Search: “Windows 11”

2 stories in the last 3d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Malware 5 Vulnerability 4 Industry 3 Threat actor 3 Advisory 3 AI industry 2 Research 2 Data breach 2 Tools 1 Phishing & fraud 1 AI safety & security 1 AI tools & infra 1 AI research 1 Policy & legal 1

SeverityAll critical 0 high 10 medium 9 low 2 info 10

APT36 Targets Indian Government and Defense Organizations With New Rust Malware Arsenal

Pakistan-linked APT36 deployed a Rust malware suite, including RUSTYSHADE and USB-spreading RUSTYMOVE, against Indian and Afghan government and defense targets.

Zscaler ThreatLabz tracks the August 2026 activity as Operation RapidRust, introducing the Rust-based RUSTYSHADE backdoor, the RUSTYMOVE removable-media propagation utility, and PSNATCH and BASHNATCH file stealers for Windows and Linux. RUSTYSHADE uses private GitHub repositories as C2 with AES-256-GCM-encrypted traffic, supporting shell commands, screenshots, webcam capture, and encrypted exfiltration, while PSNATCH collects Office documents, archives, images, and databases from user folders and drives D: through H:. Typosquat domains spoofing ThePrint and India Today staged payloads with Backblaze storage, and persistence used scheduled tasks impersonating OneDrive and Microsoft Edge updates.

GBHackersupdated 10:17 UTC · 3h agofirst 09:42 UTC · 3h agoThreat actor in the wild 3 sources

FamousSparrow Exploits Public-Facing Exchange Servers to Deploy SparroWocky Backdoor

ESET attributes a new SparroWocky backdoor to espionage group FamousSparrow, deployed via exploited internet-facing Exchange servers across Latin American governments.

ESET's Welivesecurity team reports FamousSparrow gained initial access by exploiting publicly reachable Microsoft Exchange servers, with roughly 90 percent of targets since mid-2025 in Latin America, including governments in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. The group's new modular C-language backdoor SparroWocky replaces SparrowDoor and uses a three-part loader: a legitimate executable, a malicious DLL side-loaded in memory, and an encrypted payload. It persists via Windows services or Registry Run keys, supports screenshots, file operations, TCP proxying, Beacon Object Files, TLS/RC4-encrypted C2, and anti-forensics such as call-stack spoofing. IOCs including loader SHA-1 hashes and C2 IP addresses were published.

Cyber Security News11:20 UTC · 1h agoThreat actor in the wild 3 sources