Tag: 2025-09-12

8 Attack Reports | 0 Vulnerabilities

Attack reports

Introducing HybridPetya: Petya/NotPetya copycat with UEFI Secure Boot bypass

A new ransomware called HybridPetya has been discovered, combining features of Petya and NotPetya with advanced UEFI-based system capabilities. It encrypts the Master File Table on NTFS partitions and can install a malicious EFI application to compromise UEFI systems. One variant exploits CVE-2024-…
ransomware
uefi
bootkit
CVE-2024-7344
2025-09-15
2025-09-12
notpetya
petya
bypass
mft encryption
hybridpetya
secure boot
petrwrap
diskcoder.c
secure boot bypass
expetr
goldeneye
nyetya
Published: September 15, 2025
Linked vulnerabilities : CVE-2024-7433 (CVSS 8.8), CVE-2024-7344 (CVSS 8.2)
Downloadable IOCs: 7

Yurei the New Ransomware Group on the Scene

Yurei, a newly emerged ransomware group, targeted a Sri Lankan food manufacturing company on September 5, 2025. The group employs a double-extortion model, encrypting files and exfiltrating sensitive data. Check Point Research discovered that Yurei's ransomware is based on the open-source Prince-Ra…
ransomware
open-source
go
double-extortion
2025-09-12
morocco
satanlockv2
shadow copies
prince-ransomware
yurei
Published: September 12, 2025
Downloadable IOCs: 5

Deconstructing a Cyber Deception: An Analysis of the Clickfix HijackLoader Phishing Campaign

This analysis delves into the HijackLoader malware campaign, which has gained prominence since 2023 for its sophisticated payload delivery and evasion techniques. The campaign initiates with a CAPTCHA-based phishing attack, progressing through multiple stages of obfuscated PowerShell scripts. It em…
obfuscation
phishing
powershell
infostealer
hijackloader
lumma
deerstealer
anti-vm
multi-stage
castleloader
2025-09-12
castlebot
nekostealer
Published: September 12, 2025
Downloadable IOCs: 14

CyberVolk Ransomware: Analysis of Double Encryption Structure and Disguised Decryption Logic

The CyberVolk ransomware, emerging in May 2024, targets public institutions and key infrastructures of anti-Russian countries. It uses a double encryption structure with AES-256 GCM and ChaCha20-Poly1305 algorithms. The ransomware excludes certain files and directories from encryption and uses a sy…
ransomware
geopolitical
pro-russian
chacha20-poly1305
2025-09-12
symmetric key
cybervolk
aes-256 gcm
double encryption
Published: September 12, 2025
Downloadable IOCs: 0

Trigona Rebranding Suspicions and Global Threats, and BlackNevas Ransomware Analysis

The BlackNevas ransomware group, first appearing in November 2024, has been targeting various industries and critical infrastructure globally, with a focus on the Asia-Pacific region. The group uses AES and RSA encryption, adding the '.-encrypted' extension to affected files. BlackNevas operates in…
ransomware
encryption
data leak
global threats
rsa
asia-pacific
aes
2025-09-12
blacknevas
Published: September 12, 2025
Downloadable IOCs: 1

AI-Generated Code and Fake Apps Used for Far-Reaching Attacks

A new malware campaign called EvilAI is spreading globally by disguising itself as legitimate AI-enhanced productivity tools. The malware uses AI-generated code and professional interfaces to evade detection, targeting organizations across sectors like manufacturing, government, and healthcare. It …
obfuscation
persistence
node.js
trojan
credential theft
command and control
2025-09-12
ai-generated code
evilai
fake applications
Published: September 12, 2025
Downloadable IOCs: 14

Inside the 2025 Energy Phishing Wave: Chevron, Conoco, PBF, Phillips 66

In 2025, a significant surge in phishing attacks targeting major U.S. energy companies was observed. The campaign primarily focused on Chevron, ConocoPhillips, PBF Energy, and Phillips 66, utilizing sophisticated impersonation techniques. Attackers employed HTTrack-based cloning to replicate legiti…
phishing
rhadamanthys
credential harvesting
domain impersonation
investment scams
2025-09-12
energy sector
httrack
keitaro
website cloning
brand abuse
Published: September 12, 2025
Downloadable IOCs: 43

Beaches and breaches

Recent cybersecurity news has shifted focus from AI and ransomware to breaches, particularly those involving compromised OAuth tokens linked to Salesloft's Drift integration. The main themes emerging are supply chain and identity attacks, with a need to redefine these concepts in the context of Saa…
data breaches
cyber threat intelligence
saas security
oauth tokens
2025-09-12
identity attacks
nefilim
cybersecurity trends
lockergoga
megacortex
supply chain attacks
cti-cmm
Published: September 12, 2025
Downloadable IOCs: 0
Click here to see more Attack Reports