1010.cx

  • Stolen Credentials and Valid Account Abuse Fuel the Financially Motivated Attacks

    ·

    , ,

    Throughout the first half of 2025, financially motivated threat actors have shifted their approach to intrusions, abandoning traditional implant-heavy methods in favor of a more cost-effective strategy.

    Rather than deploying sophisticated malware payloads, attackers are leveraging stolen credentials and valid account access to establish persistence within target networks across multiple industries.

    The FortiGuard Incident Response team responded to dozens of engagements, revealing a consistent pattern where adversaries gain initial access through compromised credentials, which are either harvested via phishing campaigns, purchased from Initial Access Brokers, or obtained through password reuse and infostealer malware distribution.

    Fortinet analysts identified that attackers exploit three primary initial access techniques to compromise networks.

    External remote services, particularly VPN infrastructure, serve as the most prevalent entry point, allowing adversaries to authenticate using stolen credentials and progress laterally through victim environments.

    Additionally, threat actors exploit public-facing applications using n-day vulnerabilities to deploy legitimate remote management tools such as AnyDesk, Atera, Splashtop, and ScreenConnect.

    Compromised credentials purchased from underground markets range from $100 to $20,000 depending on organizational size and geographic location, making this approach economically attractive for threat actors operating across developed and emerging economies.

    Lateral Movement and Persistence Tactics

    Once inside networks, Fortinet researchers noted that adversaries employ manual, operator-driven lateral movement using built-in tools including Remote Desktop Protocol (RDP), Server Message Block (SMB), and Windows Remote Management (WinRM).

    This manual approach enables attackers to blend with legitimate administrator activity, significantly complicating detection efforts.

    Victim Industries (Source – Fortinet)

    Adversaries maintain persistence by installing their own instances of remote access tools and leveraging privileged credentials obtained through Mimikatz execution and Zerologon exploitation for elevated account access.

    Data exfiltration occurs through direct file transfers via RDP and RMM interface drag-and-drop capabilities, leaving minimal forensic artifacts compared to conventional web-based exfiltration methods.

    In observed cases, attackers configured VPN infrastructure without multi-factor authentication, granting unrestricted network access and enabling rapid encryption of hypervisor infrastructure for ransomware deployment.

    This low-complexity, high-return methodology allows financially motivated adversaries to operate undetected for extended periods while avoiding the detection signatures commonly associated with malware-centric intrusions.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Stolen Credentials and Valid Account Abuse Fuel the Financially Motivated Attacks appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • ‘Cautious’ optimism follows top warship builder’s productivity, workforce wins

    ·

    The country’s largest builder of warships is keeping more of its shipyard workers after boosting wages and hiring better-qualified recruits, said HII CEO Chris Kastner on Thursday. 

    “From a labor perspective, we have hired over 4,600 shipbuilders year-to-date and our retention rates have improved at both shipyards. At Newport News, we’ve seen an increase in experienced hires following the wage investment this summer and increased hiring from regional workforce development pipelines, which provides more proficient incoming shipbuilders,” Kastner said during the company’s third-quarter earnings call. “These are important steps to stabilize and level up the experience of our workforce.” 

    Earlier this year, HII said it would hire fewer new or green shipyard workers and increase pay to attract more seasoned talent—an effort supported by the Navy’s maritime industrial base funding. So far, the strategy seems to be paying off at HII’s Newport News yard in Virginia; the company is still in union negotiations at its Ingalls facility in Mississippi. Kastner was light on details when asked about wage increases for workers in the pending agreement.  

    “We’re in discussions with the union at Ingalls. That union agreement expires next year. We’re hoping to get that in place [by the] beginning of next year—maybe [the] end of this year,” he said. “It makes it a bit more complicated because we have to engage with the union to get that done.” 

    HII is also on track for an overall 15 percent throughput increase compared to 2024—thanks in part to labor improvements and more outsourcing. Kastner said wage bumps at Newport News reduced attrition and led to hiring of more experienced workers. 

    “It’s been pretty positive at Newport News and the effect of those wages has been positive and in reduced attrition. We’re probably most excited about repositioning the experience level of the workforce, where we have more experience,” he said. “We’re also hiring about 50 percent out of what we call the pipeline, which are the regional workforce development centers, the apprentice schools, and the high school programs, which is very positive. Newport News labor is doing well, kind of cautiously optimistic and we hope to keep it going.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Beware of Malicious ChatGPT Apps That Records Users Action and Steals Sensitive Data

    ·

    , ,

    The explosive growth of artificial intelligence has created an unexpected security threat as cybercriminals exploit ChatGPT’s popularity through counterfeit mobile applications.

