Microsoft warns of trojanized gaming tools spreading a Java-based RAT.
Attackers use PowerShell and built-in tools like cmstp.exe for stealth, add Defender exclusions and scheduled tasks for persistence, then connect to a C2 server to steal data and deploy more payloads.
Attackers use PowerShell and built-in tools like cmstp.exe for stealth, add Defender exclusions and scheduled tasks for persistence, then connect to a C2 server to steal data and deploy more payloads.
Cyber Dispatch™️
Microsoft warns of trojanized gaming tools spreading a Java-based RAT. Attackers use PowerShell and built-in tools like cmstp.exe for stealth, add Defender exclusions and scheduled tasks for persistence, then connect to a C2 server to steal data and deploy…
Once launched, it connects to an external server at "79.110.49[.]15" for command-and-control (C2) communications, allowing it to exfiltrate data and deploy additional payloads.
Microsoft warns of trojanized gaming tools spreading a Java-based RAT.
Attackers use PowerShell and built-in tools like cmstp.exe for stealth, add Defender exclusions and scheduled tasks for persistence, then connect to a C2 server to steal data and deploy more payloads.
Attackers use PowerShell and built-in tools like cmstp.exe for stealth, add Defender exclusions and scheduled tasks for persistence, then connect to a C2 server to steal data and deploy more payloads.
Meta is suing scam advertisers in Brazil, China, and Vietnam after uncovering celeb-bait and cloaking schemes on its platforms.
It says it now protects 500,000+ celebrity images from repeated abuse and has suspended payments, disabled accounts, and blocked domains.
It says it now protects 500,000+ celebrity images from repeated abuse and has suspended payments, disabled accounts, and blocked domains.
New botnet loader Aeternum uses Polygon smart contracts as its C2 channel.
Commands go straight to the public blockchain—infected devices pull & execute them. No servers. No domains. No easy takedown.
Commands go straight to the public blockchain—infected devices pull & execute them. No servers. No domains. No easy takedown.
A previously unseen backdoor called Dohdoor is being deployed against U.S. schools and healthcare orgs.
Tracked as UAT-10027, the campaign chains phishing → PowerShell loaders → DLL side-loading → DoH C2 (via Cloudflare) → final Cobalt Strike payload.
Tracked as UAT-10027, the campaign chains phishing → PowerShell loaders → DLL side-loading → DoH C2 (via Cloudflare) → final Cobalt Strike payload.
The destruction of Israeli infrastructure has begun. This is a major cyber war against Israel since October 7th.
Forwarded from ᴛʜᴇ ɢʜᴏꜱᴛ ɪɴ ᴛʜᴇ ᴍᴀᴄʜɪɴᴇ
We Condemn False Claims Amid Ongoing #OpIsrael Cyber Campaign
"Israel is experiencing a major cyber attack." @CyberDispatch
"The destruction of Israeli infrastructure has begun. This is a major cyber war against Israel since October 7th." @CyberDispatch
As journalists covering the escalating cyber conflict targeting Israeli infrastructure, we are compelled to address a growing concern within the hacktivist community: the proliferation of false claims of responsibility.
Since October 7th, a sustained and significant cyber offensive has targeted Israeli digital infrastructure. Our verification processes confirm that thousands of Israeli sites have been rendered inaccessible, with military and government domains suffering particularly heavy disruption. The damage is real, and the coordinated effort behind it is substantial.
However, we are observing an increasing number of individuals and groups fraudulently claiming credit for attacks they did not execute. This behavior undermines the integrity of authentic hacktivism. Taking credit for someone else's labor is not activism—it is opportunism. It disrespects the skilled operatives risking exposure to make genuine contributions.
To those participating in the #OpIsrael campaign: we urge you to engage authentically. If you possess the capability to contribute technically, do so for the cause, not for personal recognition or social media attention. If you cannot participate directly, support by amplifying verified information.
"We argue that genuine hacktivists do not falsely claim credit for operations in the cyber war against Israel. Many participants are merely conducting banner grabbing or host checks on target domains rather than executing actual attacks. While thousands of Israeli sites—particularly military and government domains—are reportedly down, taking undue credit undermines the legitimacy of hacktivist operations.
If you are joining the 'OpIsrael' campaign, participate with genuine intent rather than seeking personal recognition. As journalists and security researchers, we are prepared to highlight credible actions, but we will strictly expose and deconflict false claims as part of our operational security (OpSec) protocol."
@TheGhostsITM
"Israel is experiencing a major cyber attack." @CyberDispatch
"The destruction of Israeli infrastructure has begun. This is a major cyber war against Israel since October 7th." @CyberDispatch
As journalists covering the escalating cyber conflict targeting Israeli infrastructure, we are compelled to address a growing concern within the hacktivist community: the proliferation of false claims of responsibility.
Since October 7th, a sustained and significant cyber offensive has targeted Israeli digital infrastructure. Our verification processes confirm that thousands of Israeli sites have been rendered inaccessible, with military and government domains suffering particularly heavy disruption. The damage is real, and the coordinated effort behind it is substantial.
However, we are observing an increasing number of individuals and groups fraudulently claiming credit for attacks they did not execute. This behavior undermines the integrity of authentic hacktivism. Taking credit for someone else's labor is not activism—it is opportunism. It disrespects the skilled operatives risking exposure to make genuine contributions.
To those participating in the #OpIsrael campaign: we urge you to engage authentically. If you possess the capability to contribute technically, do so for the cause, not for personal recognition or social media attention. If you cannot participate directly, support by amplifying verified information.
