Author: HackWatchit

Authorities released free decryptor for Phobos and 8base ransomware Pierluigi Paganini July 18, 2025 Japanese police released a free decryptor for Phobos and 8Base ransomware, letting victims recover files without paying ransom. Japanese authorities released a free decryptor for Phobos and 8Base ransomware, allowing victims to recover files without paying. Japanese police released the free decryptor for ransomware families, which was likely built using intel from a recent gang takedown. The software can be downloaded from the police website and Europol’s NoMoreRansom site. The tool works on files with extensions like .phobos, .8base, .elbie, .faust, and .LIZARD, and may support…

Google is suing the operators behind BadBox 2.0, accusing multiple Chinese threat groups of playing different roles in the operation of the massive botnet that rolled up more than 10 million devices to run large-scale ad fraud and other malicious campaigns. The post Google Sues the Operators Behind the BadBox 2.0 Botnet appeared first on Security Boulevard.

Bitcoin has reached a new milestone with its realized capitalization crossing the $1 trillion mark for the first time, according to on-chain analytics firm Glassnode.The surge comes just a few days after BTC’s spot price hit a fresh all-time high above $123,000, underlining the intensity of recent investor demand.Unlike traditional market capitalization, realized cap measures the value of Bitcoin based on the price each coin last moved on-chain. This approach offers a clearer picture of actual capital stored in the network and is widely regarded as a more accurate indicator of investor conviction.Bitcoin Realized Cap (Source: Glassnode)James Check, an on-chain…

CrushFTP is warning that threat actors are actively exploiting a zero-day vulnerability tracked as CVE-2025-54309, which allows attackers to gain administrative access via the web interface on vulnerable servers. CrushFTP is an enterprise file transfer server used by organizations to securely share and manage files over FTP, SFTP, HTTP/S, and other protocols. According to CrushFTP, threat actors were first detected exploiting the vulnerability on July 18th at 9AM CST, though it may have begun in the early hours of the previous day. CrushFTP CEO Ben Spink told BleepingComputer that they had previously fixed a vulnerability related to AS2 in HTTP(S) that inadvertantly…

T-Mobile is facing backlash after launching an email campaign targeting FirstNet, the national communications network that thousands of first responders are relying on during ongoing flood recovery efforts in Central Texas, according to a news story yesterday. The controversy centers around a mass email sent by T-Mobile to Capitol Hill staffers on July 8, just days after catastrophic flooding struck Texas Hill Country on July 4. The message criticized FirstNet, calling it a “broken” network with “broken trust.” But what drew attention was the image T-Mobile used to drive its message: a stock photo of Ukrainian firefighters, rather than U.S.…

part, I did an exploratory data analysis of the gamma spectroscopy data. We were able to see that using a modern scintillation detector, we can not only see that the object is radioactive. With a gamma spectrum, we are also able to tell why it is radioactive and what kind of isotopes the object contains. In this part, we will go further, and I will show how to make and train a machine learning model for detecting radioactive elements. Before we begin, an important warning. All data files collected for this article are available on Kaggle, and readers can train…

LameHug: first AI-Powered malware linked to Russia’s APT28 Pierluigi Paganini July 18, 2025 LameHug malware uses AI to create data-theft commands on infected Windows systems. Ukraine links it to the Russia-nexus APT28 group. Ukrainian CERT-UA warns of a new malware strain dubbed LameHug that uses a large language model (LLM) to generate commands to be executed on compromised Windows systems. Ukrainian experts attribute the malware to the Russia-linked group APT28 (aka UAC-0001, Fancy Bear, Pawn Storm, Sofacy Group, Sednit, BlueDelta, and STRONTIUM). “An obvious feature of LAMEHUG is the use of LLM (large language model), used to generate commands based on their textual representation (description).” reads the…

Security researchers at Expel have detailed a new phishing technique that sidesteps the protection offered by physical FIDO (Fast Identity Online) security keys. While the keys themselves remain uncompromised, attackers have figured out how to trick users into granting access by misusing a legitimate cross-device login feature. The attackers didn’t need to break the FIDO security key itself. Instead, they relied on social engineering to get around it. They took advantage of the cross-device sign-in feature, which is meant to make FIDO more user-friendly, and used it against the victim. QR Code and Phishing Page It starts with the user…

In April, the cybersecurity community held its breath as the Common Vulnerabilities and Exposures (CVE) program was plunged into a moment of existential crisis. In the end, an eleventh-hour reprieve saved the day. While CVEs do not encompass the full scope of network security issues, they are still a critical component to track as part of a security program. Over the last 25 years, the CVE program has evolved into a critical, shared, and global resource that helps IT defenders keep their constituents safe and secure, and it’s important for this work to continue. But this is no time to…