    Recent security research uncovered sophisticated malicious apps masquerading as legitimate ChatGPT interfaces, designed to harvest sensitive user data and monitor digital activities without consent.

    These fraudulent applications have infiltrated third-party app stores, targeting users seeking convenient access to AI-powered chatbots.

    The malicious applications employ convincing branding techniques that mirror authentic ChatGPT interfaces, complete with recognizable logos and functional designs.

    Once installed, these trojanized apps execute hidden surveillance routines while maintaining the appearance of working AI assistants.

    The threat intensifies as millions worldwide download unofficial AI applications from unverified sources, unaware of embedded spyware compromising their devices.

    Appknox analysts identified these malicious ChatGPT clones during comprehensive mobile security research examining AI-themed applications across distribution platforms.

    The security team discovered that threat actors weaponize brand trust as an attack vector, exploiting widespread ChatGPT familiarity to compromise user devices.

    Analysis revealed these counterfeits implement full malware frameworks capable of persistent surveillance and credential theft.

    Technical examination showed network communications masked through domain fronting using legitimate cloud infrastructure from Amazon Web Services and Google Cloud.

    This sophisticated obfuscation allows malicious traffic to blend with normal communications, evading security detection.

    Infection Mechanism and Data Exfiltration

    The malware deployment begins with convincing app store listings featuring polished graphics and descriptions promising enhanced ChatGPT functionality.

    Upon installation, malicious applications request extensive permissions including SMS access, contact databases, call logs, and account credentials.

    These requests appear legitimate, masking true surveillance capabilities. Analysis revealed code obfuscation using the Ijiami packer to encrypt malicious payloads.

    Decompiled packages contained folders labeled “secondary-program-dex-jars” housing executables that decrypt after installation—characteristic trojan loader signatures.

    The malware maintains persistence through embedded native libraries ensuring background execution continues after users close the interface.

    Network logs demonstrated systematic exfiltration targeting one-time passwords, banking verification codes, and address book contents.

    Stolen credentials enable attackers to intercept multi-factor authentication and infiltrate corporate systems. Researchers noted these techniques parallel established spyware families including Triout and AndroRAT.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Beware of Malicious ChatGPT Apps That Records Users Action and Steals Sensitive Data appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • OpenAI Unveils Aardvark: GPT-5 Agent That Finds and Fixes Code Flaws Automatically

    ·

    OpenAI has announced the launch of an “agentic security researcher” that’s powered by its GPT-5 large language model (LLM) and is programmed to emulate a human expert capable of scanning, understanding, and patching code. Called Aardvark, the artificial intelligence (AI) company said the autonomous agent is designed to help developers and security teams flag and fix security vulnerabilities at

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Threat Actors Exploit LANSCOPE Endpoint Manager Zero-Day Vulnerability to Steal Confidential Data

    ·

    , ,

    In mid-2025, researchers discovered a sophisticated campaign orchestrated by the Chinese state-sponsored threat group BRONZE BUTLER (also known as Tick) targeting organizations relying on Motex LANSCOPE Endpoint Manager.

    The attackers exploited a previously unknown zero-day vulnerability tracked as CVE-2025-61932, which grants remote adversaries the ability to execute arbitrary commands with SYSTEM privileges.

    This marks the group’s continued targeting of Japanese asset management software, following their successful exploitation of SKYSEA Client View in 2016.

    JPCERT/CC publicly disclosed the vulnerability on October 22, 2025, prompting urgent action from organizations worldwide.

    The campaign reveals a meticulously orchestrated attack chain combining multiple malware families and legitimate tools to establish persistence and exfiltrate sensitive information.

    Sophos researchers identified that the attackers leveraged the zero-day to achieve initial access on vulnerable internet-facing LANSCOPE servers, then pivoted to lateral movement within compromised networks.

    The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2025-61932 to its Known Exploited Vulnerabilities Catalog the same day the advisory was published, confirming active exploitation in the wild.

    Comparison of internal function names in the 2023 (left) and 2025 (right) Gokcpdoor samples (Source – Sophos)

    Sophos analysts identified the Gokcpdoor malware as the primary command and control mechanism employed throughout this operation.

