1010.cx

  • Hackers Abuse Microsoft Teams to Gain Remote Access With PowerShell-based Malware

    ·

    , ,

    Cybercriminals are increasingly weaponizing Microsoft Teams, exploiting the platform’s trusted role in corporate communications to deploy malware and seize control of victim systems.

    In a sophisticated campaign, threat actors are impersonating IT support staff in Microsoft Teams chats to trick employees into granting remote access, marking a dangerous evolution from traditional email-based phishing attacks.

    Social engineering remains a highly effective tactic for hackers, and as businesses have integrated platforms like Microsoft Teams into their core operations, attackers have followed. The inherent trust employees place in internal messaging makes it a fertile ground for deception.

    Recent campaigns analyzed by Permiso cybersecurity researchers reveal a multi-stage attack that begins with a simple message and culminates in the deployment of potent, multifunctional malware.

    PowerShell-based Malware via Microsoft Teams

    The attack chain often starts with a direct message or call from a newly created or compromised Microsoft Teams account. These accounts are designed to look legitimate, using display names like “IT SUPPORT ✅” or “Help Desk Specialist” to impersonate trusted personnel.

    Microsoft team Attack Chain
    Microsoft team Attack Chain

    Attackers often use checkmark emojis to simulate a verified status and leverage Microsoft’s onmicrosoft.com domain structure to appear as if they are part of the organization.

    Posing as IT staff addressing a routine issue like system maintenance, the attackers build rapport with their target.

    Once trust is established, they persuade the employee to install remote access software, such as QuickAssist or AnyDesk, under the guise of providing technical assistance. This critical step gives the attacker a direct foothold into the user’s machine and the corporate network.

    While similar techniques involving remote access tools have been linked to ransomware groups like BlackBasta since mid-2024, these newer campaigns are more direct, often forgoing the preliminary mass email campaigns seen in the past.

    The malicious payloads have also diversified, with recent incidents involving the DarkGate and Matanbuchus malware loaders.

    Once remote access is secured, the attacker executes a PowerShell command to download the primary malicious payload. This script is far from simple, equipped with capabilities for credential theft, establishing long-term persistence, and remote code execution, Permiso said.

    To evade detection and complicate removal, the malware can designate its own process as “critical,” which would cause the system to crash if terminated.

    It also uses a legitimate-looking Windows credential prompt to trick users into entering their passwords, which are then exfiltrated to an attacker-controlled server.

    Analysis of the payload’s code revealed hardcoded encryption keys that link the campaign to a known financially motivated threat actor tracked as Water Gamayun (also known as EncryptHub).

    This group has a history of combining sophisticated social engineering with custom malware to target English-speaking IT professionals and developers.

    Employees must be trained to remain vigilant against unsolicited contact, even on trusted internal platforms. All requests for credentials or the installation of remote access software should be independently verified through a known, separate communication channel.

    OHere is a table of the Indicators of Compromise (IoCs) based on the provided information.

    IndicatorType
    https://audiorealteak[.]com/payload/build.ps1URL
    https://cjhsbam[.]com/payload/runner.ps1URL
    104.21.40[.]219IPv4
    193.5.65[.]199IPv4
    Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) AppleWebKit/534.6 (KHTML, like Gecko) Chrome/7.0.500.0 Safari/534.6User Agent (UA)
    &9*zS7LY%ZN1thfIInitialization Vector
    123456789012345678901234r0hollahEncryption Key
    62088a7b-ae9f-2333-77a-6e9c921cb48eMutex
    Help Desk Specialist ✅User Display Name
    IT SUPPORT✅User Display Name
    Marco DaSilva IT Support ✅User Display Name
    IT SUPPORT ✅User Display Name
    Help DeskUser Display Name
    @cybersecurityadm.onmicrosoft[.]comUser Principal Name
    @updateteamis.onmicrosoft[.]comUser Principal Name
    @supportbotit.onmicrosoft[.]comUser Principal Name
    @replysupport.onmicrosoft[.]comUser Principal Name
    @administratoritdep.onmicrosoft[.]comUser Principal Name
    @luxadmln.onmicrosoft[.]comUser Principal Name
    @firewalloverview.onmicrosoft[.]comUser Principal Name

    As threat actors continue to innovate, a defense-in-depth strategy, combining technical controls with robust user education, is essential to protect against attacks that turn collaboration tools into conduits for compromise.

    Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.

      The post Hackers Abuse Microsoft Teams to Gain Remote Access With PowerShell-based Malware appeared first on Cyber Security News.

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

    1. State of Nevada Faces IT Outage Amid Cyberattack, Offices Suspended

      ·

      , ,

      The State of Nevada became the target of a significant cyberattack which resulted in a substantial network security incident impacting government infrastructure across multiple agencies. According to an official communication from the Governor’s Technology Office, state officials rapidly identified the breach and immediately commenced continuous recovery efforts aimed at containing the incident and restoring affected […]

      The post State of Nevada Faces IT Outage Amid Cyberattack, Offices Suspended appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

    2. BadSuccessor Post-Patch: Leveraging dMSAs for Credential Acquisition and Lateral Movement in Active Directory

      ·

      , , ,

      Microsoft’s recent patch for the BadSuccessor vulnerability (CVE-2025-53779) has successfully closed the direct privilege escalation path, but security researchers warn that the underlying technique remains viable for sophisticated attackers. 

      While the patch prevents immediate Domain Admin escalation through one-sided delegated Managed Service Account (dMSA) links, threat actors can still exploit the fundamental mechanics for credential harvesting and lateral movement in compromised Active Directory environments.

      Key Takeaways
      1. CVE-2025-53779 patch enforces mutual dMSA–account links at the KDC, blocking one-sided privilege escalations.
      2. dMSA mechanics still enable credential grabs and dumps.
      2. Mitigate by patching servers.

      The BadSuccessor vulnerability originally allowed low-privileged users to achieve instant Domain Admin privileges by abusing Windows Server 2025’s new dMSA account type. 

      By creating a controlled dMSA and linking it to high-privilege accounts, attackers could inherit both effective privileges and Kerberos keys without requiring group membership changes or exotic tooling. 

      The technique exploited how the Key Distribution Center (KDC) treated linked dMSAs as successors during authentication, merging target privileges into the dMSA’s Privilege Attribute Certificate (PAC) and returning credential packages containing the target’s authentication keys.

      BadSuccessor Post-Patch

      Microsoft’s patch implementation focuses on KDC-level validation rather than directory-side attribute protection. 

      Akamai reports that the kdcsvc.dll changes now require mutual linking between dMSA and target accounts, mirroring legitimate migration patterns. 

      However, this enforcement mechanism still permits two critical attack primitives that defenders must monitor. The first primitive enables credential and privilege acquisition as an alternative to shadow credential attacks. 

      When attackers control both a target principal and a dMSA, they can establish a mutual pairing to request dMSA tickets. 

      Error when authenticating a dMSA with a one-sided link- — failure occurs at ticket issuance
      Error when authenticating a dMSA with a one-sided link- — failure occurs at ticket issuance

      This approach offers several advantages: acting with target privileges while using dMSA identity for evasion, obtaining target keys more reliably than Kerberoasting attacks, and generating different telemetry signatures focused on link modifications and Ticket Granting Ticket (TGT) issuance to the dMSA.

      The second primitive provides a DCSync alternative for credential dumping in already-compromised domains. 

      Rather than using traditional replication-based techniques, attackers can leverage BadSuccessor mechanics to extract principal keys through normal ticket issuance processes. 

      This approach generates distinct behavioral signatures that may bypass existing detection mechanisms designed for conventional credential dumping methods.

      Mitigations

      Detection strategies should focus on System Access Control Lists (SACLs) auditing for dMSA creation and migration link attribute changes. 

