Between August and October 2025, a sophisticated phishing campaign has emerged targeting Colombian and Spanish-speaking users through deceptive emails masquerading as official communications from Colombia’s Attorney General’s office.

The campaign employs a carefully crafted social engineering strategy, luring victims with notifications about supposed lawsuits processed through labor courts.

This marks a significant shift in attack tactics as threat actors expand PureHVNC deployment into regions previously untouched by this malware.

The attack chain begins when recipients encounter an email containing an SVG attachment that leads them through Google Drive, where clicking on the document triggers an automatic download of a password-protected ZIP archive.

Inside this archive lies a renamed executable disguised with a judiciary-themed filename “02 BOLETA FISCAL.exe”, which is actually a legitimate javaw.exe file repurposed for malicious DLL side-loading.

This initial stage deploys Hijackloader, an increasingly prevalent loader previously observed delivering RemcosRAT to CrowdStrike customers.

IBM X-Force analysts identified this campaign as particularly noteworthy because it represents the first observed instance of PureHVNC being delivered to Spanish-speaking users through such coordinated efforts.

The malware, typically sold on dark web forums and Telegram channels by PureCoder, demonstrates advanced evasion capabilities that separate it from standard remote access trojans.

Infection Mechanism and Persistence

The malware operates through a sophisticated multi-stage infection process designed to evade security detection.

The attack exploits DLL side-loading, where the malicious JLI.dll hijacks Windows’ library loading procedures to inject the second-stage payload MSTH7EN.dll directly into memory using the LoadLibraryW() API function.

This shellcode eventually loads into vssapi.dll through memory manipulation techniques involving VirtualProtect() calls that modify the .text section to PAGE_EXECUTE_READWRITE permissions.

The third-stage payload contains encrypted configuration data including process name hashes that trigger execution delays when security software is detected.

When activated, the malware queries running processes and uses NtDelayExecution() API calls to pause execution, demonstrating awareness of its operational environment.

The complete infection chain ultimately establishes communication with the command server sofiavergara[.]duckdns[.]org, granting attackers complete remote access over compromised systems.

This campaign highlights how judicial and legal themes continue serving as effective social engineering vectors, particularly against government and corporate employees in Latin America.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Threat Actors Weaponizes Judicial Documents to Deliver PureHVNC RAT appeared first on Cyber Security News.

A newly discovered ransomware-as-a-service platform called Gentlemen’s RaaS has recently emerged on underground hacking forums, offering threat actors a sophisticated cross-platform attack capability.

The service, advertised by the threat actor known as zeta88, represents a significant expansion in ransomware delivery models, targeting critical infrastructure across multiple operating systems.

This development signals an intensified threat landscape where organized cybercriminals are offering affiliate-based ransomware operations to lower-level attackers, democratizing access to enterprise-level encryption malware.

The service leverages a compelling business model that allocates ninety percent of ransom proceeds to affiliates while retaining just ten percent for the operator.

This generous revenue-sharing arrangement has proven highly attractive to potential partners within the cybercriminal ecosystem.

By offering this financial incentive structure, the platform encourages widespread adoption and rapid deployment across global organizations.

The architecture reflects a deliberate strategy to scale ransomware operations efficiently while maintaining operational control through centralized decryption infrastructure.

KrakenLabs researchers identified the malware following detailed analysis of its promotional materials circulating across hacking forums.

The platform exhibits sophisticated technical construction with separate lockers designed for specific platforms, indicating purpose-built infrastructure rather than generic variants.

Lateral movement

The most technically noteworthy aspect involves the malware’s persistence and lateral movement mechanisms.

Gentlemen’s RaaS deploys a Go-based locker targeting Windows, Linux, NAS, and BSD systems, while employing a separate C-coded ESXi locker approximately thirty-two kilobytes in size.

The encryption implementation utilizes XChaCha20 combined with Curve25519 cryptography, with per-file ephemeral keys providing granular encryption architecture.

Particularly concerning is the self-propagation capability through WMI, WMIC, SCHTASKS, SC, and PowerShell Remoting commands, enabling rapid network traversal.

The malware establishes persistence via schtasks registry modifications and run-on-boot routines, ensuring survival across system restarts and administrative interventions.

Additionally, the platform supports network share discovery and automated encryption, allowing the ransomware to identify and compromise adjacent systems seamlessly.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post New Gentlemen’s RaaS Advertised on Hacking Forums Targeting Windows, Linux and ESXi Systems appeared first on Cyber Security News.

Fraudulent investment platforms impersonating cryptocurrency and forex exchanges have emerged as the predominant method used by financially motivated cybercriminals to defraud victims across Asia and beyond.

These sophisticated scam operations deploy advanced social engineering tactics to manipulate victims into transferring funds to attacker-controlled systems that masquerade as legitimate trading platforms.

The threat landscape has evolved significantly from isolated cybercriminal activities to highly organized, cross-border operations with structured hierarchies and specialized roles.

These schemes no longer target single geographic regions but instead operate internationally, utilizing complex infrastructure networks to sustain prolonged campaigns against unsuspecting investors.

Recent law enforcement actions have highlighted the massive scale of these operations.

In August 2025, Vietnamese authorities arrested 20 individuals connected to the billion-dollar Paynet Coin crypto scam, charging them with multi-level marketing violations and asset misappropriation.

While this particular case represents just one facet of the broader threat landscape, it demonstrates the transnational reach and financial impact of modern investment fraud campaigns.

Group-IB analysts identified a sophisticated victim manipulation framework that consistently appears across these fraudulent platforms.

