My Courses
-
Akira and Lynx ransomware are targeting Managed Service Providers (MSPs) by exploiting stolen login credentials and existing vulnerabilities.
Two sophisticated ransomware operations, Akira and Lynx, have emerged as significant threats to Managed Service Providers (MSPs) and small businesses. These ransomware-as-a-service (RaaS) groups have collectively compromised over 365 organisations, showcasing their effectiveness in targeting high-value infrastructure providers that serve multiple clients. Since its emergence in 2022, the Akira ransomware group has evolved into one…
-
Lazarus Hackers deceive users into thinking their camera or microphone is disabled in order to deploy the PyLangGhost RAT.
Cybersecurity researchers have recently identified a new social engineering campaign linked to North Korea’s Lazarus Group, which exploits fake camera and microphone errors to manipulate targets into executing malicious scripts. Victims, mainly from the finance and technology sectors, report receiving invitations for remote job interviews or technical assessments that suddenly freeze, displaying messages indicating that…
-
Fraudulent VPN and spam blocking applications associated with VexTrio are being utilized for advertisement deception and subscription scams.
VexTrio Viper, a malicious ad tech purveyor, has been identified as the developer behind several deceptive applications that have been published on both Apple and Google’s official app storefronts. These applications, which masquerade as useful tools such as VPNs, device monitoring apps, RAM cleaners, dating services, and spam blockers, have been downloaded millions of times.…
-
Google’s Salesforce accounts have been compromised in a continuing cyber attack, resulting in the theft of user information by hackers.
Google confirmed that one of its corporate Salesforce instances was compromised in June by the threat group tracked as UNC6040. This incident forms part of a broader Salesforce attack campaign involving voice phishing attacks aimed at stealing sensitive data from organisations’ Salesforce environments, followed by extortion demands. The breach underscores the increasing risks associated with…
-
Trend Micro has released patches for vulnerabilities in Apex One that were being exploited in the wild.
Trend Micro has swiftly addressed two critical zero-day vulnerabilities in its Apex One security solution, which may have been actively exploited by Chinese threat actors. These vulnerabilities posed significant risks, potentially allowing unauthorised access and manipulation of systems protected by Apex One. The urgency of the patch highlights the ongoing threat landscape and the need…
-
According to Meta, WhatsApp has removed 6.8 million accounts associated with criminal scam operations.
Meta has reported that it linked a series of scams to a criminal scam centre operating in Cambodia. The company announced that it successfully disrupted this extensive campaign, which involved the collaboration with OpenAI, the creator of ChatGPT. This initiative led to the removal of approximately 6.8 million accounts from WhatsApp that were associated with…
-
Mustang Panda is targeting Windows users with malware known as ToneShell, which disguises itself as Google Chrome.
A sophisticated new cyber campaign has emerged, targeting Windows users through a deceptive malware variant known as ToneShell, which masquerades as the legitimate Google Chrome browser. The advanced persistent threat (APT) group Mustang Panda, recognised for its strategic targeting of government and technology sectors, has deployed this latest tool as part of an ongoing espionage…
-
PLoB: A Framework for Behavioral Fingerprinting to Detect Malicious Login Attempts.
Splunk researchers have developed an innovative system designed to fingerprint post-logon behaviour, leveraging artificial intelligence to detect subtle signals indicative of potential intrusions. This framework, known as PLoB (Post-Logon Behaviour), aims to enhance security measures by identifying malicious logins that traditional methods may overlook. By analysing user actions after they have logged in, the system…
-
Malicious actors exploit smart contracts to siphon over $900,000 from user cryptocurrency wallets.
In early 2024, a sophisticated campaign emerged, revealing that cybercriminals were distributing malicious Ethereum smart contracts disguised as lucrative trading bots. These weaponised contracts utilised Web3 development platforms like Remix to lure victims into deploying code that ostensibly executed arbitrage strategies, only to redirect deposited funds into wallets controlled by attackers. Rather than conducting legitimate…
-
Threat actors are using Generative AI to carry out phishing attacks by impersonating government websites.
Cybercriminals have significantly advanced their phishing operations by leveraging generative artificial intelligence tools to create highly convincing replicas of government websites. A recent campaign targeting Brazilian citizens illustrates how threat actors exploit AI-powered platforms such as DeepSite AI and BlackBox AI to fabricate authentic-looking duplicates of official portals, specifically impersonating Brazil’s State Department of Traffic…