Ukrainian security agencies have issued an urgent warning regarding a sophisticated malware campaign targeting government and critical infrastructure sectors through weaponized XLL files distributed via compressed archives.

The malicious campaign leverages Microsoft Excel add-in files containing the CABINETRAT backdoor, representing a significant evolution in targeted cyber operations against Ukrainian entities.

The attack methodology involves distributing zip archives containing XLL files with names designed to evoke urgency and legitimacy, such as “dodatok.xll” embedded within “500.zip” archives.

These files masquerade as documents relating to border security incidents, exploiting current geopolitical tensions to increase victim susceptibility.

Upon execution, the malicious XLL files deploy a complex multi-stage payload that establishes persistent access to compromised systems.

CERT-UA researchers noted the campaign’s sophisticated approach, identifying it as the work of threat group UAC-0245.

The malware demonstrates advanced evasion capabilities and represents a concerning shift toward more sophisticated Office-based attack vectors targeting Ukrainian critical infrastructure.

The campaign’s technical complexity and targeting patterns suggest state-sponsored origins with significant resources dedicated to bypassing modern security defenses.

Infection Mechanism and Persistence Strategy

The CABINETRAT malware employs a sophisticated multi-file deployment strategy that ensures persistent system access while evading detection mechanisms.

When the initial XLL file executes through Excel’s xlAutoOpen function, it creates three distinct components across the victim system: a randomly named executable file with 15-20 characters (internally called “runner.exe”) placed in both the Startup folder and %APPDATA%\Microsoft\Office\, an XLL loader file “BasicExcelMath.xll” positioned in Excel’s XLSTART directory, and a PNG image file “Office.png” containing embedded shellcode.

The persistence mechanism operates through multiple redundant pathways to ensure continued system access.

The malware creates registry entries in the Windows Run key with randomized names, establishes scheduled tasks executing every 12 hours with limited privileges, and leverages Excel’s automatic add-in loading functionality.

The runner executable launches Excel in hidden mode using the “/embed” parameter, automatically triggering the malicious BasicExcelMath.xll add-in without displaying visible Excel windows to users.

The complete infection chain from initial XLL execution through final CABINETRAT deployment.

The malware incorporates extensive anti-analysis measures including BIOS fingerprinting checks for virtualization software signatures, processor core and memory threshold validation, CPUID timing analysis to detect sandboxed environments, and PEB debugging flag verification.

These sophisticated evasion techniques demonstrate the campaign’s advanced nature and dedication to avoiding security research efforts.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Ukraine Warns of Weaponized XLL Files Delivers CABINETRAT Malware Via Zip Files appeared first on Cyber Security News.

Cybersecurity researchers have uncovered a sophisticated Android malware campaign targeting seniors through fraudulent travel and social activity promotions on Facebook.

The newly identified Datzbro malware represents a dangerous evolution in mobile threats, combining advanced spyware capabilities with remote access tools designed to facilitate financial fraud.

This campaign, first detected in August 2025, has expanded beyond Australia to target users across Singapore, Malaysia, Canada, South Africa, and the United Kingdom, demonstrating the global reach of these malicious operations.

The attack begins with threat actors creating numerous Facebook groups promoting “active senior trips,” dance events, and social gatherings specifically tailored to appeal to older adults seeking community activities.

These groups feature sophisticated content generated using artificial intelligence, creating convincing promotional materials that successfully attract genuine interest from potential victims.

The consistent appearance and messaging across groups targeting different geographical regions suggests coordination by a single threat actor or organized group operating at scale.

Fraudsters operating these groups contact interested victims through private messaging platforms including Facebook Messenger and WhatsApp, where they share links to download specialized applications purportedly required for event registration.

ThreatFabric analysts identified this malware distribution mechanism after investigating multiple scam alerts reported across affected regions.

The researchers discovered that victims were often asked to pay registration fees through the same malicious websites, creating additional opportunities for credential theft and financial fraud beyond the malware installation.

The fake websites employed in these campaigns prompt visitors to install what appears to be a legitimate community application, claiming it enables event registration, member connections, and activity tracking.

While the iOS application buttons currently serve as non-functional placeholders, researchers warn these could later be updated to distribute WebClip or TestFlight applications designed to steal credentials and payment information.

However, clicking the Google Play button immediately triggers the download of malicious APK files containing either Datzbro directly or the Zombinder dropper, specifically designed to bypass Android 13+ security restrictions.