      Behavioral indicators include repeated dMSA password fetch attempts within short timeframes, enabled users unexpectedly linked to dMSAs, and previously disabled accounts receiving new dMSA associations. 

      Organizations should prioritize patching Windows Server 2025 domain controllers while reviewing organizational unit permissions and tightening dMSA delegation controls to Tier 0 administrators only.

      The evolution of BadSuccessor from vulnerability to persistent technique highlights a broader industry challenge where patches close specific exploitation paths while underlying attack mechanics remain exploitable. 

      Security teams must adapt their monitoring and detection capabilities to account for these evolved threat vectors, recognizing that sophisticated attackers will continue leveraging dMSA relationships for credential acquisition and lateral movement even in patched environments.

      Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.

      The post BadSuccessor Post-Patch: Leveraging dMSAs for Credential Acquisition and Lateral Movement in Active Directory appeared first on Cyber Security News.

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

    3. Threat Actors Exploit Velociraptor Incident Response Tool for Remote Access

      ·

      , ,

      Researchers from the Counter Threat Unit (CTU) at Sophos uncovered a sophisticated intrusion where threat actors repurposed the legitimate open-source Velociraptor digital forensics and incident response (DFIR) tool to establish unauthorized remote access within targeted networks. Velociraptor, designed for endpoint visibility and forensic analysis, was deployed maliciously to download and execute Visual Studio Code, facilitating […]

      The post Threat Actors Exploit Velociraptor Incident Response Tool for Remote Access appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

    4. MathWorks Confirms Cyberattack, User Personal Information Stolen

      ·

      , , ,

      MathWorks, Inc., the developer of the popular MATLAB and Simulink software, confirmed today that it was the target of a significant cyberattack, resulting in the theft of sensitive personal information belonging to an undisclosed number of users.

      In a notice sent to affected individuals, the company disclosed that it discovered a security incident on May 18, 2025, which involved unauthorized access to its internal networks and systems.

      A subsequent investigation revealed that the threat actor had maintained access to the systems for approximately one month, from April 17 to May 18, 2025.

      Investigation Results

      According to MathWorks, the compromised data may include a range of personally identifiable information (PII). The company stated the stolen information varies by individual but could include full names, addresses, dates of birth, Social Security Numbers, and other non-U.S. national identification numbers. The breach exposes affected users to a heightened risk of identity theft and fraud.

      Upon discovering the intrusion, MathWorks reported that it immediately initiated its incident response protocols, notified federal law enforcement, and engaged third-party cybersecurity experts to investigate the scope of the breach.

      The company has since worked to contain the threat, eradicate unauthorized access, and implement additional measures to safeguard its systems, according to the notice.

      “We have eradicated the unauthorized access and taken steps to safeguard our systems and information,” the company’s statement read. MathWorks has also engaged a third-party service to conduct dark web monitoring for any signs of the stolen data being sold or published.

      To date, the company claims there is no evidence that the stolen data has been sold, posted online, or actively misused. “While we are not aware of any actual or attempted misuse of personal information or any financial harm to involved individuals as a result of this incident, as a protective measure, we are providing notice of this incident and identity protection services,” the notice continued.

      MathWorks is urging all customers, especially those who received a notification, to remain vigilant. The company advises users to closely review their financial account statements and monitor their free credit reports for any suspicious activity or errors. It has provided an informational guide on general identity theft protection to all affected individuals.

      This incident places MathWorks among a growing list of technology companies targeted by sophisticated cybercriminals aiming to steal valuable user data. The company has not yet commented on the number of users impacted or the specific nature of the attack.

      Tired of Filling Forms for security & Compliance questionnaires? Automate them in minutes with 1up! Start Your Free Trial Now!

      The post MathWorks Confirms Cyberattack, User Personal Information Stolen appeared first on Cyber Security News.

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

    5. The D Brief: Ousted DIU chief’s legacy; Russian UAVs over Germany; DDG of drones?; Robot wingman takes flight; And a bit more.

