Internet infrastructure provider Cloudflare fends off a massive 3.8 Tbps DDoS attack, surpassing the previous record. Learn how…

Internet infrastructure provider Cloudflare fends off a massive 3.8 Tbps DDoS attack, surpassing the previous record. Learn how Cloudflare’s advanced security measures protected its customers from this unprecedented cyber threat.

Internet infrastructure provider Cloudflare has successfully repelled a massive distributed denial-of-service (DDoS) attack that reached a staggering 3.8 terabits per second (Tbps) and 2.14 billion packets per second (PPS), confirmed the company’s CEO, Matthew Prince. This unprecedented assault surpasses the previous record of 3.47 Tbps DDoS attack with a packet rate of 340 million PPS encountered by Microsoft in November 2021.

> Not all records you’re happy about breaking: @Cloudflare recently mitigated the largest ever reported hyper-volumetric #DDoS attack. 3.8 terabits per second (Tbps) and 2.14 billion packets per second (Bpps). Handled automatically any without any customer impact. Details to come. pic.twitter.com/SuHZsqCEFV
> 
> — Matthew Prince 🌥 (@eastdakota) October 1, 2024

The attack was part of a month-long hacking campaign that began in early September 2024. These attacks, designed to overwhelm a website or app with internet traffic, aimed to force Cloudflare’s customers offline. Over 100 volumetric DDoS attacks were launched during this period, with many exceeding 3 Tbps and mainly originating from Vietnam, Russia, Brazil, Spain, and the US.

The hackers utilized a botnet consisting of hijacked internet devices, including Asus and MikroTik routers, DVRs, and web servers. 

“The high bitrate attacks appear to originate from a large number of compromised ASUS home routers, likely exploited using a CVE 9.8 (Critical) vulnerability that was recently discovered by Censys,” Cloudflare researchers noted.

The botnet leveraged the User Datagram Protocol (UDP) to generate massive amounts of traffic, overwhelming Cloudflare’s targets. The attacks were primarily focused on volumetric L3/4 DDoS, which aims to exhaust a target’s bandwidth and resources. The target was a customer of an unnamed hosting provider.

While the attacks were severe, Cloudflare was able to mitigate them without significant disruption to its customers. Cloudflare’s global network of individual servers and advanced traffic analysis systems were instrumental in mitigating the record-breaking attack. The company’s ability to distribute incoming traffic and filter out malicious data flow enabled it to effectively defend its customers. 

The DDoS campaign targeted various industries, including finance, internet, and telecommunications. The company’s strong network and defence systems ensured that most customers experienced minimal downtime or service degradation.

The threat actors behind the campaign exploited hijacked internet devices, such as routers, DVRs, and web servers, to form a botnet. This botnet leveraged the User Datagram Protocol (UDP) to generate massive amounts of traffic, overwhelming Cloudflare’s targets.

Despite Cloudflare’s successful defence of this record-breaking DDoS attack, the incident highlights the growing sophistication of cyber threats and the importance of adopting reliable internet infrastructure.

The development of new attack techniques and accessible tools makes it easier for attackers to launch large-scale attacks. As online services continue to expand, the need for advanced security measures to protect against such attacks becomes increasingly critical.

1.  Cloudflare thwarts largest reported HTTP DDoS attack
2.  Microsoft Azure customer hit by 2.4 Tbps DDoS attack
3.  Record-Breaking DDoS Attack Against European Firm Mitigated
4.  Kaspersky Reveals Alarming IoT Threats, Dark Web DDoS Boom
5.  Google, Cloudflare, AWS Disclose Largest DDoS Attack in History

Cloudflare Mitigates Record Breaking 3.8 Tbps DDoS Attack

Dubai Silicon Oasis, United Arab Emirates, 3rd October 2024, CyberNewsWire

**Dubai Silicon Oasis, United Arab Emirates, October 3rd, 2024, CyberNewsWire**

ANY.RUN has announced an upgrade to its Threat Intelligence Portal, enhancing its capabilities to identify and analyze emerging cyber threats. This upgrade underscores ANY.RUN’s commitment to providing comprehensive threat intelligence solutions, empowering users to navigate the ever-evolving landscape of cyber threats. 

**About Threat Intelligence Lookup** 

The main page of ANY.RUN TI portal 

Threat Intelligence Lookup is a streamlined platform designed to help users find relevant threat data extracted from ANY.RUN’s extensive database of malware analysis sessions carried out in its interactive sandbox. This tool transforms isolated data into a holistic view of both persistent and emerging threats, offering users insights into malicious activities, suspicious connections, and hidden indicators of compromise. 

