Os grupos de bairro frequentemente ficam cheios de mensagens sobre cartões bancários perdidos que foram encontrados. As pessoas têm boas intenções e querem ajudar um vizinho, então publicam uma foto do cartão com o número e outros dados completamente visíveis. Outras pessoas dizem no grupo que deixaram o cartão com um segurança, caixa ou gerente da loja ou estabelecimento onde o encontraram, ou do mais próximo. Hoje vamos explicar por que nenhuma dessas opções é uma boa ideia e o que você realmente deve fazer se encontrar o cartão bancário de outra pessoa.

O que NÃO fazer ao encontrar um cartão perdido e por quê

Vamos explicar por que você não deve publicar em um grupo uma foto do cartão com os dados visíveis, ficar com ele ou entregá-lo a um desconhecido. O primeiro motivo é o mais óbvio, mas vale a pena reforçar: os dados do cartão são informações privadas e não devem ser compartilhados com pessoas que não têm motivo para vê-los. Uma foto publicada em um grupo pode acabar nas mãos de criminosos, que podem tentar usar esses dados para fazer compras fraudulentas pela internet. O pior cenário é uma foto mostrando os dois lados do cartão e também expondo o código de segurança de três dígitos, conhecido como CVC, CVV ou CVP, que fica no verso.

Agora, um ponto menos óbvio: por que você não deve publicar que encontrou um cartão, mesmo com o número borrado na foto, e ficar com ele até o proprietário aparecer. Como não há garantia de que você foi a primeira pessoa a pegar o cartão, fazer isso pode colocar você sob suspeita caso desapareça dinheiro da conta. Mesmo que você não tenha absolutamente nada a ver com qualquer furto, o simples fato de o cartão ter ficado em sua posse por algum tempo ainda pode fazer com que você tenha que dar explicações ao proprietário ou à polícia.

A mesma lógica se aplica a entregar o cartão a terceiros. Um segurança, caixa ou gerente é tão desconhecido quanto qualquer pessoa, e nenhum deles tem autoridade especial para assumir a responsabilidade por um cartão bancário encontrado. Entregar o cartão a essas pessoas dá a elas a oportunidade de usar o dinheiro de outra pessoa e, se isso acontecer, você pode acabar sob investigação.

A abordagem “o que os olhos não veem, o coração não sente”, ou seja, deixar o cartão onde o encontrou ou movê-lo para um local mais visível, é mais segura para você, mas ainda assim não é a atitude correta. Se você fizer isso, outra pessoa vai encontrá-lo, e não há garantia de que será uma pessoa bem-intencionada. Ela pode tentar retirar dinheiro da conta do verdadeiro proprietário. Portanto, essa também não é uma boa opção.

O que você DEVE fazer com um cartão bancário encontrado

Agora vamos falar sobre o que você deve fazer. A atitude correta pode surpreender você: ligue para o banco que emitiu o cartão, informe que encontrou o cartão e, depois… destrua o cartão. É possível que o proprietário ainda nem tenha percebido o desaparecimento do cartão. Com o uso de pagamentos por aproximação, um cartão físico pode ficar bastante tempo sem ser usado na carteira. O banco bloqueará o cartão, avisará o proprietário de que o cartão desapareceu e emitirá um novo.

Essa última etapa, destruir o cartão, pode surpreender e até gerar resistência, mas mantemos nossa recomendação: um cartão encontrado deve ser destruído. Dessa forma, ninguém poderá usá-lo, e você não precisará ficar com a propriedade de outra pessoa nem correr o risco de ser considerado suspeito caso desapareça dinheiro da conta. A maneira mais simples e confiável de destruir um cartão é cortá-lo cuidadosamente em pequenos pedaços com uma tesoura de cozinha e jogá-los no lixo ou reciclá-los.

Vale a pena ter algo em mente: atualmente, um cartão físico não representa uma perda tão grande para seu verdadeiro proprietário. Para começar, os bancos reemitem cartões de forma rápida e fácil. Na maioria dos bancos, você nem precisa ir a uma agência, pois o novo cartão é entregue diretamente na sua casa.

Além disso, a emissão de um novo cartão normalmente não impede o proprietário de fazer pagamentos. Em muitos casos, basta usar um cartão virtual ou outra forma de pagamento. Portanto, um cartão destruído causa muito menos transtorno ao proprietário do que o risco de ele cair nas mãos erradas e ser usado para retirar dinheiro da conta.

E se, de alguma forma, o proprietário irritado conseguir encontrar você e fizer perguntas, basta mostrar este artigo para que ele entenda o problema que você ajudou a evitar.

Quando você não deve destruir um cartão encontrado

Além dos cartões bancários, existem também cartões de múltiplas funções, como os emitidos para crianças e estudantes, que combinam algumas funções, como cartão de acesso à escola ou universidade e cartão de transporte público. Crianças, especialmente as mais novas, perdem esse tipo de cartão com bastante frequência. Restabelecer todas as funções desses cartões pode levar muito mais tempo do que reemitir um cartão bancário, e os valores armazenados neles geralmente são pequenos. Por isso, se você encontrar um desses cartões, o melhor a fazer é levá-lo à escola ou universidade indicada no cartão e entregá-lo ao segurança ou à recepção.

