Chinese-language phishing-as-a-service (PhaaS) platforms are rapidly expanding their global reach by leveraging SMS and over-the-top (OTT) messaging channels such as iMessage and Rich Communication Services (RCS). Over the past several months, researchers have conducted large-scale analysis to identify and track some of the most active Chinese-backed phishing ecosystems. Their findings reveal highly organized operations that […]

The post Chinese-Backed Smishing Rings Scale Credential Theft via SMS and OTT Apps appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A significant evolution in Sandworm (APT-C-13) tradecraft, revealing the group’s use of SSH-over-Tor tunneling to achieve long-term, covert persistence inside targeted networks. Sandworm, also known as FROZENBARENTS, is a state-sponsored threat group active since 2014. It has consistently targeted government bodies, energy firms, and research institutions, focusing on intelligence collection. The attack begins with spear-phishing […]

The post Sandworm Uses SSH-over-Tor Tunnel for Stealthy Long-Term Persistence appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

APT-C-49 (OilRig), an Iranian state-sponsored advanced persistent threat group also known as APT34 and Helix Kitten, has deployed a sophisticated new attack campaign that conceals command-and-control configurations inside Google Drive images using LSB steganography. The group, which has been active since at least 2014, primarily targets government, energy, telecommunications, and financial sectors across the Middle […]

The post OilRig Hides C2 Config in Google Drive Image via LSB Steganography appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.