The term “Lazarus Group,” once used to describe a singular Advanced Persistent Threat (APT) actor, has evolved to represent a complex network of sub-groups operating under shared objectives and tactics. This shift reflects the growing scale and diversification of their…
Category: GBHackers Security | #1 Globally Trusted Cyber Security News Platform
Earth Alux Hackers Use VARGIET Malware to Target Organizations
A new wave of cyberattacks orchestrated by the advanced persistent threat (APT) group Earth Alux has been uncovered, revealing the use of sophisticated malware, including the VARGEIT backdoor, to infiltrate critical industries. Linked to China, Earth Alux has been targeting…
Operation HollowQuill – Weaponized PDFs Deliver a Cobalt Strike Malware Into Gov & Military Networks
In a recent revelation by SEQRITE Labs, a highly sophisticated cyber-espionage campaign, dubbed Operation HollowQuill, has been uncovered. The operation targets academic, governmental, and defense-related networks in Russia using weaponized decoy PDFs to deliver Cobalt Strike malware implants. The campaign…
Konni RAT Exploit Windows Explorer Limitations To Launches a Multi-Stage Attack & Steal Data
Konni RAT, a highly advanced Remote Access Trojan (RAT), has emerged as a significant cybersecurity threat, leveraging Windows Explorer limitations to execute multi-stage attacks. This malware employs a combination of batch files, PowerShell scripts, and VBScript to infiltrate systems, exfiltrate…
Weaponized Zoom Installer Used by Hackers to Gain RDP Access and Deploy BlackSuit Ransomware
Cybersecurity researchers have uncovered a sophisticated attack campaign where threat actors utilized a trojanized Zoom installer to infiltrate systems, gain remote desktop protocol (RDP) access, and ultimately deploy the BlackSuit ransomware. The operation demonstrates a highly coordinated, multi-stage malware delivery…
Threat Actors Embed Malware in WordPress Sites to Enable Remote Code Execution
Security researchers have uncovered a new wave of cyberattacks targeting WordPress websites through the exploitation of the “mu-plugins” (Must-Use plugins) directory. This directory, designed to load plugins automatically without requiring activation, has become an attractive hiding spot for threat actors…
Russian Hackers Leverage Bulletproof Hosting to Shift Network Infrastructure
Russian-aligned cyber threat groups, UAC-0050 and UAC-0006, have significantly escalated their operations in 2025, targeting entities worldwide with a focus on Ukraine. These groups employ bulletproof hosting services to mask their network infrastructure, enabling sophisticated campaigns involving financial theft, espionage,…
Windows 11 Insider Released – Microsoft Removes BypassNRO.cmd Script to Enhance Security
Microsoft has launched Windows 11 Insider Preview Build 26200.5516 to the Dev Channel with exciting new updates, including innovative features and a key security enhancement. Among the major changes is the removal of the widely known BypassNRO.cmd script, a move aimed at bolstering…
A New Microsoft Tool Automatically Detects, Diagnoses, and Resolves Boot Issues in Windows
Microsoft has unveiled a transformational tool aimed at addressing one of the most frustrating challenges in modern computing: boot failures. Aptly named “Quick Machine Recovery,” this new feature automatically detects, diagnoses, and resolves critical system issues that prevent Windows devices…
Beware! A Fake Zoom Installer Drops BlackSuit Ransomware on Your Windows Systems
Cybersecurity analysts have uncovered a sophisticated campaign exploiting a fake Zoom installer to deliver BlackSuit ransomware across Windows-based systems. The attack, documented by DFIR experts, highlights how threat actors are leveraging popular software to deceive unsuspecting victims into installing malware…
Linux Distribution Nitrux3.9.1 Releaed – What’s New
Nitrux Linux, renowned for its innovative approach to desktop computing, has unveiled its latest release, Nitrux 3.9.1, codenamed “mk.” This distribution, rooted in Ubuntu and utilizing Nomad as its desktop environment, brings substantial updates to its framework, apps, and system. Designed…
CrushFTP Vulnerability Lets Hackers Bypass Security and Seize Server Control
A newly disclosed authentication bypass vulnerability (CVE-2025-2825) in CrushFTP file transfer software enables attackers to gain complete control of servers without valid credentials. The vulnerability affects versions 10.0.0 through 11.3.0 of the popular enterprise file transfer solution, exposing organizations to…
Hackers Distributing Phishing Malware Via SVG Format To Bypass File Detection
Cybersecurity experts at the AhnLab Security Intelligence Center (ASEC) have uncovered a novel phishing malware distribution method leveraging the Scalable Vector Graphics (SVG) file format to bypass detection mechanisms. SVG, an XML-based vector image format widely used for icons, logos,…
Chinese Lotus Blossom Hackers leverages Windows Management Instrumentation for Network Movement
The Chinese Advanced Persistent Threat (APT) group known as Lotus Blossom, also referred to as Billbug, Thrip, or Spring Dragon, has intensified its cyber-espionage operations by employing advanced techniques, including the use of Windows Management Instrumentation (WMI) for lateral movement…
CISA Warns of RESURGE Malware Exploiting Ivanti Connect Secure RCE Vulnerability
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a detailed Malware Analysis Report (MAR-25993211-r1.v1) on the RESURGE malware, which exploits the Remote Code Execution (RCE) vulnerability CVE-2025-0282 in Ivanti Connect Secure devices. This vulnerability has been leveraged by threat…
Water Gamayun Hackers Exploit MSC EvilTwin Zero-day Vulnerability to Hack Windows Machine
Water Gamayun, a suspected Russian threat actor, has been identified exploiting the MSC EvilTwin zero-day vulnerability (CVE-2025-26633) to compromise Windows systems. This vulnerability, embedded in the Microsoft Management Console (MSC) framework, allows attackers to execute malicious code remotely, exfiltrate sensitive…
Apache Tomcat Vulnerability Exploited to Execute Malicious Arbitrary Code on Servers
A critical remote code execution (RCE) vulnerability, tracked as CVE-2025-24813, is being actively exploited in Apache Tomcat servers. Critical RCE Flaw in Apache Tomcat The flaw allows attackers to upload malicious files via unauthenticated HTTP PUT requests, followed by a…
New Android Malware “TsarBot” Targeting 750 Banking, Finance & Crypto Apps
A newly identified Android malware, dubbed TsarBot, has emerged as a potent cyber threat targeting over 750 applications across banking, finance, cryptocurrency, and e-commerce sectors. Discovered by Cyble Research and Intelligence Labs (CRIL), this banking Trojan employs sophisticated overlay attacks…
Canon Printer Vulnerability Allows Attackers to Execute Arbitrary Code
A security vulnerability, tracked as CVE-2025-1268, has been found in certain Canon printer drivers, potentially allowing attackers to execute arbitrary code. The flaw, categorized as an out-of-bounds vulnerability, affects printer drivers for office multifunction printers, small office printers, production printers, and laser…
ClickFix Captcha – A New Technique Hackers Used to Deliver Infostealers, Ransomware, & Quakbot Malware
Cybercriminals are leveraging fake CAPTCHA verification pages dubbed ClickFix to distribute malware, including infostealers, ransomware, and the notorious Qakbot banking trojan. This technique manipulates users into executing malicious commands disguised as routine “verify you are human” prompts. The attack begins…