Accessible through an intuitive web interface and an API for seamless integration with existing security solutions, TI Lookup allows users to examine various data points including: 

*   Processes 
*   Modules 
*   Files 
*   Network activity 
*   Registry interactions 

This comprehensive approach enables cybersecurity analysts to gain detailed context about attacks, helping them understand the nature, scope, and potential impact of threats. 

**Expanded Search Capabilities** 

In addition to the enhancements to Threat Intelligence Lookup, ANY.RUN has significantly expanded its search capabilities, now offering over 40 parameters for querying its extensive database. This upgrade allows users to filter searches by file hashes, IP addresses, domain names, and more, facilitating a more targeted and efficient investigation of potential threats. 

**How TI Lookup Helps in Investigating Emerging Threats** 

ANY.RUN showcased the effectiveness of its TI Lookup feature through a practical use case. By utilizing a single suspicious IP address, users can efficiently identify associated malware.  

Search by the IP address in ANY.RUN TI Lookup 

For instance, investigating the IP address by submitting the query **destinationIP:”185.196.9.26″** revealed connections to Redline malware, which is used to steal login credentials and other sensitive data. 

The close integration between the ANY.RUN sandbox and Threat Intelligence Lookup allows users to directly access recorded sandbox sessions where the specific IP address was detected. By accessing the sandbox session, users can examine the malware’s actions in a secure environment. 

Analysis of the Redline stealer in the ANY.RUN sandbox 

One of the significant advantages of TI Lookup is its ability to provide immediate insights into threat behavior, collecting crucial data such as Indicators of Compromise (IOCs) and Tactics, Techniques, and Procedures (TTPs). 

With these significant upgrades, ANY.RUN reaffirms its position as a leader in threat intelligence solutions, equipping cybersecurity analysts with the tools necessary to combat emerging threats effectively. 

Users who want to experience ANY.RUN’s enhanced Threat Intelligence portal firsthand can sign up for a 14-day free trial to unlock powerful tools for detecting, analyzing, and combating emerging cyber threats. 

**Contact**

**The ANY.RUN team**  
**ANYRUN FZCO**  
**\[email protected\]**  
**+1 657-366-5050**

ANY.RUN Upgrades Threat Intelligence to Identify Emerging Threats

New Linux malware ‘Perfctl’ is targeting millions worldwide, mimicking system files to evade detection. This sophisticated malware compromises…

New Linux malware ‘Perfctl’ is targeting millions worldwide, mimicking system files to evade detection. This sophisticated malware compromises Linux servers, exploiting vulnerabilities for cryptomining and system resource hijacking.

Cybersecurity researchers at Aqua Nautilus have discovered a new Linux malware that has targeted millions worldwide, exploiting over 20,000 misconfigurations. The malware has been lurking for some time, but recently attacked a Nautilus honeypot, providing an opportunity to detect and examine this threat that can put any Linux server at risk.

According to Aqua Nautilus, this sophisticated Linux malware dubbed “perfctl” has been quietly targeting servers worldwide over the past few years. This highly persistent and evasive threat has been actively seeking vulnerabilities and misconfigurations to compromise systems.

The malware’s name comes from the cryptominer process, which drains system resources and causes significant issues for Linux developers. In the company’s technical research, shared exclusively with Hackread.com ahead of publishing on October 3 Thursday, there have been numerous incident reports and discussions in online communities pointing to the widespread prevalence of perfctl.

The malware’s impact has been felt across various developer forums, including Reddit, Stack Overflow, and others. “Usually in some of these posts, you can find replies with links to reports about the malware written by researchers. But in this case, however, none of these had links to such reports,” noted Assaf Morag and Idan Revivo in their research.

Another concerning trend highlighted by researchers is that Perfctl uses rootkits and evasion techniques to hide its presence from standard system tools and monitoring processes. It temporarily suspends its activities when new users log in, making it harder to detect. In addition, Perfctl uses Unix sockets for internal communication and the Tor network for external connections, making it difficult to track its activities.

The attack starts with the malware downloading a main payload from an attacker-controlled HTTP server controlled, named “httpd”. This payload has multiple layers of execution, ensuring persistence and evading detection. The malware copies itself to a new location, runs a new binary, terminates the original process, and deletes the initial binary.

It then executes the main payload under a different name, choosing the process’s name to appear less suspicious. The malware is executed by ‘sh’, changing its name from httpd to sh.

This malware gains persistence by self-replicating and using deceptive filenames that resemble legitimate system files. Perfctl copies itself to multiple locations on the disk, ensuring its survival even after system restarts or cleanups. 

