• The Russian state-sponsored hacking group tracked as APT28 has been attributed to a new Microsoft Outlook backdoor called NotDoor in attacks targeting multiple companies from different sectors in NATO member countries. NotDoor “is a VBA macro for Outlook designed to monitor incoming emails for a specific trigger word,” S2 Grupo’s LAB52 threat intelligence team said. “When such an email is

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity researchers have lifted the lid on a previously undocumented threat cluster dubbed GhostRedirector that has managed to compromise at least 65 Windows servers primarily located in Brazil, Thailand, and Vietnam. The attacks, per Slovak cybersecurity company ESET, led to the deployment of a passive C++ backdoor called Rungan and a native Internet Information Services (IIS) module

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity researchers uncovered a sophisticated, Iran-linked spear-phishing operation that exploited a compromised Ministry of Foreign Affairs (MFA) mailbox in Oman to deliver malicious payloads to government entities worldwide. Analysts attribute the operation to the “Homeland Justice” group, believed to be aligned with Iran’s Ministry of Intelligence and Security (MOIS). Leveraging stolen diplomatic communications, encoded macros, […]

    The post Iran-Nexus Hackers Impersonate Omani MFA to Target Governments Entities appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybercriminals are deploying increasingly sophisticated methods to bypass security systems, with the latest threat emerging from the advanced Tycoon phishing-as-a-service kit.

    This malicious platform has introduced novel techniques designed to obscure dangerous links, making them nearly invisible to traditional detection systems while maintaining their effectiveness against unsuspecting victims.

    The Tycoon phishing kit represents a significant evolution in email-based attacks, leveraging carefully crafted voicemail messages and fake accounting service notifications to lure targets.

    Carefully crafted and tailored voicemail messages (Source – Barracuda)

    Unlike conventional phishing campaigns that rely on obvious malicious indicators, Tycoon employs advanced URL encoding and structural manipulation techniques that fundamentally alter how links appear to both security tools and human recipients.

    Barracuda analysts identified the emergence of these sophisticated evasion tactics during recent investigations into credential-stealing campaigns.

    The researchers discovered that attackers are now combining multiple obfuscation methods to create hybrid threats that challenge existing security paradigms.

    The most concerning aspect of Tycoon’s approach involves its use of URL-encoding techniques that insert invisible spaces using the ‘%20’ code throughout web addresses.

    This method pushes malicious components beyond the scanning range of automated security systems while maintaining functional links for victims who click them.

    The technique also incorporates Unicode symbols that visually resemble standard punctuation but possess entirely different underlying code structures.

    The core innovation within Tycoon’s arsenal lies in its Redundant Protocol Prefix technique, which creates partially hyperlinked URLs containing deliberate structural inconsistencies.

    Attackers craft addresses featuring duplicate protocol declarations or missing essential components, such as incorporating two ‘https’ prefixes or omitting the standard ‘//’ separator.

    This manipulation ensures that security scanners encounter parsing errors while browsers still interpret the functional portions correctly.

    Consider this example implementation:-

    hxxps:office365Scaffidips[.]azgcvhzauig[.]es\If04

    In this structure, everything preceding the ‘@’ symbol appears legitimate to recipients, featuring trusted brand references like ‘office365’.

    However, the actual destination follows the ‘@’ symbol, directing victims to attacker-controlled infrastructure. The technique exploits browser interpretation protocols that treat pre-‘@’ content as user authentication information rather than the primary destination.

    Credential-stealing phishing page (Source – Barracuda)

    The subdomain abuse component further enhances the deception by creating seemingly legitimate Microsoft-affiliated addresses.

    While ‘office365Scaffidips’ suggests official Microsoft infrastructure, the true destination ‘azgcvhzauig.es’ represents a completely separate, malicious domain designed for credential harvesting.

    These evolving techniques demonstrate how modern phishing operations are adapting to security improvements, requiring organizations to implement multilayered defense strategies incorporating artificial intelligence and machine learning capabilities to identify these sophisticated threats effectively.

    Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

    The post Tycoon Phishing Kit Employs New Technique to Hide Malicious Links appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Under what legal auspices did the White House order Tuesday’s deadly strike on a speedboat off South America? More than 24 hours after the attack on what President Trump claims were eleven “Tren de Aragua Narcoterrorists…transporting illegal narcotics, heading to the United States,” military leaders still aren’t sure, or they’re not saying publicly just yet. 

    “Pentagon officials were still working Wednesday on what legal authority they would tell the public was used to back up the extraordinary strike in international waters,” the New York Times reported Wednesday evening. 

    “Instead of interdicting it, on the president’s orders, we blew it up,” Secretary of State Marco Rubio told reporters Wednesday when asked about the incident during a trip to Mexico City. It’s not clear from the incident video Trump shared that the U.S. military conducted any search of the boat it destroyed or the people it killed on Tuesday. 

    Rubio on Tuesday: “These particular drugs were probably headed to Trinidad or some other country in the Caribbean.”

    On Wednesday, he changed his story, telling reporters that the boat was headed for the United States but offering no evidence for this new claim. Rubio added that “the President, under his authority as Commander-in-Chief, has a right under exigent circumstances [which means a warrantless search] to eliminate imminent threats to the United States, and that’s what he did yesterday in international waters, and that’s what he intends to do” in the future. 

    Trump on Wednesday: “We have tapes of them speaking.” To our knowledge, those tapes have not been released publicly. “In fact, you see it, you see the bags of drugs all over the boat, and they were hit,” he told reporters. Bags are visible in the video, but what’s inside them is not at all clear. What’s more, the Times reported, “A Defense Department official questioned whether a boat that size could hold 11 people,” as the Trump administration alleges. 

    SecDef Hegseth: “We knew exactly who was in that boat. We know exactly what they were doing, and we knew exactly who they represented,” he said on “Fox & Friends” on Wednesday. He offered no evidence to support his claim.  

    Capitol Hill reax: “The administration has not identified the authority under which this action was taken, raising the question of its legality and constitutionality,” said Rep. Adam Smith, D-Washington. The questions this episode raises, Smith added, are “even more concerning. Does this mean Trump thinks he can use the U.S. military anywhere drugs exist, are sold, or shipped? What is the risk of dragging the United States into yet another military conflict?”

    Former Pentagon counsel Ryan Goodman effectively concurred with Smith, writing Wednesday on social media, “I worked at [the Department of Defense]. I literally cannot imagine lawyers coming up with a legal basis for [the] lethal strike of [a] suspected Venezuelan drug boat. Hard to see how this would not be ‘murder’ or war crime under international law that DoD considers applicable.”

    Colombia’s President Gustavo Petro also said it looks like “murder,” writing on social media Wednesday, “If this is true, it is a murder anywhere in the world. We have been capturing civilians who transport drugs for decades without killing them.”

    Notable: The U.S. War Crimes Act criminalizes murder, which is defined as the “act of a person who intentionally kills, or conspires or attempts to kill, or kills whether intentionally or unintentionally in the course of committing any other offense under this subsection, one or more persons taking no active part in the hostilities, including those placed out of combat by sickness, wounds, detention, or any other cause.”

    Dive deeper: Former State Department counsel Brian Finucane assessed several angles of the boat strike in an analysis piece published Wednesday in Just Security. He calls the attack “an unnecessary and performative use of the U.S. military,” and one “that is legally fraught at best,” similar to Trump’s decision to send U.S. troops into American cities like Washington, D.C., and Los Angeles. Here are a few more observations from Finucane: 

    • “The use of lethal force was used in the first resort…to send a message. Such use of lethal force raises a number of distinct legal issues.”
    • “Despite labelling the targets ‘narcoterrorists,’ there is no plausible argument under which the principle legal authority for the U.S. so-called ‘war on terror’—the 2001 Authorization for the Use of Military Force—authorizes military action against the Venezuelan criminal entity Tren de Aragua.”
    • “Drug trafficking by itself does not constitute an ‘armed attack,’ nor a threat of an imminent armed attack, for the purposes in international law. Nor does drug trafficking represent the predicate for self-defense commonly recognized as required for the invocation of self-defense under criminal law in the United States.”
    • “In my view, the U.S. attack on this supposed smuggling vessel constituted the introduction of U.S. armed forces into hostilities, triggering both the reporting requirements of the War Powers Resolution as well as its 60-day clock for withdrawing U.S. forces…U.S. armed forces were deliberately introduced into the situation with the U.S. president himself reportedly giving the order to ‘blow up’ the supposed smuggling vessel.” Read Finucane’s analysis in full, here.  

