All news in category “Threat and Trends Reports”

🛡️ Researchers disclosed a new .NET-based DLL loader named QuirkyLoader that's been used since November 2024 to deliver information stealers, keyloggers and RATs via email spam. IBM X-Force says attackers send malicious archives from both legitimate providers and self-hosted servers; each archive contains a DLL, an encrypted payload and a real executable used for DLL side-loading. The loader uses process hollowing to inject decrypted payloads into AddInProcess32.exe, InstallUtil.exe or aspnet_wp.exe. Operators compile the .NET DLL with ahead-of-time (AOT) compilation so the resulting binary resembles native C/C++ code and is harder to attribute.

🔍 This article debunks ten common cyberbullying myths that can mislead parents and educators. It cites rising rates of online harassment among US middle- and high-school students and explains why beliefs such as “what happens online stays online” or “remove the tech and you solve it” are false. The piece urges open dialogue, vigilance for behavioral signs, and collaborative plans to support children.

🔬 Google researchers demonstrated practical improvements to the Retbleed speculative-execution attack, showing that on AMD Zen 2 CPUs attackers can read arbitrary RAM at roughly 13 KB/s with perfect cache-extraction accuracy. They adapted a modified Speculative ROP technique to evade Spectre v2 mitigations and showed ways to bypass Linux kernel defenses. The exploit still requires prior knowledge of kernel configuration, but common default builds and probing reduce that hurdle, and Google has already restricted Zen 2 in certain cloud workloads.

🔒 Cisco Talos identified a roughly 1.4× rise in ransomware incidents in Japan during H1 2025, with 68 confirmed cases versus 48 in the same period last year. Attacks continued to focus on small and medium-sized enterprises, with manufacturing the most affected sector. The report highlights active groups such as Qilin, RansomHub and Hunters International and spotlights the emerging Kawa4096/KaWaLocker family. Talos recommends layered defenses including Cisco Secure Endpoint, Secure Email and Secure Malware Analytics, and publishes IOCs for responders.

⚡ Top-tier managed detection and response (MDR) gives organisations 24/7 expert monitoring to detect, contain and remediate threats before they escalate. With adversaries reducing breakout times to minutes, rapid detection and containment are essential to minimise dwell time, limit blast radius and reduce breach costs. Choose MDR with AI-driven detection, proactive threat hunting and a trusted SOC team for speedy, tailored protection.

📸 Parents should engage when children show interest in blogging, using open discussion to build trust and teach online safety. The article recommends creating accounts together, reviewing privacy settings, disabling geolocation, choosing strong unique passwords, and enabling two-factor authentication to reduce account-takeover risk. It also outlines what not to post, how to monitor usernames, and how to spot scams, doxing, and stalker behavior.

⚠️ AI-driven deepfake ads on social media are increasingly used to impersonate banks, celebrities and news outlets to lure victims into investment fraud. Campaigns observed in 2024–2025, including the Nomani Trojan activity, use fake or hijacked accounts, localized messaging and deepfake testimonials to harvest credentials or steer targets into scam groups. Reported losses from investment fraud are substantial, so verify offers independently and avoid clicking unsolicited financial ads.

📦 Delivery scams now include evolved brushing and QR-based "quishing" campaigns that use unsolicited packages or printed postcards to trick recipients into visiting malicious sites, paying fake fees, or installing malware. Scammers may include QR codes, phone numbers, or counterfeit tracking cards to extract payment data, one-time codes, or to prompt app installs. Never scan printed QR codes or call numbers on unexpected parcels; verify shipments via official courier channels and avoid connecting unknown USB devices. Enable two-factor authentication and report suspicious packages to the courier and police.

🔍 Cisco Talos describes a widespread malvertising campaign delivering a modular malware framework called PS1Bot. The multi-stage operation uses in-memory PowerShell and C# components to steal browser credentials, target cryptocurrency wallets, capture screenshots and keylogs, and maintain persistent access through modular updates. Active and evolving through 2025, PS1Bot minimizes its footprint to evade detection. Talos urges caution when downloading files, keeping security software current, and using dedicated password managers instead of browser-stored credentials.

🔍 UpGuard analyzed 22 million leaked request logs showing client traffic to leakzone.net over 28 days in June–July 2025. The follow-up focuses on requests originating from owned organizational IP ranges — highlighting visits from universities, governments, and private companies. Observed security vendors and SEO crawlers (e.g., Censys, SEMrush, Ahrefs) displayed patterns consistent with automated scanning, while many university and government entries suggested intermittent, likely human-driven visits. The findings emphasize why organizations monitor leak forums for risk and threat intelligence.