      ·

      Ousted DIU leader leaves behind a blueprint for faster tech. Defense Innovation Unit Director Doug Beck, a champion of acquisition reform who was instrumental in the Pentagon’s push to rapidly build and deploy new technology, resigned Friday due to political pressure, Defense Department sources told Defense One’s Patrick Tucker. Pentagon officials had raised concerns about Beck’s political donations to Democrats, Reuters reported Monday.

      Beck’s efforts had received broad endorsement from Republican lawmakers and SecDef Hegseth. A March memo from the Defense Secretary’s office essentially directed a scaling-up of DIU’s practices: removing barriers and contract restrictions so the services and the combatant commands can purchase new technology through streamlined contracts. The memo also gave DIU a central role in execution, directing the undersecretary for acquisition “in coordination with the Director of the Defense Innovation Unit” to produce an implementation plan.

      In July, Hegseth doubled down with a second memo building on Beck’s efforts, “delegating authorities to procure and operate drones from the bureaucracy to our warfighters” and giving brigade commanders greater authority to buy new tech. The changes, which had been urged for years by lawmakers and government watchdogs, were made possible by Beck, one former official said. Tucker has more, here.

      The 10-year-old DIU will be led in an acting capacity by Emil Michael, defense undersecretary for research and engineering, DOD officials have confirmed. 

      Report: The final draft of the National Defense Strategy has been distributed in the Pentagon. Nikkei Asia says the 80-page document draws from Vice President JD Vance's speeches and interviews and Pentagon policy chief Elbridge Colby's book Strategy of Denial.

      ICYMI: “Civilian and uniformed Pentagon officials have said publicly that this administration is prioritizing the geographical United States in its national security policy, a departure from recent administrations—including Trump’s first—that have described conflict with China in the Indo-Pacific or terrorism in the Middle East as the biggest threats to America,” Defense One’s Meghann Myers reported earlier this month.

      Podcast: Ohio State University’s Angus Fletcher uses his work with U.S. special operations forces to explain a new neuroscientific approach to intuition, imagination, emotion, and common sense. He talked with your D Brief-er for Defense One Radio’s Ep. 191: “Primal Intelligence.” Listen, here.

      Could a flotilla of robot boats do the job of a destroyer? “We have a thesis in TF66 we call the ‘deconstructed DDG,” said Rear Adm. Michael Mattis, who leads an effort to figure out how low-cost, commercially available uncrewed systems might fit into the Navy’s Sixth Fleet. “We think that with 20 USVs of different, heterogeneous types, we could deconstruct a mission that a DDG could do. And we think we could do it at a cost point of essentially 1/30 of what a DDG would cost.” Mattis talked more about his team’s work Wednesday at the NDIA conference; Defense One’s Lauren C. Williams has more of that, here. 

      More reading:

      Welcome to this Thursday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson with Bradley Peniston. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1867, U.S. Navy Capt. William Reynolds of USS Lackawanna formally seized possession of the Midway Atoll for the United States.

      Around the Air Force

      A second B-21 Raider bomber will likely fly by year’s end, joining the pre-production test aircraft that first flew in late 2023 and has since been flying up to twice a week. That news comes from Lt. Gen. Andrew Gebara, Air Force deputy chief of staff for strategic deterrence and nuclear integration, who spoke Wednesday at an event hosted by the Mitchell Institute. Gebara added that the extra $4.5 billion for the aircraft provided in the reconciliation bill would go a “long way” to help move to full-rate production.

      The three-star joined other military officials in suggesting that the Air Force may need to buy more than the planned 100 B-21s, but he said it will be a “long time” before the service comes to an official conclusion about that. Defense One’s Audrey Decker has a bit more, here.

      Gebara added a rare public comment about the deployment of the B61-12 nuclear gravity bomb. Asked about recent reports that American nukes are back in the UK after almost two decades, he declined to answer directly but said, “We now have F-35, 5th-gen sensor-fused aircraft, many of our allies purchasing the same aircraft, common training, common TTPs [tactics, techniques, and procedures], with our modernized B61-12 weapon that has been fully deployed throughout the continent.”

