cybersecurity

A brief look at all things infostealers for the week 20, 2025 (12.05.2025–18.05.2025). This week observed updates from LummaC2, MonsterV2 and KatzStealer infostealers. Grabbed some numbers from marketplaces and some interesting news/articles.

Weekly thread for any and all career, learning and general guidance questions. Thinking of taking a training or going for a cert? Wondering how to level up your career? Wondering what NOT to do? Got other questions? This is the time and place to ask!

Archived

• In Operation RoundPress, the compromise vector is a spearphishing email leveraging an XSS vulnerability to inject malicious JavaScript code into the victim’s webmail page.
• In 2023, Operation RoundPress only targeted Roundcube, but in 2024 it expanded to other webmail software including Horde, MDaemon, and Zimbra.
• For MDaemon, Sednit used a zero-day XSS vulnerability. We reported the vulnerability to the developers on November 1st, 2024 and it was patched in version 24.5.1.
• Most victims are governmental entities and defense companies in Eastern Europe, although we have observed governments in Africa, Europe, and South America being targeted as well.
• The report provides an analysis of the JavaScript payloads SpyPress.HORDE, SpyPress.MDAEMON, SpyPress.ROUNDCUBE, and SpyPress.ZIMBRA.
• These payloads are able to steal webmail credentials, and exfiltrate contacts and email messages from the victim’s mailbox. Additionally, SpyPress.MDAEMON is able to set up a bypass for two-factor authentication.

cross-posted from: https://lemmy.sdf.org/post/34853591

Archived

The world is in a cyberwar in every sense except a legal one because no side has declared war, said Mart Noorma, director of the NATO Cooperative Cyber Defense Center of Excellence (CCDCOE) in Tallinn. Russian hackers' goal is to sow chaos and steal money, he said.

[...]

The avalanche of attacks from Russia is very intense. "The bad actors think they can attack as much as they can, limited only by how well countries can defend themselves and hold the criminals accountable," he told the show.

"The West constantly feels how hacker groups supported by the Russian authorities are carrying out attacks against us. By supporting hacker groups, the state can more easily create confusion. Then the state is not directly connected. Creating chaos has been a constant for Russia — their goal is to achieve geopolitical and cognitive effects so that people in democratic countries begin to doubt their values and governments. Even influencing presidential elections is of interest to the hackers," he explained.

"Quite often, Russian hackers also have financial motives — the proceeds are divided among state agencies," Noorma explained.

[...]

Wanna chat about something non-infosec amongst those of us who frequent /c/cybersecurity? Here’s your chance! (Keep things civil & respectful please)

cross-posted from: https://lemmy.sdf.org/post/34652759

Archived

Cyber attacks were the most common form of hybrid threat faced by Australia in the last decade, but economic coercion and foreign interference are not far behind.

[...]

Analysts at the Australian Strategic Policy Institute have been tracking hybrid threats against Australia since March 2016, and between then and February 2025 have tracked 74 discrete activities targeting the country.

Given the growing state of digital connectivity across the globe, cyber security incidents and attacks make up approximately 35 per cent of all hybrid activity. Both private and public sector companies have been targeted by largely PRC-backed hackers, such as Naikon, APT40, APT27 and Aoqin Dragon, as well as critical infrastructure entities.

[...]

“The ASPI research into hybrid threats underscores a key trend observation that we have always expected would occur: nation-state aligned threat actors are prioritising cyber security as the foremost battleground in today’s modern, digital world. Whether it is cyber-espionage or targeting critical infrastructure for sabotage, this type of conflict is no longer relegated to complex stories found in television and movies,” Satnam Narang, senior staff research engineer at Tenable, told Defence Connect.

Economic coercion, foreign interference, and narrative & disinformation campaigns all make up about 20-25 per cent each targeted activity, and here again, China is highly active. China is thought to have engaged in efforts to sway debate toward far-right sources during the Voice to Parliament campaign, and its extensive Spamouflage network of fake social media accounts targeted an Australian rare earth mining company in recent years as well.

Journalists and members of the Chinese diaspora in Australia have also been targeted by Chinese influence and harassment campaigns.

China’s efforts to impact the Australian economy include tariffs and bans on Australian produce, trade restrictions, and even consumer boycotts

[...]

“Economic coercion involves actions that go beyond standard trade policy [such as tariffs], including: engaging in targeted boycotts; blocking access to essential resources; and imposing sanctions with the explicit goal of forcing political concessions.”