Em resumo: o que fazer ao encontrar um cartão bancário de outra pessoa

Para resumir, se um cartão bancário perdido chegar às suas mãos:

1. Procure o número de telefone do banco no cartão. Normalmente, ele está impresso no próprio cartão. Caso não esteja, você pode encontrá-lo facilmente no site oficial do banco. Depois, ligue para o banco. Informe que você encontrou o cartão de outra pessoa.
2. Depois da ligação, destrua o cartão: corte-o em pequenos pedaços com uma tesoura e jogue-os fora.

E mais um lembrete sobre o que não fazer: não publique fotos do cartão ou de seus dados em grupos de conversa ou nas redes sociais, não fique com o cartão na esperança de localizar o proprietário e não o entregue a desconhecidos.

Também recomendamos acompanhar nosso blog para ficar por dentro das ameaças online mais recentes. E fique à vontade para compartilhar este artigo no grupo do seu bairro, para que seus vizinhos saibam exatamente o que fazer caso encontrem o cartão bancário de outra pessoa.

Quanto à proteção do seu próprio dinheiro, vale a pena usar uma solução de segurança robusta e em várias camadas, que proteja seu dinheiro, cartões, carteiras e pagamentos. Saiba mais em Cinco tecnologias da Kaspersky que vão proteger suas finanças.

Quais outros riscos ocultos os cartões bancários apresentam? Descubra em nossos outros posts:

• Como evitar se tornar uma mula financeira
• Como os cibercriminosos roubam dinheiro de cartões bancários
• Web skimmers: por que eles são particularmente sorrateiros e perigosos?
• Fraudadores de cartões com NFC se escondem atrás do Apple Pay e Google Wallet

Serbian activists were targeted with zero-click Pegasus and NoviSpy spyware, exposing a major surveillance campaign ahead of elections.

A member of Serbia’s student protest movement had their iPhone infected with NSO Group‘s Pegasus spyware without ever clicking a link or opening a file. The Citizen Lab confirmed the infection in collaboration with the SHARE Foundation, tracing it to an iMessage zero-click exploit and identifying high-confidence indicators of compromise between December 2025 and January 2026, with the possibility of additional infections not ruled out.

“In collaboration with the SHARE Foundation, the Citizen Lab analyzed forensic artefacts from the iPhone of a member of Serbia’s student protest movement after they received an Apple Threat Notification warning of targeting with mercenary spyware.” reads the report published by Citizen Lab. “Our analysis confirmed that an iMessage zero-click exploit was used to infect the device with NSO Group’s Pegasus spyware. “

The attack required no action from the victim, which makes zero-click attacks especially dangerous. Citizen Lab said the Pegasus infection could stay hidden while giving the attacker full access to the phone, including messages, photos, notes, microphone, and camera. Apple later fixed this specific exploit through security updates in iOS 18.4.1.

“We believe that the zero-click exploit used in this attack targeted Apple iMessage, and has subsequently been patched by Apple as of iOS 18.4.1.” continues the report. “A zero-click infection with Pegasus spyware would not have been visible to the target, and would give the Pegasus attacker total access to the device. Pegasus allows an attacker to do anything that a user can do, ranging from accessing private data like notes, pictures and even encrypted messages. Pegasus also has the ability to covertly enable the phone’s microphone and camera.”

This one confirmed infection sits inside something considerably bigger. The SHARE Foundation has documented at least 14 individuals targeted with advanced spyware since early 2026, spanning student movement members, civil society activists, an opposition member of parliament, and a local councilor, which the organization is calling the largest documented surveillance wave in Serbia’s history. Twelve people approached SHARE’s digital forensics team in August after receiving Apple’s own threat notifications, warnings the company sends when it detects likely state-sponsored spyware targeting; eleven of those devices remain presumed infected pending further forensic confirmation.

The timing lines up uncomfortably well with Serbia’s political calendar. This surveillance wave coincides with local elections held on March 29, 2026, and stretches toward planned early parliamentary elections in October, following months of student-led anti-government and anti-corruption protests.

“These notifications and forensic confirmation highlight the aggressive mercenary spyware targeting of the peaceful pro-democracy movement with mercenary spyware ahead of key 2026 election cycles.” continues the report.

Targeting activists and opposition figures specifically in the run-up to elections isn’t subtle, and it fits a pattern Serbia has shown before.

Serbia has a history of using commercial spyware. Citizen Lab previously documented Pegasus targeting civil society and the use of Cellebrite tools to install the locally developed NoviSpy on activists’ phones. In this case, SHARE Foundation and Amnesty Tech found a new version of NoviSpy on a student activist’s Android phone after Serbian authorities seized it during police questioning.

Amnesty International’s Security Lab head, Donncha Ó Cearbhaill, connected the dots plainly between state custody and spyware installation.

“The forensic findings by SHARE prove that Serbian students continue to be targeted with invasive Android spyware tools, installed while detained by Serbian authorities” he said.