Perfctl’s primary goal is cryptomining, using infected systems for cryptocurrency generation. It has also been observed engaging in proxy-jacking, and hijacking server resources for malicious purposes. Perfctl attempts to exploit the Polkit vulnerability (CVE-2021-4043) to gain root privileges, granting it greater access and control over the system.

Attack flow (Aqua Nautilus)

> _“Given the scale, we strongly believe the attackers targeted millions worldwide with a potential number of victims of thousands, it appears that with this malware any Linux server could be at risk.”_
> 
> Aqua Nautilus

Perfctl’s rootkit and evasion techniques make detection challenging, while its deceptive filenames and behaviour can make it appear legitimate. Its dynamic behaviour can also hinder detection efforts.

To protect your Linux systems from Perfctl, regularly update your operating system and software with the latest security patches, conduct vulnerability assessments, implement robust network security measures like firewalls and intrusion detection systems, monitor system activity for unusual behaviour, and use security tools like endpoint protection solutions.

1.  Telegram-Controlled TgRat Trojan Targets Linux Servers
2.  New Linux Malware “Migo” Exploits Redis for Cryptojacking
3.  Play Ransomware Variant Targeting Linux ESXi Environments
4.  Decade-Old Linux Vulnerability Used for DDoS Attacks on CUPS
5.  Mirai-based NoaBot Botnet Hits Linux Systems with Cryptominer

New Linux Malware ‘Perfctl’ Targets Millions by Mimicking System Files

San Francisco, United States / California, 3rd October 2024, CyberNewsWire

**San Francisco, United States / California, October 3rd, 2024, CyberNewsWire**

Doppler, the leading platform in secrets management, today announces the launch of **Change Requests**, a new feature providing engineering teams with a secure, auditable approval process for managing and controlling secret changes across environments. Designed to enhance security, compliance, and team collaboration, **Change Requests** gives organizations the tools to mitigate the potential risks from misconfigurations or unauthorized changes and maintain a comprehensive audit trail of all secret modifications. This launch comes at a time when organizations are facing increased security and compliance demands, particularly in managing sensitive information.

As security breaches and insider threats continue to rise, managing secrets has become a growing challenge for teams of all sizes; protecting sensitive information at every stage of the software development lifecycle is critical. According to a recent study by Cybersecurity Ventures, cybercrime damages are expected to cost the world $9.5 trillion in 2024 alone, and compromised secrets and misconfigurations remain significant factors in these attacks. In 2023, GitGuardian reported that there were 12.8 million incidents of exposed secrets on Github which is an increase of 28% from 2022, highlighting the need for tighter controls over sensitive information.

Doppler’s **Change Requests** is designed to address these risks by introducing a formalized, auditable approval process for secrets management. This feature offers teams a centralized and controlled way to manage changes to sensitive information while maintaining full visibility into who made updates and when.

**Addressing Needs for Security and Compliance**

*   **Reducing Misconfiguration:** According to the most recent Verizon Data Breach Investigation Report, breaches as a result of errors grew by 28%. By treating secret changes like code, Doppler seeks to help companies decrease this number and reduce the chances of misconfigurations reaching production. With Change Requests, organizations can require peer reviews and approvals for every configuration change to ensure all updates undergo proper scrutiny before being deployed.
*   **The Growing Compliance Burden:** Cybersecurity standards are increasingly holding companies accountable for how they handle sensitive data. Organizations need clear audit trails and compliance-friendly processes. Paired with detailed activity logging, Change Requests further eases the burden teams face by keeping a complete, auditable trail of every request, review, and change, providing a fully traceable history.
*   **Enforce Security with Controlled Access:** As teams grow, so does the complexity of managing secrets. Organizations can safeguard sensitive secrets with custom roles and user groups by enforcing a structured approval process, ensuring only authorized personnel can make critical updates. This helps prevent unauthorized changes and boosts their overall security posture while keeping teams nimble.

**Building Trust Through Security**

> “It’s incredibly exciting to ship our most demanded feature by both developers and enterprises! Just as pull requests have increased the level of trust with production code, Doppler will fill that long awaited gap with secrets,” said **Brian Vallelunga**, CEO of Doppler. “I’m confident that Doppler’s Change Requests is going to establish a new paradigm for managing secrets securely at enterprise scale—undergoing approval, maintaining a rich audit trail for security and compliance, and integrating natively with production infrastructure for uninterrupted, no-downtime rollouts.”

**Availability**

The Change Requests feature is available now for all users on Doppler’s Enterprise plan. To learn more about implementing Change Requests and how it can improve the organization’s security and compliance efforts, users can visit Doppler’s documentation.

