Search: “utilization”

6 stories in the last 3d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Threat actor 11 Data breach 10 Malware 9 AI industry 8 Advisory 6 AI safety & security 6 AI research 5 Vulnerability 4 Exploit / PoC 4 Research 4 Industry 2 Policy & legal 1 Ransomware 1 Phishing & fraud 1

SeverityAll critical 4 high 31 medium 13 low 0 info 27

Hackers Abuse VSSAdmin to Extract NTDS.dit and Delete Windows Recovery Copies

Huntress details intruders using PsExec and VSSAdmin on domain controllers to steal NTDS.dit credentials and delete shadow copies before ransomware.

Huntress analysts identified attackers launching SYSTEM-level command shells via PsExec on a domain controller, then running 'vssadmin create shadow' to snapshot and copy the NTDS.dit Active Directory database. Shadow copies were later deleted to destroy local recovery options ahead of a likely ransomware stage. Huntress recommends correlating VSS creation/deletion events with remote execution, DNS enumeration, and lateral movement rather than alerting on any single VSS event.

Cyber Security NewsSep 15, 08:29 UTC · 2d agoThreat actor in the wild

APT36 Uses USB-Spreading Malware to Reach Air-Gapped Government Networksnew

Zscaler attributes the RapidRust campaign by Pakistan-linked APT36 to USB-propagating Rust malware targeting air-gapped government networks in India and Afghanistan.

Zscaler identified in August 2026 a campaign tracked as RapidRust in which APT36 uses infected removable drives to reach air-gapped government environments in India and Afghanistan. RUSTYMOVE, a Rust USB-spreading utility, copies a fake-PDF shortcut and the RUSTYSHADE backdoor to removable media; RUSTYSHADE uses attacker-controlled private GitHub repositories for C2, running shell commands, capturing screenshots and webcam images, while PSNATCH and BASHNATCH steal files. Operators enumerated users, shares, and remote administrative shares to expand beyond initial victims, with payloads staged on lookalike domains mimicking Indian media outlets and Backblaze B2 storage.

Cyber Security News10:17 UTC · 15m agoThreat actor in the wild 3 sources

Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers

Kaspersky details NightEagle, Hacking Cat, and Toy Ghouls targeting Russian enterprises with Exchange backdoors, Gorilla RAT, and destructive Monkey ransomware.

Kaspersky reports three threat clusters targeting Russian enterprises: NightEagle (APT-Q-95), the pro-Ukrainian hacktivist group Hacking Cat, and Toy Ghouls. NightEagle uses compromised VPN credentials and the GhostContainer modular backdoor to fully compromise Microsoft Exchange servers, chaining CVE-2020-0688 exploitation, BlueKeep (CVE-2019-0708), Active Directory vulnerabilities, and DCSync to seize domain controllers. Hacking Cat exploits Exchange flaws including CVE-2021-26855 and CVE-2026-42897 to deliver the Gorilla RAT and multiple Monkey ransomware variants written in Rust, .NET, C++, and Golang targeting Windows, Linux, and VMware ESXi, with some variants acting as wipers that never store the encryption key.

The Hacker Newsupdated 07:55 UTC · 2h agofirst Sep 16, 15:27 UTC · 19h agoThreat actor in the wild 5 sources CVE-2020-0688 CVE-2019-0708 CVE-2021-26855+1 CVEs1

Iranian hackers use CHOSEN BRICK data-stealing malware to spy on dissidents and journalists

UK NCSC, FBI and Dutch AIVD warn Iranian state hackers deploy CHOSEN BRICK spyware via WhatsApp and Telegram lures against dissidents and journalists since 2025.

The UK's NCSC, the FBI and the Netherlands' AIVD jointly warned that Iranian state cyber actors have deployed CHOSEN BRICK against dissidents, activists and journalists in the UK, US and Netherlands since at least 2025. Victims are contacted on WhatsApp or Telegram by impostors posing as known contacts or platform support, then tricked into running files disguised as software such as fake Norton Antivirus, KeePass, Telegram or MRI scan results. The Windows malware adds Microsoft Defender exclusions, persists via HKCU Run keys, uses per-device Telegram bots for C2, and can capture screens, activate microphones, steal email and messaging data, and download further payloads. Some stolen data has later appeared on pro-Iranian leak sites, and the agencies note Iranian intelligence has plotted kidnappings or lethal operations against targets abroad.

Help Net Securityupdated 07:25 UTC · 3h agofirst Sep 16, 09:06 UTC · 1d agoThreat actor in the wild 7 sources

Iranian spies hit Windows machines with Chosen Brick data-stealing malware

FBI, UK NCSC, and Dutch AIVD warn Iranian intelligence uses Chosen Brick spyware against dissidents, stealing contacts, emails, and messaging data.

A joint advisory from the FBI, UK NCSC, and Dutch AIVD says Iranian state cyber actors have used the Chosen Brick Windows malware since at least 2025 to surveil dissidents, activists, and journalists. Attacks begin with heavily researched WhatsApp and Telegram messages impersonating trusted contacts, tricking victims into opening fake installers resembling Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, and KeePass. The malware persists via the HKCU Run registry key, adds Microsoft Defender exclusions, uses victim-specific Telegram bots for C2, captures screen and audio, steals emails and Telegram/WhatsApp data, and can wipe systems.

The Register · SecuritySep 15, 18:01 UTC · 1d agoThreat actor in the wild1

Red Heron Hackers Exploit Critical Gitea RCE to Steal Source Code and Deploy Linux Rootkit

PRC-linked Red Heron exploits critical Gitea RCE CVE-2026-60004 to steal source code and deploy JITTERLY implant with SIXZUT LD_PRELOAD rootkit; victims span five countries.

Acronis Threat Research Unit attributes a campaign to Chinese-speaking threat actor Red Heron, which weaponized CVE-2026-60004, a CVSS 9.8 RCE in Gitea versions 1.17 through 1.27.0, patched in 1.27.1 on July 27, 2026. The actor built an automated exploitation framework after a public PoC appeared, scanned 1,386 internet-exposed Gitea instances across seven countries, and separately listed 477 Taiwan-based systems across defense, energy, elections, and AI sectors. Confirmed victims include organizations in Canada, Argentina, Taiwan, the US, and Sri Lanka, with a Canadian renewable-energy firm hit in 22 sessions and a Taiwanese industrial automation firm losing hundreds of repositories including SCADA/HMI tools. Red Heron deploys the JITTERLY Linux implant (30+ commands, AES-128-GCM, Adaptix-like protocol) and the SIXZUT LD_PRELOAD rootkit disguised as libglthread.so.2, and moved laterally into a Synology/Proxmox environment to steal VM backups.

GBHackersSep 15, 11:16 UTC · 1d agoThreat actor in the wild 3 sources CVE-2026-6000410