Login
SoundCloud Confirms Cyberattack, Limited User Data Exposed
16 December 2025 at 02:51
Normal view
Received today — 16 December 2025
Received before yesterday
Cloudflare Forces Widespread Outage to Mitigate Exploitation of Maximum Severity Vulnerability in React2Shell
8 December 2025 at 05:36
A critical React2Shell (CVE-2025-55182) RCE flaw in React and Next.js is being actively exploited by China-nexus threat groups, prompting urgent patching and global mitigations.
The post Cloudflare Forces Widespread Outage to Mitigate Exploitation of Maximum Severity Vulnerability in React2Shell appeared first on Security Boulevard.
US Offers $10M for Iranian Cyber Operatives Behind Election Interference and Critical Infrastructure Attacks
3 December 2025 at 02:25
In August 2020, Shahid Shushtari actors began a multi-faceted campaign targeting the US presidential election, combining computer intrusion activity with exaggerated claims of access to victim networks to enhance psychological effects. The US Treasury Department designated Shahid Shushtari and six employees on November 18, 2021, pursuant to Executive Order 13848 for attempting to influence the 2020 election.
Read: Six Iranian Hackers Identified in Cyberattacks on US Water Utilities, $10 Million Reward Announced
The Infrastructure and Olympic Targeting
Since 2023, Shahid Shushtari established fictitious hosting resellers named "Server-Speed" and "VPS-Agent" to provision operational server infrastructure while providing plausible deniability. These resellers procured server space from Europe-based providers including Lithuania's BAcloud and UK-based Stark Industries Solutions.
In July 2024, actors used VPS-Agent infrastructure to compromise a French commercial dynamic display provider, attempting to display photo montages denouncing Israeli athletes' participation in the 2024 Olympics. This cyberattack was coupled with disinformation including fake news articles and threat messages to Israeli athletes under the banner of a fake French far-right group.
Following the October 7, 2023, Hamas attack, Shahid Shushtari used cover personas including "Contact-HSTG" to contact family members of Israeli hostages, attempting to inflict psychological trauma. The group also undertook significant efforts to enumerate and obtain content from IP cameras in Israel, making images available via several servers.
AI Integration and Hack-and-Leak Operations
Shahid Shushtari incorporated artificial intelligence into operations, including AI-generated news anchors in the "For-Humanity" operation that impacted a US-based Internet Protocol Television streaming company in December 2023. The group leverages AI services including Remini AI Photo Enhancer, Voicemod, Murf AI for voice modulation, and Appy Pie for image generation, a joint October advisory from the U.S. and Israeli agencies stated.
Since April 2024, the group used the online persona "Cyber Court" to promote activities of cover-hacktivist groups including "Makhlab al-Nasr," "NET Hunter," "Emirate Students Movement," and "Zeus is Talking," conducting malicious activity protesting the Israel-Hamas conflict.
FBI assessments indicate these hack-and-leak operations are intended to undermine public confidence in victim network security, embarrass companies and targeted countries through financial losses and reputational damage.
Anyone with information on Mohammad Bagher Shirinkar, Fatemeh Sedighian Kashi, or Shahid Shushtari should contact Rewards for Justice through its secure Tor-based tips-reporting channel.
Who Is Dark Storm? The Threat Actor European Security Teams Can’t Ignore
20 November 2025 at 05:41
Who Is Dark Storm? A Pro-Russian Collective Expanding Its Reach
The threat actor Dark Storm, also known as Dark Storm Team, TeamDarkStorm, and MRHELL112, has built a reputation for hitting critical infrastructure, particularly airports and transportation networks. While DDoS has remained its signature method, the group has recently broadened its campaigns to include political, opportunistic, and retaliatory attacks. Dark Storm is part of the pro-Russian alliance Matryoshka 424, connecting it to other hacktivist clusters that coordinate messaging, tools, and attack timing. The group’s alignment with wider pro-Russian cyber movements has amplified its operational impact, especially during geopolitical flashpoints.Growing Web of Alliances Boosts Their Disruptive Capabilities
The threat actor’s tactic frequently overlaps with those of linked groups such as OverFlame, Server Killers, Z-Pentest, and Team BD Cyber Ninja, all of which share DDoS infrastructure and ideological motivations.- OverFlame focuses on attacks connected to Ukraine and its allies.
- Server Killers routinely targets entities perceived as opposing Russian interests.