If you’ve received an Apple Threat Notification, whether in Serbia or anywhere else, the Citizen Lab’s guidance is unambiguous: treat it as a presumed infection and get expert help immediately rather than waiting to see if anything seems wrong. Individuals in Serbia should contact the SHARE Foundation directly, and anyone elsewhere can reach Access Now’s Digital Security Helpline, which supports journalists, human rights defenders, and other high-risk civil society targets worldwide. Anyone who suspects they might be a target based on their work or public role should also turn on Lockdown Mode, Apple’s built-in feature that significantly narrows what a zero-click exploit can actually reach, and keep every device updated, since the patch that closed this specific hole has already existed for well over a year for anyone who installed it.

“We believe that the zero-click used in this attack has been rendered ineffective by a patch from Apple in recent iOS versions. We urge everyone, especially those facing increased risks because of who they are or the work they do, to keep all devices updated.” concludes the report. “Click HERE for instructions on how to keep your iPhone up to date.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Pegasus)

Arquivos criados com a técnica poliglota têm aparecido cada vez mais em ciberataques nos últimos anos. Eles permitem que os invasores façam o malware passar pelos filtros de e-mail e pelos verificadores de arquivos, enganem as vítimas em ataques de phishing e dificultem as investigações de incidentes. Para conseguir isso, os invasores constroem deliberadamente um arquivo que o sistema pode interpretar como formatos diferentes, dependendo do aplicativo em que ele é aberto.  Um exemplo clássico é um arquivo que pode ser tratado como uma imagem PNG ou um arquivo ZIP. Basta alterar a extensão do arquivo ou simplesmente usar um ou outro aplicativo para abri-lo.

Vamos entender por que é possível criar arquivos desse tipo, quais combinações de formatos já foram usadas em ataques reais e como as organizações podem se proteger contra essa ameaça.

Por que é possível criar arquivos poliglotas

Os formatos de dados por trás dos arquivos poliglotas raramente são exóticos. Tudo se resume a uma combinação inteligente de formatos comuns que são estruturalmente compatíveis. Os poliglotas exploram pelo menos uma das seguintes peculiaridades em determinados formatos de arquivo:

• A maioria dos formatos de arquivo precisa ser decodificada a partir do primeiro byte, mas alguns precisam ser lidos a partir do final. O exemplo mais claro é um arquivo ZIP: um início corrompido ou ausente não impede que os aplicativos leiam o arquivo, porque todos os cabeçalhos necessários ficam no final. Isso permite que os invasores simplesmente concatenem dois arquivos (no exemplo acima, um PNG e um ZIP). A parte inicial é lida como uma imagem PNG válida, enquanto a parte final é lida como um arquivo ZIP válido.
• Muitos formatos funcionam como bonecas russas matrioscas: embora externamente tenham uma extensão específica correspondente ao uso pretendido, internamente o arquivo é, essencialmente, um arquivo ZIP que contém os dados necessários. Esse grupo inclui documentos modernos do Office (DOCX/XLSX/PPTX), pacotes de instalação do Android (APK), arquivos de biblioteca Java (JAR) e muitos outros.
• Alguns formatos não têm requisitos estruturais rígidos ou têm requisitos suficientemente flexíveis para que o aplicativo que processa o arquivo consiga localizar o trecho de que precisa, mesmo quando esse trecho não está no início.

O repositório Polydet no GitHub apresenta vários exemplos de combinações possíveis de arquivos para criar um arquivo poliglota. De acordo com a classificação da MITRE, essa técnica se enquadra na categoria Masquerading (T1036.008, Masquerade File Type).

Exemplos de arquivos poliglotas em ciberataques conhecidos

Análises de campanhas de malware disponíveis publicamente revelam diversos tipos de arquivos poliglotas. Os invasores adaptam todo o cenário do ataque a uma combinação específica de tipos de arquivo.

O grupo Head Mare entregou o malware PhantomPyramid como um anexo ZIP. O arquivo consistia em código executável do Windows (EXE), com um pequeno arquivo ZIP concatenado ao final. Quando a vítima abriu o arquivo compactado, ele continha um arquivo com a extensão PDF.LNK que, então, iniciava esse mesmo anexo poliglota, desta vez como um arquivo executável.

No ataque documentado pela JPCERT, os invasores criaram um arquivo que começava como PDF e era detectado como PDF pela maioria dos verificadores, mas tinha uma extensão DOC e era aberto nos aplicativos do Office como um arquivo DOC válido contendo macros maliciosas.

Os ataques que disseminaram os cavalos de Tróia StrRAT e Ratty usaram um arquivo poliglota criado a partir de um pacote de instalação assinado do Windows (MSI), com código Java malicioso (JAR) anexado ao final.

Os ataques do StrelaStealer usaram um arquivo poliglota com extensão HTML: uma biblioteca do Windows (DLL) com um documento HTML de chamariz concatenado ao final. Um atalho no arquivo compactado iniciou o arquivo duas vezes: uma vez por meio do comando start (o equivalente a um clique duplo, que abriu um navegador exibindo o documento HTML) e outra por meio do rundll32 (que iniciou a DLL maliciosa).