    The 2025 variant represents a significant evolution from earlier versions, discontinuing support for the KCP protocol while implementing advanced multiplexing communication capabilities using third-party libraries for command-and-control communications.

    Advanced Persistence Through Malware Multiplexing

    Sophos researchers identified two distinct Gokcpdoor variants tailored for specific operational purposes.

    The server variant maintains open listening ports specified within its embedded configuration, typically using ports 38000 or 38002, to establish incoming remote access channels.

    Execution flow utilizing OAED Loader (Source – Sophos)

    The client variant, conversely, initiates connections to hard-coded command and control servers, establishing secure communication tunnels that function as persistent backdoors.

    To complicate forensic analysis and evade detection, the threat actors deployed the OAED Loader malware, which injects payloads into legitimate executables according to embedded configurations.

    On certain compromised hosts, the attackers substituted Gokcpdoor entirely with the Havoc command and control framework, demonstrating operational flexibility.

    For data exfiltration and lateral movement, BRONZE BUTLER abused legitimate tools including goddi (Go dump domain info), remote desktop applications, and 7-Zip archiving utility.

    The attackers further leveraged cloud storage services including io and LimeWire accessed through web browsers during remote sessions, successfully stealing confidential organizational data.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Threat Actors Exploit LANSCOPE Endpoint Manager Zero-Day Vulnerability to Steal Confidential Data appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Nation-State Hackers Deploy New Airstalk Malware in Suspected Supply Chain Attack

    ·

    A suspected nation-state threat actor has been linked to the distribution of a new malware called Airstalk as part of a likely supply chain attack. Palo Alto Networks Unit 42 said it’s tracking the cluster under the moniker CL-STA-1009, where “CL” stands for cluster and “STA” refers to state-backed motivation. “Airstalk misuses the AirWatch API for mobile device management (MDM), which is now

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The D Brief: Venezuela targets picked?; STRATCOM nom pressed on tests; USAF fighter plan; New Guard quick-reaction forces; And a bit more.

    ·

    The Trump administration has chosen military installations inside Venezuela to attack, “and the strikes could come at any moment,” the Miami Herald reported Friday—hours after the Wall Street Journal first reported the available targeting. 

    The attacks “will seek to destroy military installations used by the drug-trafficking organization the U.S. says is headed by Venezuelan strongman Nicolás Maduro and run by top members of his regime,” with the goal of “decapitat[ing] the cartel’s hierarchy,” the Herald reports. 

    “If President Trump decides to move forward with airstrikes…the targets would send a clear message to Venezuelan leader Nicolás Maduro that it is time to step down,” U.S. officials told the Journal.

    Update: U.S. military officials “do not know precisely who they have killed in multiple military strikes against alleged drug smuggling boats in the Caribbean” since the attacks began on Sept. 1, Politico reported Thursday following a classified briefing for lawmakers in the House Armed Services Committee. 

    Notable: “The briefing came just one day after Democratic lawmakers were shut out of a similar closed-door Senate meeting on the boat strikes,” the New York Times reports. 

    Sen. Mark Warner of Virginia, the senior Democrat on the Senate Intelligence Committee: “When an administration decides it can pick and choose which elected representatives get the understanding of their legal argument of why this is needed for military force and only chooses a particular party, it ignores all the checks and balances.” Read on, here.

    Additional reading: “UN human rights chief says US strikes on alleged drug boats are ‘unacceptable,’” the Associated Press reported Friday. 

    STRATCOM nominee takes heat hours after Trump’s nuclear-test bombshell. The morning after President Donald Trump vowed to “start testing our Nuclear Weapons,” his pick to lead U.S. Strategic Command fielded questions from senators who wondered what the president meant and what the nominee planned to do about it. Vice Adm. Richard Correll, a submariner and STRATCOM’s deputy commander, vows to give his best military advice. Defense One’s Lauren C. Williams reports.

    ICBM test planned? It appears the U.S. military is about to test an unarmed intercontinental ballistic missile over the Pacific next week, as it does periodically, Dutch researcher Marko Langbroek flagged on social media Friday. 

    New: SpaceX tipped to win $2B for Golden Dome satellites. Wall Street Journal: “The funding was included in the tax-and-spending bill that Trump signed in July, but wasn’t publicly linked to a contractor. The planned ‘air moving target indicator’ system could eventually field as many as 600 satellites,” according to “people familiar with the matter.” More, here.

