Search: “systematicity”

256 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Exploit / PoC 2946 Ransomware 1196 Policy & legal 787 Data breach 691 Malware 560 Vulnerability 525 Threat actor 431 Phishing & fraud 283 Research 52 AI safety & security 45 Industry 40 AI research 36 Advisory 24 Model release 9

SeverityAll critical 6680 high 366 medium 258 low 213 info 131

Exploring the Latest Mispadu Stealer Variant

Unit 42 found a new Mispadu infostealer variant targeting Mexican users via malicious .url files exploiting the SmartScreen CVE-2023-36025 bypass.

Unit 42 discovered a new variant of Mispadu Stealer, a Delphi-based banking trojan first reported in 2019, found while hunting for the Windows SmartScreen bypass CVE-2023-36025. The campaign uses crafted .url files referencing UNC network-share paths with an HTTP port (@80) that forces payload retrieval over WebDAV via rundll32.exe, avoiding SmartScreen warnings. Analyzed samples (~4 KB, compiled 2023-11-12) predate the CVE publication, and ZIP payloads were likely distributed as email attachments, primarily targeting users in Mexico.

Palo Alto Unit 42Aug 17, 11:46 UTC · Aug 17, 2026Malware in the wildCVE-2023-360251

Fake CVE-2023

A fake PoC for WinRAR RCE CVE-2023-40477 posted on GitHub actually deploys VenomRAT through a multi-step infection chain targeting researchers.

Four days after Zero Day Initiative publicly disclosed the WinRAR RCE vulnerability CVE-2023-40477 on August 17, 2023, an actor using the alias whalersplonk published a fake proof-of-concept on GitHub. The Python script actually repurposed public PoC code for GeoServer SQL injection CVE-2023-25157 and triggered an infection chain ending in VenomRAT. The README and an accompanying video lured users into running the script; the video drew over 100 plays. Unit 42 assesses the actor was opportunistic, targeting other miscreants adopting new vulnerabilities rather than researchers specifically.

Palo Alto Unit 42Aug 17, 10:57 UTC · Aug 17, 2026Malware CVE-2023-40477 CVE-2023-25157

Stately Taurus Activity in Southeast Asia Links to Bookworm Malware

Unit 42 links Stately Taurus APT activity in ASEAN region and Myanmar to the decade-old Bookworm malware family via infrastructure overlaps.

Unit 42 connected Stately Taurus (aka Mustang Panda) espionage activity targeting ASEAN-affiliated organizations and Myanmar to the Bookworm malware family, first published in 2015. Earlier attacks delivered the PubLoad stager via DLL sideloading, with a PubLoad variant communicating with C2 at 123.253.32[.]15 while mimicking Windows Update URLs. Three previously unreported loader samples from 2021-2022 used UUID-decoded shellcode loaded via heap allocation and API callbacks, ultimately decrypting and loading Bookworm DLLs. A ToneShell backdoor variant shared debug paths with Bookworm loaders, and the January 2024 CSIRT CTI post corroborated the Myanmar attacks.

Palo Alto Unit 42Aug 17, 10:54 UTC · Aug 17, 2026Threat actor in the wild1

Ukrainian police raid 94 fraudulent call centers, seize $2 million

Ukrainian police raided 94 fraudulent call centers impersonating banks and brokers, seizing about $2 million and thousands of devices.

Ukraine's National Police, with the Security Service of Ukraine and Prosecutor General's Office, executed 400-plus searches across 867 addresses, dismantling 94 call centers used for bank-impersonation, fake investment, and crypto-platform fraud. Seizures included 3,336 pieces of computer equipment, 1,346 phones, over 5,200 SIM cards, 20 crypto wallets, and about $2 million, 64,000 euros, and a kilogram of gold. 26 people were named as suspects under fraud and money laundering charges carrying up to 12 years in prison, and one group defrauded EU citizens with German authorities cooperating.

Help Net SecurityAug 14, 00:00 UTC · Aug 14, 2026Phishing & fraud

Kimwolf botnet rebuilt to survive takedowns, researchers say

Palo Alto Unit 42 reports the Kimwolf/Aisuru botnet now uses HTTP/2 Chrome-impersonation floods and Ethereum blockchain-based command resolution to survive takedowns.

Palo Alto Networks' Unit 42 says a new Kimwolf/Aisuru botnet version active since February conducts DDoS floods over HTTP/2 with full Chrome browser fingerprints, making attack traffic hard to distinguish from real users. The malware resolves command servers via the Ethereum Name Service using five shuffled Ethereum endpoints, with a Tor hidden service fallback, so authorities cannot seize a domain or serve a takedown order. The botnet, powered mostly by hijacked Android TV boxes and IoT devices, previously had servers seized and an alleged operator arrested; new C2 infrastructure traces to a single network in Saint Petersburg, Russia. It is unclear whether the same developers built the new version.

CyberScoopAug 12, 00:13 UTC · Aug 12, 2026Malware in the wild1

DeadLock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt

Microsoft reports DeadLock ransomware using Polygon smart contracts and Session messaging for extortion infrastructure, claiming 96 victims across Europe and the U.S.

Microsoft Threat Intelligence reports the DeadLock ransomware operation uses the Session messaging network and Polygon blockchain smart contracts to host victim chat, proxy server addresses, and its data leak blog, making takedowns harder. First detected in July 2025, the group has claimed 96 victims, mostly in Italy, Spain, Poland, Türkiye, and the U.S., with deployments by affiliates of Lynx and INC ransomware. The encryptor uses Curve25519 with XChaCha20, drops an interactive HTML recovery chat application, geofences CIS-linked countries, and clears logs and shadow copies to evade forensics.

The Hacker NewsAug 11, 18:08 UTC · Aug 11, 2026Ransomware in the wild