**About Doppler**

Doppler is the leading platform for managing secrets such as environment variables, API keys, and tokens in a centralized, secure, and scalable way. Trusted by thousands of security-conscious teams around the world, Doppler provides developers with the tools they need to keep secrets in sync across every app, service, and infrastructure. Built with security in mind, Doppler offers robust integrations, comprehensive logging, and enterprise-grade encryption to ensure sensitive data remains protected throughout its lifecycle.

**Contact**

**Doppler Press**  
**\[email protected\]**

Doppler Launches ‘Change Requests’ to Strengthen Secrets Management Security with Audited Approvals

Singapore, Singapore, 3rd October 2024, CyberNewsWire

**Singapore, Singapore, October 3rd, 2024, CyberNewsWire**

At DEF CON 32, the SquareX research team delivered a hard-hitting presentation titled Sneaky Extensions: The MV3 Escape Artists where they shared their findings on how malicious browser extensions are bypassing Google’s latest standard for building chrome extensions: Manifest V3 (MV3)’s security features, putting millions of users and businesses at risk.

SquareX’s research team publicly demonstrated rogue extensions built on MV3. The key findings include:

*   Extensions can steal live video streams, such as those from Google Meet and Zoom Web, without requiring special permissions.
*   The rogue extensions can act on a user’s behalf to add collaborators to private GitHub repositories.
*   The extensions are capable of hooking into login events to redirect users to a page disguised as a password manager login.
*   Extensions built on MV3 can steal site cookies, browsing history, bookmarks, and download history with ease, like their MV2 counterparts.
*   The rogue extensions can add pop-ups to the active webpage, such as fake software update prompts, tricking users into downloading malware.

Browser extensions have long been a target for malicious actors — a Stanford University report estimates that 280 million malicious Chrome extensions were installed in recent years. Google has struggled to address this issue, often relying on independent researchers to identify malicious extensions. In some cases, Google has had to manually remove them, such as the 32 extensions taken down in June last year. By the time they were removed, these extensions had already been installed 75 million times.

Most of these issues arose because the Chrome extension standard, Manifest Version 2 (MV2), was riddled with loopholes that granted extensions excessive permissions, and allowed scripts to be injected on the fly, often without users’ knowledge. This allowed malicious actors to easily exploit these vulnerabilities to steal data, inject malware, and access sensitive information. MV3 was introduced to address these problems by tightening security, limiting permissions, and requiring extensions to declare their scripts beforehand. 

However, SquareX’s research shows that MV3 falls short in many critical areas, demonstrating how attackers are still able to exploit minimal permissions to carry out malicious activity. Both individual users and enterprises are exposed, even under the newer MV3 framework.

Today’s security solutions, such as endpoint security, SASE/SSE, and Secure Web Gateways (SWG), lack visibility into installed browser extensions. There is currently no mature tool or platform capable of dynamically instrumenting these extensions, leaving enterprises without the ability to accurately assess whether an extension is safe or malicious. 

SquareX is committed to the highest level of cybersecurity protection for enterprises and has built key innovative features to solve this problem, which include;

*   Fine grained policies to decide which extensions to allow / block and parameters include extension permissions, creation date, last update, reviews, ratings, user count, author attributes etc
*   SquareX blocks network requests sent by extensions at run time – based on policies, heuristics and machine learning insights
*   SquareX is also experimenting with dynamic analysis of Chrome Extensions using a modified Chromium browser in its cloud server

These are part of SquareX’s Browser Detection and Response solution which is being deployed at medium-large enterprises and is effectively blocking these attacks.

> **Vivek Ramachandran****, Founder & CEO of** **SquareX**, warned about the mounting risks: “Browser extensions are a blind spot for EDR/XDR and SWGs have no way to infer their presence. This has made browser extensions a very effective and potent technique to silently be installed and monitor enterprise users, and attackers are leveraging them to monitor communication over web calls, act on the victim’s behalf to give permissions to external parties, steal cookies and other site data and so on.” “Our research proves that without dynamic analysis and the ability for enterprises to apply stringent policies, it will not be possible to identify and block these attacks. Google MV3, though well intended, is still far away from enforcing security at both a design and implementation phase,” said Vivek Ramachandran.

**About SquareX**

SquareX helps organizations detect, mitigate and threat-hunt client-side web attacks happening against their users in real time.

SquareX’s industry-first Browser Detection and Response (BDR) solution, takes an attack-focused approach to browser security, ensuring enterprise users are protected against advanced threats like malicious QR Codes, Browser-in-the-Browser phishing, macro-based malware, malicious extensions and other web attacks encompassing malicious files, websites, scripts, and compromised networks.

