Malware campaign targets Ukrainian agency with credential theft
Cisco Talos reports that a Ukrainian government organization experienced a malware attack involving a DLL file executed through WebDAV. The malware chain led to the installation of credential and cryptocurrency stealers, including Amatera stealer, ZigCryptoStealer, and NetSupport Manager. The attackers, believed with moderate confidence to be Russian, used deceptive prompts to infect victims, but did not specifically target the affected organization.
- Amatera stealer delivered via WebDAV infection chain
- NetSupport Manager installed with Russian-based C2 server
- Attack attributed to Russian threat actor UAT-10820
- No evidence Ukrainian agency was specifically targeted
Sources covering this
In this story
More in Cybersecurity
Browser-based malware campaign targets cryptocurrency users
Cisco Talos reports a criminal campaign targeting cryptocurrency traders by convincing users to paste or install malicious JavaScript in their browsers. The scheme uses Google Sheets and Docs to host and distribute the code, which then intercepts crypto transactions by modifying deposit addresses and displaying fake bonuses. Victims are lured via messages on Telegram, DarkForums, and paste sites, often under the pretext of exploiting a non-existent API vulnerability for profit.
OpenAI pledges $1 billion for AI cyber defense program
OpenAI has pledged $1 billion in credits to help organizations defending critical U.S. infrastructure—including water utilities, electric grids, local governments, banks, and nonprofits—access its AI-powered cybersecurity tools, training, and support. The "Daybreak for Frontline Defenders" initiative aims to help these sectors strengthen their defenses as AI-driven cyberattacks become more advanced. OpenAI says it will expand the program to partner countries in the coming weeks.
BigBear 2.0 phishing campaign hits Microsoft 365 accounts
Researchers at CloudSEK have identified a phishing-as-a-service campaign called BigBear 2.0 that stole over 5,100 Microsoft 365 credentials from users in at least 40 countries. Attackers obtained session cookies and passwords, allowing them to bypass multifactor authentication in hundreds of cases. IT service providers were among the most targeted organizations, increasing the possibility of broader downstream attacks.
Liquid Network exploit creates $320 million in unbacked bitcoin
Attackers exploited a software bug in Blockstream's Liquid Network, a Bitcoin sidechain, creating about 4,000 unbacked Liquid Bitcoin (L-BTC) and withdrawing $320 million. The attackers identified themselves as white hat hackers and have returned most funds, retaining around $47 million. According to Blockstream, the incident did not involve compromised multisig keys but was caused by a vulnerability in recent node software.