The research reveals that threat actors employ a multi-stage approach beginning with initial contact through social media platforms including Zalo, Facebook, TikTok, and messaging applications such as Telegram and WhatsApp.

Scammers present themselves as successful investors or financial experts, using carefully crafted personas and forged credentials to establish trust with potential victims.

The deception extends beyond simple impersonation tactics. When victims display hesitation or skepticism, operators introduce additional “bait” personas, including fake fellow investors, friends, or support staff who engage directly with targets to simulate genuine platform activity and reinforce the illusion of legitimacy.

Advanced Infrastructure and Technical Sophistication

These fraudulent platforms operate on shared backend infrastructure rather than isolated throwaway websites.

The technical analysis reveals recurring API endpoints, SSL certificate reuse, and common administrative interfaces across multiple scam domains.

Group-IB researchers noted cross-domain HTTP requests during controlled browsing sessions, with captured traffic showing requests to API subdomains using paths such as /user/info, /index/tickers, and /index/init.

The infrastructure investigation uncovered exposed administrative panels accessible through subdomains following predictable naming patterns like adn.<domain> and api.<domain>.

These control interfaces, often presented in Simplified Chinese, feature standard login fields and integration with popular Chinese platforms including Tencent QQ, WeChat, and Weibo.

Source code analysis revealed the use of lightweight UI frameworks such as Layui, commonly employed in dashboard and administrative panel development.

Chat-based onboarding systems represent another layer of technical sophistication. Instead of direct registration forms, many platforms load chatbot interfaces powered by third-party services like Meiqia.

These chatbots serve multiple functions including access control, trust reinforcement, and payment instruction delivery.

When victims select deposit functions, the platform redirects them to chatbot windows that provide specific bank account details or cryptocurrency wallet addresses.

Backend payload analysis of these chatbot systems exposes configuration data, registered email addresses, and system-level parameters.

HTTP request traces show API calls to external chatbot infrastructure, while payload inspection reveals Chinese-language system messages and queue notifications not visible in the frontend interface.

The technical infrastructure also includes auxiliary components such as chat simulation tools designed to fabricate convincing conversation screenshots.

These web-based messaging simulators mimic popular platforms and include configurable message metadata, timestamps, and delivery status indicators to create fabricated social proof for victim persuasion.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Huge Surge in Fake Investment Platforms Mimic Forex Exchanges Steal Logins appeared first on Cyber Security News.

A groundbreaking security vulnerability has emerged that fundamentally challenges the integrity of modern trusted execution environments across Intel and AMD server platforms.

Researchers from Georgia Tech, Purdue University, and van Schaik LLC have unveiled TEE.fail, a sophisticated attack methodology that exploits weaknesses in DDR5 memory bus interposition to extract sensitive cryptographic keys from supposedly secure environments.

This discovery represents the first successful demonstration of memory bus interposition attacks on DDR5-based systems, affecting Intel SGX, TDX, and AMD SEV-SNP implementations running on the latest server hardware.

The attack leverages a critical shift in trusted execution environment design, where manufacturers moved from client-oriented hardware with robust integrity protections to server-grade implementations using deterministic AES-XTS memory encryption.

Unlike earlier SGX implementations that utilized Merkle tree-based integrity verification and replay protections, current server TEEs prioritize performance and scalability over security guarantees.

This trade-off enables support for terabytes of protected memory while reducing latency, but introduces vulnerabilities that TEE.fail exploits through physical memory bus monitoring.

TEE.fail researchers noted that the attack can be executed for under $1,000 using readily available hobbyist equipment from secondhand markets.

The research team demonstrated successful key extraction from machines maintaining Intel’s fully trusted “UpToDate” attestation status, highlighting that even systems meeting the highest security certifications remain vulnerable to this attack vector.

Probe isolation networks, DDR5 RDIMM interposer and logic analyzer connecting pods (Source – Tee.fail)

The implications extend beyond theoretical vulnerabilities, as the researchers successfully extracted provisioning certification keys (PCK) from production systems and used them to forge arbitrary SGX and TDX attestations.

Memory Bus Interposition Technique

The attack methodology centers on constructing a DDR5 memory interposition probe using components sourced from electronic equipment resellers.

The researchers developed a custom interposer by modifying DDR5 RDIMM riser boards and incorporating probe isolation networks salvaged from decommissioned Keysight test equipment.

The isolation network, consisting of carefully matched resistors, capacitors, and inductors, prevents electrical interference with the target system while enabling memory bus traffic observation.

// Example of deterministic encryption verification
void ecall_experiment() {
    memset(global_memory, 0x00, burst_size);
    uncached_read(global_memory);
    wait_for_logic_analyzer_collection();

    memset(global_memory, 0xFF, burst_size);
    uncached_read(global_memory);
    wait_for_logic_analyzer_collection();

    memset(global_memory, 0x00, burst_size);
    uncached_read(global_memory);
    wait_for_logic_analyzer_collection();
}

The attack exploits Intel’s use of deterministic AES-XTS encryption combined with precise control over enclave execution timing.

By implementing controlled-channel attacks to pause enclave execution at specific points and utilizing cache thrashing techniques to force memory accesses, researchers achieved synchronized data collection with their logic analyzer setup.

The deterministic nature of the encryption enables correlation between observed ciphertexts and known plaintext values, creating a direct pathway to cryptographic key recovery through ECDSA nonce extraction during signing operations performed by Intel’s Provisioning Certification Enclave.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post New TEE.fail Attack Breaks Trusted Environments to Exfiltrate Secrets from Intel and AMD DDR5 Environments appeared first on Cyber Security News.