      That almost, but not precisely, echoed what another senior nuclear-weapons official has said. “The new B61-12 gravity bombs are fully forward deployed, and we have increased NATO’s visibility to our nuclear capabilities through visits to our enterprise and other regular engagements,” Jill Hruby, who was then the administrator of the National Nuclear Safety Administration, said in January. 

      No successor: Hruby stepped down as NNSA director at the beginning of the Trump administration. Brandon Williams, a former GOP congressman, was quickly named as her successor but has not been confirmed by the U.S. Senate. The NNSA website says an acting director is in place.

      A “robot wingman” makes first flight. The YFQ-42A, General Atomics’ entry in the contest to build collaborative combat aircraft for the Air Force, took off Wednesday from its airport in Palmdale, California, according to a service press release. Anduril says its rival YFQ-44 will fly “soon.” Decker has more, here.

      Related reading:

      Trump 2.0

      ICE and CBP agents want to stage out of a naval base north of Chicago (Naval Station Great Lakes) during the month of September “as part of President Donald Trump’s plan to target Chicago,” the Chicago Sun-Times reported Wednesday. 

      “These operations are similar to what occurred in Los Angeles earlier this summer. Same [Department of Homeland Security] team,” the base’s commander said in an email Monday. He also said “there is the potential to also support National Guard units,” adding, “Not many details on this right now. Mainly a lot of concerns and questions.”

      One source told the paper that “about 30 to 40 ICE agents had been practicing riot control tactics at the military installation for months, using flash-bang grenades and marching in phalanxes with shields. The source said the planned operation would likely involve more agents than had been previously running drills, noting that the barracks can house 200 people.”

      Second opinion: “We know that Donald Trump bringing in ICE and other federal enforcement to Chicago isn’t about ‘law and order’ because he is once again refusing to coordinate with our local officials,” said Army veteran and Sen. Tammy Duckworth, D-Illinois. She also called it “yet another unwarranted, unwanted and unjust move straight out of the authoritarian’s playbook that will only undermine our military’s readiness and ultimately weaken our national security.” 

      And: “May I remind the President that deploying the military to Chicago, and derailing critical operations at Naval Station Great Lakes, would be both unhelpful and illegal,” Duckworth’s Senate colleague Dick Durbin said. Full story, here. 

      Meanwhile, Reuters reports Trump’s police takeover and military occupation of the nation’s capital has yielded not one case “involv[ing] someone being charged with a violent offense” in the nearly two weeks since it began. 

      Out of more than 500 criminal cases filed since August 11, “records show Trump’s anti-crime task force was involved in at least 69 local cases over the past two weeks, of which nearly half were comparatively minor offenses, including misdemeanors,” the wire service reported Wednesday. “The rest were felonies under the local D.C. code, not the more serious federal felonies that agencies usually handle. About half of those were for carrying a firearm without a license, possessing drugs with intent to distribute, or both.” More, here. 

      ICYMI: “Just 38% of Americans support using troops for law enforcement in the U.S. capital, with 46% opposed,” Reuters reported Wednesday from new polling results. More than three-quarters of Republicans supported it compared to just 8% of Democrats. Among independents, “28% were in favor and 51% were opposed.” More, here. 

      Hoagie-hurler update: Federal prosecutors could not get a grand jury to indict the Air Force veteran and Department of Justice employee who tossed a Subway sandwich at a CBP officer in Washington on August 13, shouting “fascists” and said, “I don’t want you in my city!”  

      Why bring it up: “It is extremely unusual for prosecutors to come out of a grand jury without obtaining an indictment because they are in control of the information that grand jurors hear about a case and defendants are not allowed to have their lawyers in the room as evidence is presented,” the New York Times reports. “Prosecutors typically have 30 days to secure an indictment after a defendant is arrested. If they fail to do so within that window, they either have to reduce the charges to a misdemeanor or dismiss the case altogether.”

