Mercenary spyware vendor Paragon claims it's "responsible", (unlike NSO Group) But our investigations @citizenlab.ca show Paragon's spyware was abused in Italy 🇮🇹 to target civil society @accessnow.org sent them a letter with questions, and I signed on 👇 www.accessnow.org/press-releas...

Access Now - Paragon must answer for spyware use against civil society and journalists

Access Now calls on Paragon to answer for the use of its spyware in Italy against journalists, and to address oversight failures.

accessnow.org

"Typically the Iranians have deployed wipers against targets in critical infrastructure and other organizations," Google threat intelligence group chief analyst John Hultquist told The Register. "We will probably see more of that in Israel and we could see it in the US as well."

Cyber weapons in the Israel-Iran conflict may hit the US

: With Tehran’s military weakened, digital retaliation likely, experts tell The Reg

theregister.com

Mysterious leaker GangExposed outs Conti kingpins in massive ransomware data dump

Mysterious leaker GangExposed outs Conti kingpins in massive ransomware data dump

'It's a high-stakes intelligence war' he told El Reg exclusive  A mystery whistleblower calling himself GangExposed has exposed key figures behind the Conti and Trickbot ransomware crews, publishing a trove of internal files and naming names.…

dlvr.it

It’s amazing to me that it can take 6 years from the first attack until the trial starts. via @jgreig.bsky.social & @therecordmedia.bsky.social

Iranian pleads guilty to launching Baltimore ransomware attack, faces 30 years behind bars

Sina Gholinejad admitted to using the Robbinhood ransomware variant to extort ransom payments from dozens of victims.

therecord.media

NASA simulation for what you'd see while plunging into a black hole: youtu.be/chhcwk4-esM There's actually a lot left to see after passing the event horizon!

#ESETresearch has published its latest APT Activity Report, covering October 2024 to March 2025 (Q4 2024–Q1 2025). China-aligned groups like Mustang Panda and DigitalRecyclers continued their espionage campaigns targeting the EU government and maritime sectors. 1/2

Here's how the TM SGNL server, which had access to plaintext chat logs from people like Mike Waltz, got hacked in about 20 minutes www.wired.com/story/how-th... (my first article in @wired.com!)

How the Signal Knockoff App TeleMessage Got Hacked in 20 Minutes

The company behind the Signal clone used by at least one Trump administration official was breached earlier this month. The hacker says they got in thanks to a basic misconfiguration.

wired.com

Learn about monitoring inauthentic accounts and conducting investigations into Foreign Information Manipulation and Interference (FIMI) in our next Stage Talk on Thursday, 4pm CEST/10am EDT. We're joined by the @doublethinklab.bsky.social team live in our Discord Server discord.gg/FGq4XfYm?eve...

Layoffs at CrowdStrike. I’m safe, but if you’re looking for IR consultants I know a bunch of fucking amazing ones that will be looking for jobs 🫠

Socket Security has discovered a malicious Python library that contained a remote access trojan and went undetected for over three years socket.dev/blog/malicio...

Malicious PyPI Package Targets Discord Developers with Remot...

The Socket Research team investigates a malicious Python package disguised as a Discord error logger that executes remote commands and exfiltrates dat...

socket.dev

I'm analyzing the TM SGNL source code and will publish findings tomorrow. But the for a sneak peak, here's how it seems TeleMessage's system works: There's E2EE between TM SGNL and Signal, but NOT between TM SGNL and archive destinations. TM's archive server can read the chat logs. Stay tuned.

No as a service 
Demo naas.isalman.dev/no Repo github.com/hotheadhacke...

Recorded Future Insikt Group researchers analyse MintsLoader, a malicious loader deployed through multiple infection vectors that commonly deploys second-stage payloads such as GhostWeaver, StealC, and a modified BOINC client. www.recordedfuture.com/research/unc...

ESET researchers provide an analysis of Spellbinder, a lateral movement tool for performing adversary-in-the-middle attacks, used by TheWizards, a China-aligned threat actor. www.welivesecurity.com/en/eset-rese...

Trustwave researchers observed a notable increase in NodeJS-based backdoor deployments across multiple malware campaigns, including KongTuke, Fake CAPTCHA schemes, Mispadu, and Lumma stealers. www.trustwave.com/en-us/resour...

Security leaders at Mandiant and Google Cloud say nearly every major company has hired or received applications from North Korean nationals working on behalf of the country’s regime. via @mattkapko.com cyberscoop.com/north-korea-...

North Korean operatives have infiltrated hundreds of Fortune 500 companies

Security leaders at Mandiant and Google Cloud say nearly every major company has hired or received applications from North Korean nationals working on behalf of the country’s regime.

cyberscoop.com

CVE-2024-10442 (CVSS 10): Zero-Click RCE in Synology DiskStation, PoC Publishes

So regarding this behavior: I've confirmed it, and there's more detail than is in the story. Let's go. arstechnica.com/security/202...

Windows RDP lets you log in using revoked passwords. Microsoft is OK with that.