- Z-Pentest, a newer group, has been seen exploiting unauthorized access to ICS panels and performing website defacements.
How Dark Storm Executes Its Attacks
1. Exploiting Public-Facing Applications
Dark Storm’s operations often begin with exploiting weaknesses in internet-facing applications, including misconfigured servers, outdated services, and vulnerable web components. By leveraging Initial Access techniques such as exploiting public-facing apps (T1190), the group aims to identify high-value entry points. This includes:- Web servers and cloud-hosted applications
- Administrative interfaces
- Exposed databases or misconfigured network devices
- Voluminous traffic generation using botnets
- IP spoofing to hide origin
- Reflective amplification techniques
- Multi-layer targeting of network and application endpoints
- Flooding official portals
- Disrupting public-facing service websites
- Interrupting online citizen services
- Targeting digital communication channels
How Organizations Can Defend Against Dark Storm’s Tactics
The tactics used by Threat Actor Dark Storm, particularly large-scale DDoS attacks and exploitation of exposed applications, stress on the importance of continuous threat visibility. Organizations dependent on online services remains especially vulnerable during periods of geopolitical tension or heightened hacktivist activity. Solutions like Cyble’s Cyber Threat Intelligence Platform provide early detection of adversary behavior, monitoring of emerging campaigns, and insights into developing threats that groups like Dark Storm rely on. With holistic visibility, automation, and advanced analytics, security teams can prioritize high-risk exposures, detect reconnaissance activity sooner, and prepare defenses before attacks escalate.Stay ahead of threat actor groups like Dark Storm.
Explore deeper threat insights with Cyble’s Cyber Threat Intelligence Platform- Get Your FREE Demo Now
Operation Endgame Dismantles 1,025 Servers in a Strike Against Rhadamanthys, VenomRAT Operations
13 November 2025 at 08:04
The warning arrived on chat at 3:47 AM: "Immediately reinstall your server, erase traces, the German police are acting."
Cybercriminals worldwide using the Rhadamanthys infostealer watched in real-time as German law enforcement IP addresses appeared in their web panels, signaling the collapse of what investigators now reveal as one of the largest credential theft operations globally.
Between November 10 and 14, 2025, authorities coordinated from Europol's headquarters in The Hague dismantled 1,025 servers supporting the Rhadamanthys infostealer, VenomRAT remote access trojan, and Elysium botnet in the latest phase of Operation Endgame.
The infrastructure controlled hundreds of thousands of infected computers containing several million stolen credentials and access to over 100,000 cryptocurrency wallets potentially worth millions of euros. The coordinated international action involved law enforcement from eleven countries including the United States, Canada, Australia, and multiple European nations.
Key Suspect Arrested in Greece
Authorities arrested a primary suspect linked to VenomRAT operations in Greece on November 3, 2025. The arrest preceded the broader infrastructure takedown by days, suggesting investigators conducted extensive surveillance before executing simultaneous strikes.
Officers conducted searches at 11 locations across Germany, Greece, and the Netherlands while seizing 20 domains tied to the malware operations. The Rhadamanthys developer acknowledged the disruption in a Telegram message, claiming German law enforcement accessed their infrastructure.
Web panels hosted in EU data centers logged German IP addresses connecting immediately before cybercriminals lost server access, according to messages circulated among the infostealer's customer base. Security researchers known as g0njxa and Gi7w0rm, who monitor malware operations, reported that cybercriminals using Rhadamanthys received urgent warnings about the law enforcement action.
Internal communications advised immediate cessation of activities and system reinstallation to erase traces, with operators noting that SSH access suddenly required certificates instead of root passwords. The panic spread rapidly through underground forums as customers realized law enforcement had penetrated their command and control infrastructure.
Malware-as-a-Service Business Model Disrupted
Rhadamanthys operates on a subscription model where cybercriminals pay monthly fees for malware access, support, and web panels used to collect stolen data. The operation marketed itself professionally as "Mythical Origin Labs" through a Tor website with detailed product descriptions, a Telegram support channel, and communication via Tox messaging.
Also read: Be Wary of Google Ads: Rhadamanthys Stealer is Here!
The infostealer steals login credentials, browser data, cryptocurrency wallet information, autofilled data, and other sensitive information from browsers, password managers, and crypto wallets. Subscription plans ranged across multiple tiers, providing different levels of functionality and support.
