60
60
60
60
60
60
60
60
60
60
60
60
60
60
Week in review: ChatGPT as an infosec assistant, Google offers help to EU cybersecurity startups
60
57
60
60
60
60
60
60
60
60
60
HVNC Backdoor Targets LATAM Organizations with Fake Tax and DocuSign Lures
A custom HVNC backdoor is targeting Latin American financial organizations via fake DocuSign and NFe tax-document lures, giving attackers hidden persistent remote access.
ANY.RUN researchers analyzed a multi-stage phishing campaign delivering a custom HVNC backdoor to banking and financial organizations in Latin America. The chain starts with fake DocuSign and NFe tax-document pages that serve per-visitor ZIP archives, followed by an LNK dropper, an NSIS loader, and a 64-bit backdoor masquerading as Windows Update Assistant. The implant provides hidden remote desktop control, keystroke monitoring, Firefox data theft, Startup-folder persistence, and EDR-aware behavior, communicating over TCP/27015.
55
60
60
60
60
60
60
60
60
Cyclops Blink Evolves Into x86-64 Linux Implant With Packet Sniffing and Internal Network Scanning
Sophos uncovers a new x86-64 Cyclops Blink Linux implant with packet sniffing and internal network scanning on compromised Cisco FMC appliances.
Sophos identified a 64-bit Linux Cyclops Blink implant in August on compromised Cisco Firewall Management Center devices, persisting via SysV init scripts and masquerading as the process 'kworker01'. The modular malware runs five child processes for reconnaissance, file transfer, scanning, packet capture, and persistence, and beacons hourly over outbound TLS to hardcoded C2 89.34.96.56 on ports 43856 and 49172. The family was previously tied to Russian-linked Sandworm activity on WatchGuard appliances, though Sophos treats 2026 attribution cautiously. The packet-capture module applies configurable filters to retain credentials, cookies, and authentication tokens from raw Ethernet traffic.
70
Hackers Abuse AutoIt to Inject AsyncRAT Into Microsoft-Signed Windows Process
Attackers use AutoIt and an invoice-themed batch file to inject AsyncRAT into Microsoft-signed charmap.exe for stealthy remote access.
Point Wild Threat Intelligence documented a five-stage campaign starting with 'Right-click to open Invoice Details.bat' that launches hidden PowerShell, drops a renamed AutoIt interpreter and encrypted loader into a random Temp folder, and persists via a Startup-folder batch file. The loader decrypts AsyncRAT only in memory and injects it into the Microsoft-signed charmap.exe (Windows Character Map) process, leaving no payload file on disk. The final payload patches AMSI inside the infected process and includes screen-capture code that prepares images for transfer to a command-and-control server at 158[.]51[.]122[.]136:4944.
30
60
60
60
60