Research
-
Source-code leak exposes ERMAC Android banking trojan infrastructure, researchers say
The ERMAC Android banking trojan v3 source code was leaked online, exposing its backend, panel, and exfiltration infrastructure and signaling an expanded targeting scope of over 700 apps, along with notable operational security lapses that could invite further risk from other threat actors.
-
Noodlophile Infostealer Campaign Uses Legal-Threat Phishing to Target Businesses, Researchers Warn
Security researchers warn of a spear-phishing campaign leveraging legal-threat prompts to deploy the Noodlophile infostealer, using DLL side-loading in legitimate applications and malicious archives to exfiltrate cookies, payment data and system information across global targets.
-
Taiwan Web Infrastructure Targeted by UAT-7237, Cisco Talos Says
Cisco Talos links a China-aligned APT cluster, UAT-7237, to attacks on Taiwan’s web infrastructure, using customized open-source tooling and a SoundBill shellcode loader to deploy backdoors and credentials-stealing utilities. The operation, active since 2022 and considered a sub-group of UAT-5918, also employs VPN persistence and RDP access, with updates to embed Mimikatz and broader lateral…
-
Curly COMrades APT Targets Georgia and Moldova, Leveraging Ngen for Persistence, Bitdefender Warns
A new cyber espionage campaign attributed to the Curly COMrades threat actor targets Georgia and Moldova, leveraging a mix of legitimate tools and a bespoke backdoor to establish long-term access and exfiltrate credentials, according to Bitdefender.
-
9GB Data Leak From Alleged North Korean Hacker Surfaces at DEF CON
Two hackers released a 9GB archive reportedly from a North Korean operator during DEF CON, with the material—including logs, credentials, and scripts—made available via DDoSecrets and published on Phrack; the data has been indexed and deemed authentic by researchers, though attribution remains uncertain.
-
Critical Vulnerabilities Discovered in NVIDIA’s Triton Inference Server
A set of critical vulnerabilities in NVIDIA’s Triton Inference Server has been discovered, posing significant risks to organizations using the platform for AI operations. Potential exploits could lead to remote control of servers and theft of sensitive data.
-
China Accuses US of Cyberattacks Using Microsoft Zero-Day Vulnerability
China has alleged that U.S. intelligence agencies conducted cyberattacks on Chinese military enterprises, exploiting a Microsoft zero-day vulnerability. The accusations come amid heightened tensions and increasing allegations of cyber warfare between the two nations.
-
New Cyber Espionage Campaign Targets Russian Aerospace Sector with EAGLET Implant
A new cyber espionage campaign named Operation CargoTalon has targeted Russian aerospace and defense sectors, deploying the EAGLET backdoor to facilitate data theft. Analysts report sophisticated tactics involving spear-phishing emails and the use of decoy documents referencing U.S. sanctioned entities.
-
White House Unveils AI Action Plan with Cybersecurity Focus Amid Budget Concerns
The White House has introduced an AI action plan filled with cybersecurity measures, as it aims to secure the United States’ leadership in artificial intelligence. The plan faces scrutiny for its lack of specific implementation guidelines amidst proposed federal budget cuts.
-
National Nuclear Security Administration Targeted in SharePoint Vulnerability Attacks
The National Nuclear Security Administration has been hacked as part of a widespread campaign exploiting a Microsoft SharePoint vulnerability, with the potential breach of numerous government and private sector organizations. No sensitive information appears compromised, according to officials.
