ZeroHour

Search: “Defender”

2,006 stories

Ukrainian software developer faces 12 years in Swiss ransomware trial

Swiss prosecutors seek a 12-year sentence for a Ukrainian developer accused in LockerGoga, MegaCortex and Nefilim ransomware attacks causing roughly $160 million in losses.

A 52-year-old Ukrainian software developer went on trial at Zurich District Court over alleged involvement in ransomware attacks using LockerGoga, MegaCortex and Nefilim, with victims including Stadler Rail, Crealogix and Meier Tobler. Prosecutors allege he participated in attacks on 10 companies between December 2018 and May 2020, causing more than 130 million Swiss francs (~$160 million) in losses, and seek a 12-year sentence plus 1.8 million Swiss francs in proceeds. He denies developing malware, and his defense challenges digital evidence handling. The case ties to Oleksandr Ieremenko, who allegedly directed the attacks, was said to have FSB protection, and died falling from a Moscow window in 2022.

The Record · 29d agoPolicy & legal in the wild1

Mustang Panda Upgrades CoolClient With a Kernel Rootkit

Mustang Panda's updated CoolClient backdoor deploys a signed kernel driver to hide processes, files and network activity in Asian intrusions.

Kaspersky analysis shows Mustang Panda (HoneyMyte) upgraded its CoolClient espionage backdoor with a signed kernel-mode driver installed as a Windows service, communicating via IOCTL requests to hide processes, files and registry entries. In a Myanmar campaign the actor deployed PlugX first, then CoolClient via a fake Windows Defender directory and Sangfor defender.exe DLL sideloading, with scheduled task and AutoRun persistence and UAC bypass. The updated variant was observed in intrusions across Pakistan, Mongolia and Myanmar, with victims also in Russia including confirmed government entities.

Security Affairs · Aug 16, 2026Threat actor in the wild1