With SquareX, enterprises can also provide contractors and remote workers with secure access to internal applications, enterprise SaaS, and convert the browsers on BYOD / unmanaged devices into trusted browsing sessions.

**Contact**

**Head of PR**  
**Junice Liew**  
**SquareX**  
**\[email protected\]**

Millions of Enterprises at Risk: SquareX Shows How Malicious Extensions Bypass Google’s MV3 Restrictions

Torrance, United States / California, 3rd October 2024, CyberNewsWire

**Torrance, United States / California, October 3rd, 2024, CyberNewsWire**

**An exclusive live webinar** will take place on October 4th at noon Eastern Time (ET), demonstrating how Criminal IP’s Attack Surface Management (ASM) can help organizations proactively detect and mitigate cyber threats.

The webinar will feature a Criminal IP ASM Live Demo, providing a comprehensive view of attack surface visibility. As cyber threats continue to evolve, businesses must strengthen their defenses, and this session will outline essential steps for achieving that goal.

**▶ Users can register now for the free webinar at 12PM ET on October 10 ◀**

**Key Takeaways:**

*   **Criminal IP ASM Live Demo**: Seeing ASM in action as it uncovers hidden threats and helps secure user’s organization attack surface.
*    **Comprehensive Attack Surface Visibility**: Discovering how to gain real-time insights into a user’s organization’s digital ecosystem, identifying vulnerabilities before they can be exploited.
*    **Proactive Threat Detection and Mitigation**: Learning how to detect risks early and implement mitigation strategies to minimize exposure.
*    **Strengthening Cyber Defenses with ASM**: Exploring how ASM can be integrated into cybersecurity frameworks to enhance protection and provide continuous defense against threats.

This webinar is designed for IT professionals, security managers, and decision-makers looking to advance their cybersecurity strategies and stay ahead in today’s rapidly changing threat landscape.

**Users can register now** to gain valuable insights on safeguarding their organization’s attack surface and taking proactive steps toward a more secure future.

**Contact**

**Michael Sena**  
**AI SPERA**  
**\[email protected\]**

Webinar Announcement: Attack Surface Management to the Rescue – Find, Fix, Fortify Your ASM with Criminal IP

This article explores the Linux vulnerability discovered by Simone Margaritelli, which, according to cybersecurity companies Uptycs and Akamai,…

This article explores the Linux vulnerability discovered by Simone Margaritelli, which, according to cybersecurity companies Uptycs and Akamai, can be exploited for additional malicious purposes, including RCE and DDoS attacks against the Common Unix Printing System (CUPS).

Hackread.com recently **reported** a critical Linux vulnerability, discovered by cybersecurity researcher Simone Margaritelli (aka **evilsocket**), which could allow attackers to gain complete control of GNU/Linux systems, potentially allowing Linux Remote code execution. This decade-old flaw affects all GNU/Linux systems and has a severity score of 9.9 out of 10, indicating immense potential for damage if exploited. 

As per the latest updates, new findings from Cloud computing giant, Akamai, and cybersecurity firm, Uptycs, highlight an even more immediate concern: exploiting the issue for devastating DDoS attacks and carrying out remote code execution (RCE) in Linux.

****Uptycs Research****

Uptycs threat research team **identified** vulnerabilities in CUPS (Common UNIX Printing System), which can be exploited to install malicious printers and execute unauthenticated remote code execution attacks. CUPS is a widely used open-source printing system for Linux and Unix-like operating systems, allowing users to share printers on a network and manage printing jobs. 

The vulnerability resides in the cups-browsed daemon, a component that searches for available network printers. An attacker can exploit this flaw by sending a malicious packet to a vulnerable CUPS service. This packet tricks the service into fetching a non-existent printer description file from a target server specified by the attacker.

According to researchers, attackers can create a malicious PPD file and send it to a vulnerable CUPS server, requiring the cups-browsed daemon to be enabled, UDP port 631 open, and the victim to print to the malicious printer.

****Akamai Research****

Researchers at Akamai SIRT (Security Incident Response Team) also discovered a flaw that allows attackers to exploit vulnerable CUPS servers and turn them into unwitting amplifiers for distributed- denial-of-service (DDoS) attacks, allowing attackers to exploit vulnerable servers and turn them into unwitting DDoS hosts.

According to the company’s **blog post** published on October 01, 2024, the attack involves misinterpreting a UDP packet, downloading malicious data, and establishing multiple TCP connections to a target system, potentially causing an outage. 