      Update: Florida’s “Alligator Alcatraz” migrant detention center will “probably [be] going to be down to 0 individuals within a few days,” Florida Division of Emergency Management Executive Director Kevin Guthrie said in an email last Friday, according to the Associated Press. 

      Background: This new development comes “less than a week after a federal judge in Miami ordered the detention center to wind down operations, with the last detainee needing to be out within 60 days.” Florida officials have asked the judge to delay her deadline, pending an appeal. More, here. 

      Additional reading: 

      Russia’s Ukraine war

      Russian drone and missile attacks killed at least 18 Ukrainians overnight, the Wall Street Journal reports from Kyiv, calling it “the worst death toll in the capital since Trump held talks in Alaska earlier this month with Russian leader Vladimir Putin.” 

      At least four of those killed were children, Ukrainian President Volodymir Zelenskyy said on social media. 

      “Russia has no intentions of ending this war,” Finland President Alexander Stubb wrote on social media after Russia’s latest deadly attacks. And “Russia has not changed its main strategic aim of destroying the independence, sovereignty and territorial integrity of Ukraine,” he stressed, and added, “Finland will continue to support Ukraine with all necessary diplomatic, financial and military efforts. For as long as it takes.”

      Italian Prime Minister Giorgia Meloni: “The intense attacks on Kyiv this night demonstrate who stands on the side of peace and who has no intention of believing in the negotiating path. Our thoughts go to the Ukrainian people, to civilians, to the families of defenseless victims, including children, of the senseless Russian attacks.” 

      New: Russians or their proxies are flying surveillance drones over eastern Germany, where the U.S. and its allies move weapons, the New York Times reported Thursday. “The flights, concentrated in the eastern German state of Thuringia, were also reported by WirtschaftsWoche, a German publication that has reported extensively on the [alleged Russian] sabotage campaign” throughout Europe since Russia’s full-scale Ukraine invasion began in 2022. 

      “U.S. officials confirmed the flights but said they were unable to track their origin. They believe the drones have been flown by Russians or people working for Russian intelligence services,” the Times reports. More, here. 

      Related reading: 

      ]]>

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

    6. Threat Actors Abuse Velociraptor Incident Response Tool to Gain Remote Access

      ·

      , , , ,

      A sophisticated intrusion in which threat actors co-opted the legitimate, open-source Velociraptor digital forensics and incident response (DFIR) tool to establish a covert remote access channel.

      This represents an evolution from the long-standing tactic of abusing remote monitoring and management (RMM) utilities, with attackers now repurposing DFIR frameworks to minimize custom malware deployment and evade detection.

      During the attack, the adversary leveraged the native Windows msiexec utility to download and install a malicious Velociraptor MSI package from a Cloudflare Workers–hosted staging domain, files.qaubctgg.workers.dev.

      This staging area also housed other attacker tools, such as a Cloudflare tunneling component and the Radmin remote administration tool. Once installed, Velociraptor was configured to communicate with a command-and-control (C2) server at velo.qaubctgg.workers[.]dev.

      Next, the intruder executed an obfuscated PowerShell command to retrieve Visual Studio Code (code.exe) from the same workers.dev folder and ran it with the built-in tunnel feature enabled.

      Process tree showing Velociraptor creating Visual Studio Code tunnel.
      Process tree showing Velociraptor creating Visual Studio Code tunnel.

      By installing code.exe as a Windows service and redirecting its output to a log file, the threat actor effectively created a persistent, encrypted tunnel to the attacker’s C2 infrastructure.

      This technique bypassed many traditional security controls, as the tunneling feature in Visual Studio Code is often used legitimately by developers for remote collaboration, according to Sophos’ investigation.

      In response, CTU analysts provided the affected organization with mitigation guidance, enabling rapid isolation of the compromised host. This containment measure prevented the adversary from advancing to their ultimate goal of ransomware deployment.

