Author: HackWatchit

Executive Summary This article provides a comprehensive analysis of two new variants of the KimJongRAT stealer. We combine our new research findings with existing knowledge to provide a comprehensive resource for understanding and combating these new KimJongRAT variants. The KimJongRAT stealer was first described in 2013 by the Malware.lu CERT [PDF]. We documented another variant of this family in 2019. One of the new variants uses a Portable Executable (PE) file and the other uses a PowerShell implementation. The PE and PowerShell variants are both initiated by clicking a Windows shortcut (LNK) file that downloads a dropper file from an…

In episode 58 of “The AI Fix” podcast, our hosts discover a pair of AI headphones that don’t electrocute you, Microsoft invents “medical superintelligence”, Chucky opens a hotel, some robot footballers fall over, Jony Ive invents a $6 billion pen, and Malcolm Gladwell fears a dystopian future full of children playing joyfully in the street. Graham discovers that the number 27 holds a special place in the heart of every AI, and Mark investigates Anthropic’s terrible AI shopkeeper. All this and much more is discussed in the latest edition of “The AI Fix” podcast by Graham Cluley and Mark Stockley.…

With PoC exploits for CVE-2025-5777 (aka CitrixBleed 2) now public and reports of active exploitation of the flaw since mid-June, you should check whether your Citrix NetScaler ADC and/or Gateway instances have been probed and compromised by attackers. Citrix’s current official line is that they have no evidence of in-the-wild exploitation and no indicators of compromise to share. Luckily, several security companies and researchers have provided some. CVE-2025-5777 exposed CVE-2025-5777 is an out-of-bounds memory read vulnerability stemming from insufficient input validation, which may allow unauthorized attackers to extract valid session tokens from the memory of internet-facing, vulnerable Netscaler ADC and…

According to cybersecurity researchers at eSentire, infostealer malware and advanced phishing toolkits are behind a massive 156% jump in cyberattacks targeting user logins and identity information impacting both office and remote workers. eSentire’s report, shared with Hackread.com also noted attackers increasingly focusing on stealing login details and session cookies, which they then use to commit financial crimes like Business Email Compromise (BEC) and cryptocurrency theft. The Rise of Phishing and Infostealers-as-a-Service A key factor driving this surge, as per the report (PDF) is the availability of Phishing-as-a-Service (PhaaS) platforms, which lower the technical skill and cost needed for criminals to…

Rodríguez and his collective received digital security training from Amate, another LGBTIQ+ organization that advocates nationally. Since May, Amate has trained 60 people on issues including digital rights, risk analysis, extortion, phishing, outing, surveillance, and revenge porn. It also includes the implementation of tools such as the use of VPN and encrypted messaging platforms, such as Signal and Proton.“Something that activists were telling us [that] is very common is that people take their Facebook photos and impersonate them on social networks, either to attack other collectives or to undermine personal aspects. So it’s a very interesting experience. People are not…

Cybersecurity leaders across state governments are well aware that state and local entities are increasingly prime targets for cyber attackers. From ransomware groups disrupting state health systems to phishing campaigns aimed at state employees, the threats are escalating, and the financial and operational consequences are growing. Additionally, according to the 2023 K-12 Six year in review report, nearly 80 school districts (impacting over 2,000 individual schools) were hit by ransomware, leading to closures, lost instruction, as well as compromised student data. Despite this, many state agencies still overspend on disjointed, redundant cybersecurity tools that don’t deliver the integrated protections needed…

Executive Summary In March 2025, Unit 42 researchers identified a wave of Prometei attacks. Prometei refers to both the botnet and the malware family used to operate it. This malware family, which includes both Linux and Windows variants, allows attackers to remotely control compromised systems for cryptocurrency mining (particularly Monero) and credential theft. This article focuses on the resurgence of the Linux variant. Prometei is under active development, incorporating new modules and methods into its capabilities. The latest Prometei versions feature a backdoor that enables a variety of malicious activities. Threat actors employ a domain generation algorithm (DGA) for their…

An emerging ransomware group that calls itself Bert is quickly evolving after hitting the cybercrime scene in April, targeting both Windows and Linux systems used by organizations in the health care, tech, and other industries in the United States, Europe, and Asia. It may be a Russian group whose malware evolved from REvil code. The post New Bert Ransomware Evolves With Multiple Variants appeared first on Security Boulevard.

Tesla’s Cybercab rollout should prompt tech-friendly jurisdictions to encourage a physical internet revolution. Decentralized physical-infrastructure networks that pay the people who supply real-world assets with on-chain rewards can ensure that everyone can participate in these economies.Read All