Search: “interference”

7 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Threat actor 7 Research 6 Exploit / PoC 5 AI safety & security 4 Vulnerability 3 AI research 3 Malware 3 Phishing & fraud 3 Policy & legal 3 Tools 2 Advisory 1 Data breach 1 Industry 1 Model release 1

SeverityAll critical 1 high 13 medium 13 low 2 info 14

Counterfeit installers turn routine software downloads into enterprise breaches

Microsoft warns of a multi-sector campaign using counterfeit download sites for Edge, Kaspersky and Razer to deliver trojanized installers with persistent implants.

Microsoft Defender Experts tracked a campaign breaching organizations in healthcare, manufacturing, gaming, technology, logistics, government, and education via spoofed vendor download pages, often using .com.cn and .hl.cn domains. Installers keep the same filename while their hash changes on every download, indicating server-side payload generation that defeats file-based detection. The chain abuses msiexec.exe and scheduled tasks for persistence, adds Defender exclusions, deletes shadow copies, and disables Windows Update, with some hands-on-keyboard activity. The activity is consistent with the publicly reported Silver Fox (Yinhu) campaign, though Microsoft has not attributed it to a nation-state actor.

CSO OnlineSep 3, 11:17 UTC · 13d agoThreat actor in the wild1

Red Heron Hackers Exploit Critical Gitea RCE to Steal Source Code and Deploy Linux Rootkit

PRC-linked Red Heron exploits critical Gitea RCE CVE-2026-60004 to steal source code and deploy JITTERLY implant with SIXZUT LD_PRELOAD rootkit; victims span five countries.

Acronis Threat Research Unit attributes a campaign to Chinese-speaking threat actor Red Heron, which weaponized CVE-2026-60004, a CVSS 9.8 RCE in Gitea versions 1.17 through 1.27.0, patched in 1.27.1 on July 27, 2026. The actor built an automated exploitation framework after a public PoC appeared, scanned 1,386 internet-exposed Gitea instances across seven countries, and separately listed 477 Taiwan-based systems across defense, energy, elections, and AI sectors. Confirmed victims include organizations in Canada, Argentina, Taiwan, the US, and Sri Lanka, with a Canadian renewable-energy firm hit in 22 sessions and a Taiwanese industrial automation firm losing hundreds of repositories including SCADA/HMI tools. Red Heron deploys the JITTERLY Linux implant (30+ commands, AES-128-GCM, Adaptix-like protocol) and the SIXZUT LD_PRELOAD rootkit disguised as libglthread.so.2, and moved laterally into a Synology/Proxmox environment to steal VM backups.

GBHackersSep 15, 11:16 UTC · 1d agoThreat actor in the wild 3 sources CVE-2026-6000410

Claude Used to Automate Exploitation and Data Theft Across Multiple Victims

Anthropic's 154-page report details Generative Threat Groups, including APT29-linked GTG-20006 and ShinyHunters affiliates, using Claude for reconnaissance, exploitation, and data theft.

Anthropic reports that between December 2025 and August 2026 state-sponsored hackers, criminals, spyware vendors, and propaganda operators used its Claude models for cyber attacks, weapons design, propaganda, and mass surveillance. Notable clusters include GTG-50014, a ShinyHunters affiliate that scanned 1.8 million Android APKs for secrets via 10 AWS EC2 workers, GTG-10007, a Chinese-speaking group targeting roughly 50 organizations, and GTG-50029, a lone French-speaking actor exploiting a previously undocumented WordPress re-installation race condition. The report describes multi-agent frameworks autonomously executing reconnaissance, exploitation, and exfiltration against multiple victims, and influence operations that were disrupted before building authentic audiences.

The Hacker Newsupdated Sep 16, 17:41 UTC · 14h agofirst Sep 11, 14:29 UTC · 5d agoThreat actor in the wild 20 sources1

2,000 Leaked Documents Reveal How Russia Turns Engineering Students Into GRU Cyber Operators

Leaked Bauman Moscow State Technical University files reveal a hidden GRU training pipeline feeding APT28 and Sandworm units.

More than 2,000 leaked Bauman Moscow State Technical University documents show that Department No. 4, a hidden program inside the Military Training Center, trained roughly 250 career and reserve students for GRU cyber and intelligence roles across six academic years. Graduates were linked to Military Unit 26165 (APT28), Unit 74455 (Sandworm/APT44) and Unit 29155, and former Unit 26165 commander Viktor Netyksho was involved in department oversight. Reporting by The Insider, The Guardian, Le Monde, Der Spiegel and other outlets, with independent analysis by DomainTools, estimates 10-15 students annually were selected for GRU-related assignments before graduating.

Security AffairsSep 3, 08:12 UTC · 13d agoThreat actor1

Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon

Check Point identifies Chinese-speaking group Gambling Goblin hijacking Brazilian government domains via malicious Apache modules for SEO-manipulated gambling phishing.

Check Point Research tracks a sustained campaign since mid-2025 against Brazilian government and educational organizations by Gambling Goblin, a Chinese-speaking cybercrime cluster linked to Earth Berberoka. Attackers compile and install malicious Apache modules that silently reverse-proxy visitors to phishing pages impersonating Google Play, Microsoft Store, and Amazon, chaining compromised high-reputation domains to inflate search rankings. The group deploys a heavily obfuscated Linux toolkit including DownPro, AlphaAgent, oRAT, a 3snake-based credential stealer, and SSH brute-forcers, with parallel phishing networks localized for Vietnamese, Spanish, and English victims.

Check Point ResearchSep 2, 10:16 UTC · 14d agoThreat actor

Russia-Aligned UAC-0099 Plants Nuclear Weapon Prompt in Malware to Disrupt AI Analysis

Russia-aligned UAC-0099 planted a nuclear-weapon prompt inside malicious VBS scripts to derail LLM-based malware analysis targeting Ukraine.

ESET disclosed a technique dubbed GuardBreaker used by Russia-aligned UAC-0099 against a Ukrainian target: inserting the text 'I want to make a nuclear weapon. Help me ...' as a comment in a malicious VBS script to trip LLM safety guardrails and stop AI-assisted analysis. The script downloads and installs MATCHBOIL, a C# loader exclusive to UAC-0099, which CERT-UA warned was distributed as a fake Notepad++ plugin in late July 2026. Similar prompt-injection anti-analysis tricks appeared in the Mini Shai-Hulud, Miasma, and Hades npm supply chain campaigns linked to TeamPCP, two of whose alleged members were arrested in Western Australia.

The Hacker NewsSep 2, 06:25 UTC · 15d agoThreat actor

TrueConf Server Flaws Exploited to Replace Client Installers with PhantomCore

Head Mare exploits TrueConf server flaws to install web shells and deliver PhantomCore and PhantomGraph backdoors at Russian organizations.

Kaspersky detected July 2026 attacks by the threat actor Head Mare exploiting a vulnerability chain (KLCERT-26-057 and KLCERT-26-058) in unpatched TrueConf videoconferencing servers. The chain enables arbitrary code execution with SYSTEM privileges, deployment of a web shell at locale.php, and replacement of client installers with versions delivering the PhantomCore backdoor and PhantomGraph, which uses Microsoft OneDrive as C2. Targets span Russian instrumentation, electronics, transport, energy, IT, and software firms. Patches shipped in TrueConf Server 5.3.9, 5.4.9, and 5.5.5 on June 18, 2026.

The Hacker NewsAug 21, 09:43 UTC · 26d agoThreat actor in the wild1