Credential theft alert! Venak Security discovers a BYOVD attack using .SYS drivers to bypass Windows security. Learn how…

Credential theft alert! Venak Security discovers a BYOVD attack using .SYS drivers to bypass Windows security. Learn how this attack steals user data and gains control.

A recent investigation by Venak Security uncovered an attack scenario that leverages a vulnerability within a kernel-level driver associated with Checkpoint’s ZoneAlarm antivirus software. The vulnerable driver, vsdatant.sys, version 14.1.32.0, with an MD5 hash of 190fe0ce4d43ad8eed97aaa68827e2c6, was the core component of the exploit.

This driver was originally released in 2016 and became a point of entry for malicious actors employing a technique known as “Bring Your Own Vulnerable Driver” (BYOVD). This method allowed the attackers to gain elevated privileges within the compromised systems, effectively bypassing crucial Windows security features, including Memory Integrity- a Windows security feature that uses virtualization to safeguard the system’s memory from malicious code and drivers.

Researchers noted that BYOVD has become a favoured tool among cybercriminal groups seeking to disable Endpoint Detection and Response (EDR) products. For your information, the BYOVD approach involves introducing vulnerable drivers onto targeted systems and exploiting them to execute malicious code at the kernel level. A key aspect of this technique is the abuse of digitally signed drivers. Because these drivers carry valid signatures, they appear legitimate to security software, effectively bypassing detection.

As per Venak Security’s research, the attack starts with a malicious email containing a Dropper, which downloads and executes a script that installs the vulnerable driver (.SYS file) and registers it as a service.

The driver interrupts Core Isolation and removes process protection. The attacker then extracts user credentials, sends them to a Command and Control Server, and uses Remote Desktop to gain persistent control of the compromised machine. This image demonstrates how this attack was implemented:

Source: Venak Security

Researchers noted that while Memory Integrity isolates protected processes within a virtualized environment, making it difficult for attackers to inject malicious code, the vulnerable vsdatant.sys driver allowed the attackers to bypass these protections, rendering the feature ineffective.

Since vsdatant.sys features high-level kernel privileges, the vulnerability allowed the attackers to evade standard security protocols and gain complete control over the infected machines while remaining undetected. Resultantly, the attackers could access and extract sensitive information, including user passwords and stored credentials.

Furthermore, the vulnerable driver carried a valid digital signature, which is the reason why typical EDR solutions failed to detect the attack, classifying it as safe. This allowed the malicious activity to proceed without triggering security alerts. Venak Security was able to replicate the attack and demonstrate its execution. This highlights a critical limitation of traditional security measures against BYOVD attacks.

It is important to note that the most current version of the driver does not contain this vulnerability and Checkpoint has been informed of the issue. Still, the findings shows the importance of driver security and the need for vendors to thoroughly inspect their drivers for vulnerabilities.

Checkpoint ZoneAlarm Driver Flaw Exposes Users to Credential Theft

Article updated with a statement from ServiceNow.

ServiceNow vulnerability alert: Hackers are actively exploiting year-old flaws (CVE-2024-4879, CVE-2024-5217, CVE-2024-5178) for database access. Learn how to protect your systems.

Security researchers at threat intelligence firm GreyNoise have issued a warning regarding a significant increase in malicious activity targeting three previously disclosed vulnerabilities within ServiceNow- a cloud-based platform that helps organizations automate and manage their digital workflows.

These vulnerabilities, identified as CVE-2024-4879, CVE-2024-5217, and CVE-2024-5178, were initially revealed by Assetnote’s security researcher Adam Kues on 14 May 2024 and promptly patched by ServiceNow the same day.

Despite the availability of patches, GreyNoise has observed a “resurgence of in-the-wild activity” aimed at exploiting these flaws. This surge in attack attempts has seen a significant number of unique IP addresses involved, with activity detected within the last 24 hours. Specifically, 36 threat IPs targeted CVE-2024-5178, while 48 threat IPs each targeted CVE-2024-4879 and CVE-2024-5217, according to GreyNoise’s blog post.

Geographically, the majority of observed malicious activity, exceeding 70% of sessions in the past week, has been directed at systems located in Israel. However, targeted systems have also been detected in Lithuania, Japan, and Germany, with only Israel and Lithuania experiencing activity within the most recent 24-hour period. This geographical focus suggests the possibility of a targeted campaign.