      Velociraptor Incident Response Tool Abused

      Although remote access abuse via RMM tools is a familiar tactic documented in previous incidents involving SimpleHelp vulnerabilities and virtual machine–based tools, this case marks one of the first observed instances in which DFIR software itself was weaponized.

      By pivoting to Velociraptor, the attackers reduced reliance on bespoke malware, lowering their operational footprint and complicating attribution.

      CTU’s analysis indicates that this tradecraft should be treated as a likely precursor to ransomware. Organizations are therefore advised to:

      • Monitor unauthorized deployments of DFIR and incident response tools, including Velociraptor, across endpoints and servers.
      • Implement comprehensive EDR systems capable of detecting atypical processes and suspicious command lines.
      • Enforce strict application allow-listing policies to block unapproved installers and service creations.
      • Regularly audit network traffic for unexpected encrypted tunnels or anomalous C2 beaconing.
      • Maintain robust, offline backups and rehearse ransomware recovery plans.

      Security teams should review and restrict access to these domains, taking into account the risk of interacting with potentially malicious content.

      Indicator TypeDomainDescription
      Installerfiles.qaubctgg.workers.dev/v2.msiVelociraptor MSI package
      Tunneling Toolfiles.qaubctgg.workers.dev/code.exeVisual Studio Code executable
      Additional MSIworkers.dev/sc.msiSecondary malware installer

      By treating unauthorized use of incident response tools as a high-risk event and adopting layered detection and prevention measures, organizations can significantly reduce the impact of such attacks and halt adversaries before they deploy ransomware.

      Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.

      The post Threat Actors Abuse Velociraptor Incident Response Tool to Gain Remote Access appeared first on Cyber Security News.

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

    7. Nevada IT Systems Hit by Cyberattack – State Office Closed for Two Days

      ·

      , ,

      A significant cyberattack disrupted Nevada’s state government network on August 24, forcing all state office branches to shut down operations for 48 hours.

      The intrusion began with the exploitation of an unpatched VPN gateway, allowing the threat actor to gain initial foothold on the internal network.

      Within hours, the attackers deployed a custom malware payload designed to escalate privileges, move laterally across critical servers, and exfiltrate sensitive data.

      This event marks one of the most severe disruptions of state IT services in recent history, affecting email, public records access, and internal communication channels.

      Governor Lombardo Press Office analysts noted that the malware leveraged a multi-stage attack vector: a lightweight dropper written in PowerShell, which in turn fetched a second-stage binary from a compromised web server.

      This binary contained encrypted configuration files, indicating the attackers’ intent to remain undetected while mapping the network topology.

      As state technicians worked to isolate infected endpoints, normal user authentication services were rerouted to offline backups, further complicating the recovery process.

      Initial forensic analysis revealed that the dropper script used the following pattern to establish persistence on reboot:-

      $TaskAction = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument '-NoProfile -WindowStyle Hidden -File C:\Windows\Temp\svc_update.ps1'
$Trigger    = New-ScheduledTaskTrigger -AtStartup
Register-ScheduledTask -TaskName 'WindowsUpdateSvc' -Action $TaskAction -Trigger $Trigger -Description 'System Update Service'
      Incident report (Source – X)

      This technique allowed the malware to relaunch silently, even after endpoint patches were applied.

      Governor Lombardo Press Office researchers identified the dropper’s code similarities to known APT toolkits, suggesting that the perpetrators possess advanced capabilities and extensive reconnaissance data on state infrastructure.

      Infection Mechanism

      Delving deeper into the infection mechanism, the second-stage binary employs a custom communications protocol over HTTPS, masquerading its traffic as benign REST API calls to evade intrusion detection systems.

      Upon execution, the binary loads a DLL into the Windows Management Instrumentation (WMI) host process (wmiprvse.exe), effectively concealing its operations within legitimate system processes.

      The DLL decrypts embedded payloads in memory, deploying modules that scan for domain controllers and file shares.

      Once targets are identified, encrypted archives of critical files are staged for exfiltration using chunked uploads to a remote C2 server.