Em um ataque simulado, mas engenhoso, os pesquisadores concatenaram dois arquivos ZIP comuns e descobriram que diferentes ferramentas populares de compactação exibiam o arquivo combinado de maneiras diferentes: algumas mostravam apenas o primeiro arquivo compactado, outras apenas o segundo, e outras mostravam ambos ao mesmo tempo, como se fossem um único arquivo compactado com conteúdo compartilhado. Se o invasor estiver familiarizado com a infraestrutura da vítima e souber quais softwares estão instalados, poderá usar essa combinação para mostrar um arquivo às ferramentas de segurança e outro à vítima.

Os invasores empregaram uma complexa matriosca de malware em uma campanha que distribuiu o infostealer IcedID. Eles anexaram um arquivo ZIP aos e-mails de phishing; descompactá-lo produziu um arquivo ISO. Esse ISO, por sua vez, era descompactado em um arquivo CHM (Ajuda do Windows) criado com a técnica poliglota. Quando a vítima o abriu com a ferramenta padrão de Ajuda do Windows, o arquivo executou um script JavaScript incorporado ao conteúdo da ajuda, que iniciou o aplicativo padrão mshta (host de aplicativos HTML da Microsoft) e o direcionou para esse mesmo arquivo CHM. Os autores da campanha empacotaram um aplicativo HTA dentro do arquivo CHM de forma que sua presença não interferisse na leitura do arquivo como um documento de ajuda inócuo. O manipulador de HTA, por sua vez, simplesmente ignora todos os dados irrelevantes no início do arquivo até encontrar o script HTA.

Como as ferramentas de segurança lidam com arquivos poliglotas

Os exemplos acima deixam claro como esse truque de leitura dupla permite que os invasores implantem malware no computador da vítima. Mas como os filtros de e-mail e os sistemas EDR realmente lidam com arquivos desse tipo? A resposta depende inteiramente da solução específica, portanto, isso precisa ser verificado, seja por meio da análise da documentação técnica do fornecedor, seja pela execução de um teste controlado na infraestrutura corporativa, com todas as devidas precauções.  De modo geral, apenas dois pontos são válidos em todos os casos:

• A maioria das soluções de segurança não confia na extensão informada de um arquivo; em vez disso, verifica seu início para determinar sua estrutura real. É por isso que, no ataque descrito acima, o arquivo PDF com extensão DOC foi analisado como um PDF inofensivo, enquanto a macro maliciosa estava na parte DOC concatenada.
• Se um arquivo começar como algo inofensivo (por exemplo, uma imagem) e sua extensão corresponder, uma análise mais sofisticada provavelmente não será aplicada a ele. Os invasores podem explorar isso: as instruções que acompanham o arquivo podem orientar a vítima a renomeá-lo para que o comportamento do sistema acabe associado à segunda carga útil, e não à imagem.

Como proteger uma organização contra ataques de arquivos poliglotas

A defesa contra arquivos poliglotas não requer soluções técnicas ou organizacionais complexas. O que exige são boas práticas de segurança sólidas e consistentes em toda a organização:

• use listas fechadas de aplicativos autorizados a serem executados nas estações de trabalho dos funcionários. exclua aplicativos do Windows desatualizados, ferramentas administrativas da Microsoft não utilizadas, softwares de acesso remoto e de transferência de arquivos e qualquer outro software considerado potencialmente perigoso ou obsoleto.
• use soluções de segurança de e-mail avançadas e equipadas com CDR (tecnologia de Desarme e Reconstrução de Conteúdo, que desarma anexos suspeitos e os reconstrói em versões mais seguras) e tecnologia de detonação (que executa anexos suspeitos em um ambiente isolado para análise). configure a análise aprofundada para anexos que apresentem sinais externos de serem arquivos poliglotas: todos os arquivos compactados e do Office, arquivos com extensões não padrão e assim por diante.
• da mesma forma, configure a solução EDR para realizar uma análise aprofundada de possíveis arquivos poliglotas.
• crie regras de monitoramento que gerem alertas para combinações incomuns entre um processo e os arquivos que ele recebe para processamento, como um arquivo CHM iniciado por meio do mshta ou um arquivo HTML iniciado por meio do rundll32, como nos exemplos acima.
• adicione informações básicas sobre arquivos poliglotas ao programa de conscientização em segurança utilizado pela organização, para que os usuários fiquem atentos quando forem orientados a alterar a extensão de um arquivo ou a manipulá-lo de alguma forma incomum, por exemplo, abrindo-o em um aplicativo específico.

2,000 leaked files expose Bauman University’s hidden Department No. 4, which trained GRU-linked hackers and propagandists linked to APT28 and Sandworm.

Leaked Documents Expose Bauman University’s Hidden Department That Trained Hackers, Propagandists, and Malware Developers for the GRU

More than 2,000 internal documents from Bauman Moscow State Technical University have been reviewed by an international media consortium, and the picture they describe is not a conventional cybersecurity program. The files span academic and administrative records through 2025.

