Mozilla Firefox (Product): news timeline & CVEs

UAC-0099 Targets Ukrainian Government Personnel With ASHVEIN RAT Hiding Commands in HTML

Russia-aligned UAC-0099 deployed the ASHVEIN RAT against Ukrainian government staff, hiding tasking in HTML.

TrendAI attributes a new .NET infostealer and RAT, ASHVEIN (internally TelemetryBrowser), to Russia-aligned UAC-0099, also tracked as Earth Sirrush, in attacks on Ukrainian government personnel. ASHVEIN steals Chrome and Firefox credentials, captures screenshots, collects files, runs PowerShell, and hides tasking in invisible HTML, with a GitHub dead-drop fallback. Delivery includes DLL sideloading, VHD containers, and a National Police of Ukraine decoy. ESET also reported a VBScript that embeds a prohibited-weapons prompt to trip LLM safety filters and hinder analysis of the MATCHBOIL loader.

The Hacker NewsOct 8, 15:26 UTC · 9h agoThreat actor in the wild 3 sources

CLOSEDQUORUM, the malware that asks four AI models what to do next

Cisco Talos says CLOSEDQUORUM lets four commercial AI models vote on credential and wallet theft.

Cisco Talos documented CLOSEDQUORUM, a Windows implant that sends host context to DeepSeek, Qwen, Mistral, and Google Gemini and executes the majority vote among steal, inject, persist, or move. The steal path dumps LSASS credentials, saved passwords from Chrome, Edge, and Firefox, and wallets such as MetaMask and Exodus, then exfiltrates AES-256-GCM data through a Discord webhook. The public sample is inert with placeholder API keys, while development builds embed real credentials. Talos found it with the CAIRN toolkit and linked artifacts to carding-forum posts from 2025.

Security AffairsSep 24, 05:44 UTC · 14d agoMalware

Mozilla Firefox

Timeline2 articles

Appears with

UAC-0099 Targets Ukrainian Government Personnel With ASHVEIN RAT Hiding Commands in HTML

CLOSEDQUORUM, the malware that asks four AI models what to do next