CVE-2024-4879 is a template injection vulnerability. For your information, template injection vulnerabilities occur when user-supplied input is inserted into a template engine without proper sanitization. In the context of ServiceNow, this could allow attackers to inject malicious code into templates used by the platform. Successful exploitation could lead to remote code execution, meaning attackers could gain control of the server hosting the ServiceNow instance.

CVE-2024-5217 and CVE-2024-5178 both involve input validation errors, which can enable attackers to manipulate data and bypass security controls. Input validation vulnerabilities arise when applications fail to properly validate user-supplied input.

The vulnerabilities are particularly concerning because they can be chained together, as initially noted by Assetnote and reaffirmed by GreyNoise, to gain “full database access” to affected ServiceNow instances. This poses a substantial risk to organizations that rely on ServiceNow to manage sensitive data, including employee information and HR records.

However, ServiceNow’s spokesperson shared the company’s statement with Hackread.com, explaining that they have not observed any customer impact from a coordinated attack campaign to date.

> _“Nearly a year ago, ServiceNow learned of a vulnerability on the Now Platform impacting instances running on the Vancouver and Washington, D.C. family releases. Immediately—starting, the day we learned of it—we deployed a series of updates and  
> fully addressed the issue.”_
> 
> _“To-date, our investigations have not observed any customer impact from any attacks. We will continue to monitor the situation to best support our customers.”_
> 
> ServiceNow

Nevertheless, GreyNoise recommends that organizations using ServiceNow take immediate action to mitigate the risk. This includes applying the latest security patches, restricting access to management interfaces, and monitoring suspicious activity.

Aaron Costello, chief of SaaS security research at AppOmni, emphasized that the vulnerability was severe because it allowed unauthenticated access to full databases. On-premise ServiceNow systems that didn’t update security patches were at risk, unlike cloud-hosted versions where the vendor handles updates. Implementing IP address access controls could have prevented exploitation. Costello stressed the importance of keeping up with security patches, especially for on-premise SaaS software.

New Attacks Exploit Year-Old ServiceNow Flaws – Israel Hit Hardest

Today, we are discussing Computer Vision applications, one of the most impactful AI-powered technologies that is reshaping our…

Today, we are discussing Computer Vision applications, one of the most impactful AI-powered technologies that is reshaping our world, with Oleg Goncharenko, the CEO of Alltegrio. Oleg has been an entrepreneur for over 25 years and built a successful 8-figure software service company, as well as a few more innovative tech projects.

Alltegrio is Oleg’s AI development-focused company that specializes in creating AI and Machine Learning-powered custom solutions for businesses worldwide. Over the 10+ years of Alltegrio’s existence, the developers completed quite a few Computer Vision projects.

In this article, Oleg will share with us his insights into the growth of Computer Vision technology and its impact on different industries. Read on to learn how this tech affects our lives daily and what businesses must invest in it to stay compliant with evolving regulations.

****What is Alltegrio’s expertise in Computer Vision?****

AI Computer Vision is one of the most common demands in AI development. However, it’s crucial to note that many clients looking for AI and ML solutions don’t even realize they need Computer Vision services. That’s why spreading awareness about this technology and its actual role in the apps we use daily is so important.

It’s also important to understand that many of these solutions aren’t strictly full-scale Computer Vision applications. This technology is usually only a part of a more complex solution.

At Alltegrio, we worked on many projects that included some Computer Vision components, and they cou;dn’t have been more different from each other. Some Computer Vision examples from our practice are:

*   **Sports Analytics Solutions**

We created several products for sports analytics companies that can analyze game footage and evaluate athletes based on it. These tools use Computer Vision technology to analyze visuals and specifically trained ML algorithms to understand data input and predict the player’s fitness levels, performance, injury risks, etc. This analytics solution is used for recruiting, betting forecasts, and even by coaches to improve strategies.

*   **Selfie-Processing for E-commerce**

One of my favourite projects was the app we created for a major beauty products retailer. It fully realized the Computer Vision definition, meaning we created an app that could ‘see’ and understand selfies taken by customers. Then, generative AI joined in and offered the user personalized skincare suggestions based on the image analysis.

*   **OCR Solutions for Receipt Processing**

Our number one request that uses Computer Vision services is receipt-processing automatization tools. We’ve created several for invoice and receipt processing for retail and logistics businesses. These apps use cameras, like the one on your phone, to process images and enter receipt data directly into your bookkeeping software. It’s highly convenient and saves tons of time.