“Recently leaked records show that Bauman Moscow State Technical University’s Department No. 4 operated as a long-term training pipeline for Russian military intelligence and cyber operations.” reads the report published by DomainTools. “The department served several elements of the Russian General Staff and trained roughly 250 career and reserve students across three specialties: special intelligence (“Служба специальной разведки”), operational information-technical effects (“Применение сил и средств информационно-технического воздействия и защиты от информационно-технического воздействия”), and information-technology protection (”3ащита информационных технологий”). “

Department No. 4, also called “Special Training,” operated inside Bauman’s Military Training Center and doesn’t appear anywhere on the university’s public organizational chart. The GRU’s talent pipeline tends not to announce itself.

The investigation was carried out by a group of media outlets including The Insider, The Guardian, Le Monde, Der Spiegel, Delfi, VSquare, and FRONTSTORY.PL. DomainTools researchers also analyzed the leaked files independently. A DarkForums user known as “Losyash” may have shared the data, but it has not been confirmed that the account originally obtained the records.

The department trained students in three military specialties. These covered special intelligence, information and cyber operations, and the protection of IT systems. In practice, the courses included espionage, offensive cyber operations, electronic reconnaissance, secure systems, and influence operations.

Around 250 career and reserve students went through the program over six academic years. Researchers estimate that 10 to 15 students each year were selected for GRU-related assignments before graduating.

“Technical protection training covered cryptography and steganography, as well as code analysis and intrusion detection. Students were also trained in hardware inspection, the discovery of physical implants, and the identification of undocumented device functions. These subjects point to possible assignments in technical counterintelligence and supply chain security, as well as firmware analysis and embedded system inspection. Other likely functions include secure procurement and the protection of specialized military platforms.” continues the report. “The files also reveal an underreported malware-analysis and cyber threat intelligence program.”

One advanced practical assignment required the creation of a social-media video built around what the course materials called “manipulation, pressure, and hidden propaganda.” This counted as coursework.

Course materials defined “information-technical weapons” as tools and methods designed to alter, destroy, copy, block, or manipulate information. Red-team and blue-team functions were treated as a single discipline, not separate tracks, which mirrors how Russian military doctrine actually deploys cyber operators.

The personnel links are what make this more than a training curiosity. The leaked records identify Major General Viktor Netyksho as involved in Department No. 4’s oversight. Netyksho was the former commander of Military Unit 26165, the GRU formation publicly associated with APT28, also tracked as Fancy Bear, Sofacy, and STRONTIUM. He was among the 12 GRU officers indicted by the United States in 2018 for interference in the 2016 presidential election.

“Reporting identified graduates assigned to GRU Military Unit 26165 (associated with APT28) and Military Unit 74455 (associated with Sandworm), and linked senior officers, including former Unit 26165 commander Viktor Netyksho, to student oversight.” continues the report. “The data also connected senior GRU officers to the supervision and evaluation of Bauman students. Viktor Netyksho, the former commander of Unit 26165 and the 85th Main Special Service Center, is part of the department’s teaching and oversight structure.”

The reporting also identifies Aleksei Kondrashov, a 2024 Department No. 4 graduate, as linked to Military Unit 74455: the GRU’s Main Center for Special Technologies, known publicly as Sandworm, or APT44. That unit has been associated with the 2017 NotPetya attack and ongoing destructive operations against Ukraine. DomainTools also connected graduates and senior staff to Military Unit 29155, a GRU formation linked to sabotage and assassination operations in Europe.

A necessary precision: the reports establish unit placements, not individual operational involvement. A documented assignment to Military Unit 74455 doesn’t establish that a specific person participated in a specific attack. That distinction matters for both attribution work and legal proceedings.

What the leak does establish is the factory behind the names. APT28 and Sandworm are the threat groups that security teams track, attribute, and brief about. Department No. 4 is where some of the people running those operations were systematically trained, assessed, and selected.

For defenders, DomainTools summarizes the implication precisely: Russian operations should be tracked as a combined threat in which espionage, destructive attacks, military reconnaissance, technical surveillance, and influence campaigns draw on the same personnel pipelines and the same underlying doctrine. The Bauman material makes that pipeline visible for the first time at this level of institutional detail.

“The documents show that Department No. 4 is a small part of a larger long-term military training system, not a single hacking unit. The program prepared personnel for espionage and offensive cyber operations within a larger Russian technical university system.” concludes the report. “Its doctrine treated cyber warfare as more than network intrusion. Students were taught not only adversarial cyber warfare, but also a larger holistic doctrine of cyber war using both defense and attack to be better able to carry out successful campaigns.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Russia)

This is interesting:

The records describe a force-generation mechanism for several General Staff components, including the GRU, Main Operational Directorate, and 8th Directorate, which is associated with protected communications, cryptography, and information security.

[…]

The reporting also linked a 2024 Department No. 4 graduate, Aleksei Kondrashov, to Military Unit 74455, widely known as Sandworm.

That unit has been associated with destructive cyber activity against Ukraine and other targets, including the 2017 NotPetya attack.

The reports do not establish that every listed graduate participated in a named operation; assignments should therefore be described as reported unit placements, not proof of individual operational involvement.

The Bauman material reframes Russia’s cyber capability as an institutional system, not merely a collection of well-known threat groups.

