Ransomware-as-a-Service (RaaS) platforms have revolutionized the ransomware market. Unlike traditional standalone ransomware sales, RaaS offers a subscription-based model where attackers can access pre-built ransomware tools and infrastructure without significant upfront costs. These platforms provide user-friendly dashboards, customization options, and ongoing…
Category: GBHackers Security | #1 Globally Trusted Cyber Security News Platform
Researchers Detailed Credential Abuse Cycle
The United States Department of Justice has unsealed an indictment against Anonymous Sudan, a hacking group responsible for distributed denial-of-service attacks. LameDuck, a new threat actor, has carried out several massive distributed denial of service (DDoS) attacks to affect critical…
Azure API Management Vulnerabilities Let Attackers Escalate Privileges
Recent discoveries by Binary Security have revealed critical vulnerabilities in Azure API Management (APIM) that could allow attackers with minimal privileges to escalate their access and take full control over the APIM service. These vulnerabilities were reported to Microsoft, leading to some…
Google Patches High-Severity Vulnerabilities in Chrome
Google has released a new update for its Chrome browser, addressing two high-severity vulnerabilities. The Stable channel has now been updated to version 130.0.6723.116/.117 for Windows and Mac and version 130.0.6723.116 for Linux. The update will be rolled out to users over the next…
ClickFix Exploits GMeet & Zoom Pages to Deliver Sophisticated Malware
A new tactic, “ClickFix,” has emerged. It exploits fake Google Meet and Zoom pages to deliver sophisticated malware. The Sekoia Threat Detection & Research (TDR) team monitors this social engineering strategy closely. It represents a significant evolution in how threat…
APT36 Hackers Attacking Windows Deevices With ElizaRAT
APT36, a sophisticated threat actor, has been actively targeting Indian entities with advanced malware like ElizaRAT, which is designed for espionage. It leverages cloud-based services for covert communication and data exfiltration. Recent campaigns have seen significant enhancements in ElizaRAT’s evasion…
Hackers Created 100+ Fake Web Stores To Steal Millions Of Dollars From Customers
The Phish, ‘n’ Ships fraud operation leverages, compromised websites to redirect users to fake online stores, which, optimized for search engine visibility, trick victims into providing credit card details to third-party payment processors, resulting in financial loss without receiving any…
Hackers Using AV/EDR Bypass Tool From Cybercrime Forums To Bypass Endpoints
Researchers uncovered two previously unknown endpoints with older Cortex XDR agents that used to test an AV/EDR bypass tool were compromised, granting unauthorized access. The threat actor utilized a bypass tool, likely purchased from cybercrime forums, to compromise the system.…
Google Patched 40 Security Vulnerabilities Along With Two Zero-Days
Google has released a batch of security updates addressing 40 vulnerabilities, two of which are critical zero-day exploits. As reported in the November 2024 Android Security Bulletin, these updates are crucial for maintaining the integrity and safety of Android devices…
Threat Actor IntelBroker Claims Leak of Nokia’s Source Code
The threat actor known as IntelBroker, in collaboration with EnergyWeaponUser, has claimed responsibility for a significant data breach involving Nokia’s proprietary source code. The news, which has sent ripples through the tech industry, was shared on social media, highlighting the…
New Windows Zero-Day Vulnerability Let Attackers Steal Credentials From Victim’s Machine
A security researcher discovered a vulnerability in Windows theme files in the previous year, which allowed malicious actors to steal Windows users’ credentials. When a theme file specifies a network path for specific properties, like the brand image or wallpaper,…
Chinese Hackers Attacking Microsoft Customers With Sophisticated Password Spray Attacks
Researchers have identified a network of compromised devices, CovertNetwork-1658, used by Chinese threat actors to launch highly evasive password spray attacks, successfully stealing credentials from multiple Microsoft customers. The stolen credentials are then leveraged by threat actors like Storm-0940 to…
Sophisticated Phishing Attack Targeting Ukraine Military Sectors
The Ukrainian Cyber Emergency Response Team discovered a targeted phishing campaign launched by UAC-0215 against critical Ukrainian infrastructure, including government agencies, key industries, and military entities. Phishing emails promoting integration with Amazon, Microsoft, and ZTA contained malicious .rdp files. Upon…
Massive Midnight Blizzard Phishing Attack Using Weaponized RDP Files
Researchers warn of ongoing spear-phishing attacks by Russian threat actor Midnight Blizzard targeting individuals in various sectors. The attacks involve sending signed RDP configuration files to thousands of targets, aiming to compromise systems for intelligence gathering. The actor impersonates Microsoft…
Evasive Panda Attacking Cloud Services To Steal Data Using New Toolkit
The Evasive Panda group deployed a new C# framework named CloudScout to target a Taiwanese government entity in early 2023, which leverages three modules, CGM, CGN, and COL, to hijack web sessions and access cloud services like Google Drive, Gmail,…
SYS01 InfoStealer Malware Attacking Meta Business Page To Steal Logins
The ongoing Meta malvertising campaign, active for over a month, employs an evolving strategy to distribute the SYS01 InfoStealer through ElectronJs applications disguised as legitimate software like video editors, productivity tools, and streaming services. The campaign leverages nearly a hundred…
Singapore’s Government Directed ISPs To Block Access To Ten Inauthentic Websites
Singapore’s government has instructed internet service providers to block access to websites deemed “inauthentic,” which are believed to be part of hostile information campaigns potentially targeting Singapore. The government’s action is intended to combat the distribution of false information and…
Embargo Ransomware Actors Abuses Safe Mode To Disable Security Solutions
In July 2024, the ransomware group Embargo targeted US companies using the malicious loader MDeployer and EDR killer MS4Killer. MDeployer deployed MS4Killer, which disabled security products, before executing the Embargo ransomware. The ransomware encrypted files with a random six-letter extension…
Russian Hackers Attacking Ukraine Military With Malware Via Telegram
Researchers discovered a Russian-linked threat actor, UNC5812, utilizing a Telegram persona named “Civil Defense. ” This persona has been distributing Windows and Android malware disguised as legitimate software designed to aid potential conscripts in Ukraine. Once installed, these malicious apps…
A Massive Hacking Toolkit From “You Dun” Threat Group Developed To Lauch Massive Cyber Attack
The “You Dun” hacking group exploited vulnerable Zhiyuan OA software using SQL injection, leveraging tools like WebLogicScan, Vulmap, and Xray for reconnaissance. They further escalated privileges on compromised hosts with tools like traitor and CDK. Active Cobalt Strike server leaked,…