30
Adobe security advisory (AV26-848)
Canada's Cyber Centre relayed Adobe advisories covering vulnerabilities in Campaign Classic, Substance 3D apps, Adobe XD, Illustrator, and C2PA tools.
Bulletin AV26-848 lists Adobe vulnerabilities affecting Campaign Classic (through 7.4.4 build 9400), Substance 3D Designer, Painter, and Sampler, Adobe XD, C2PA Tool, Content Credentials Rust SDK, and Illustrator 2025/2026. The Canadian Centre for Cyber Security encourages users and administrators to review the linked Adobe bulletins and apply updates. Specific CVE identifiers are not enumerated in the advisory text.
28
30
30
Network Abuses Leveraging High-Profile Events: Suspicious Domain Registrations and Other Scams
Unit 42 found scammers surge deceptive domain registrations around major events like the 2024 Paris Olympics to run phishing and counterfeit merchandise scams.
Unit 42 analyzed newly registered domains (over 200,000 detected daily from zone files, WHOIS, and passive DNS) containing event-specific keywords, using the 2024 Paris Summer Olympics as a case study. Threat actors register lookalike domains to sell counterfeit merchandise, push fraudulent services, and run phishing, as previously seen with COVID-19-themed and fake ChatGPT tool scams. The article recommends monitoring domain registrations, DNS and URL traffic trends, textual patterns, and verdict change requests to catch event-themed abuse early.
35
30
45
30
30
30
30
45
30
45
30
30
30
30
30
30
30
30
45
30
30
30
30
30
30
30
30
45
30
45
30
30
Scam Attacks Taking Advantage of the Popularity of the Generative AI Wave
Unit 42 finds about 225 generative AI-themed domains registered daily since ChatGPT's launch, with nearly 29 percent suspicious, fueling scams and PUP delivery.
Palo Alto Networks analyzed new domain registrations containing generative AI keywords such as chatgpt, prompt, and sora since ChatGPT's November 2022 launch, observing around 225 GenAI-related registrations per day. About 28.75 percent of these domains are suspicious, a rate 22 times higher than for general new domains, with registration spikes aligning with milestones like Bing ChatGPT integration, the GPT-4 release, new GPTs, and OpenAI's Sora announcement. Over 72 percent of the domains use gpt or chatgpt keywords, and gpt domains show a 76 percent suspicious rate. Case studies cover PUP delivery, spam distribution, and monetized domain parking, with 35 percent of traffic to these domains directed at suspicious ones.
38
The Gopher in the Room: Analysis of GoLang Malware in the Wild
Unit 42 analysis of 10,700 Go-compiled malware samples shows steady growth in the wild, with 92% targeting Windows and top families including Veil, GoBot2, and HERCULES.
Unit 42 collected roughly 10,700 unique Go-compiled malware samples and found that Go usage by malware developers has steadily risen in recent months. About 92% of samples targeted Windows and 75% were attributed to known families, led by Veil, GoBot2, and HERCULES. The most prevalent groupings were penetration testing tools, remote access Trojans, and backdoors. Statically linked Go binaries average 4.65MB, which can complicate phishing delivery but sometimes causes antivirus products to skip or fail scanning.
45
Mole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics
Unit 42 tracks the new Mole ransomware (CryptoMix family) spread via USPS-themed malspam, with tactics escalating to JavaScript downloaders dropping multiple malware families.
On April 11, 2017, a malspam campaign began distributing Mole ransomware, a CryptoMix-family strain, through USPS-themed emails linking to fake Microsoft Word Online sites offering a bogus Office plugin. By April 13 the campaign added Nemucod JavaScript downloaders installing Mole alongside Kovter and Miuref, and by April 18 it switched to the KINS banking Trojan before moving to speeding-ticket themes and a fake parking services website. Unit 42 notes the rapid tactic changes are likely intended to evade detection, and CryptoMix variants like Mole are typically repackaged within weeks.
27
Tech contractor for Brightly Software sentenced to 2 years in prison for insider attack
Cameron Curry sentenced to two years for stealing Brightly Software employee data and extorting the Siemens-owned firm for $7,540.92.
Cameron Nicholas Curry, a 27-year-old data analyst contractor at Siemens-owned Brightly Software, stole corporate and sensitive payroll data between August and December 2023 and sent more than 60 threatening emails to employees after his contract ended. He demanded roughly $2.5 million but received $7,540.92 in late January 2024, and was convicted of six counts of extortion in March. He was sentenced to two years in prison plus one year of supervised release, less than the 12-year maximum, after investigators traced him via operational security mistakes including a Coinbase account linked to family debit cards.
28