**In which niches does Computer Vision show the fastest ROI?**

From our experience, clients who are able to get good ROI on their Computer Vision applications come from retail, logistics, and manufacturing industries. It’s because, in these niches, this technology can offer major improvements and process optimizations. Therefore, the client can experience the benefits it offers right away. For example:

*   In manufacturing, Computer Vision solutions can be used for automated and precise defect detection, saving the user from millions of losses caused by recalls.

*   In logistics and warehousing, Computer Vision technology is used in tools that manage automated sorting and real-time parcel tracking. This immediately reduces losses on lost and damaged cargo and speeds up deliveries.

*   In retail, we’ve already talked about receipt-processing automation. Still, Computer Vision models can also be used in inventory management, warehouse optimization, and automation. They are also integral for checkout-free stores.

****Where is Computer Vision most important for security?****

Did you think about the fact that every time you unlock your iPhone, you are using a Computer Vision application? Facial recognition is now an essential part of security systems, and it’s powered by this exact technology. I’d say that in terms of security, Computer Vision solutions are now crucial to the critical infrastructure and public security sectors.

These solutions literally manage access to our most vulnerable and important services. Any business or state-funded organization that wants to ensure the highest level of security must use Computer Vision services in some capacity today.

****Which emerging niche is relying most on real-time Computer Vision solutions?****

I’d say that Computer Vision technology had the most profound impact on the development of autonomous vehicles and drones. To put it simply, no machine can move by itself without using Computer Vision solutions. Smart city technologies, like smart traffic lights and pedestrian safety systems, also can’t function without specialized AI Computer Vision tools.

****In what niches has using Computer Vision become a regulatory requirement?****

AI technology, as a whole, is a murky area in terms of legal regulations. As the tech is so new, governments are only now mobilizing to manage it with proper regulations. Therefore, it would be incorrect to say that Computer Vision technology is a mandatory requirement from the legal standpoint.

However, Computer Vision models are indispensable to ADAS (Advanced Driver Assistance Systems) installed in modern vehicles. Those systems must undergo rigorous testing to ensure they are safe and efficient enough to be licensed for use in traffic conditions.

Moreover, Computer Vision apps used for quality control in food production and diagnostics in healthcare applications also fall under strict quality testing regulations.

****Which industry faces the greatest risks without using Computer Vision?****

Computer Vision solutions impact many industries and can have an impact on life-and-death situations. In my personal opinion, the industry that faces the greatest risks without advanced AI Computer Vision tools is self-driving vehicle production. In this case, the industry itself won’t exist without this technology.

****What business benefits does Computer Vision bring?****

Computer Vision projects can be extremely versatile, but all of them contribute to business success in similar ways. Those are:

*   Improving customer experiences

*   Reducing labor costs via automatization

*   Streamlining workflows through many levels of the business
*   Reducing the number of errors and losses associated with them

*   Increasing safety in many areas (self-driving cars, warehouses, transportation, crime monitoring, etc.)

All in all, I cannot stress enough the importance of Computer Vision applications for our future. And I’m anxious to see what else we will achieve with this technology.

Featured/Top Image by Garik Barseghyan from Pixabay

Where Is Computer Vision Essential Today? Insights from Alltegrio’s CEO

Citizen Lab's investigation reveals sophisticated spyware attacks exploiting WhatsApp vulnerabilities, implicating Paragon Solutions. Learn how their research exposed these threats and the implications for digital privacy.

Cybersecurity researchers at the Citizen Lab at the University of Toronto have exposed the use of sophisticated spyware named **Graphite**, developed by the Israeli firm Paragon Solutions, to target high-profile individuals through WhatsApp.

Their **investigation** reveals that a previously unknown zero-day vulnerability in WhatsApp’s software allowed the spyware to be installed on devices through a zero-click exploit, allowing adversaries to gain unauthorized access to targeted phones.

For your information **zero-click exploits** mean that a device can be compromised without the user clicking a link, opening a file, or performing any other action.

Attack flow explained (Source: The Citizen Lab)

****Graphite Spyware Servers Worldwide****

Paragon Solutions, established in 2019 by figures including former Israeli Prime Minister Ehud Barak, claims to differentiate itself by adhering to ethical standards, unlike other spyware vendors like the **NSO Group**.