****The Scope of the Problem:****

*   Akamai identified over 198,000 internet-connected devices running CUPS.
*   Roughly 34% (over 58,000) of these devices were vulnerable to the attack.
*   Outdated CUPS versions (released as far back as 2007) were the most susceptible.
*   Testing revealed potential amplification factors of up to 600x, significantly increasing attack power.

The issues discussed in these reports are directly related to the Linux vulnerability discovered by Margaritelli because his identified vulnerability involves a remote code execution exploit chain that targets the Common Unix Printing System (CUPS).

This exploit chain leverages several vulnerabilities, including **CVE-2024-47175** (libppd), **CVE-2024-47176** (cups-browsed), **CVE-2024-47177** (cups-filters), and **CVE-2024-47076** (libcupsfilters).

To stay protected, install the latest version of CUPS and ensure all system components, such as libcupsfilters, libppd, and cups-filters, are updated. Disable or configure cups-browsed daemon, if printing isn’t essential, or restrict access to it to trusted devices. Strengthen network security with firewalls, intrusion detection systems, and IPS, and regularly review and update security policies.

1.  **Telegram-Controlled TgRat Trojan Targets Linux Servers**
2.  **Critical Flaws Found in GNU C Library, Major Linux Distros at Risk**
3.  **Goldoon Botnet Hits D-Link Devices by Exploiting 9-Year-Old Flaw**
4.  **7-Year-Old 0-Day in Microsoft Office Exploited to Drop Cobalt Strike**
5.  **9-year-old Windows flaw dropped ZLoader malware in 111 countries**

Decade-Old Linux Vulnerability Can Be Exploited for DDoS Attacks on CUPS

Pig Butchering scam targets crypto users with fake trading apps on Apple and Google Play Stores. Disguised as…

Pig Butchering scam targets crypto users with fake trading apps on Apple and Google Play Stores. Disguised as legitimate platforms, these apps defraud investors, bypassing store checks and exploiting unsuspecting users globally.

A fraud campaign targeting **Apple iOS and Android users** has been discovered by GroupIB, involving fake trading apps. These apps, found on Apple’s App Store and Google Play, and on phishing sites, are part of a Pig Butchering scam targeting cryptocurrency investors in Asia-Pacific, Middle East & Africa, and European regions.

Group-IB’s Threat Intelligence, and Fraud Protection analysts first discovered these fake mobile applications in May 2024 and have been investigating the campaign ever since.

According to their **report** shared with Hackread.com ahead of publishing on Wednesday, these applications were developed for Android using a single cross-platform framework. One was distributed through the Google Play store, while another targeted iOS devices.

What’s worse, unlike traditional mobile trojans, these applications had no typical malicious features and cybercriminals have created a facade of a legitimate trading platform to defraud victims.

The fraudulent apps check the current date and time to bypass Apple’s App Store checks, launching a fake activity with mathematical formulas and graphics if it is earlier than 22 July 2024, 00:00:00. Android samples were designed to display a fraudulent trading application hosted on the api.fxbrokerscc domain, part of a larger fraudulent infrastructure.

According to researchers, these fake trading apps and downloader apps mimic legitimate platforms and may include features like account settings, transaction history, and stock information. Downloader apps, found in the Apple App Store or distributed through phishing websites, prompt victims to install the fraudulent app.

Fake app on Apple Store (left) – Fake app on Google Play Store (Screenshot: Ground-IB)

The malware family used in the pig butchering scam is **UniShadowTrade**, classified under the UniApp Framework. This name is given by Group-IB analysts to categorize the fraudulent applications involved in the scam. For your information, the UniApp framework enables developers to create cross-platform applications with a single codebase, making it easier for scammers to develop and distribute malware.

****What Exactly is Pig Butchering?****

For your information, **Pig butchering** is a notorious digital scam that involves a meticulous process of grooming victims, building trust, and ultimately defrauding them of their money.

This particular campaign follows a specific pattern: target identification through social media, grooming and trust-building through social engineering techniques, offering a seemingly lucrative investment opportunity in cryptocurrency or other investments, encouraging a small initial investment, and building confidence through small profits.

Scammers pressure victims into making large investments, transfer funds they cannot withdraw, and disappear. This process continues until the victim is unable to withdraw the funds, causing significant financial loss and affecting their financial stability.

Nevertheless, scams Pig butchering can have devastating consequences for victims. Understanding scammers’ tactics and taking proactive measures can reduce the risk of falling victim to such fraud.

