Cybercrime
-
Russian-origin CTRL toolkit spread through malicious Windows shortcut files, researchers say
Researchers say a Russian-origin toolkit called CTRL was spread through malicious Windows shortcut files disguised as private key folders. The malware adds phishing, keylogging, RDP hijacking and reverse tunneling while limiting network traces.
-
Three China-linked clusters targeted Southeast Asian government, researchers say
Researchers said three China-linked clusters targeted a Southeast Asian government organization in 2025, using several malware families and techniques aimed at staying inside networks for long-term access.
-
Ajax says hacker accessed fan data and enabled ticket transfers
AFC Ajax said a hacker accessed parts of its systems and viewed email addresses for a few hundred people and personal details for fewer than 20 people with stadium bans. RTL journalists who were tipped off verified vulnerabilities that they said allowed ticket transfers and broad access to fan records; Ajax says it has patched…
-
China-linked group embeds stealthy kernel backdoors in telecom networks, Rapid7 says
Security firm Rapid7 reported that a China-linked threat cluster known as Red Menshen has embedded kernel-level implants and stealthy backdoors such as BPFDoor inside telecommunications networks to gather intelligence while evading conventional detection.
-
UK sanctions Xinbi marketplace linked to Southeast Asian scam centres
The U.K. has sanctioned Xinbi, a Chinese-language marketplace accused of selling stolen data and cryptocurrency services to scam centres in Southeast Asia, and targeted the operators of a large scam compound known as #8 Park, as part of efforts to disrupt crypto-based money laundering and large-scale investment fraud.
-
Phishing campaign targets TikTok for Business accounts with bot-blocking pages
A phishing campaign is targeting TikTok for Business accounts with bot-blocking pages that redirect through Google Storage and use a Cloudflare Turnstile check, then present fake login pages designed to capture credentials and session cookies.
-
Kaspersky links Coruna iOS exploit framework to Operation Triangulation, finds expanded targets
Kaspersky researchers say the Coruna exploit framework is an updated successor to the Operation Triangulation toolkit, adding support for A17 and M3 chips and iOS up to 17.2, and that its components include multiple exploit chains used in both espionage and financially motivated attacks.
-
Armenian Extradited to U.S. on Charges of Helping Run RedLine Infostealer
Hambardzum Minasyan, an Armenian national, was extradited to the U.S. and charged with helping manage the RedLine infostealer operation by registering servers, domains and a cryptocurrency account used for affiliate payments; he faces federal counts that carry up to 30 years in prison.
-
VoidStealer uses debugger trick to extract Chrome master key, researchers say
VoidStealer, a malware-as-a-service, uses a debugger-based method that leverages hardware breakpoints to extract Chrome’s v20_master_key from memory, researchers at Gen Digital reported.
-
CanisterWorm self propagates in npm after Trivy supply chain compromise
A self propagating worm called CanisterWorm followed a Trivy supply chain compromise to infect 47 npm packages. The worm uses an ICP canister dead drop and stolen npm tokens to publish malicious package versions.