The malware commonly spreads through campaigns promoted as software cracks, malicious YouTube videos, or poisoned search advertisements. Most victims remained unaware of infections on their systems, with stolen credentials silently exfiltrated to attacker-controlled infrastructure.
VenomRAT functions as a remote access trojan capable of exfiltrating various files, stealing cryptocurrency wallets and browser data, credit card details, account passwords, and authentication cookies. Both malware families operated as enablers for broader cybercrime ecosystems, with customers using stolen data for identity theft, financial fraud, and follow-on attacks.
Elysium Botnet Infrastructure Eliminated
The Elysium botnet, marketed alongside Rhadamanthys by the same operators as a proxy bot service, fell under the operation's scope. Security researchers assess that machines infected with Rhadamanthys or VenomRAT may have also been equipped with the proxy bot, creating a multi-layered criminal infrastructure serving various malicious purposes.
The dismantled infrastructure consisted of hundreds of thousands of infected computers across multiple continents. Many victims unknowingly participated in proxy networks that criminals used to route malicious traffic and obscure attack origins.
The Operation Endgame website was updated with new video content mocking Rhadamanthys operators and encouraging their customers to contact law enforcement. The site previously featured countdown timers announcing upcoming actions, creating psychological pressure on cybercriminals.
About Operation Endgame
Operation Endgame launched with initial actions in May 2024, described by Europol as the largest ever operation against botnets that play major roles in ransomware deployment. Previous phases disrupted IcedID, Bumblebee, Pikabot, Trickbot, SystemBC, SmokeLoader, and DanaBot malware operations.
Read: Operation Endgame – Largest Ever Operation Against Multiple Botnets Used to Deliver Ransomware
The May 2024 actions resulted in four arrests, over 100 servers taken down across 10 countries, over 2,000 domains brought under law enforcement control, and seizure of €3.5 million in various cryptocurrencies.
Shadowserver published a Rhadamanthys Historical Bot Infections Special Report containing information about devices infected between March 14 and October 11, 2025. The report was shared with 201 National CSIRTs in 175 countries and 10,000-plus network owners to identify compromised computers and alert owners. Authorities established accessible resources for concerned victims.
Security researchers warn that despite Operation Endgame's successes, some malware operations have demonstrated resilience. DanaBot banking trojan resurfaced with version 669 approximately six months after disruption, focusing on cryptocurrency theft and demonstrating the persistent nature of cybercrime infrastructure.
The simultaneous dismantling of three interconnected criminal platforms disrupts infrastructure enabling some of the most damaging cybercrimes globally, though investigators acknowledge the ongoing challenge of preventing criminal groups from rebuilding operations.
Also read: Operation Endgame 2.0: Europe’s Cyber Dragnet Just Crippled the Ransomware Economy at Its Source
Large-Scale Spam Campaign Hits npm Registry With 43,000+ Fake Packages
13 November 2025 at 03:51
The Naming Scheme Behind the “IndonesianFoods Worm”
The IndonesianFoods worm derives its name from its distinctive naming scheme and the internal dictionaries embedded within its malicious code. The script uses two lists, one containing Indonesian personal names such as andi, budi, cindy, and zul, and another containing Indonesian food terms like rendang, sate, bakso, and tapai. When executed, the script randomly selects one name, one food term, adds a random number between 1 and 100, and appends a suffix like “-kyuki” or “-breki.” Examples of generated package names include “andi-rendang23-breki” and “zul-tapai9-kyuki.” This combination of names and foods gives the worm both its unique identity and its connection to Indonesia, which inspired its name. McCarty stated that the attack “focuses on creating new packages rather than stealing credentials or engaging in other immediately malicious behavior.” Instead, it exploits npm’s open publishing model to overwhelm the registry with automated spam, disrupting developers, and polluting search results.Accounts and Behavior of the Spam Campaign
The IndonesianFoods worm has been traced to at least 11 npm accounts, including voinza, yunina, noirdnv, veyla, vndra, vayza, doaortu, jarwok, bipyruss, sernaam.b.y, and rudiox. Each of these accounts was created specifically for this operation, collectively responsible for publishing thousands of packages. None of them appears to be compromised by legitimate users. Once the malware is triggered, typically through a file like auto.js, it modifies the package.json file, assigns random version numbers, and publishes new packages continuously using the npm publish command. This happens in an infinite loop, creating a new spam package roughly every seven seconds. The result is an ongoing flood of junk data that strains npm’s infrastructure and risks contaminating legitimate dependency chains if developers accidentally install one of the packages. Though the payload does not directly steal data or credentials, it turns the npm registry itself into an attack vector, weaponizing its openness to spread an enormous volume of fake packages.Conclusion
The IndonesianFoods worm exposes how modern spam campaigns in software supply chains rely on automation and persistence to evade detection. Over two years, attackers, possibly linked to Indonesia, published tens of thousands of malicious npm packages, undermining trust in open ecosystems. With threats growing more coordinated, Cyble’s AI-native threat intelligence platform helps organizations detect, predict, and neutralize new cyber risks. Book a free demo to uncover vulnerabilities and strengthen your defense against large-scale attacks like the IndonesianFoods worm.Cyble Detects Phishing Campaign Using Telegram Bots to Siphon Corporate Credentials
11 November 2025 at 13:53
Cybersecurity researchers at Cyble have uncovered an extensive phishing campaign that represents a significant evolution in credential theft tactics. The operation, which targets organizations across multiple industries in Central and Eastern Europe, bypasses conventional email security measures by using HTML attachments that require no external hosting infrastructure.