However, Citizen Lab’s researchers mapped out servers attributed to Graphite, and identified suspected deployments against journalists, human rights activists, and government critics across multiple countries. This includes:

*   Italy
*   Israel
*   Canada
*   Cyprus
*   Denmark
*   Australia
*   Singapore

WhatsApp’s parent company, Meta, has confirmed that approximately 90 users in 24 countries were targeted. However, since the researchers are based in Canada; a significant aspect of the investigation focused on a Canadian client, the Ontario Provincial Police (OPP). The analysis uncovered links between Paragon and the OPP, revealing a systematic use of spyware capabilities among Ontario-based police services.

The Italian connection proved to be a focal point of the investigation. Forensic analysis of Android devices belonging to individuals notified by WhatsApp, including journalist Francesco Cancellato and Mediterranea Saving Humans founders Luca Casarini and Dr. Giuseppe Caccia, revealed clear indications of Graphite spyware.

Researchers identified a unique Android forensic artifact, BIGPRETZEL, which confirmed the presence of Paragon’s spyware on these devices. The Italian government initially **denied** any involvement but later **acknowledged** having contracts with Paragon.

Furthermore, the investigation extended to an iPhone belonging to David Yambio, a close associate of the confirmed Paragon targets. Apple threat notifications received by Yambio, coupled with forensic analysis, revealed an attempted infection with novel spyware, subsequently patched by Apple in iOS 18.

In response to Citizen Lab’s findings, Meta, along with Apple and Google, collaborated to address the security vulnerability. WhatsApp implemented a server-side fix, eliminating the need for users to update their apps. Apple also released a patch for its iOS operating system to protect iPhone users.

WhatsApp subsequently **notified** the targeted users. “If we believe that your device has come under threat, we may notify you about it directly via a WhatsApp chat,” the notification read.

****WhatsApp Attacks Persist Despite NSO Group Lawsuit Win****

Hackread.com earlier **reported** that the infamous Israeli spyware company, NSO Group, was held legally liable for compromising hundreds of WhatsApp accounts. Court found NSO Group responsible for breaching WhatsApp’s terms of service and exploiting a vulnerability to install its powerful Pegasus spyware on at least 1,400 devices, targeting journalists, human rights activists, political dissidents, and government officials.

Interestingly, CyberScoop **reported** in November 2024 that NSO Group continued to develop new malware based on WhatsApp exploits, even after Meta filed a lawsuit against them and that when WhatsApp disabled the Eden exploit, NSO Group created the Erised vector to target users until May 2020.

Now, the Citizen Lab’s findings indicate that Israeli spyware firms are continually focusing on exploiting WhatsApp vulnerabilities for spyware deployment and aggressively using them against journalists and activists.  

These cases show the never-ending struggle between technology companies and malicious actors seeking to compromise user privacy and the critical need for continuous caution, stricter security measures, and legal accountability within the spyware industry to protect digital privacy and **human rights**.

Israeli Spyware Graphite Targeted WhatsApp with 0-Click Exploit

A new Zimperium report reveals that rooted Android phones and jailbroken iOS devices face growing threats, with advanced toolkits making detection nearly impossible for cybersecurity researchers.

Despite tighter security from **Apple and Google**, hackers and cybercriminals continue to exploit rooted and jailbroken devices for their attacks. A new report from mobile security firm Zimperium shared with Hackread.com ahead of its publishing on Thursday, warns that compromised mobile phones remain a major risk for businesses, as these devices are far more likely to be targeted by malware and system takeovers.

****What Are Rooting and Jailbreaking?****

**Rooting** (on Android) and **jailbreaking** (on iOS) give users full control over their devices. This allows customization beyond what manufacturers allow and also removes key security protections. A rooted or jailbroken can’t enforce security protocols like Google’s Play Integrity or Apple’s security checks, but they can install apps from unverified sources, disable security features, and modify system files, making them prime targets for cybercriminals.

According to Zimperium’s **research**, rooted Android devices are:

*   **3.5 times more likely** to be attacked by malware

*   **250 times more likely** to suffer a system compromise

*   **3,000 times more likely** to experience a filesystem breach

Depending on who the targeted victim is, a compromised phone can be used as an entry point into corporate networks, allowing attackers to steal sensitive data, launch phishing campaigns, and bypass OTPs.