****Alert for Android and iOS users****

It is a fact that Google, which owns Android, and Apple, which owns the iOS App Store, try their best to keep the marketplace safe from malware and other cybersecurity threats. Despite constant monitoring, cybercriminals often slip into these stores with malicious apps, draining the bank accounts and crypto wallets of unsuspecting users.

Just last week, **Google approved** a crypto drainer app on the Play Store that stole over $70,000 from Android users. On the other hand, **in February 2024**, Apple approved a fake LastPass Password Manager app on its iOS App Store. The same month, Apple approved a **fake Rabby Wallet app** that stole millions from unsuspecting users.

Therefore, be extra careful when downloading an app from any of these stores. Check their reviews, search for the official app on Google, find their social media platforms, and confirm whether the app advertised on app stores is legitimate or not.

1.  **Phishing Scam Hits European Bank Users on iOS and Android**
2.  **Scylla Ad Fraud on iOS, Android Users Halted by Apple, Google**
3.  **Pink Drainer Posed as Journalists, Stole $3M from Twitter Users**
4.  **Hackers Posed as Google Support to Steal $243 Million in Crypto**
5.  **Apple mistakenly approved malware masked as Adobe Flash Player**

Pig Butchering: Fake Trading Apps Target Crypto on Apple, Google Play Stores

Silver Spring, Maryland, 2nd October 2024, CyberNewsWire

**Silver Spring, Maryland, October 2nd, 2024, CyberNewsWire**

Aembit, the non-human IAM company, today announced the appointment of Mario Duarte as chief information security officer (CISO). Duarte, formerly head of security at Snowflake, joins Aembit with a deep commitment to address pressing gaps in non-human identity security.

Duarte’s journey in cybersecurity began with a passion for penetration testing, sparked by the 1980s cult classic film WarGames. He started his career in red teaming, later expanding his expertise into both technical and leadership roles on the defensive side. Throughout his career, he has focused on protecting mission-critical systems, solving complex security problems, and developing and overseeing high-performing teams.

His experience spans multiple industries, including finance, health care, retail, and technology. Most notably, Duarte spent nearly a decade at Snowflake, where he played a key role in shaping and leading the data cloud company’s security program, rising to vice president of security (aka CISO). It was during this time that he first encountered Aembit and its innovative and award-winning approach to securing non-human identities.

> “I fell in love with security because of the thrill of finding weaknesses and fixing them,” Duarte said. “I’ve always had the mindset of an attacker, but over the years, I’ve focused on defending organizations – understanding where the real threats are coming from and solving those problems at scale. Throughout my career, I’ve witnessed how non-human identities like workloads and service accounts are being exploited, and knew this was the next big frontier in security.”

Before his time at Snowflake, Duarte held senior security roles at multiple organizations, including GoGrid, Moodys KMV, and Ross Stores. His ability to adapt and thrive in diverse sectors helped shape his understanding of security from multiple threat angles and perspectives, including compliance with FedRAMP, HIPAA/HITECH, and PCI standards.

Duarte was drawn to Aembit not only because of its groundbreaking technology but also by the culture and mission of the company. 

> “Aembit is solving a problem that’s been neglected for years – securing the non-human identities that drive IT infrastructure,” he said. “It’s replacing outdated methods like static credentials and manual processes with a more dynamic and secure approach that my peers and I have been seeking for a long time. The Aembit team recognizes the complexity of this problem and is relentless in creating a practical and scalable solution for it.”

As the need for identity-driven, secretless, centrally enforced, and auditable connections across distributed applications, SaaS services, and the rise of AI workloads, the Aembit Workload IAM Platform – honored as runner-up in the 2024 RSA Innovation Sandbox competition – responds by enforcing secure access between non-human workloads and the sensitive resources and infrastructure that businesses run on, providing just-in-time, secretless access based on the workload’s identity and posture.

>  “Mario brings an unmatched level of experience and passion to our team,” Aembit Co-Founder and CEO David Goldschlag said. “He’s been in the trenches, defending some of the most sophisticated infrastructures, and his leadership will help guide Aembit as we continue to solve the toughest identity security challenges.”

In his new role, Duarte will focus on advancing Aembit’s efforts to meet the needs of the security community as organizations increasingly shift to cloud-native, distributed, and automated environments. His deep connection to his fellow CISOs and security professionals, along with his commitment to providing effective, scalable, and practical solutions, will help guide Aembit’s continued growth in this fast-growing space.

> “Security is my tribe,” he said. “The stakes are too high here, and I wouldn’t put my name behind anything I didn’t fully believe in.”