It suggests that Moscow has formalized a recurring pathway from university recruitment to military service, where students receive supervised technical and ideological preparation before entering intelligence, cyber, and security roles.

For defenders, the leak reinforces the need to track Russian operations as a combined threat: espionage, destructive activity, military reconnaissance, technical surveillance, and influence campaigns may draw on related personnel pipelines and overlapping doctrine.

The exposure of Department No. 4 also provides researchers with a clearer lens for understanding how the GRU sustains cyber capacity beyond the familiar APT28 and Sandworm brand names.

BlueDelta (APT28) uses webhook.site and Microsoft Edge to hide HOOKEDGE espionage traffic targeting European governments.

Recorded Future’s Insikt Group documented a campaign by BlueDelta, the Russian GRU-linked group that overlaps with the group APT28, running an entire espionage operation against European government targets using webhook.site, a service built for developers to test HTTP requests, as its command-and-control backbone.

The campaign ran from late September 2025 through early April 2026, targeting government and diplomatic organizations in Romania, Spain, and Türkiye.

“The campaigns delivered a lightweight Windows batch-script backdoor, dubbed “HOOKEDGE,” via macro-enabled Microsoft Word documents using diplomatic-themed lures, including material impersonating Spain’s Ministry of the Presidency, Justice and Relations with the Cortes, created shortly after a September 2025 meeting between Spanish and Moldovan officials.” states the report by Insikt Group.

“Insikt Group assesses with moderate confidence that this activity was conducted by BlueDelta (which overlaps with APT28, Fancy Bear, and Forest Blizzard), a Russian state-sponsored threat group attributed to the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU).”

The attackers used a fairly old-school trick: macro-enabled Word documents. One of them looked like a real meeting agenda from Spain’s Ministry of the Presidency and appeared shortly after an actual meeting between Spanish and Moldovan officials. The timing was interesting because it came just before Moldova’s September 2025 parliamentary elections. The document looked credible enough to make the phishing attempt believable.

The backdoor, called HOOKEDGE, is surprisingly simple. It uses a Windows batch script and relies on two webhooks. One receives commands, while the other sends the stolen data back to the attackers. Every 30 minutes, a scheduled task downloads a command file through Microsoft Edge, runs it and sends the results to another endpoint. The malware uses Edge to make the traffic look like normal web activity, making it harder for security tools to spot.

That reliance on a real browser for both tasking and exfiltration is the cleverest part of the whole design.

“A notable aspect of HOOKEDGE is its use of msedge.exe for both tasking and exfiltration. By generating network traffic through a legitimate web browser rather than a commonly abused LotL binary (LOLBin) or a custom binary, the malware blends its communications with normal enterprise browsing activity.” continues the report.

Recorded Future explains, and that’s really the entire evasion strategy in one sentence: don’t build something exotic, just make your traffic look exactly like an employee checking a website.

BlueDelta didn’t build HOOKEDGE from scratch either. It shares deep code and structural overlap with HEADLACE, a backdoor the same group used years earlier, right down to identical JavaScript variable names and the same base64 encoding scheme for automated downloads.

“HOOKEDGE’s code and structural design have significant overlap with HEADLACE, a backdoor used by BlueDelta in previous campaigns.” states the report.

Recorded Future assesses with moderate confidence that HOOKEDGE is a direct evolutionary successor, maintained by the same operators rather than a fresh tool built by a different team, which fits BlueDelta’s long-documented habit of refining working tradecraft instead of reinventing it.

The operation also included a triage mechanism worth understanding on its own. Once a victim showed signs of being worth deeper attention, active communication with the initial webhook endpoints, BlueDelta deployed a second HOOKEDGE payload configured to check in every five minutes instead of thirty, giving operators much faster interactive control over higher-value targets. That two-tier setup also solved a practical infrastructure problem: webhook.site’s free tier caps out at 100 requests per endpoint, so spreading routine and high-priority tasking across separate endpoints kept any single one from getting exhausted mid-operation.

BlueDelta kept tuning the operation continuously rather than treating it as a finished product. Beaconing intervals stretched from 30 minutes to 61, deliberately timed to slip past sandbox environments that typically only watch a sample’s behavior for an hour. The group added canary tracking pixels named things like mailopened.jpg and docopened.jpg to monitor exactly when a phishing email got opened versus when the document itself got opened versus when macros actually executed, essentially building analytics for their own phishing funnel.

“The malicious document also contains a hidden image referencing a remote webhook URL: hxxp://webhook[.]site/62114596-33f5-47fb-9012-0223529e5a13/docopened[.]jpg. This serves as a document-open “canary,” alerting BlueDelta operators when a victim opens the lure. Later variants used the filename doc.jpg in place of docopened.jpg.” states Insik. “Insikt Group also identified webhooks using the filename mailopened.jpg, indicating that BlueDelta likely used a similar canary mechanism to monitor when recipients opened phishing emails, providing operators with visibility into campaign delivery success before any payload execution.”

That kind of detailed tracking of what victims do would look very familiar to a marketing team. The difference is that here the targets are victims, not customers.