    Update: The U.S. dispatched another guided-missile cruiser to the waters around Latin America. That would be the Navy’s USS Lake Erie, which was spotted four days ago entering the Caribbean from the Pacific Ocean, via the Panama Canal. 

    Already in the region: The Wasp-class amphibious assault ship Iwo Jima and the San Antonio-class amphibious transport dock ships San Antonio and USS Fort Lauderdale. Those “are operating off the coast of Puerto Rico as sailors and Marines from the 22nd MEU take part in an amphibious landing training exercise on the southern part of that island,” Howard Altman of The War Zone reported Wednesday. 

    There are at least four more warships nearby: USS Gravely, USS Jason Dunham, USS Sampson, and the fast attack submarine USS Newport News. 

    What may lie ahead: “Anyone else trafficking in those waters who we know is a designated narco-terrorist will face the same fate” as the four-engine speedboat, Pentagon chief Hegseth told “Fox & Friends” Wednesday. “It’s important to the American people to protect our homeland and protect our hemisphere.” 


    Welcome to this Thursday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson with Bradley Peniston. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1998, Larry Page and Sergey Brin founded Google. 

    The future of the National Guard

    After objections in Illinois, Trump says he could send National Guard troops to New Orleans, where the state’s governor is also a Republican, like Trump. “We’re making a determination now, do we go to Chicago, or do we go to a place like New Orleans?” the president told reporters Wednesday. 

    Louisiana Gov. Jeff Landry replied: “We will take President [Trump]’s help from New Orleans to Shreveport!”

    For the record: “Landry doesn’t have to wait for Trump if he wants National Guard troops in New Orleans,” the Wall Street Journal reports, citing law professor Steve Vladeck. “The governor can just call out the Louisiana national guard to perform whatever services are necessary. There’s no need for federal intervention,” Vladeck said. 

    Background: Trump’s use of National Guard and Marines in Los Angeles this past June violated the Posse Comitatus Act, a federal judge said Tuesday in a 52-page opinion (PDF). The “defendants instigated a months-long deployment of the National Guard and Marines to Los Angeles for the purpose of establishing a military presence there and enforcing federal law…There were indeed protests in LosAngeles, and some individuals engaged in violence. Yet there was no rebellion, nor was civilian law enforcement unable to respond to the protests and enforce the law.” 

    “Such conduct is a serious violation of the Posse Comitatus Act,” he wrote, and warned, “Los Angeles was the first US city where President Trump and Secretary Hegseth deployed troops, but not the last.” 

    Update: About 140 unmarked vehicles have entered the largest military installation in Illinois, Naval Station Great Lakes, located just north of Chicago, the Sun-Times reported Wednesday. Officials are also hoping to “establish a no-fly zone to keep away news helicopters and drones that aren’t already prohibited from flying in the area.”

    Context: “Trump highlighted a surge in gun violence in Chicago over the weekend, framing himself as a savior who can quickly solve an intractable problem,” the Sun-Times reports. But “The deployment, and threats of the National Guard, come as a WBEZ analysis has found that a three-month summer span saw the fewest murders in 60 years in Chicago while overall violent crime remained near its lowest point in at least four decades.”

    Additional reading: 

    Industry

    The jets were late. Lockheed got on-time bonuses anyway. The maker of F-35 jets is getting paid for on-time delivery, even though it’s not delivering the aircraft on time and without the required upgrades, a government watchdog agency said. “The F-35 program office compensated Lockheed Martin with hundreds of millions of dollars of performance incentive fees while the percentage of aircraft delivered late and the average days late grew,” according to a new report from the Government Accountability Office. Defense One’s Audrey Decker has more, here

    The infantry is getting AI tools to spot incoming threats, the Wall Street Journal reports off a $98.9 million contract between the U.S. Army and TurbineOne, a four-year-old San Francisco startup. “TurbineOne’s software runs on soldiers’ laptops, smartphones and drones, eliminating the need for a steady cloud connection. The AI application equips individual soldiers with the ability to quickly identify enemy threats, such as a drone-launch site or concealed troop position, and the context needed to decide how to respond without relying on analysts sitting miles away.” Read on, here.

