ClickFix attacks are gaining traction among threat actors, with multiple advanced persistent threat (APT) groups from North Korea, Iran, and Russia adopting the technique in recent espionage campaigns. #APThacker #CyberAlerts https://www.bleepingcomputer.com/news/security/state-sponsored-hackers-embrace-clickfix-social-engineering-tactic/

Surge in cyberattacks tied to Russian bulletproof host Proton66 since Jan 8, 2025.

New research links it to brute-force, malware, ransomware—even traffic routed via Kaspersky Lab’s network path.

Attackers exploit 2024–25 zero-days, deploy SuperBlack & WeaXor ransomware, and run phishing via hacked WordPress sites.
#CyberAlerts #CyberAttacks
https://thehackernews.com/2025/04/hackers-abuse-russian-bulletproof-host.html

From zero-click iOS exploits to NTLM credential leaks and the 4Chan breach — this week’s cyber threats hit where trust runs deepest.

THN’s Weekly Recap breaks down the stealth, the strategy, and the systems under fire. #CyberSecurity #CyberAlerts
https://thehackernews.com/2025/04/thn-weekly-recap-ios-zero-days-4chan.html

New cyber threat alert!

Pakistan-linked hackers are ramping up attacks on India's oil, railways, and external affairs sectors using Xeno RAT, Spark RAT, and new malware CurlBack RAT.
They're now using MSI packages—ditching old methods—to steal browser data, files, and credentials across Windows & Linux. #CyberAlerts
https://thehackernews.com/2025/04/pakistan-linked-hackers-expand-targets.html

Nine VSCode extensions on Microsoft's Visual Studio Code Marketplace pose as legitimate development tools while infecting users with the XMRig cryptominer to mine Ethereum and Monero. #MaliciousVSCode #CyberAlerts https://www.bleepingcomputer.com/news/security/malicious-vscode-extensions-infect-windows-with-cryptominers/

EncryptHub, a notorious threat actor linked to breaches at 618 organizations, is believed to have reported two Windows zero-day vulnerabilities to Microsoft, revealing a conflicted figure straddling the line between cybercrime and security research. #bugbounty #CyberAlerts https://www.bleepingcomputer.com/news/security/encrypthubs-dual-life-cybercriminal-vs-windows-bug-bounty-researcher/

Meta warned Windows users to update the WhatsApp messaging app to the latest version to patch a vulnerability that can let attackers execute malicious code on their devices. #CyberAlerts #securityupdate https://www.bleepingcomputer.com/news/security/whatsapp-flaw-can-let-attackers-run-malicious-code-on-windows-pcs/

Two CVEs, One Critical Flaw: Inside the CrushFTP Vulnerability Controversy - (CVE-2025-31161 vs. CVE-2025-2825)
#CyberAlerts #CyberSecurity
https://www.securityweek.com/details-emerge-on-cve-controversy-around-exploited-crushftp-vulnerability/

North Korea’s #Lazarus Group is back—with a new twist on fake job scams.

They’re using ClickFix tricks to infect crypto job seekers with GolangGhost, a stealthy Go-based backdoor hitting Windows & macOS.

#CyberAlerts #CyberSecurity

https://thehackernews.com/2025/04/lazarus-group-targets-job-seekers-with.html

Hackers are abusing WordPress mu-plugins—a hidden auto-run directory—to inject malware, hijack links, and redirect users to scam sites.

Also, add these to the list of 2024's major WordPress threats:
CVE-2024-27956 | SQL injection
CVE-2024-25600 | RCE in Bricks theme
CVE-2024-8353 | PHP injection
CVE-2024-4345 | Arbitrary file upload
#CyberAlerts https://thehackernews.com/2025/03/hackers-exploit-wordpress-mu-plugins-to.html

A Russian group, Water Gamayun, is abusing a Windows zero-day (CVE-2025-26633) to drop two chilling backdoors: SilentPrism & DarkWisp.

They’re hiding in plain sight—using signed .msi files posing as legit apps like DingTalk & VooV to hijack systems.

Targets? Your data, credentials, and even crypto wallets. #CyberAlerts https://thehackernews.com/2025/03/russian-hackers-exploit-cve-2025-26633.html

New Android threat spotted: Crocodilus malware is targeting users in Spain and Turkey, posing as Google Chrome to hijack phones.

• Bypasses Android 13+ protections
• Abuses Accessibility to steal credentials
• Records screen & key actions
• Remotely controls the device
• Hides with black screen overlays
#CyberAlerts
https://thehackernews.com/2025/03/new-android-trojan-crocodilus-abuses.html

New Chinese cyber attack spotted.

FamousSparrow breached a U.S. trade group + Mexican institute using new, modular malware: SparrowDoor + ShadowPad (first use).
#MalwareAttacks #CyberAlerts https://thehackernews.com/2025/03/new-sparrowdoor-backdoor-variants-found.html

One IP. 180+ C2 domains. One malware: Raspberry Robin.

This Russia-linked botnet is back—smarter, stealthier, and spreading fast.

Used by ransomware gangs + nation-state actors like Cadet Blizzard via USBs, Discord, and fast-flux C2s.

Not just a worm—it's a launchpad for LockBit, Dridex, Clop, and more.
#CyberAlerts #CyberAttacks
https://thehackernews.com/2025/03/researchers-uncover-200-unique-c2.html

Tempted to Classifying #APT Actors: Practical Challenges of Attribution in the Case of #Lazarus’s Subgroup #CyberAlerts #CyberSecurity https://blogs.jpcert.or.jp/en/2025/03/classifying-lazaruss-subgroup.html

The FBI is warning that fake online document converters are being used to steal peoples’ information and, in worst-case scenarios, to deploy ransomware on victims' devices. #CyberAlerts #CyberSecurity https://www.bleepingcomputer.com/news/security/fbi-warnings-are-true-fake-file-converters-do-push-malware/

A critical severity vulnerability has been discovered in the Next.js open-source web development framework, potentially allowing attackers to bypass authorization checks. #hacking #CyberAlerts https://www.bleepingcomputer.com/news/security/critical-flaw-in-nextjs-lets-hackers-bypass-authorization/

A China-linked advanced threat group named Weaver Ant spent more than four years in the network of a telecommunications services provider, hiding traffic and infrastructure with the help of compromised Zyxel CPE routers. #CyberAlerts #CyberSecurity https://www.bleepingcomputer.com/news/security/chinese-weaver-ant-hackers-spied-on-telco-network-for-4-years/

A new multi-platform ransomware-as-a-service (RaaS) operation named VanHelsing has emerged, targeting Windows, Linux, BSD, ARM, and ESXi systems. #RansomwareAttacks #CyberAlerts https://www.bleepingcomputer.com/news/security/new-vanhelsing-ransomware-targets-windows-arm-esxi-systems/

UAT-5918 has been quietly breaching Taiwan’s critical infrastructure since 2023—targeting IT, telecom, healthcare, and more.

Linked to China-based groups like Volt Typhoon, it uses open-source tools, web shells & reverse proxies to stay hidden for the long haul. #CyberAlerts https://thehackernews.com/2025/03/uat-5918-targets-taiwans-critical.html