****A Well-Equipped Toolkit of Hackers****

The security industry has worked hard to detect and block rooted devices, but hackers have also been catching up. Tools like Magisk, APatch, KernelSU, Dopamine, and Checkra1n are in active development, with some even designed to hide their presence to avoid scans.

Magisk, for example, uses a “systemless” root method that avoids modifying core system files, making them harder to detect. APatch takes a different approach by modifying kernel memory on the fly, leaving no permanent traces. These updated toolkits make it increasingly difficult for cybersecurity researchers to spot compromised devices before damage is done.

Overview of current rooting tools (left) and the threat chain of a rooted device leading to a security breach (right) via Zimperium.

****Decline in Rooting and Jailbreaking but Still a Threat****

Rooting and jailbreaking were a big deal from 2011 to 2019. Now that the number of rooted and jailbroken devices has declined, they still pose a serious risk, especially in workplaces where employees use personal phones for work.

Worse, this threat is not limited to small businesses; even employees at cybersecurity giants like Kaspersky Labs have had **their iPhones infected** by malware. A single compromised phone can give attackers access to corporate data, email accounts, and internal applications.

**J. Stephen Kowski**, Field CTO at cybersecurity firm SlashNext, highlights the issue, “When employees root or jailbreak their devices, they’re removing crucial security guardrails. This creates significant attack vectors for threat actors. Businesses need advanced threat detection that can identify compromised devices and block attacks without disrupting workflows.”

Nevertheless, companies need to take mobile security seriously. Traditional security solutions often fail to detect modern rooting tools, so businesses should invest in advanced mobile threat detection that can identify cybersecurity threats in real time. Here’s how a company can start tackling this threat:

*   **Educating employees** on the risks of rooting and jailbreaking

*   **Using mobile security solutions** that detect hidden modifications

*   **Blocking rooted and jailbroken devices** from accessing corporate networks

*   **Implementing strict app policies** to prevent sideloading of unverified software.

Rooted Androids 3,000x More Likely to Be Breached, Even iPhones Not Safe

Microsoft refuses to patch serious Windows shortcut vulnerability abused in global espionage campaigns!

A new Windows zero-day vulnerability is being actively exploited by at least 11 hacking groups linked to nation-states including North Korea, Iran, Russia, and China for years. Despite evidence of widespread attacks dating back to 2017, Microsoft has declined to issue a security patch, labelling the issue as “not meeting the bar for servicing.”

The vulnerability, tracked by Trend Micro as **ZDI-CAN-25373**, allows attackers to execute malicious code on Windows systems by hiding commands within shortcut (.lnk) files. When Trend Micro submitted proof of this vulnerability through their Zero Day Initiative bug bounty program, Microsoft categorized it as low severity and stated they would not address it with an immediate security update. No CVE identifier has been assigned to the flaw.

“We discovered nearly a thousand Shell Link (.lnk) samples that exploit ZDI-CAN-25373; however, it is probable that the total number of exploitation attempts are much higher,” Trend Micro researchers stated in a **blog post** shared with Hackread.com.

****How the Vulnerability Works****

The vulnerability takes advantage of how Windows displays information about shortcut files. When a user right-clicks on a file to view its properties, Windows fails to show hidden malicious commands embedded within the file.

Hackers achieve this by inserting large numbers of blank spaces or other whitespace characters into the command line arguments of the shortcut file. These invisible characters effectively push the malicious commands beyond what’s visible in the Windows interface, making the file appear harmless to users.

What’s even more concerning, some North Korean threat actors including **Earth Manticore** (APT37) and **Earth Imp** (Konni), have created “extremely large” shortcut files, reaching sizes up to 70MB, to further complicate detection. This technique has proven effective enough that various state-backed hacking groups have exploited it in their attack methods for years.

The security firm’s analysis found that nearly half of the state-sponsored attackers exploiting this vulnerability originate from North Korea, with the remaining groups linked to Iran, Russia, and China. Approximately 70% of these campaigns focused on espionage and information theft, while over 20% aimed at financial gain.

According to researchers, organizations in various sectors are at high risk, including:

*   Government
*   Energy companies
*   Financial institutions
*   Military and defence
*   Telecommunications providers.

While most victims were detected in North America, researchers noted attacks across Europe, Asia, South America, and Australia. On the other hand, industry leaders are criticizing Microsoft for not addressing such a serious vulnerability.