For defenders, the useful indicators are quite clear. Block macros in documents downloaded from the internet, monitor scheduled tasks that launch scripts from user-writable folders, and flag Microsoft Edge running in headless mode or making automated connections to file-sharing and webhook services that the organization does not normally use. You don’t need sophisticated tools to spot these behaviors. Even a well-configured monitoring system should be able to detect them early. The worrying part is that a persistent, state-backed group can still rely on a small set of behaviors that defenders can identify and block.

For defenders, the actionable pieces here are concrete rather than abstract. Block macro execution from documents that arrived over the internet, watch for scheduled tasks spawning script interpreters from user-writable folders, and specifically flag Microsoft Edge running in headless mode or making automated requests to file-hosting and webhook services your organization doesn’t actually use for anything legitimate. None of this requires exotic tooling to catch, which is oddly reassuring: a threat group this persistent and state-backed is still, at its core, relying on the same handful of detectable behaviors that a properly configured monitoring setup would catch on day one.

“BlueDelta is likely to continue conducting initial access campaigns against European government and diplomatic organizations in support of Russian intelligence collection. Given the enduring strategic importance of European governance, NATO-related affairs, and diplomatic engagement with former Soviet republics, the intelligence requirements driving this activity are unlikely to diminish in the near term.” concludes the report.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, BlueDelta)

OpenAI banned Russian ChatGPT accounts tied to a covert influence campaign involving copied research, fake attribution and coordinated social posts.

The post OpenAI Bans Russian ChatGPT Accounts Used in Covert Influence Campaign appeared first on TechRepublic.

SilkParasite APT ran China-nexus cyberespionage across Central Asia, using 7 custom RATs, DLL sideloading, and AI-assisted malware.

Related Posts:

• FBI Seizes QScan and QTRouter Platforms Run by China State Hackers
• Operation CameraSwarm: 14,500 Dahua Cameras Compromised Across Ukraine and Russia
• Core Werewolf Deploys New CoreRAT Malware Against Russian Targets

The post SilkParasite APT Hits Central Asian Governments With 7 RATs appeared first on Daily CyberSecurity.

Rumors suggest NVIDIA seeks a Hugging Face acquisition exceeding $13 billion. Discover how this colossal deal could reshape the global open-source AI community.

Related Posts:

• uBlock Origin v1.74.0 Is the Final Version for Chrome Before Google's Delisting
• Microsoft Unveils the AI at Work Roadmap
• Google Launches Gemini 3.5 Transcribe With Sub-Second Streaming Latency

The post NVIDIA Hugging Face Acquisition Rumors Surface appeared first on Daily CyberSecurity.

Critical NVIDIA security updates patch multiple flaws in UFM and DGX Spark systems, addressing CVE-2026-24170 and CVE-2026-24262.

Related Posts:

• CVE-2026-19042: TeamViewer Command Injection Enables Remote Code Execution
• CVE-2026-72137 (CVSS 9.8): Linux Kernel Flaw Enables Root Privilege Escalation, PoC Public
• CISA Adds Six Exploited Vulnerabilities Including Citrix NetScaler Flaw

The post NVIDIA Releases Security Fixes for UFM Enterprise and DGX Spark appeared first on Daily CyberSecurity.

OpenAI banned Russian ChatGPT accounts backing a fake think tank, IBI, that used AI posts and a fake “sovereignty” index to push pro‑Russia narratives.

OpenAI says it has banned a cluster of ChatGPT accounts that likely originated in Russia and were used to support a covert influence operation. The campaign promoted an organisation called the International Burke Institute, or IBI, a supposed expert community that claimed to be based in Israel.

The operation did not rely on dramatic deepfakes or a viral bot army. It used a more familiar method: build something that looks credible, fill it with enough content to seem legitimate, then use social media to push people toward it. Credibility is often cheaper to fake than to earn.

OpenAI says the operators prompted ChatGPT in Russian to generate comments and posts, mostly in English, for X, Facebook, LinkedIn, Telegram and Substack. They specifically asked the model to avoid linguistic signals that might reveal a Russian origin, and used VPNs to bypass OpenAI’s restriction on access from Russia.

“We banned a cluster of ChatGPT accounts that very likely originated in Russia. The operators prompted in Russian to generate social media comments that were posted on Substack, Telegram, X, Facebook and LinkedIn.” reads the report published by OpenAI, “Most of the comments they generated were in English, and the operators instructe. ChatGPT to hide any linguistic clues that they were Russian. As we do not allow access to our models from Russia, they used VPNs to access our platform.”

The social media content promoted IBI articles or urged readers to follow IBI-linked channels. Some posts came from accounts bearing the institute’s name and logo, while others appeared to come from ordinary users whose main activity was sharing the same material.

The website behind the brand was registered in February 2025 and presented itself as an Israel-based community of international experts. It claimed links to well-known names such as Francis Fukuyama and Noam Chomsky, but OpenAI’s review found that 34 of 36 sampled articles published under expert profiles had been copied from elsewhere online.

