Iran-linked hacking group deploys new Android spyware amid Israel-Iran conflict
Recent DCHSpy samples have been disguised as VPN and banking apps and promoted on Telegram channels in both English and Farsi.
Recent DCHSpy samples have been disguised as VPN and banking apps and promoted on Telegram channels in both English and Farsi.
The exploit chain, dubbed ‘ToolShell’, has enabled the compromise of dozens of organizations worldwide.
The tool is designed to gather extensive information, including GPS data, SMS messages, photos, contacts, and audio.
The decryptor aims to help victims recover locked files without paying ransom demands.
According to Shadowserver, nearly 1,040 CrushFTP servers are still unpatched and exposed online.
Additionally, UK’s NCSC has publicly attributed the deployment of a sophisticated new malware dubbed ‘AUTHENTIC ANTICS’ to the APT28 threat actor long thought to be a unit of the GRU (Military Unit 26165).
Lamehug is integrated with Qwen 2.5-Coder-32B-Instruct, a powerful LLM accessed via the HuggingFace API.
The zero-day flaw, tracked as CVE-2025-53770, allows unauthorized attackers to remotely execute code on vulnerable systems.
The group is using stolen credentials and OTP seeds to regain access to devices even after security updates have been applied.
The flaw stems from insufficient validation of untrusted input in ANGLE and GPU.
Showing elements 481 - 490