"We argue that genuine hacktivists do not falsely claim credit for operations in the cyber war against Israel. Many participants are merely conducting banner grabbing or host checks on target domains rather than executing actual attacks. While thousands of Israeli sites—particularly military and government domains—are reportedly down, taking undue credit undermines the legitimacy of hacktivist operations.
If you are joining the 'OpIsrael' campaign, participate with genuine intent rather than seeking personal recognition. As journalists and security researchers, we are prepared to highlight credible actions, but we will strictly expose and deconflict false claims as part of our operational security (OpSec) protocol."
@TheGhostsITM
❤1
موقع والا العبري:
هجمات سيبرانية إيرانية تسببت بعطل في شبكات الاتصالات والانترنت الليلة في إسرائيل
هجمات سيبرانية إيرانية تسببت بعطل في شبكات الاتصالات والانترنت الليلة في إسرائيل
❤1
Forwarded from ᴛʜᴇ ɢʜᴏꜱᴛ ɪɴ ᴛʜᴇ ᴍᴀᴄʜɪɴᴇ
מאז תחילת המלחמה, עלייה של כ-500% במתקפות הסייבר על ישראל.
רוב המתקפות הן מתקפות דידוס קצרות וחסרות משמעות.
חברות שונות חוו תקלות במהלך היממה האחרונה, חלקן מעומס וחלקן מתקלות טכניות, ועם זאת קיבלתי דיווחים כי חלק מהחברות דיווחו ללקוחות כי השיבושים נגרמו כתוצאה ממתקפות סייבר.
(בוואלה דיווחו כי חברות התקשורת אכן סבלו משיבושים בסלולרי ובאינטרנט בעקבות מתקפות סייבר.)
בגזרה האיראנית - הקבוצות לא מאיימות רק על ישראל, אלא גם על מדינות נוספות שמסייעות לכאורה במלחמה, כך לדוגמא קבוצת טופאן האיראנית מפרסמת מתקפות דידוס נגד בחריין, קבוצת הנדלה מפרסמת מתקפות על ירדן, איומים על ערב הסעודית ועל מדינות נוספות במזרח התיכון. כרגע נראה כמו שום דבר רציני.
@TheGhostsITM
רוב המתקפות הן מתקפות דידוס קצרות וחסרות משמעות.
חברות שונות חוו תקלות במהלך היממה האחרונה, חלקן מעומס וחלקן מתקלות טכניות, ועם זאת קיבלתי דיווחים כי חלק מהחברות דיווחו ללקוחות כי השיבושים נגרמו כתוצאה ממתקפות סייבר.
(בוואלה דיווחו כי חברות התקשורת אכן סבלו משיבושים בסלולרי ובאינטרנט בעקבות מתקפות סייבר.)
בגזרה האיראנית - הקבוצות לא מאיימות רק על ישראל, אלא גם על מדינות נוספות שמסייעות לכאורה במלחמה, כך לדוגמא קבוצת טופאן האיראנית מפרסמת מתקפות דידוס נגד בחריין, קבוצת הנדלה מפרסמת מתקפות על ירדן, איומים על ערב הסעודית ועל מדינות נוספות במזרח התיכון. כרגע נראה כמו שום דבר רציני.
@TheGhostsITM
❤1
Forwarded from ᴛʜᴇ ɢʜᴏꜱᴛ ɪɴ ᴛʜᴇ ᴍᴀᴄʜɪɴᴇ
Forwarded from ᴛʜᴇ ɢʜᴏꜱᴛ ɪɴ ᴛʜᴇ ᴍᴀᴄʜɪɴᴇ
Forwarded from ᴛʜᴇ ɢʜᴏꜱᴛ ɪɴ ᴛʜᴇ ᴍᴀᴄʜɪɴᴇ
במהלך היממה האחרונה אחד מספקי התקשורת הקטנים בישראל, המספק תקשורת למספר קיבוצים ויישובים, דיווח על מתקפת סייבר.
בעקבות המתקפה מורגשים שיבושים בשירותים המוענקים לתושבים, כך שחלק משירותי, התקשורת, האינטרנט והטלוויזיה לא פעילים.
@TheGhostsITM
בעקבות המתקפה מורגשים שיבושים בשירותים המוענקים לתושבים, כך שחלק משירותי, התקשורת, האינטרנט והטלוויזיה לא פעילים.
@TheGhostsITM
Forwarded from ᴛʜᴇ ɢʜᴏꜱᴛ ɪɴ ᴛʜᴇ ᴍᴀᴄʜɪɴᴇ
A wave of cyberattacks has temporarily disrupted access to U.S. and Israeli diplomatic web portals across several nations.
@TheGhostsITM
@TheGhostsITM
Dohdoor Malware Targets U.S. Schools and Healthcare with Multi-Stage Attack.
Forwarded from ᴛʜᴇ ɢʜᴏꜱᴛ ɪɴ ᴛʜᴇ ᴍᴀᴄʜɪɴᴇ
המוני ישראלים קיבלו בשעה האחרונה מסרון המתחזה לפיקוד העורף ומבקש ללחוץ על לינק להורדת גרסה.
@TheGhostsITM
@TheGhostsITM
Forwarded from ᴛʜᴇ ɢʜᴏꜱᴛ ɪɴ ᴛʜᴇ ᴍᴀᴄʜɪɴᴇ