Unlike traditional phishing attacks that rely on suspicious URLs or compromised servers, this campaign embeds malicious JavaScript directly within seemingly legitimate business documents. When victims open these HTML attachments—disguised as requests for quotation (RFQ) or invoices—they're presented with convincing login interfaces impersonating trusted brands like Adobe, Microsoft, FedEx, and DHL.
How the Attack Works
The attack chain begins with targeted emails posing as routine business correspondence. The HTML attachments use RFC-compliant filenames such as "RFQ_4460-INQUIRY.HTML" to appear legitimate and avoid triggering basic security filters.
[caption id="attachment_106661" align="aligncenter" width="600"] Attack Flow (Source: Cyble)[/caption]
Once opened, the file displays a blurred background image of an invoice or document with a centered login modal, typically branded with Adobe styling. The victim, believing they need to authenticate to view the document, enters their email and password credentials.
Behind the scenes, embedded JavaScript captures this data and immediately transmits it to attacker-controlled Telegram bots via the Telegram Bot API. This approach eliminates the need for traditional command-and-control infrastructure, making the operation harder to detect and disrupt.
"The sophistication lies not just in the technical execution but in how it circumvents multiple layers of security," explains the Cyble Research and Intelligence Labs (CRIL) team. The self-contained nature of the HTML files means they don't trigger alerts for suspicious external connections during initial email scanning.
Technical Sophistication
Analysis of multiple samples reveals ongoing development and refinement of the attack methodology. Earlier versions used basic JavaScript, while more recent samples implement CryptoJS AES encryption for obfuscation and sophisticated anti-forensics measures.
Advanced samples block common investigation techniques by disabling F12 developer tools, preventing right-click context menus, blocking text selection, and intercepting keyboard shortcuts like Ctrl+U (view source) and Ctrl+Shift+I (inspect element). These measures significantly complicate analysis efforts by security researchers and forensic investigators.
The malware also employs dual-capture mechanisms, forcing victims to enter their credentials multiple times while displaying fake "invalid login" error messages. This ensures accuracy of the stolen data while maintaining the illusion of a legitimate authentication failure.
Beyond credentials, the samples collect additional intelligence including victim IP addresses (using services like api.ipify.org), user agent strings, and other environmental data that could be valuable for subsequent attacks.
Scale and Targeting
CRIL's investigation identified multiple active Telegram bots with naming conventions like "garclogtools_bot," "v8one_bot," and "dollsman_bot," each operated by distinct threat actors or groups. The decentralized infrastructure suggests either collaboration among multiple cybercriminal groups or widespread availability of phishing toolkit generators.
The campaign primarily targets organizations in the Czech Republic, Slovakia, Hungary, and Germany, with affected industries including manufacturing, automotive, government agencies, energy utilities, telecommunications, and professional services. The geographic concentration and industry selection indicate careful reconnaissance and targeting based on regional business practices.
Threat actors customize their approach for different markets, using German-language variants for Telekom Deutschland impersonation and Spanish-language templates for other targets. The modular template system enables rapid deployment of new brand variants as the campaign evolves.