    Air Force: We need more money to buy the fighter jets we need. Clarifying a report sent to Congress last week, a service official said the Air Force plans to have nearly 1,400 manned tactical aircraft by 2030, about one-quarter more than the 1,160 it has today. But it would need 1,558 to achieve its missions with high confidence and low risk—a goal that would require more funding from Congress. Defense One’s Thomas Novelly reports from the Thursday briefing, here.

    Related: The Senate confirmed fighter pilot Gen. Kenneth Wilsbach to be the Air Force’s next chief of staff. Wilsback will replace Gen. David Allvin, who  unexpectedly announced his retirement in August, halfway through his customary four-year term. Task & Purpose reports, here.

    Moving into generals’ houses. Political appointees Stephen Miller, Kristi Noem, Defense Secretary Pete Hegseth, and Secretary of State Marco Rubio have moved onto military bases, “where they are shielded not just from potential violence but also from protest,” the Atlantic reported on Thursday. The New York Times has more, here.

    Coverage continues below…

    Welcome to this Friday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson with Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1956, the United Kingdom and France began bombing Egypt to force the reopening of the Suez Canal.

    Developing: The National Guard is scrambling to staff and train entirely new “quick reaction forces” by the end of the year, Aaron Glantz of the Guardian reported Wednesday. The effort began in earnest on October 8, when National Guard Army Maj. Gen. Ronald Burkett quietly launched the initiative, which extends from an executive order Trump signed on August 25.

    This means every state is now “required to train 500 national guard members, for a total of 23,500 troops nationwide,” Glantz writes. That’s a sizable uptick from administration plans two months ago reportedly featuring just two groups of 300 troops stationed in Alabama and Arizona as a “Domestic Civil Disturbance Quick Reaction Force.”

    Each state is expected to “be able to deploy a fourth of all their troops within eight hours and all of those assigned to the units within a day,” AP reported Thursday, citing the new memo. “To help with that goal, units will be provided 100 sets of crowd control equipment as well as two full-time trainers by the National Guard Bureau.” 

    Since Guard troops are not trained in handling civil disturbances, they will need to attend special courses in “crowd management techniques,” “domestic civil disturbance training,” and “proper use of baton and body shields,” the memo says. 

    Worth noting: It’s not yet clear exactly how these forces will be dispatched since the U.S. military is forbidden by law from conducting law enforcement activities domestically. The Trump administration has already run afoul of that 150-year-old law with its June deployments of Marines and Guard troops to help immigration enforcement operations in the Los Angeles area—an assignment later found by District Judge Charles Breyer to be in violation of U.S. law. The White House appealed that decision, which moved the case to the 9th Circuit Court.  

    Historian reax: “The establishment of a domestic quick reaction force to quell civil disturbances at a time when there are no civil disturbances that can’t be handled easily by existing law enforcement suggests the administration is expecting those conditions to change,” warned Heather Cox Richardson of Boston College, writing Thursday. 

    Update: Despite the government shutdown, U.S. troops will receive their  next paycheck. Newsweek reported this week “The money comes from multiple sources, including $2.5 billion redirected from the administration’s summer tax cut legislation, $1.4 billion from a military procurement account and another $1.4 billion from research and development.”

    See also: “Who is Timothy Mellon, the billionaire who reportedly donated $130M to help pay troops?” via The Hill, reporting Monday. 

    Additional reading: 

    Lastly this week, Ukraine isn’t just hurling attack drones; they’re waging real robot warfare, Defense One’s Patrick Tucker reported Thursday after the release of a recent report from the London-based Royal United Services Institute. 

    What’s going on: “Political developments in Washington interrupted the provision of military-technical assistance, disrupting Ukraine’s ability to coherently plan the equipping of its forces with its international partners. As a result, Ukraine doubled down on a method which delivered results and was under its control: drones,” RUSI’s Jack Watling writes. “Two dedicated UAV regiments, and two non-standard brigades of the Armed Forces of Ukraine…are pioneering the use of novel equipment,” as in air and ground drones.

    Parallel to this, the U.S. and other European militaries are developing new battle-robot concepts around Ukraine’s experiences, Tucker reports. NATO and Ukraine recently tested new ways to counter UAVs. This effort, led by the NATO-Joint Analysis, Training And Education Centre, “aims to keep the alliance on the cutting edge and to support Ukraine,” a NATO official said. But the war in Ukraine has revealed the obsolescence of the way the large militaries of NATO members do many things, from force design to acquisitions to battlefield maneuver. Continue reading, here. 

