Malware

Updated Roaming Mantis malware involves DNS changer Threat actors behind the Roaming Mantis credential theft and malware distribution campaign have added a DNS changer to their Wroba.o/XLoader Android malware, which enables DNS settings modification on targeted WiFi routers to facilitate further infections, according to BleepingComputer.

Security pros say this new research from Cisco Talos shows how adaptable threat actors are as defenders work to mitigate attacks.

BleepingComputer reports that Russian hacking operation Sandworm is being tied by the Computer Emergency Response Team of Ukraine to a significant CaddyWiper malware attack against Ukraine's national news agency Ukrinform.

Nozomi Networks reported that wiper malware, IoT botnet activity, and the Russia-Ukraine war significantly influenced the threat landscape last year.

Threat actors could exploit the port forwarding feature in cloud-based configurable development environment GitHub Codespaces to facilitate malware delivery, according to The Hacker News.

BleepingComputer reports that three malicious packages have been uploaded by Lolip0p on the Python Package Index to spread information stealing malware.

Qihoo Netlab 360 researchers have discovered the active distribution of a novel backdoor based on the Central Intelligence Agency's Hive multi-platform malware suite, according to The Hacker News.