6 casos · pág. 1/1
ESET researchers observed the Russia-aligned group UAC-0099 embedding a decoy request for guidance on building a nuclear weapon in a comment inside a VBScript used in the early stages of an attack on a target in Ukraine. The comment was meant to trigger the safety guardrails of an LLM-powered code scanner so that it stops inspecting the f…
FortiGuard Labs reports an ongoing Ousaban campaign targeting the Iberian Peninsula. The actor keeps refining its delivery chain and uses geofencing and environmental checks to restrict access to the malware to the intended victims. Ousaban resolves its C2 IP through daily-changing domains and runs a traditional C2 setup as a decoy. Its l…
On August 20, 2026, a compromised release of the Rust crate arrayref (0.3.10, about 245 million all-time downloads) appeared on crates.io. It added a dependency on the typosquatted crate proc-macro1 1.0.107, whose build script downloads and runs a remote binary at compile time. The maintainer account droundy appears to have been compromis…
Silent Lynx, tracked as UAT-6275 by Cisco Talos and TAG-193 by Recorded Future Insikt Group, has been linked to a new set of attacks on government organizations across the Commonwealth of Independent States. The activity ran from June 2025 through August 2026 and used four infection chains to deploy custom reverse shells (FoalShell, Chvos…
ESET documented the evolution of MATCHBOIL, a custom C downloader used by the Russia-aligned cyberespionage group UAC-0099. Samples span April 2024 to April 2026, although CERT-UA first documented the malware in August 2025. Each iteration became more sophisticated, with new obfuscation, sandbox checks and persistence methods. All victims…
Symantec reports that the Russia-linked APT28 (aka BlueDelta, Fancy Bear, Forest Blizzard), tracked by Symantec as Swallowtail, targeted entities in two NATO member states. Victims include a law enforcement agency, a naval shipbuilder and a manufacturer of military aircraft engines. In the shipbuilder intrusion in late July 2026, operator…