    Frontline dispatch: Ukrainian soldiers have turned their drone war with Russia into an incentivized game, the New York Times reported Friday. “Wound a Russian soldier? Eight points. Kill one? That is good for 12. A Russian drone pilot is worth more: 15 points for wounding one, and 25 points for a kill. Capturing a Russian soldier alive with the help of a drone is the jackpot: 120 points.”

    How it works: “Teams compete for points to acquire Ukrainian-made gear, including basic surveillance drones and larger drones carrying powerful explosives, through an internal Amazon-style weapons store called Brave1 Market…The more points a unit gets, the better stuff it can buy, ensuring that resources are directed to the teams that best use them.” Story (gift link), here. 

    For your ears only, Patrick Tucker unpacked what he learned during a recent trip to Latvia and Estonia regarding the European Union’s emerging plans for a “drone wall” to defend against an increasing number of Russian aerial incursions. Find that podcast episode on our site, at Spotify, or wherever you listen to podcasts. 

    And here are two leftover links we didn’t get to this week, but you might still like to read over the weekend: 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Google Unveils new AI-Protection for Android to Keep You Safe From Mobile Scams

    ·

    , , , ,

    Google is strengthening its defense against mobile scams with advanced AI-powered protections built directly into Android devices.

    As cybercriminals become more sophisticated, using AI themselves to create convincing fraud schemes, Google’s new safeguards work around the clock to protect your personal information and money from theft.

    Mobile scams cost people worldwide over $400 billion annually, as fraudsters send increasingly convincing messages and calls to trick unsuspecting users.

    Android now blocks over 10 billion suspected malicious calls and messages every month, preventing scams before they even reach your phone.

    Android Gets Smarter at Blocking Scammers

    Recent surveys comparing Android and iPhone users reveal significant differences in protection effectiveness. Android users reported receiving 58% fewer scam texts than iPhone users in the previous week.

    When comparing Google Pixel phones specifically to iPhones, the advantage grew even larger. Pixel users were 96% more likely to report zero scam messages.

    users’ experience with scams on Android and iOS
    users’ experience with scams on Android and iOS

    The difference extends to user confidence. Android users were 20% more likely to describe their device’s scam protections as “very effective,” while iPhone users were 150% more likely to say their protections were ineffective.

    Google’s defense strategy uses multiple layers of protection. Google Messages automatically filters spam by analyzing sender reputation and message patterns.

    For suspicious calls, Phone by Google blocks known spam automatically and screens unfamiliar numbers. Advanced on-device AI analyzes conversations in real-time, warning you about fraudulent patterns without saving any call data on your phone.

    comparison of Android and iOS AI-powered protections
    Comparison of Android and iOS AI-powered protections

    These protections work silently in the background, combined with Google Play Protect scanning apps for threats and Safe Browsing protection in Chrome.

    Android continuously updates its defenses, blocking over 100 million suspicious numbers from RCS services monthly to prevent scams before they start.

    comparison of scam protections across various devices
    Comparison of scam protections across various devices

    In today’s threat landscape, intelligent security built into your phone is essential. Google’s commitment to AI-powered protection ensures Android users can communicate confidently, knowing their device is actively defending against modern scams and fraud attempts.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Google Unveils new AI-Protection for Android to Keep You Safe From Mobile Scams appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • China-Linked Hackers Exploit Windows Shortcut Flaw to Target European Diplomats

    ·

    A China-affiliated threat actor known as UNC6384 has been linked to a fresh set of attacks exploiting an unpatched Windows shortcut vulnerability to target European diplomatic and government entities between September and October 2025. The activity targeted diplomatic organizations in Hungary, Belgium, Italy, and the Netherlands, as well as government agencies in Serbia, Arctic Wolf said in a

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Attackers Exploit Windows Server Update Services Flaw to Steal Sensitive Organizational Data

    ·

    , , ,

    Sophos researchers have identified real-world exploitation of a newly disclosed vulnerability in Windows Server Update Services (WSUS), where threat actors are harvesting sensitive data from organizations worldwide. The critical remote code execution flaw, tracked as CVE-2025-59287, has become a prime target for attackers seeking to breach enterprise networks and extract valuable information without authentication requirements. […]

    The post Attackers Exploit Windows Server Update Services Flaw to Steal Sensitive Organizational Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