      The malware transition from initial code execution to data exfiltration without triggering standard network security alarms.

      Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

      The post Nevada IT Systems Hit by Cyberattack – State Office Closed for Two Days appeared first on Cyber Security News.

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

    8. Electronics Manufacturer Data I/O Suffers Ransomware Breach

      ·

      , , ,

      Data I/O Corporation, a well-known electronics firm that specializes in device programming and security provisioning solutions, revealed a ransomware attack that penetrated its internal IT infrastructure in a major cybersecurity event. The incident, detected on August 16, 2025, prompted an immediate activation of the company’s incident response protocols, highlighting the persistent threat of ransomware in […]

      The post Electronics Manufacturer Data I/O Suffers Ransomware Breach appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

    9. Cisco Nexus 3000 and 9000 Series Vulnerability Let Attackers Trigger DoS Attack

      ·

      , , ,

      Cisco has issued a High-severity security advisory alerting customers to a critical vulnerability in the Intermediate System-to-Intermediate System (IS-IS) feature of NX-OS Software for Cisco Nexus 3000 and 9000 Series switches. 

      Tracked as CVE-2025-20241 with a CVSS base score of 7.4, the flaw could allow an unauthenticated, Layer 2-adjacent attacker to send a malformed IS-IS packet that restarts the IS-IS process, potentially reloading the device and causing a denial-of-service (DoS) condition. 

      Key Takeaways
      1. Cisco Nexus 3000/9000 IS-IS flaw allows adjacent DoS.
      2 No workaround; enable IS-IS area authentication.
      3. Apply Cisco’s free NX-OS update.

      Cisco Nexus 3000 and 9000 Vulnerabilities

      The vulnerability stems from insufficient input validation when parsing ingress IS-IS packets. An attacker must be on the same broadcast domain as the target switch and can exploit the flaw by transmitting a specially crafted IS-IS L1 or L2 packet. 

      Upon receipt, the NX-OS IS-IS daemon may crash and subsequently reload the entire switch, disrupting network routing and traffic forwarding. This condition affects:

      • Cisco Nexus 3000 Series Switches
      • Cisco Nexus 9000 Series Switches in standalone NX-OS mode

      Only devices with IS-IS enabled on at least one interface are vulnerable. Products such as Nexus 9000 in ACI mode, Firepower 1000/2100/4100/9300, MDS 9000, and UCS Fabric Interconnects are confirmed not vulnerable. 

      The advisory notes that if IS-IS authentication is configured, the attacker must supply valid keys to exploit the issue.

      To verify IS-IS status, administrators can run the CLI command:

      Cisco Nexus 3000 and 9000 Series Vulnerability

      Presence of feature isis, router isis name, and at least one ip router isis name entry confirms exposure. To view live IS-IS peers, use:

      Cisco Nexus 3000 and 9000 Series Vulnerability
      Risk FactorsDetails
      Affected ProductsCisco Nexus 3000 Series SwitchesCisco Nexus 9000 Series Switches (standalone NX-OS)
      ImpactIS-IS process restart causing device reload (DoS)
      Exploit PrerequisitesLayer 2 adjacency; IS-IS enabled on interface
      CVSS 3.1 Score7.4 (High)

      No temporary workarounds exist; however, enabling area authentication for IS-IS can mitigate risk by requiring attackers to authenticate before sending malicious packets.

      Cisco strongly recommends that customers thoroughly evaluate this mitigation to ensure compatibility with their network requirements.

      Cisco has released free software updates to address the vulnerability. Customers with valid service contracts should download and install the fixed releases from the Cisco Support and Downloads portal. 

      For those without service contracts, contacting the Cisco TAC with the advisory URL and product serial number will enable entitlement to the necessary patches.

      Tired of Filling Forms for security & Compliance questionnaires? Automate them in minutes with 1up! Start Your Free Trial Now!

      The post Cisco Nexus 3000 and 9000 Series Vulnerability Let Attackers Trigger DoS Attack appeared first on Cyber Security News.

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