🧩 Muddled Libra is not a single organized group but a fluid collaboration of personas that form distinct strike teams with varying objectives and tradecraft. Unit 42 has identified patterns across at least seven teams, from crypto theft and extortion to IP theft and mass data harvesting. Defenders should prioritize protecting high-value data, tighten access controls, and assume evolving tactics rather than a fixed adversary profile.

🔐A DEF CON 33 panel argued that while digital tactics like misinformation and cyberattacks can disrupt systems, they rarely win wars on their own. Panelists emphasised that cyber effects tend to be temporary, whereas kinetic attacks inflict longer-lasting physical damage. Using a Taco Bell supply-chain analogy and real incidents such as Change Healthcare, the discussion urged organisations to map dependencies and build resilience to mitigate third-party risk.

🔒 Digital natives often spend more time online and maintain large numbers of accounts, which increases exposure to scams, phishing and account takeovers. Research shows Gen Z is less likely to use unique passwords, enable MFA, or install updates regularly, and some admit sharing sensitive data with AI or bypassing corporate security tools. Simple, practical steps — stick to official app stores, keep software updated, deploy trusted security software, review privacy settings and treat unsolicited offers with skepticism — can significantly reduce risk.

🔒 This deep-dive by Philippe Laulheret (Talos) dissects Dell's ControlVault3 ecosystem, exposing firmware decryption, memory-corruption flaws, and exploit chains that cross the device/host boundary. The researchers recovered hardcoded keys, reverse-engineered the SCD/SMAU update mechanism, and achieved arbitrary code execution in firmware, enabling persistence and a demonstrated Windows Hello bypass. Practical attacks include forging SCD blobs, backdooring firmware to escalate to SYSTEM, and physically extracting the USH board over USB for rapid compromise.

🛡️ At Black Hat USA 2025 speakers warned that high cyber-insurance premiums can reflect insurers capping exposure to specific third-party vendors rather than a direct finding of poor security in a customer’s environment. Insurers may respond to exceeded vendor thresholds by issuing prohibitively high quotes instead of declining coverage, effectively pricing some customers out. Claims data presented showed 45% of new claims in H1 2025 involved an SSL VPN lacking MFA, and Coalition reported 55% of ransomware begins at perimeter devices.

📱 Android adware can range from benign ad‑supported apps to intrusive PUAs that harvest data, perform click fraud, or hide to prevent removal. Detections rose by 160% in H1 2025, and sophisticated campaigns such as Kaleidoscope — which uses identical “evil twin” apps across official and third‑party stores — accounted for a substantial share of incidents. To reduce risk, only install apps from reputable developers and the Google Play Store, keep software updated, enable PUA detection in mobile security tools, and if infected disconnect, reboot to Safe Mode and remove suspicious apps or run a trusted scanner.

🔒 Unit 42 observed a new DarkCloud Stealer infection chain in early April 2025 that employs ConfuserEx-based obfuscation and a final Visual Basic 6 payload. Phishing TAR/RAR/7Z archives deliver obfuscated JavaScript or WSF downloaders which retrieve a PowerShell stage from open directories and drop a ConfuserEx-protected executable. The loaders are heavily protected with javascript-obfuscator and the variant follows prior AutoIt-based deliveries. Palo Alto Networks notes that Advanced WildFire, Advanced URL Filtering, Advanced DNS Security, Cortex XDR and XSIAM can help detect and mitigate these stages and recommends contacting Unit 42 for incident response.

🛡️Unit 42 explains why Muddled Libra receives outsized attention: the group uses a consistent playbook, industry-focused waves of attacks, and unusually convincing English-language vishing that makes attribution and impact more visible. In 2025 cases, about 50% led to DragonForce ransomware deployment and data exfiltration, heightening executive concern. The report highlights practical defenses such as Conditional Access Policies and analytic correlation with tools like Cortex XSIAM to detect and disrupt operations.

🔍 ESET's H1 2025 Threat Report highlights a sharp rise in manipulative social-engineering techniques, coordinated infostealer takedowns, and aggressive infighting among ransomware groups. Hosts Aryeh Goretsky and Ondrej Kubovič analyze the rapid emergence of ClickFix, including the FakeCaptcha variant that coaxes victims into executing commands. They also summarize law enforcement disruptions of RedLine/Meta Stealer and other services, and recount a brazen “deathmatch” in which the small actor Dragonforce defaced and dismantled rival data leak sites.

🔐 Talos, in collaboration with NetHope and Cisco Crisis Response, developed a customized Backdoors & Breaches expansion deck to help humanitarian aid NGOs improve incident response and proactive security within constrained budgets. The cards model real-world challenges—forced relocation, limited connectivity, and scarce resources—to make tabletop exercises practical and relevant for both technical and non-technical teams. Hundreds of physical decks have been distributed and a U.S.-focused edition was created with NGO-ISAC for domestic organizations. Resources and virtual play options are provided to lower barriers to adoption and scale training.