**Thomas Richards**, Principal Consultant, Network and Red Team Practice Director at Black Duck, a Burlington, Massachusetts-based provider of application security solutions expressed surprise at Microsoft’s decision.

“Actively exploited vulnerabilities are usually patched within a short period. It’s unusual for Microsoft to refuse to release a security patch in this situation given that it is actively being exploited by nation-state groups,” said Thomas. “Microsoft should address the vulnerability immediately to manage software risk and prevent further attacks and compromises of systems throughout the world.”

**Jason Soroko**, Senior Fellow at Sectigo, a Scottsdale, Arizona-based provider of comprehensive certificate lifecycle management (CLM), is not surprised by Microsoft’s decision.

“Exploiting the vulnerability involves manipulating how Windows displays shortcut files by padding command-line arguments with whitespace characters and if this method requires a chain of specific conditions or user interactions that are unlikely in everyday scenarios, Microsoft may view it as lower risk,” Jason explained. “If the ability to do this requires the attacker to elevate privileges using an endpoint compromise, I have seen Microsoft in the past express a similar viewpoint.”

****ZDI and Microsoft: A History of Cybersecurity Disputes****

This is not the first time ZDI has criticized Microsoft over a security vulnerability issue. In July 2024, ZDI **accused** Microsoft of failing to credit them in its Patch Tuesday update and criticized its lack of transparency in vulnerability disclosure.

Another researcher, Haifei Li of Check Point, who independently discovered the same vulnerability, also went unacknowledged, further highlighting the lack of communication from Microsoft.

Nevertheless, the fact that Microsoft has chosen not to issue a patch for this flaw leaves millions of users exposed to cybersecurity threats and puts organizations at risk as nation-state hackers continue to exploit it. Therefore, to stay protected, use a strong EDR solution to detect and block malicious .lnk files. Monitor network traffic for signs of compromise, train users to avoid suspicious links, and stay updated on security alerts.

11 Nation-State Hackers Exploit Unpatched Windows Flaw Since 2017

Bengaluru, India, 19th March 2025, CyberNewsWire

**Bengaluru, India, March 19th, 2025, CyberNewsWire**

**Moving Beyond Detection to Real-Time, Automated Security Across Workloads, Cloud, and Infrastructure** 

SecPod, a global cybersecurity provider, has announced the General Availability of Saner Cloud, a Cloud-Native Application Protection Platform designed to provide automated remediation and workload security across multi-cloud environments. Unlike conventional security solutions that focus primarily on detection, Saner Cloud integrates security using AI-driven automation to remediate threats in real-time.

Security teams have long faced challenges managing disparate security solutions across cloud workloads, IT infrastructure, and endpoints, often resulting in fragmented operations and a high volume of unresolved alerts. Saner Cloud is designed to address these challenges by providing a unified security platform that continuously detects, prioritizes, and remediates vulnerabilities, misconfigurations, identity risks, and compliance violations—automatically and in real time.

During the launch, Chandrashekhar Basavanna, Founder & CEO of SecPod, emphasized the urgent need to rethink cloud security and shift towards an AI-powered, prevention-first model. 

> “Cloud security has long been reactive—detecting risks but failing to fix them. Security is only effective when threats are eliminated before they can be exploited. The industry has spent years chasing alerts but has failed to bridge the gap between awareness and action. AI now gives us the power to move beyond detection and automate remediation at scale. Saner Cloud ensures security is enforced in real time, across every workload, every piece of infrastructure, and every cloud environment.” – Chandrashekhar Basavanna, Founder and CEO of SecPod.

Unlike legacy cloud security solutions that focus only on cloud misconfigurations or identity risks, Saner Cloud secures the full attack surface, covering endpoints, servers, network infrastructure, cloud environments, and cloud workloads – all from a single platform. 

Saner Cloud leverages advanced AI-driven automation to eliminate manual security operations. Saner Cloud applies intelligent risk prioritization and executes remediation automatically, ensuring that security gaps are fixed before they can be exploited by attackers. By continuously learning from new attack patterns and security incidents, Saner Cloud dynamically adapts its security enforcement, delivering self-healing cloud infrastructure that remains protected against even the most sophisticated threats. 

Most Cloud-Native Application Protection Platform (CNAPP) solutions focus on visibility, requiring security teams to manually address large volumes of unresolved risks. Saner Cloud is designed to bridge this gap by not only identifying security issues but also automating their remediation in real-time and at scale.

