DanaBot Returns: Windows Campaign Resumes After Six-Month
DanaBot restarted Windows campaigns after a six-month break. Consequently, teams tighten email defenses, inspect loaders, and hunt for fresh C2 as affiliates pivot tooling.
Tag: malware
Read More
GootLoader’s comeback: hidden filenames, ZIP-JS payloads
GootLoader reappeared with custom WOFF2 web-fonts that swap glyph shapes, so a gibberish string in source renders as a harmless-looking filename in the browser. Consequently, victims on SEO-poisoned WordPress sites download ZIP archives carrying JavaScript loaders that trigger rapid, hands-on compromises. Therefore, block risky downloads, hunt for loader execution, and harden WordPress and endpoints to cut dwell time and prevent domain-wide impact within hours.
Rhadamanthys disruption derails credential-theft campaigns
Rhadamanthys suffered a coordinated disruption as “customers” lost access to panels and servers. With certificate-only logins and Tor sites offline, credential theft pipelines broke. Use the lull to rotate passwords, revoke tokens, scrub loaders, and harden identity before operators relaunch under a new brand.
Zoom for Enterprise: close DLL path attacks, move to 6.3.10 today
Zoom delivered security fixes for Windows clients after investigators identified CVE-2025-49457, an untrusted DLL search path that can enable local privilege escalation and broader compromise. Because attackers chain DLL hijacking with lateral movement, admins should update Windows endpoints to version 6.3.10 and validate explicit path loading. This analysis explains affected apps, exploitation flow, high-signal detection, and quick remediation steps so defenders can reduce risk without adding noise.
KONNI abuses Google Find Hub for Android remote wipes
KONNI operators hijack Google accounts, pivot into Find Hub, track target locations, and trigger remote resets on Android blending valid features with malicious intent while evading conventional controls.
APT37 exploits Google Find Hub to wipe Android phones
APT37 used stolen Google credentials to access Find Hub, check Android device locations, and trigger remote factory resets. The tactic lives in the cloud, not on the handset, so identity controls matter most. Enforce phishing-resistant MFA, restrict console actions, and rehearse rapid re-enrollment.
AI-Powered Phishing and Cloud Malware Push Threats
Threat actors now pair generative AI with trusted cloud apps to breach manufacturing. They deliver malware through OneDrive/GitHub, steal API keys and tokens, and persist via OAuth consent. Without governed AI usage, Cloud DLP, and consent controls, factories face quiet IP theft and escalating downtime risks.
Lost iPhone Smishing: Don’t Tap “We Found Your Phone” Links
Smishing texts now target lost iPhone owners with fake “found” alerts and cloned iCloud pages. Verify only in Find My, keep Activation Lock tied to your Apple ID, and avoid links in messages. Set a SIM PIN, rotate your Apple ID password, and review trusted devices to prevent account takeover.
QNAP NAS at Risk: New Exploits Target OS and Backup Apps
Seven zero-day vulnerabilities affecting QTS/QuTS hero and popular QNAP apps were exploited at a live event. Update OS and apps, remove internet exposure, and enforce MFA. Verify snapshots and offline backups, stream logs off-box, and alert on admin anomalies and backup job edits to prevent data loss.
Cephalus Ransomware Breaks In via RDP, Then Exfiltrates
Cephalus ransomware breaks in through exposed or weak RDP, steals data, and launches a Go-based encryptor that disables backups and evades analysis with DLL sideloading and key obfuscation. Consequently, victims encounter fast double-extortion pressure and noisy business disruption unless identity and remote-access controls stop the chain early.