    Additional reading: Oak Ridge is using diamonds to marry quantum, classical computers,” our sister site Nextgov reported Wednesday. 

    China’s military parade

    Chinese leader Xi Jinping staged a giant military parade that marked the public debut of several new weapons. Washington Post: “China’s ambitions to rival the United States militarily—and gain the edge in a potential war over Taiwan—were laid bare Wednesday when Beijing displayed a breathtaking array of advanced new weaponry…” Among them were a new ICBM, a light tank, 65-foot unmanned submarines, and more.

    Find the Post’s multimedia list of the new arms on display, here, and another one from the New York Times, here.

    Salt Typhoon update: China’s “unrestrained” hacking group may have stolen information from nearly every American, officials said. “I can’t imagine any American was spared given the breadth of the campaign,” Cynthia Kaiser, a former top official in the F.B.I.’s cyber division, who oversaw investigations into the hacking, told the New York Times. Read on, here.

    Related reading:

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Tire manufacturer launches a comprehensive investigation after a limited cyber incident affects operations at multiple plants. Bridgestone Americas has confirmed that a cyberattack has impacted manufacturing facilities across North America, including two plants in Aiken County, South Carolina. The tire manufacturing giant disclosed the cyber incident on Thursday, stating that it has launched a comprehensive […]

    The post Bridgestone Confirms Cyberattack Impacts Manufacturing Facilities Across North America appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Tire manufacturing giant Bridgestone Americas has confirmed it is responding to a cyberattack that disrupted operations at some of its manufacturing facilities this week.

    In a statement, the company asserted that the incident has been contained and that business is now operating normally, though a full investigation into the breach is ongoing.

    Bridgestone acknowledged that it identified a “limited cyber incident” that impacted its production capabilities. “We have launched a comprehensive forensic analysis and believe we contained the incident early,” the company stated.

    The disruption directly impacted plant workers. At facilities including the company’s two plants in Aiken County, South Carolina, employees whose normal duties were halted were reportedly given a choice: stay on-site to perform preventive maintenance and receive a full day’s pay, or opt to go home without pay.

    While Bridgestone’s official statements characterize the incident as “limited,” reports from local officials suggest a potentially more widespread event. Pierre-Luc Bellerose, Mayor of Joliette, Quebec, where Bridgestone operates a large plant, told local media that he believes the attack affected all of the company’s factories in North America.

    Mayor Bellerose, who contacted company executives after being alerted to the situation, noted that an internal memo was sent to employees. The Joliette plant alone employs an estimated 1,400 people.

    A primary concern in any cyberattack is data security. On this front, Bridgestone has moved to reassure its stakeholders, stating, “it doesn’t believe any customer data was affected in the incident.” Mayor Bellerose echoed this sentiment after his conversations with the company. “No information has been compromised, either for employees or customers,” he said. “I’ve been reassured on that front.”

    This event marks the second major cybersecurity challenge for Bridgestone in recent years. The company suffered a significant ransomware attack in 2022 that also forced production to a halt and was attributed to the LockBit hacking group.

    As the forensic investigation continues, the exact nature of this new cyber incident and the full scope of its impact remain under review. In a written statement, Bridgestone Americas reiterated that it is “continuing its investigation” while maintaining that business is proceeding as usual.

    Find this Story Interesting! Follow us on Google NewsLinkedIn, and X to Get More Instant Updates.

    The post Bridgestone Confirms Cyberattack Impacts Manufacturing Facilities appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A sophisticated threat actor known as NoisyBear has emerged as a significant concern for Kazakhstan’s energy sector, employing advanced tactics to infiltrate critical infrastructure through weaponized ZIP files and PowerShell-based attack chains.

