XenoRAT malware campaign hits multiple embassies in South Korea

Por
Picus Blue Report 2025

A state-sponsoredespionage campaign is targeting foreign embassies in South Korea to deployXenoRAT malware from malicious GitHub repositories. According to Trellix researchers, the campaign has been running since Marchand isongoing, having launched at least 19 spearphishing attacks against high-value targets. Although infrastructure and techniques match the pllaybook of North Korean actorKimsuky (APT43), there are signs that … Ler mais

Nebraska man gets 1 year in prison for $3.5M cryptojacking scheme

Por
Picus Blue Report 2025

A Nebraska man was sentenced to one year in prison for defrauding cloud computing providers of over $3.5 million to mine cryptocurrency worth nearly $1 million. Charles O. Parks III (also known as “CP3O”) was arrested and charged in April with wire fraud, money laundering, and engaging in unlawful monetary transactions. He was facing up … Ler mais

Os atores de ameaças exploram o arquivo de índice de ajuda da Microsoft para implantar malware pipemagic

Por
UAC-0099 Hackers Weaponize HTA Files to Deploy MATCHBOIL Loader Malware

Os pesquisadores de segurança cibernética descobriram uma campanha sofisticada, onde os atores de ameaças aproveitam um arquivo de índice de ajuda da Microsoft (.MSHI) para implantar o backdoor Pipemagic, marcando uma evolução notável nos métodos de entrega de malware. Esse desenvolvimento se vincula à exploração do CVE-2025-29824, uma elevação de vulnerabilidade de privilégios de dia … Ler mais

ERMAC Android malware source code leak exposes banking trojan infrastructure

Por
ERMAC Android malware source code leak exposes banking trojan infrastructure

The source code for version 3 of theERMACAndroid banking trojanhas been leaked online, exposing the internals of the malware-as-a-service platform and the operator’s infrastructure. The code base was discovered in an open directory by Hunt.io researchers while scanning for exposed resourcesin March 2024. They located an archive named Ermac 3.0.zip, which contained the malware’s code, … Ler mais

AI for Cybersecurity: Building Trust in Your Workflows

Por
AI for Cybersecurity: Building Trust in Your Workflows

AI for Cybersecurity: Building Trust in Your Workflows In cybersecurity, speed matters, but trust is crucial. AI must ensure both rapid response and reliable decisions to avoid errors and disruption. In cybersecurity, speed matters. But speed without trust can be just as dangerous – if not more so – as no action at all. A … Ler mais

Pacote python armado "Termncolor" Usa a chave do Windows Run para persistência

Por
Weaponized Python Package "termncolor" Uses Windows Run Key for Persistence

Especialistas em segurança cibernética descobriram um complexo ataque da cadeia de suprimentos que se originou do Python Package Index (PYPI) em uma recente divulgação do ZSCaler AmeaMlabz. O pacote em questão, denominado “TermNColor”, se disfarça de utilitário de cores benignas para terminais Python, mas importa secretamente uma dependência maliciosa chamada “Colorinal”. Essa dependência serve como … Ler mais

USB Malware Campaign Spreads Cryptominer Worldwide

Por
USB Malware Campaign Spreads Cryptominer Worldwide

A multi-stage malware attack delivered via infected USB devices has been identified, raising concerns over the persistence of cryptomining threats in 2025. Analysts from CyberProof’s Managed Detection and Response (MDR) team discovered that the campaign used DLL search order hijacking and PowerShell to bypass security controls before attempting to install a cryptominer. The malware was … Ler mais

The AI Fix #64: AI can be vaccinated against evil, and the “Rumble in the Silicon Jungle”

Por
The AI Fix #64: AI can be vaccinated against evil, and the “Rumble in the Silicon Jungle”

In episode 64 of The AI Fix, AI discovers new physics, a robot crab looks for love on the beaches of Portugal, the “Godfather of AI” thinks our only hope is to build motherly AI, a robot folds some laundry, the UK government has a terrible idea, and our hosts discover a long lost sixties … Ler mais

UK sentences “serial hacker” of 3,000 sites to 20 months in prison

Por
Picus Blue Report 2025

A 26-year old in the UK who claimed to have hacked thousands of websites wassentenced to 20 months in prison after pleading guilty earlier this year. Al-Tahery Al-Mashriky ofRotherham, UK, was arrested in 2022 based on information received from U.S. law enforcement and charged for stealing log in details of millions of Facebook users, and … Ler mais

Over 800 N-able servers left unpatched against critical flaws

Por
Picus Blue Report 2025

Over 800 N-able N-central servers remain unpatched against a pair of critical security vulnerabilities tagged as actively exploited last week. N-central is a popular platform used by many managed services providers (MSPs) and IT departments to monitor and manage networks and devices from a centralized web-based console. Tracked as CVE-2025-8875 and CVE-2025-8876, the two flaws … Ler mais