Detection and Defense
Security teams face challenges in detecting this threat due to its innovative use of legitimate platforms. Traditional indicators like suspicious URLs or known malicious domains don't apply when the attack infrastructure consists of HTML attachments and Telegram's legitimate API.
Cyble recommends organizations implement several defensive measures. Security operations centers should monitor for unusual connections to api.telegram.org from end-user devices, particularly POST requests that wouldn't occur in normal business operations. Network traffic to third-party services like api.ipify.org and ip-api.com from endpoints should also trigger investigation.
Email security policies should treat HTML attachments as high-risk file types requiring additional scrutiny. Organizations should implement content inspection that flags HTML attachments containing references to the Telegram Bot API or similar public messaging platforms.
For end users, the guidance remains straightforward: exercise extreme caution with unsolicited HTML attachments, especially those prompting credential entry to view documents. Any unexpected authentication request should be verified through independent channels before entering credentials.
Cyble has published complete indicators of compromise, including specific bot tokens, attachment patterns, and YARA detection rules to its GitHub repository, enabling security teams to hunt for signs of compromise within their environments and implement preventive controls.
Also read: Over 20 Malicious Crypto Wallet Apps Found on Google Play, CRIL Warns
Brazilian “Caminho” Loader Turns Images into Malware Delivery Chain
22 October 2025 at 03:02
A newly identified loader dubbed “Caminho” (Portuguese for “path”) has emerged as a sophisticated Loader-as-a-Service platform that uses Least Significant Bit (LSB) steganography to conceal malicious .NET payloads inside innocuous image files.
According to research from Arctic Wolf Labs, the operation was first observed in March 2025 and evolved significantly by June, expanding from South America into Africa and Eastern Europe.
Modular Loader-as-a-Service, Brazilian Origin
The investigation uncovered 71 sample variants all sharing the same core architecture and Portuguese-language artifacts across the code—strong indicators of Brazilian origin. Victim environments included Brazil, South Africa, Ukraine and Poland, suggesting the operation matured into multi-regional service rather than a single-campaign actor.
Victims were hit via spear-phishing attachments using business-themed social engineering. The first stage deployed obfuscated JavaScript or VBScript, which fetched a PowerShell script that in turn downloaded a steganographic image from legitimate platforms like archive.org.
Steganography and Fileless Execution
Caminho uses LSB steganography inside image files like JPGs or PNGs, to hide a payload. The PowerShell script extracts the embedded .NET loader from the image, loads it directly into memory without writing to disk and injects it into a legitimate Windows process such as calc.exe. Researchers described the technical routine stating, “[the script] loads the extracted BMP as a Bitmap object and iterates through every pixel… these color channel values encode the concealed binary data.”
This “fileless” execution model helps evade traditional disk-based detection. Persisting via scheduled tasks named “amandes” or “amandines”, the loader continues even after reboots.
Delivery Infrastructure and Payload Diversity
The delivery chain is modular. After the loader executes, it fetches final-stage malware via URLs passed as arguments. Payloads already observed include the commercial remote access trojan REMCOS RAT, XWorm and credential-stealer Katz Stealer.
By reusing steganographic images and C2 infrastructure across campaigns, the operation mirrors a LaaS (Loader-as-a-Service) business model. One example: the image file “universe-1733359315202-8750.jpg” appeared in multiple campaigns with different payloads.
Their infrastructure is likewise cleverly designed. The campaign leverages legitimate services like Archive.org to host stego-images and paste-style services, like paste.ee, pastefy.app, for script staging, blending malicious content amid benign traffic. For command and control the campaign used domains such as “cestfinidns.vip” on AS214943 (Railnet LLC), known for bullet-proof hosting.
Caminho poses challenges to defenders because:
-
Steganographic images evade signature-based detection and appear harmless.
-
Fileless execution avoids writing payloads to disk, limiting forensic traceability.
-
The modular service architecture allows multiple malware families at scale.
-
Use of legitimate hosting and staging reduces network-based red flags.
-
Portuguese-language artifacts and targeting in Brazilian business hours suggest regional origin, but infrastructure supports global operations.
Caminho demonstrates how modern loaders blend legacy attack crafts—script drop from phishing, process injection and sleeper tasks—with advanced evasion via steganography and service-like architectures. As the campaign expands its geography and payload support, organizations in targeted regions—particularly South America, Africa and Eastern Europe—should assume exposure, hunt proactively and validate the integrity of image files, download origins and process trees.
