Lightnews — Scholar-powered news

piggo @pigondrugs.bsky.social · 13h

~Socket~
A cluster of 131 cloned Chrome extensions are being used as spamware to automate bulk messaging on WhatsApp.
-
IOCs: zapvende. com, lobovendedor. com. br, youseller. com. br
-
#ChromeExtension #Spamware #ThreatIntel #WhatsApp

131 Spamware Chrome Extensions Target WhatsApp

socket.dev

piggo @pigondrugs.bsky.social · 13h

~Microsoft~
Microsoft's 2025 Digital Defense Report finds over half of all cyberattacks are now driven by extortion and ransomware for financial gain.
-
IOCs: (None identified)
-
#Cybercrime #Ransomware #ThreatIntel

Microsoft Report: Extortion & Ransomware Drive Attacks

blogs.microsoft.com

piggo @pigondrugs.bsky.social · 13h

~Microsoft~
Microsoft has been recognized as a Leader in the 2025 Gartner® Magic Quadrant™ for its SIEM solution, Microsoft Sentinel.
-
IOCs: (None identified)
-
#Gartner #Microsoft #SIEM #ThreatIntel

Microsoft Named a 2025 Gartner SIEM Leader

www.microsoft.com

piggo @pigondrugs.bsky.social · 13h

~Microsoft~
Threat actors are actively targeting Azure Blob Storage using a full attack chain from reconnaissance and initial access to data exfiltration and impact.
-
IOCs: (None identified)
-
#Azure #CloudSecurity #ThreatIntel

Threats Targeting Azure Blob Storage

www.microsoft.com

1

piggo @pigondrugs.bsky.social · 13h

~Mandiant~
Russian state-actor COLDRIVER deploys new NOROBOT & MAYBEROBOT malware after their LOSTKEYS tool was publicly disclosed.
-
IOCs: 85. 239. 52. 32, system-healthadv. com, southprovesolutions. com
-
#COLDRIVER #Malware #ThreatIntel

COLDRIVER's New Malware

cloud.google.com

piggo @pigondrugs.bsky.social · 13h

~Cisa~
CISA adds five actively exploited vulnerabilities affecting Apple, Microsoft, Oracle, and Kentico products to its KEV catalog.
-
IOCs: CVE-2025-33073, CVE-2025-61884, CVE-2022-48503
-
#CISA #PatchNow #ThreatIntel #Vulnerability

CISA Adds 5 Vulns to KEV Catalog

www.cisa.gov

piggo @pigondrugs.bsky.social · 3d

~Socket~
ENISA's 2025 report finds AI is fundamentally reshaping the threat landscape, automating phishing and creating new supply chain risks.
-
IOCs: Lumma Stealer, WormGPT, Rafel RAT
-
#AI #ENISA #SupplyChain #ThreatIntel

ENISA 2025: AI Reshapes Cyber Attacks

socket.dev

piggo @pigondrugs.bsky.social · 3d

~Sophos~
Threat actors exploit legacy vulnerabilities and stolen credentials where MFA is absent, fueling a volatile ransomware landscape.
-
IOCs: Qilin, Akira
-
#MFA #Ransomware #ThreatIntel

Threat Intel Report: Ransomware, Stolen Credentials & Legacy Vulns

news.sophos.com

piggo @pigondrugs.bsky.social · 4d

~Zscaler~
Nation-state actor UNC5221 breached F5, exfiltrating BIG-IP source code and internal zero-day vulnerability documentation.
-
IOCs: BRICKSTORM, UNC5221
-
#F5 #ThreatIntel #UNC5221

F5 Discloses Major Security Breach

www.zscaler.com

piggo @pigondrugs.bsky.social · 4d

~Socket~
Vite+ is a new commercial, Rust-based toolchain designed to consolidate the JavaScript development ecosystem.
-
IOCs: (None identified)
-
#JavaScript #ThreatIntel #Vite

Vite+ Unveils Unified JS Toolchain

socket.dev

1

piggo @pigondrugs.bsky.social · 4d

~Cisa~
CISA has released 13 new advisories detailing vulnerabilities in various ICS products from Rockwell, Siemens, and others.
-
IOCs: (None identified)
-
#CISA #ICS #ThreatIntel

CISA Releases 13 ICS Advisories

www.cisa.gov

1

piggo @pigondrugs.bsky.social · 4d

~Mandiant~
UNC5142 distributes infostealers (VIDAR, ATOMIC) from compromised WordPress sites using a blockchain technique to store malicious code.
-
IOCs: ratatui[. ]today, browser-storage[. ]com, 80. 64. 30[. ]238
-
...

UNC5142 Uses EtherHiding to Distribute Malware

cloud.google.com

1

piggo @pigondrugs.bsky.social · 4d

~Mandiant~
DPRK actor UNC5342 is using the EtherHiding technique to deliver JADESNOW & INVISIBLEFERRET malware via public blockchains.
-
...

DPRK Adopts EtherHiding Malware Delivery

cloud.google.com

piggo @pigondrugs.bsky.social · 4d

~Cofense~
Phishing campaign distributes a malicious 'Mac Spoofer' Chrome extension to steal user credentials from login forms.
-
IOCs: hibarriotech. com, reader. hibarriotech. com, 194. 146. 41. 102
-
#Malware #Phishing #ThreatIntel

Malicious 'Mac Spoofer' Browser Extension

https://cofense.com/blog/privacy”-and-prizes”-rewards-from-a-malicious-browser-extension

piggo @pigondrugs.bsky.social · 4d

~Checkpoint~
A vulnerability in a new Rust-based Windows kernel component (win32kbase_rs.sys) allows local users to cause a system crash (BSOD) via a malformed metafile.
-
IOCs: (None identified)
-
#DoS #Rust #ThreatIntel #Windows

Rust Vulnerability in Windows GDI Kernel

research.checkpoint.com

1

piggo @pigondrugs.bsky.social · 4d

~Trendmicro~
A doxxing campaign against alleged Lumma Stealer (Water Kurita) operators has caused a sharp decline in activity, with customers migrating to alternatives like Vidar and StealC.
-
IOCs: (None identified)
-
...

Lumma Stealer Doxxing Leads to Decline

www.trendmicro.com