Seqrite Labs APT-Team has uncovered a persistent threat entity, UNG0002 (Unknown Group 0002), orchestrating espionage-driven operations across Asian jurisdictions, including China, Hong Kong, and Pakistan. Active since at least May 2024, this South-East Asia-based cluster has demonstrated a high degree of adaptability and technical prowess, targeting critical sectors such as defense, civil aviation, electrotechnical engineering, […]
The post UNG0002 Deploys Weaponized LNK Files with Cobalt Strike and Metasploit to Target Organizations appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
As the state responded to a pro-Iranian attack, officials tell CyberScoop that it avoided reaching out to the federal agency, partly because it has been “politicized and weakened” under the president.
The post After website hack, Arizona election officials unload on Trump’s CISA appeared first on CyberScoop.
A new wave of cyber-attacks has emerged, exploiting Windows shortcut files (.LNK) combined with legitimate system utilities collectively known as Living-off-the-Land Binaries and Scripts (LOLBin/S) to deliver the DeerStealer infostealer through highly obfuscated multi-stage chains. Recent campaigns begin with phishing emails or fraudulent file shares containing weaponized .LNK files camouflaged as seemingly benign documents, often […]
The post DeerStealer Malware Spread Through Weaponized .LNK and LOLBin Tools appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
Threat actors have leveraged a phishing campaign targeting npm package maintainers, resulting in the compromise of widely used JavaScript tooling libraries. The campaign, first reported on July 18, 2025, utilizes a typosquatted domain, npnjs.com, to mimic legitimate npm communications and trick developers into surrendering their authentication tokens. This multi-stage operation begins with automated emails scraped […]
The post Threat Actors Compromise Popular npm Packages to Steal Maintainers’ Tokens appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
An developer recently came across a highly advanced phishing email that spoofs the [email protected] address in order to impersonate npm, the Node.js package registry. The email directed recipients to a malicious link on npnjs.com, a domain cleverly typosquatted to mimic npmjs.com by swapping ‘m’ for ‘n’. This fake site hosted a complete clone or proxy […]
The post Beware of npm Phishing Emails Targeting Developer Credentials appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.