**About Aembit**

Aembit is the leading provider of workload identity and access management solutions, designed to secure non-human identities like applications, AI agents, and service accounts across on-premises, SaaS, cloud, and partner environments. Aembit’s no-code platform enables organizations to enforce access policies in real-time, ensuring the security and integrity of critical infrastructure. Users can follow them on LinkedIn.

**Contact**

**CMO**  
**Apurva Dave**  
**Aembit**  
**\[email protected\]**

Mario Duarte, Former Snowflake Cybersecurity Leader, Joins Aembit as CISO to Tackle Non-Human Identities

SSSCIP reports a strategic shift in Russian cyber operations in H1 2024. Targeting Ukraine’s defence sectors, attacks doubled,…

SSSCIP reports a strategic shift in Russian cyber operations in H1 2024. Targeting Ukraine’s defence sectors, attacks doubled, focusing on intelligence gathering. Ukrainian experts respond with red teaming to strengthen cyber defences against targeted threats.

Recent reports from Ukraine’s State Service of Special Communications and Information Protection (SSSCIP) reveal a significant shift in Russian cyber operations against Ukraine in the first half of 2024. The new strategy marks a departure from previous broad-spectrum attacks to a more targeted approach focusing on Ukraine’s military and defence sectors.

According to the SSSCIP’s “Russian Cyber Operations (H1 2024)” **report**, cyber attacks targeting Ukraine’s defence industries more than doubled from 111 to 276 from the latter half of 2023 to the former half of   2024. This surge reflects a concerted effort by Russian-aligned threat actors to gather intelligence directly related to the ongoing conflict.

In response to these escalating threats, Ukrainian cybersecurity experts have intensified their **red teaming** efforts, simulating sophisticated attacks to identify and address vulnerabilities in their defence systems. This proactive approach has helped strengthen Ukraine’s cyber resilience against increasingly targeted Russian operations.

****Key Threat Actors and Tactics****

The majority of the activity comes down to five Russian-attributed threat groups: **UAC-0149**, UAC-0020, UAC-0180, UAC-0184, UAC-0200. These groups have been employing remote access Trojans (RATs) to compromise Ukrainian Forces computers that use Windows.

Russian cyber tactics have changed direction over the past couple of years. In 2022, Russian hackers focused on dismantling critical infrastructure IT systems and exfiltrating databases. This focus shifted to broad information collection within many different Ukrainian industries in 2023, before honing in on military targets in 2024.

****Messaging Apps: The New Frontier****

A concerning trend highlighted in the report is the increased use of messaging apps including WhatsApp, Telegram and Signal. The Signal app in particular has been used to target high-value military and government personnel. Hackers, particularly those associated with UAC-0184, gather personal information to impersonate known contacts and build trust with certain targets, akin to a phishing attack.

The screenshot shows malicious messages on Signal, WhatsApp and Telegram sent by Russian hackers (Credit: SSSCIP)

Once trust is established, the attackers send malicious archives disguised as relevant content. This might be combat footage or recruitment information, for example. When opened, these archives secretly infect the target’s system with malware. It is worth noting that UAC-0184 is known for its multi-stage attack and for using **XWorm malware and Remcos RAT** against its targets.

****Rising Cyber Incidents and Malware Infections****

The total number of cyber attacks that were reported in Ukraine **rose by 19%** to 1,739 in Q1 and Q2 of 2024 compared to Q3 and Q4 of 2023. This rise is primarily attributed to more incidents considered to be less severe, and more critical breaches went down.

Malware infections are becoming a central part of these cyberattacks. The number of infections recorded in Q1 and Q2 of 2024 was 196, up from 103 in Q3 and Q4 of 2023. This surge is partly down to a rise in unlicensed software that has been pirated but with backdoors baked into it.

****Importance of Licensed Software****

The SSSCIP continues to hone in on the importance of using licensed software because unlicensed software creates more vulnerabilities. For example, Office, MDM, Windows, EDR, etc. This applies to the Ukrainian military, but also civilian organizations, as they try to mitigate vulnerabilities that stem from infections.

As the conflict enters its third year, cyberspace remains core to the warfare. The SSSCIP warns that cyberattacks targeting military personnel are likely to remain important.

1.  **Ukraine’s Cyberattack Cripples Russia’s Tax System**
2.  **Ukraine Claims Cyber Attack Disrupted Russian ATMs**
3.  **Ukrainian Hackers Trick Russian Military Wives for Personal Info**
4.  **Ukraine Claims Destruction of 280 Russian Servers, 2 Petabytes Lost**
5.  **Ukraine Thwart Russian Industroyer 2 Malware Attack on Energy Provider**

Source

HackRead