“Some of these articles were years old; others were attributed to the wrong authors. For example, one article on the China-Pakistan Economic Corridor appears to have been copied from a Cambridge University Press original, but incorrectly attributed to a professor at the University of Nottingham whose expertise is in South Asian politics.” continues the report.

This was not a case of ChatGPT writing every false article on the site. OpenAI says the website content itself was not generated by its models, and some material appeared to have been written by a Slavic-language speaker and machine-translated. The AI’s role was narrower but still useful: it helped create the promotional layer that sent people toward the site and made the operation appear more active and organic.

“What began as an investigation into AI-generated social media posts led us to a much broader influence operation, built around a website containing copied and misattributed academic work, a “sovereignty” index that cast Russia in a favourable light, and efforts to disguise the operators’ Russian origins.” states OpenAI. “Although the campaign appears to have reached relatively small audiences, its elaborate construction distinguishes it from other Russia-linked⁠(opens in a new window) influence⁠(opens in a new window) operations⁠(opens in a new window) we have disrupted⁠(opens in a new window) since the start of the war in Ukraine.”

The centrepiece was the so-called Sovereignty Index, also called the Burke Index. It ranked countries across political, economic, technological, information, cultural, cognitive and military dimensions, and consistently gave Russia a favourable place while criticising Western states, especially France, Germany, the European Union and the United States. openai

A made-up index can be effective because numbers carry authority even when the method is vague, selective or impossible to audit. Add charts, expert profiles, academic-looking articles and a professional website, and a claim can travel much further than a Telegram post from an anonymous account.

OpenAI found one Telegram channel, “Lahme Ente,” that published German-language posts attacking Ukraine, the EU and the German government while calling for closer ties with Russia. Another operator used ChatGPT to create logos for channels focused on Germany, France, Poland, Türkiye and the United States, then repeatedly asked for Russian-language summaries of their activity.

“As well as generating content about IBI, one of the operators generated German-language posts that were posted on a Telegram channel called “Lahme Ente” (“lame duck”). These posts routinely criticized Ukraine, the EU and the German government, and advocated for better relations with Russia.” continues the report. “A second operator, alongside their IBI-related content, generated logos for a dozen Telegram channels (including Lahme Ente) focused on Germany, the USA, France, Poland and Türkiye. “

One American-facing channel called “American Observer” included awkward English that suggested it was not run by a native speaker. The operators were trying to hide their origin, but language remains a stubborn problem: a VPN can change an IP address, not always a sentence.

The campaign’s immediate reach appears limited. OpenAI says most social posts received few views and the official IBI accounts had low subscriber counts, although its Telegram channels reportedly attracted around 10,000 to 20,000 followers each. Using the Brookings Breakout Scale, OpenAI rated the effort at the lower end of Category Three: activity across multiple platforms with some signs of reaching genuine audiences.

That does not make it irrelevant. Influence operations are often built for scale, reuse and timing rather than instant virality. A network with a website, a recognisable brand, social accounts, apparent experts and ready-made narratives can remain quiet until a political event, election, protest or crisis gives it an opening.

This case also shows what AI changes and what it does not. It does not eliminate the need for operators, infrastructure, stolen material, audience research or political intent. It makes routine tasks cheaper: drafting posts, translating them, changing tone, generating replies, creating branding and monitoring channels at a pace that a small team can sustain.

“The significance of the operation lies less in the audience it reached, however, than in the infrastructure it had built. While the actors only used ChatGPT to produce isolated promotional posts, those posts pointed to an otherwise credible-appearing institution, complete with purported experts, republished academic work and a purported proprietary risk index.” concludes the report. “This illustrates how influence actors can use AI as a supporting tool within a broader effort to manufacture authority, obscure the source of favored narratives, and establish assets that could be scaled over time. It also illustrates how their supporting use of AI can lead to the broader operation being exposed.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, OpenAI)

TikTok and ByteDance agree to pay up to $400 million to settle US allegations involving children’s data, parental consent and account deletion.

The post TikTok Agrees to $400M Settlement Over Children’s Privacy appeared first on TechRepublic.

NVIDIA patched 20 NemoClaw and OpenShell flaws. The worst, CVE-2026-65093 (CVSS 9.9), enables code execution via sandbox escape. Update now.

Related Posts:

• GitLab Updates Fix Arbitrary Command Execution Vulnerability
• FreeBSD Patches Eight Kernel Vulnerabilities
• UniFi CVE-2026-77537 (CVSS 10.0): Command Injection Flaws Hit 22 Ubiquiti Products

The post NVIDIA NemoClaw and OpenShell: CVE-2026-65093 (CVSS 9.9) Enables Code Execution appeared first on Daily CyberSecurity.

NVIDIA confirms EA and Ubisoft are adapting anti-cheat software for the RTX SPARK platform, solving critical multiplayer gaming issues on Windows on Arm.

Related Posts:

• Reverse Engineering Reveals Microsoft's Hidden InvisMark Watermark in Paint
• Google Cloud Launches Gemini Enterprise for Finance and Law
• Uber Fined $966 Million for Automated Driver Terminations

The post EA Anti-Cheat Secures Support for RTX SPARK appeared first on Daily CyberSecurity.