Researchers say the behavior amounts to a persistent backdoor.

arstechnica.com

Ako ransomware affiliate gets five years in prison

Gabriel Thierry@gabrielthierry.eurosky.social · last yr.

Rançongiciel: comment "JohnSmith", "Boba" ou encore "Svetka" ont tenté d'extorquer leurs victimes en passant par des accès RDP www.zdnet.fr/actualites/r...

#ESETResearch analyzed the toolset of the China-aligned APT group that we have named #TheWizards. It can move laterally on compromised networks by performing adversary-in-the-middle (AitM) attacks to hijack software updates. www.welivesecurity.com/en/eset-rese... 1/6

TheWizards APT group uses SLAAC spoofing to perform adversary-in-the-middle attacks

ESET researchers publish an analysis of Spellbinder, a lateral movement tool used to perform adversary-in-the-middle attacks.

welivesecurity.com

Russia attempting cyber sabotage attacks against Dutch critical infrastructure therecord.media/dutch-mivd-r...

Russia attempting cyber sabotage attacks against Dutch critical infrastructure

Kremlin-backed hackers have tried sabotage attacks against critical infrastructure in the Netherlands, the country's Military Intelligence and Security Service said in its annual report.

therecord.media

@volexity.com #threatintel: Multiple Russian threat actors are using Signal, WhatsApp & a compromised Ukrainian gov email address to impersonate EU officials. These phishing attacks abuse 1st-party Microsoft Entra apps + OAuth to compromise targets. www.volexity.com/blog/2025/04...

#dfir

Phishing for Codes: Russian Threat Actors Target Microsoft 365 OAuth Workflows

Since early March 2025, Volexity has observed multiple suspected Russian threat actors conducting highly targeted social engineering operations aimed at gaining access to the Microsoft 365 (M365) acco...

volexity.com

Rocky ❤️

Check Point published a write-up of CVE-2025-24054, an NTLM leak that Microsoft patched last month. The company says the vulnerability is now being exploited in the wild, with one campaign targeting government and private institutions in Poland and Romania. research.checkpoint.com/2025/cve-202...

CVE-2025-24054, NTLM Exploit in the Wild - Check Point Research

Key Points Introduction NTLM (New Technology LAN Manager) is a suite of authentication protocols developed by Microsoft to verify user identities and protect the integrity and confidentiality of netwo...

research.checkpoint.com

After years of the West naming and shaming nation-state hackers I have wondered (and written about) the lack of similar finger pointing back at the US etc. This new shift from China to out western hackers for cyber spying is overall a good thing for transparency. www.theregister.com/2025/04/15/c...

China swipes at NSA for alleged Asian Winter Games hack

: Beijing claims NSA went for gold in offensive cyber, got caught in the act

theregister.com

My first blog with Proofpoint is live! And we love a good crossover. State-sponsored actors try their hand at ClickFix - the hottest thing in cybercrime. Meet the North Koreans, Iranians, and Russians who are upping their social engineering game www.proofpoint.com/us/blog/thre...

Around the World in 90 Days: State-Sponsored Actors Try ClickFix | Proofpoint US

Key Findings While primarily a technique affiliated with cybercriminal actors, Proofpoint researchers discovered state-sponsored actors in multiple campaigns using the ClickFix social

proofpoint.com

NEW: In a hearing last week, an NSO Group lawyer said that Mexico, Saudi Arabia, and Uzbekistan were among the governments responsible for a 2019 hacking campaign against WhatsApp users. This is the first time representatives of the spyware maker admit who its customers are.

NSO lawyer names Mexico, Saudi Arabia, and Uzbekistan as spyware customers behind 2019 WhatsApp hacks | TechCrunch

This is the first time representatives for the spyware maker have publicly named its government customers.

techcrunch.com

MITRE’s CVE database was hours from disappearing. CISA saved it at the last minute with a contract extension. Here’s what you need to know. Read Cynthia Brumfield's @metacurity.com news article: www.csoonline.com/article/3963... #InfoSec #ThreatIntel #CVE

CVE program averts swift end after CISA executes 11-month contract extension

After DHS did not renew its funding contract for reasons unspecified, MITRE’s 25-year-old Common Vulnerabilities and Exposures (CVE) program was slated for an abrupt shutdown on April 16, which would ...

csoonline.com

👏 "Active CVE Board members have spent the past year developing a strategy to transition CVE to a dedicated, non-profit foundation." www.thecvefoundation.org/home

CVE Foundation

FOR IMMEDIATE RELEASE April 16, 2025 CVE Foundation Launched to Secure the Future of the CVE Program [Bremerton, Washington] – The CVE Foundation has been formally established to ensure the long-term ...

thecvefoundation.org

SCOOP: sources tell me that the State Dept plans to eliminate its only office to counter foreign disinformation, as soon as today, delivering a win to foreign governments like Russia, Iran, and China—and the office's mostly conservative critics. www.technologyreview.com/2025/04/16/1...

US office that counters foreign disinformation is being eliminated, say officials

Conservative critics have long accused the department of helping to censor the American right.

technologyreview.com