Advanced Remote Access and Financial Targeting Capabilities

Datzbro employs sophisticated remote access technologies that distinguish it from conventional mobile malware families.

The malware leverages Android Accessibility Services to execute remote actions on behalf of operators, supporting comprehensive device control including screen sharing, interface interaction, and file management.

Each operator command corresponds to specific gestures or system functions, enabling threat actors to simulate button clicks, navigate applications, and perform complex interactions while remaining undetected by victims.

The malware’s “schematic” remote control mode represents a particularly innovative approach to device manipulation.

This feature creates basic screen layout representations using Accessibility event data, transmitting information about displayed elements, their positions, and content to command and control servers.

Operators can recreate the device interface on their systems, enabling effective control even when video streaming quality is poor or when black overlay attacks are active.

This dual-control mechanism ensures consistent access regardless of network conditions or defensive countermeasures.

Datzbro incorporates advanced evasion techniques including customizable black overlay attacks that hide fraudulent activities from victims.

Operators can adjust overlay transparency levels and display custom text messages, creating the impression that devices are idle or experiencing normal system updates.

While victims see opaque overlays preventing interaction observation, operators maintain semi-transparent views enabling continued device control.

This sophisticated visual deception allows financial transactions and credential harvesting to occur without victim awareness, significantly increasing attack success rates.

The malware specifically targets banking and cryptocurrency applications through hardcoded filtering systems that monitor Accessibility events for financial keywords including “bank,” “pay,” “wallet,” and “finance.”

Chinese language variants targeting “密码验证” (password verification) and “验证码” (verification code) demonstrate the malware’s multilingual capabilities and global targeting scope.

This focused approach to financial application monitoring, combined with keylogging capabilities and credential theft activities, positions Datzbro as a significant banking Trojan capable of comprehensive financial fraud operations against unsuspecting victims worldwide.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Threat Actors Leveraging Senior Travel Scams to Deliver Datzbro Malware appeared first on Cyber Security News.

A sophisticated malicious package has infiltrated the Python Package Index (PyPI), masquerading as a legitimate SOCKS5 proxy tool while harboring backdoor capabilities that target Windows systems.

The SoopSocks package, tracked as XRAY-725599, presents itself as a benign networking utility that creates SOCKS5 proxy services and reports server information to configurable Discord webhooks.

However, beneath this facade lies a complex multi-stage attack framework designed to establish persistent backdoor access on compromised Windows machines.

The malware demonstrates remarkable evolution across its version history, progressing from basic SOCKS5 implementations in versions 0.1.0 through 0.1.2 to sophisticated deployment mechanisms incorporating Windows service integration, VBScript installers, and compiled Go executables.

This progression indicates deliberate development aimed at enhancing stealth capabilities and bypassing security controls through automated installation processes that leverage both VBScript and executable deployment vectors.

JFrog Security Research analysts identified the malicious package during their routine monitoring of open-source repositories, recognizing suspicious behaviors that warranted deeper investigation.

The package’s deceptive nature lies in its functional SOCKS5 proxy capabilities, which provide legitimate functionality while simultaneously establishing covert communication channels and persistent access mechanisms.

The primary threat emerges from the package’s ability to install itself as a Windows service with elevated privileges, automatically configure firewall rules, and maintain continuous communication with command and control infrastructure.

The malware employs multiple persistence mechanisms including scheduled tasks, Windows services, and automatic startup configurations, ensuring survival across system reboots and user sessions.

Stealth Installation and Persistence Mechanisms

The current iteration of SoopSocks employs a sophisticated installation mechanism centered around the _autorun.exe executable, a PE32+ binary compiled from Go source code that orchestrates the entire deployment process with minimal user interaction.

This executable utilizes PowerShell as its primary orchestration mechanism while implementing multiple evasion techniques designed to avoid detection and user visibility.

The installation process begins when the executable launches PowerShell with carefully crafted parameters that bypass standard security controls and logging mechanisms.

The malware sets the execution policy to Bypass, skips profile loading to avoid detection hooks, suppresses error output to prevent user alerts, and hides interactive prompts throughout the installation sequence.

This configuration allows the malware to execute multiple deployment stages without triggering user notifications or administrator alerts.

powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden

Once operational, the malware copies itself to C:\Program Files\socks5svc\socks5svc.exe and establishes persistence through Windows service installation using the Go service library github.com/kardianos/service.

The service, named SoopSocksSvc, configures automatic startup with elevated permissions, ensuring continued operation across system restarts.