Military and paramilitary coercion only makes up about 15 per cent of hybrid activity, but as ASPI notes, such activity has increased in the last few years, and, again, China is the main culprit. Only recently, we have had the example of a Chinese naval flotilla performing firing drills in the Tasman Sea and aerial encounters between Chinese and Australian military aircraft in the South China Sea – all just in February 2025 alone.

[...]

Of course, while China is responsible for the bulk of hybrid activity targeting Australia, it is not alone. China is responsible for 69 per cent of such activity, with Russia the next most active nation at 11 per cent of activity, trailed closely by Iran, which makes up fully ten per cent of hybrid threat activity.

Other nations make up four per cent of activity, unidentified hackers responsible for five per cent of threat activity, and ideologically motivated violent extremism is one per cent.

[...]

cross-posted from: https://lemmy.sdf.org/post/34536054

Archived

China-Nexus Nation State Actors Exploit SAP NetWeaver (CVE-2025-31324) to Target Critical Infrastructures, according to a research.

In April 2025, China-nexus nation-state APTs (advanced persistent threat) launched high-temp exploitation campaigns against critical infrastructure networks by targeting SAP NetWeaver Visual Composer. Actors leveraged CVE-2025-31324 [...], an unauthenticated file upload vulnerability that enables remote code execution (RCE). This assessment is based on a publicly exposed directory (opendir) found on attacker-controlled infrastructure, which contained detailed event logs capturing operations across multiple compromised systems.

[...]

EclecticIQ analysts link observed SAP NetWeaver intrusions to Chinese cyber-espionage units including UNC5221 [...], UNC5174 [...], and CL-STA-0048 [...] based on threat actor tradecrafts patterns. Mandiant and Palo Alto researchers assess that these groups connect to China's Ministry of State Security (MSS) or affiliated private entities. These actors operate strategically to compromise critical infrastructures, exfiltrate sensitive data, and maintain persistent access across high-value networks worldwide.

[...]

Targets of the campaign were

• natural gas distribution networks, water and integrated waste management utilities in the United Kingdom,

• medical device manufacturing plants oil and gas exploration and production companies in the United States, and

• government ministries in Saudi Arabia that are responsible for investment strategy and financial regulation.

[...]

• The new class of vulnerabilities in Intel processors arises from speculative technologies that anticipate individual computing steps.
• Openings enable gradual reading of entire privilege memory contents of shared processor (CPU).
• All Intel processors from the last 6 years are affected, from PCs to servers in data centres.

cross-posted from: https://lemmy.sdf.org/post/34478394

Archived

Britain’s intelligence services are seeing a “direct connection between Russian cyber attacks and physical threats to our security,” the country’s cyber chief announced on Wednesday.

Malign actors in Moscow are “waging acts of sabotage, often using criminal proxies in their plots,” warned Richard Horne, the head of the National Cyber Security Centre (NCSC) at the CYBERUK conference in Manchester.

Horne said both NCSC and the domestic security service MI5 were seeing the hacking threat from Russia manifesting “on the streets of the U.K. against our industries and our businesses, putting lives, critical services and national security at risk.”

He told the CYBERUK audience that the role of the information security community was “therefore not just about protecting systems, it’s about protecting our people, our economy, our society, from harm.”

[...]

[Among others], Russia is believed to have been behind a July 2024 blaze that also affected the DHL logistics chain in Leipzig, Germany. If that parcel bomb bound for the U.K. had detonated aboard a flight it could have caused a plane crash, German security services said.

A third incident took place in July near Warsaw, the capital of Poland. As reported by Reuters, the attempts are believed to be a “dry run” for a future plot in which Russia detonates incendiary devices in midair on transatlantic cargo flights to the United States and Canada.

The devices were reportedly disguised as massage machines from Lithuania and **contained a magnesium-based substance which could have burned so destructively that an aircraft would have crashed. ** In November, Kęstutis Budrys, the chief national security adviser to Lithuania’s President Gitanas Nausėda, blamed Russia’s military intelligence agency, known as the GRU, for the plots. Other Western security officials have agreed with this assessment.

[...]

Weekly thread for any and all career, learning and general guidance questions. Thinking of taking a training or going for a cert? Wondering how to level up your career? Wondering what NOT to do? Got other questions? This is the time and place to ask!

Wanna chat about something non-infosec amongst those of us who frequent /c/cybersecurity? Here’s your chance! (Keep things civil & respectful please)