Lifeboat Foundation

A leading health-care technology company is experiencing a network outage due to a “cyber security issue,” pausing prescription services at pharmacies nationwide.

The Anatsa banking trojan has been targeting users in Europe by infecting Android devices through malware droppers hosted on Google Play.

Over the past four months, security researchers noticed five campaigns tailored to deliver the malware to users in the UK, Germany, Spain, Slovakia, Slovenia, and the Czech Republic.

Researchers at fraud detection company ThreatFabric noticed an increase of Anatsa activity since November, with at least 150,000 infections.

The Cactus ransomware gang claims they stole 1.5TB of data from Schneider Electric after breaching the company’s network last month.

25MB of allegedly stolen were also leaked on the operation’s dark web leak site today as proof of the threat actor’s claims, together with snapshots showing several American citizens’ passports and non-disclosure agreement document scans.

As BleepingComputer first reported, the ransomware group gained access to the energy management and automation giant’s Sustainability Business division on January 17th.

A coalition of international law enforcement agencies, including the FBI and UK National Crime Agency, said they have disrupted LockBit, one of the most prolific hacker groups of all time, including shutting down websites the organization used for ransomware payments.

According to a Chinese security expert, a significant number of attacks actually originate from countries in South Asia.

One India-based group of hackers, known as ‘Bitter’, has used various methods to target government, military and nuclear sectors.

The fourth group is Curium, an Iranian group that has used LLMs to generate phishing emails and code to evade antivirus detection. Chinese state-affiliated hackers have also used LLMs for research, scripting, translations, and refining their tools.

Fight AI with AI

Microsoft and OpenAI say they have not detected any significant attacks using LLMs yet, but they have been shutting down all accounts and assets associated with these groups. “At the same time, we feel this is important research to publish to expose early-stage, incremental moves that we observe well-known threat actors attempting, and share information on how we are blocking and countering them with the defender community,” says Microsoft.

This post is also available in: עברית (Hebrew)

HP Wolf Security’s latest threat insights disclosure put a spotlight on DarkGate – a group of web-based criminals using legal advertising tools to enhance their spam-based malware attacks.

The security report claims DarkGate has been operating as a malware provider since 2018, with an apparent shift in tactics last year of using legitimate advertisement networks “to track victims and evade detection.” The claims are that by using ad services, threat actors can analyze which lures generate clicks and infect the most users – helping them refine campaigns for maximum impact.

Hackers are exploiting a ZERO-DAY flaw in Microsoft Defender SmartScreen to deliver DarkMe malware. This sophisticated attack can steal your data and give hackers access to your financial accounts.

The threat actors behind the PikaBot malware have made significant changes to the malware in what has been described as a case of “devolution.”

“Although it appears to be in a new development cycle and testing phase, the developers have reduced the complexity of the code by removing advanced obfuscation techniques and changing the network communications,” Zscaler ThreatLabz researcher Nikolaos Pantazopoulos said.

PikaBot, first documented by the cybersecurity firm in May 2023, is a malware loader and a backdoor that can execute commands and inject payloads from a command-and-control (C2) server as well as allow the attacker to control the infected host.