Cato CTRL exposed the MuddyWater SimpleHelp campaign in Israel using tax lures. Learn how the MuddyWater SimpleHelp campaign abuses RMM tools.

Related Posts:

• APT29 Uses Watering Holes and Plerdy Tracker to Deploy Mobile Exploits
• mSecure Security Notification Prompts Password Resets
• Threat Actors Hijack Enterprise AI Models in Costly LLMJacking Cloud Attacks

The post Suspected MuddyWater SimpleHelp Campaign Targets Israeli Organizations With Tax Lures appeared first on Daily CyberSecurity.

NetamLoader, a new XAML-based .NET loader, points to a supply chain attack on a custom Windows build used by government entities in Asia.

Related Posts:

• Binance Hack Investigation Traces Historic $6.3B Breach
• Polymarket Supply Chain Attack Drains Trader Wallets
• Binance Hot Wallet Breach Prompts Multibillion-Dollar Inquiry

The post NetamLoader Hides in Windows Update Folder in Suspected Supply Chain Attack on Asian Government appeared first on Daily CyberSecurity.

BRONZE SANDCASTLE uses Sandboxie DLL sideloading to run a modified Meterpreter backdoor in memory against targets in Asia and Africa.

Related Posts:

• Skynet LLMjacking Agent Hijacks Exposed AI Models to Hack Servers and Mine Crypto
• INC Ransomware Affiliates Expose Seven Servers Holding Phantom AI Framework and 46 Encryptors
• SafePay Ransomware Hits 600 Victims as FBI, CISA and Allies Issue Joint Warning

The post BRONZE SANDCASTLE Uses Sandboxie DLL Sideloading to Deploy Modified Meterpreter Backdoor appeared first on Daily CyberSecurity.

APT28 used the Hookedge backdoor, SSH tunnels, and a new loader to spy on a naval shipbuilder and defense firms in two NATO countries.

Related Posts:

• APT41 Deploys BlackX UEFI Bootkit Against Central Asian Diplomatic Agencies
• China-Linked Operator Used AI Agents to Breach 48 Government and Corporate Targets Across Asia
• Lazarus Operation FlashHole Abuses CrossWeb EX and GitHub to Spy on South Korean Firms

The post APT28 Uses Hookedge Backdoor to Spy on Naval Shipbuilder and Defense Firms in Two NATO Countries appeared first on Daily CyberSecurity.

In Operation FlashHole, the Lazarus Group used AI-made lure sites, CrossWeb EX, and GitHub C2 to spy on South Korean firms. Here is how.

Related Posts:

• Attackers Abuse ConnectWise Cloud Backup Credential to Breach Over 300 Microsoft 365 Tenants
• Ahold Delhaize Cyberattack Knocks Brand Websites and Apps Offline in US and Europe
• UNC7017 Executes AOMEI Supply Chain Attack Using Five-Minute Server Tampering

The post Lazarus Operation FlashHole Abuses CrossWeb EX and GitHub to Spy on South Korean Firms appeared first on Daily CyberSecurity.

Kimsuky spear phishing lures target Ukrainian security experts with fake invitations, as Operation GitPower abuses GitHub and GitLab.

Related Posts:

• Massive Cyberattack Paralyzes French Supermarket Refrigeration
• Suspected TraderTraitor Hackers Use Trojanized Terraform Provider to Deliver FLATROOF and ROOFDECK
• UAT-11985 Uses AI-Written Lures and an AitM Phishing Kit Against Taiwan Researchers

The post Kimsuky Spear Phishing Targets Ukrainian Diplomacy and Security Experts in Operation GitPower appeared first on Daily CyberSecurity.

Star Blizzard RedFlick phishing hit 100+ groups that back Ukraine, using scheduled tasks to drop the CosmicPulse backdoor after a single click.

Related Posts:

• Attackers Exploit Citrix NetScaler Zero-Day CVE-2026-88772 to Plant Hidden Web Shells
• Nigeria-Based Fraudsters Hijack .edu Accounts to Run University Job Scams
• SVG Phishing Attacks Return in August as Symantec Logs 222,000 Detections

The post Russia’s Star Blizzard Scales Up Phishing With RedFlick to Deliver CosmicPulse Backdoor appeared first on Daily CyberSecurity.