    This newly identified group has been orchestrating targeted campaigns against KazMunaiGas (KMG), the country’s national oil and gas company, using highly crafted phishing emails that mimic legitimate internal communications about salary schedules and policy updates.

    The attack methodology demonstrates remarkable precision in social engineering, with threat actors compromising legitimate business email accounts within KazMunaiGas to lend authenticity to their malicious communications.

    These emails contain ZIP attachments disguised as urgent HR-related documents, creating a false sense of legitimacy that encourages employee interaction.

    The campaign’s sophistication extends beyond simple phishing, incorporating multi-stage payload delivery systems that leverage trusted system binaries and PowerShell execution environments to maintain stealth throughout the infection process.

    Seqrite researchers identified this threat group’s activities beginning in April 2025, with active campaigns intensifying throughout May 2025.

    The researchers noted that NoisyBear’s operational patterns suggest Russian origins, evidenced by Russian language comments within malicious code, utilization of sanctioned hosting services, and targeting patterns consistent with geopolitical interests in Central Asian energy resources.

    Infection Chain (Source – Seqrite)

    The group’s infrastructure analysis reveals connections to Aeza Group LLC, a sanctioned hosting provider, indicating deliberate attempts to operate within jurisdictions that complicate attribution and takedown efforts.

    The malware’s impact extends beyond simple data theft, incorporating advanced persistence mechanisms and defense evasion techniques that allow prolonged network access.

    Victims face potential exposure of sensitive corporate communications, strategic planning documents, and operational data critical to Kazakhstan’s energy infrastructure.

    The campaign’s focus on energy sector entities raises concerns about potential disruption to critical national infrastructure and economic stability.

    Infection Mechanism and Technical Analysis

    The NoisyBear infection chain begins with malicious ZIP files containing three critical components: a decoy document bearing the official KazMunaiGas logo, a README.txt file providing execution instructions, and a weaponized LNK file named “График зарплат.lnk” (Salary Schedule.lnk).

    The malicious shortcut file employs PowerShell as a Living Off The Land Binary (LOLBIN) to execute sophisticated download operations.

    Upon execution, the LNK file initiates a PowerShell command that retrieves a malicious batch script named “123.bat” from the remote server “77.239.125.41:8443”.

    The downloaded script is strategically placed in the C:\Users\Public directory, a location chosen for its accessibility and reduced security scrutiny.

    The batch script serves as a secondary loader, downloading PowerShell scripts dubbed “DOWNSHELL” by researchers.

    These loaders demonstrate advanced Anti-Malware Scan Interface (AMSI) bypass techniques, using reflection to manipulate the System.Management.Automation.AmsiUtils class.

    The malware sets the “amsiInitiFailed” flag to convince PowerShell that AMSI initialization has failed, effectively disabling real-time scanning capabilities for subsequent malicious operations.

    The final payload involves process injection techniques targeting explorer.exe, utilizing classic CreateRemoteThread injection methods.

    The malware employs OpenProcess, VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread API calls to inject Meterpreter reverse shell capabilities, establishing persistent backdoor access for data exfiltration and remote command execution.

    Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

    The post NoisyBear Weaponizing ZIP Files to PowerShell Loaders and Exfiltrate Sensitive Data appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The threat actor known as NoisyBear has launched a sophisticated cyber-espionage effort called Operation BarrelFire, using specially designed phishing lures that imitate internal correspondence to target Kazakhstan’s energy sector, particularly workers of the state oil and gas major KazMunaiGas. Security researchers at Seqrite Labs first observed the campaign in April 2025 and noted its rapid […]

    The post NoisyBear Exploits ZIP Files for PowerShell Loaders and Data Exfiltration appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • ESET security researchers have uncovered a sophisticated cyber threat campaign targeting Windows servers across multiple countries, with attackers deploying custom malware tools designed for both remote access and search engine manipulation. Cybersecurity experts at ESET have identified a previously unknown threat group dubbed GhostRedirector, which has successfully compromised at least 65 Windows servers primarily located in […]

    The post GhostRedirector Hackers Target Windows Servers Using Malicious IIS Module appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