.com (The Hacker News) / 1d

•

LightSpy malware expands cross-platform

Cybersecurity researchers have flagged an updated version of the LightSpy implant that comes equipped with an expanded set of data collection features to extract information from social media platforms like Facebook and Instagram. LightSpy is the name given to a modular spyware that's capable of infecting both Windows and Apple systems with an aim to harvest data. It was first documented in

Belarus-Linked Ghostwriter Uses Macropack-Obfuscated Excel Macros to Deploy Malware

IoC > 1 domain

•

58by info@thehackernews.com (The Hacker News) / 1d

•

8 TTPs

•

Belarusian activists targeted by malware

Opposition activists in Belarus as well as Ukrainian military and government organizations are the target of a new campaign that employs malware-laced Microsoft Excel documents as lures to deliver a new variant of PicassoLoader. The threat cluster has been assessed to be an extension of a long-running campaign mounted by a Belarus-aligned threat actor dubbed Ghostwriter (aka Moonscape,

5 Active Malware Campaigns in Q1 2025

IoC > 1 domain

•

56by info@thehackernews.com (The Hacker News) / 2d

•

50 TTPs

The first quarter of 2025 has been a battlefield in the world of cybersecurity. Cybercriminals continued launching aggressive new campaigns and refining their attack methods. Below is an overview of five notable malware families, accompanied by analyses conducted in controlled environments. NetSupport RAT Exploiting the ClickFix Technique In early 2025, threat actors began exploiting a technique

2,500+ Truesight.sys Driver Variants Exploited to Bypass EDR and Deploy HiddenGh0st RAT

7 TTPs

•

100+by info@thehackernews.com (The Hacker News) / 2d

•

Legacy driver exploitation campaign uncovered

A large-scale malware campaign has been found leveraging a vulnerable Windows driver associated with Adlice's product suite to sidestep detection efforts and deliver the Gh0st RAT malware. "To further evade detection, the attackers deliberately generated multiple variants (with different hashes) of the 2.0.2 driver by modifying specific PE parts while keeping the signature valid," Check Point

GitVenom Malware Steals $456K in Bitcoin Using Fake GitHub Projects to Hijack Wallets

10 TTPs

•

100+by info@thehackernews.com (The Hacker News) / 2d

•

GitVenom campaign steals cryptocurrency

Cybersecurity researchers are calling attention to an ongoing campaign that's targeting gamers and cryptocurrency investors under the guise of open-source projects hosted on GitHub. The campaign, which spans hundreds of repositories, has been dubbed GitVenom by Kaspersky. "The infected projects include an automation instrument for interacting with Instagram accounts, a Telegram bot that enables

Feb 24, 2025

FatalRAT Phishing Attacks Target APAC Industries Using Chinese Cloud Services

IoC > 1 domain

•

83by info@thehackernews.com (The Hacker News) / 2d

•

17 TTPs

•

Chinese hackers target industrial organizations

Various industrial organizations in the Asia-Pacific (APAC) region have been targeted as part of phishing attacks designed to deliver a known malware called FatalRAT. "The threat was orchestrated by attackers using legitimate Chinese cloud content delivery network (CDN) myqcloud and the Youdao Cloud Notes service as part of their attack infrastructure," Kaspersky ICS CERT said in a Monday

Two Actively Exploited Security Flaws in Adobe and Oracle Products Flagged by CISA

Execution (Enterprise TA0002)

•

99by info@thehackernews.com (The Hacker News) / 2d

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two security flaws impacting Adobe ColdFusion and Oracle Agile Product Lifecycle Management (PLM) to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The vulnerabilities in question are listed below - CVE-2017-3066 (CVSS score: 9.8) - A deserialization vulnerability impacting

New Malware Campaign Uses Cracked Software to Spread Lumma and ACR Stealer

8 TTPs

•

81by info@thehackernews.com (The Hacker News) / 2d

Cybersecurity researchers are warning of a new campaign that leverages cracked versions of software as a lure to distribute information stealers like Lumma and ACR Stealer. The AhnLab Security Intelligence Center (ASEC) said it has observed a spike in the distribution volume of ACR Stealer since January 2025. A notable aspect of the stealer malware is the use of a technique called dead drop

⚡ THN Weekly Recap: From $1.5B Crypto Heist to AI Misuse & Apple’s Data Dilemma

21 TTPs

•

38by info@thehackernews.com (The Hacker News) / 3d

Welcome to your weekly roundup of cyber news, where every headline gives you a peek into the world of online battles. This week, we look at a huge crypto theft, reveal some sneaky AI scam tricks, and discuss big changes in data protection. Let these stories spark your interest and help you understand the changing threats in our digital world. ⚡ Threat of the Week Lazarus Group Linked to

Becoming Ransomware Ready: Why Continuous Validation Is Your Best Defense

42by info@thehackernews.com (The Hacker News) / 3d

Ransomware doesn’t hit all at once—it slowly floods your defenses in stages. Like a ship subsumed with water, the attack starts quietly, below the surface, with subtle warning signs that are easy to miss. By the time encryption starts, it’s too late to stop the flood. Each stage of a ransomware attack offers a small window to detect and stop the threat before it’s too late. The problem is

Google Cloud KMS Adds Quantum-Safe Digital Signatures to Defend Against Future Threats

Google Cloud adds quantum-resistant signatures

•

70by info@thehackernews.com (The Hacker News) / 3d

Google Cloud has announced quantum-safe digital signatures in Google Cloud Key Management Service (Cloud KMS) for software-based keys as a way to bulletproof encryption systems against the threat posed by cryptographically-relevant quantum computers. The feature, currently in preview, coexists with the National Institute of Standards and Technology's (NIST) post-quantum cryptography (PQC)

Australia Bans Kaspersky Software Over National Security and Espionage Concerns

Australia bans Kaspersky antivirus software

•

100+by info@thehackernews.com (The Hacker News) / 3d

Australia has become the latest country to ban the installation of security software from Russian company Kaspersky, citing national security concerns. "After considering threat and risk analysis, I have determined that the use of Kaspersky Lab, Inc. products and web services by Australian Government entities poses an unacceptable security risk to Australian Government, networks and data,

End of feed