Malware

Russian phishing campaign hits Ukraine with novel malware Attacks delivering novel malicious payloads have been deployed by a Russian state-sponsored threat operation against Ukrainian entities as part of a new phishing campaign, reports The Record, a news site by cybersecurity firm Recorded Future.

The attackers are using compromised Extended Validation (EV) certificates, specifically one issued to TrustConnect Software PTY LTD, to sign malicious executables.

The malicious packages, including "nhattuanbl/lara-helper" and "nhattuanbl/simple-queue," contain obfuscated PHP code that connects to a command and control (C2) server at helper.leuleu[.]net:2096.

Cybernews reports that AI has been tapped by malicious actors to generate vibe hacking scripts and modular malware for scalable cyber intrusions.

Infosecurity Magazine reports that Iranian threat operation Dust Specter has spoofed Iraq's Ministry of Foreign Affairs to compromise Iraqi government officials with the new SplitDrop, TwinTask, TwinTalk, and GhostForm payloads as part of an AI-powered intrusion campaign initially discovered in January.

Information included Social Security, driver's license and voter records dating to the 1990s.

The SloppyLemming group employed two distinct attack chains to deploy malware.