⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
South Korean authorities and four security firms disclosed a state-sponsored campaign that compromised trusted Korean websites to exploit AnySign4PC, a locally installed financial-security software, without any user prompt or download. The watering-hole attacks delivered SIGNBT or COPPERHEDGE backdoors.
The Chinese cybercrime group Silver Fox has been observed using a new three-driver BYOVD attack chain targeting a Japanese manufacturer. The attack uses invoice-themed phishing lures and DLL sideloading to deliver ValleyRAT for persistent remote access.
The Chinese cybercrime group Silver Fox targeted a Japanese industrial manufacturing organization using a BYOVD (bring your own vulnerable driver) attack chain involving three drivers, combined with DLL sideloading via legitimate applications, to deploy ValleyRAT (Winos 4.0) for persistent remote access. The attack chain begins with an invoice-themed phishing lure hosted on legitimate QQ and Tencent Cloud services, uses a ZIP archive containing a downloader, and leverages kernel access through vulnerable drivers to impair security controls and evade detection.
The Chinese cybercrime group Silver Fox has targeted a Japanese industrial manufacturer using a sophisticated attack chain involving bring your own vulnerable driver (BYOVD) techniques to deploy ValleyRAT, a remote access trojan. The campaign begins with a phishing lure disguised as an invoice, hosted on legitimate QQ and Tencent Cloud services, which triggers a DLL sideloading chain via a ZIP archive.
Unit 42 reports on a Chinese-speaking threat actor leveraging AI models to autonomously scan and exploit seven vulnerabilities. The actor combines this automated approach with manual exploitation techniques, marking a significant evolution in cyberattack capabilities.
Unit 42 reports on a Chinese-speaking threat actor that uses AI models to autonomously scan for vulnerabilities across seven different exploits. The actor then combines this automated scanning with manual exploitation techniques to carry out cyberattacks.