Additionally, the malware implements a fallback mechanism through scheduled tasks named SoopSocksAuto that trigger on system startup and user logon events.

The persistence strategy extends beyond service installation to include automatic firewall rule configuration that opens inbound TCP and UDP communications on port 1080.

These rules, designated as “SoopSocks TCP 1080” and “SoopSocks UDP 1080,” facilitate the SOCKS5 proxy functionality while providing attackers with unrestricted network access through the compromised system.

The malware’s ability to automatically escalate privileges through UAC bypass mechanisms ensures successful deployment even on systems with standard user accounts, representing a significant security concern for organizational environments.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Malicious PyPI Package Mimics as SOCKS5 Proxy Tool Attacking Windows Platforms appeared first on Cyber Security News.

The cybersecurity landscape witnessed the emergence of a sophisticated rootkit variation, FlipSwitch, targeting modern Linux kernels. First surfacing in late September 2025, FlipSwitch exploits recent changes in syscall dispatching to implant stealthy hooks directly into kernel code.

Early indicators suggest attackers leverage this novel approach to evade traditional detection, compromising critical infrastructure and cloud environments.

As organizations race to patch and monitor their systems, FlipSwitch underscores the evolving cat-and-mouse dynamic between kernel hardening efforts and adversary innovation.

FlipSwitch’s arrival follows the adoption of Linux kernel 6.9, which replaced the classic syscall_table array lookup with a switch-statement dispatch within the x64_syscall function.

While this change closed off traditional pointer-overwrite methods, it inadvertently introduced a new attack surface.

Elastic analysts noted that FlipSwitch takes advantage of this very transformation, carving a path through updated defenses and restoring adversaries’ ability to redirect system calls at will.

Elastic researchers identified FlipSwitch after observing anomalous syscalls in hardened environments, linking them back to a proof-of-concept module hidden within legitimate kernel modules.

Through careful reverse engineering, analysts uncovered the rootkit’s approach: rather than tampering with deprecated dispatch tables, FlipSwitch patches the compiled machine code of the x64_syscall dispatcher itself, flipping the hook at runtime without altering the kernel’s data structures.

Unlike prior rootkits that relied on data-structure corruption, FlipSwitch’s mechanism is remarkably precise.

By scanning the raw bytes of x64_syscall for the unique opcode pattern corresponding to the call instruction invoking a target syscall, the rootkit locates a single insertion point.

Next, it disables memory write protections at the CPU level by clearing the WP bit in the CR0 register, overwriting the call’s relative offset to divert execution into a malicious callback.

Once the malicious code executes, the original syscall behavior is restored by re-enabling write protection and reverting the offset, leaving minimal forensic artifacts.

Infection Mechanism and Persistence

FlipSwitch achieves initial kernel-space foothold through a two-stage loader embedded within a seemingly benign kernel module.

Upon module insertion, the loader leverages a kprobe on a trusted kernel function to derive the address of kallsyms_lookup_name, circumventing its non-exported status.

With this address, the loader obtains pointers to both target syscalls (e.g., sys_kill) and the x64_syscall dispatcher. It then calls a helper function to locate the precise call instruction:-

static inline void disable_write_protection(void) {
    unsigned long cr0 = read_cr0();
    write_cr0(cr0 & ~X86_CR0_WP);
}

static inline void enable_write_protection(void) {
    unsigned long cr0 = read_cr0();
    write_cr0(cr0 | X86_CR0_WP);
}

void apply_flipswitch_hook(void *dispatcher, unsigned long target) {
    disable_write_protection();
    // Overwrite 4-byte offset at hook_offset to point to fake_kill
    *(int32_t *)(dispatcher + hook_offset + 1) = calc_relative(target, hook_offset);
    enable_write_protection();
}

After patching, FlipSwitch unloads its loader, restoring the kernel’s write-protection settings and leaving only the modified instruction in memory.

This two-stage process ensures both stealth and persistence: the loader’s footprint vanishes after execution, and the hook remains active until the kernel module is removed or the system reboots.

FlipSwitch’s development highlights the need for advanced memory-integrity monitoring and the continued evolution of in-kernel security mechanisms.

As defenders adapt, rootkit authors will doubtless seek new avenues to subvert them, reinforcing the imperative for layered detection and proactive threat hunting.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post New FlipSwitch Hooking Technique Bypasses Linux Kernel Defenses appeared first on Cyber Security News.