By utilizing Infrastructure-as-Code remediation, automated patching, and security policy enforcement, Saner Cloud helps mitigate compliance drift, reduce misconfiguration risks, and minimize delays in threat response. The platform continuously enforces security across cloud and IT assets while embedding compliance measures directly into cloud operations, assisting organizations in maintaining ongoing adherence to regulatory frameworks.

The launch of Saner Cloud reflects a shift toward a prevention-first approach in cloud security, focusing on reducing risk exposure rather than solely identifying threats. As cyber threats evolve, organizations require security measures that are immediate, automated, and continuous, rather than relying on manual alert response.

Saner Cloud is now available for enterprises worldwide. For more information or to schedule a demo, users can visit www.secpod.com. 

**About SecPod** 

SecPod is a leading cybersecurity technology company committed to preventing cyberattacks through proactive security. Its mission is to secure computing infrastructure by enabling preventive security posture. 

At the core of SecPod’s offerings is the **Saner Platform –** a suite of solutions that help organizations establish a strong security posture to preempt cyber threats against endpoints, servers, networks, and cloud infrastructure, as well as cloud workloads. With its cutting-edge and comprehensive solutions, SecPod empowers organizations to stay ahead of evolving threats and build a resilient security framework. 

**Contact**

**Head – Marketing**  
**Supriya Bhaskar Rao**  
**SecPod Technologies**  
**\[email protected\]**

SecPod launches Saner Cloud: A Revolutionary CNAPP For Preventive Cybersecurity

New Immersive World LLM jailbreak lets anyone create malware with GenAI. Discover how Cato Networks researchers tricked ChatGPT, Copilot, and DeepSeek into coding infostealers - In this case, a Chrome infostealer.

Cato Networks, a Secure Access Service Edge (SASE) solution provider, has released its 2025 Cato CTRL Threat Report, revealing an important development. According to researchers, they have successfully designed a technique that allows individuals with no **prior coding experience** to create malware using readily available generative AI (GenAI) tools.

****LLM Jailbreak Created Functioning Chrome Infostealer via “Immersive World”****

The core of their research is a novel Large Language Model (LLM) jailbreak technique, dubbed “Immersive World,” developed by a Cato CTRL threat intelligence researcher. The technique involves creating a detailed fictional narrative where GenAI tools, including popular platforms like DeepSeek, Microsoft Copilot, and OpenAI’s ChatGPT, are assigned specific roles and tasks within a controlled environment.

By effectively bypassing the default security controls of these AI tools through this narrative manipulation, the researcher was able to force them into generating functional malware capable of stealing login credentials from **Google Chrome**.

> _“A Cato CTRL threat intelligence researcher with no prior malware coding experience successfully jailbreak multiple LLMs, including DeepSeek-R1, DeepSeek-V3, Microsoft Copilot, and OpenAI’s ChatGPT to create a fully functional Google Chrome infostealer for Chrome 133.”_
> 
> Cato Networks

This technique (Immersive World) indicates a critical flaw existing in the safeguards implemented by GenAI providers as it easily bypasses the intended restrictions designed to prevent misuse. As Vitaly Simonovich, a threat intelligence researcher at Cato Networks, **stated**, “We believe the rise of the zero-knowledge threat actor poses a high risk to organizations because the barrier to creating malware is now substantially lowered with GenAI tools.”

The report’s findings have prompted Cato Networks to reach out to the providers of the affected GenAI tools. While Microsoft and OpenAI acknowledged receipt of the information, DeepSeek remained unresponsive.

Screenshots show researchers interacting with DeepSeek, which ultimately generated a functional Chrome infostealer (Images via Cato Networks)

****Google Declined to Review Malware Code****

According to researchers, Google, despite being offered the opportunity to review the generated malware code, declined to do so. This lack of a unified response from major tech companies highlights the complexities surrounding the addressing of threats in advanced AI tools.

****LLMs and Jailbreaking****

Although LLMs are relatively new, jailbreaking has evolved alongside them. A report **published** in February 2024 revealed that DeepSeek-R1 LLM failed to prevent over half of the jailbreak attacks in a security analysis. Similarly, a **report** from SlashNext in September 2023 showed how researchers successfully jailbroke multiple AI chatbots to generate phishing emails.

****Protection****

The 2025 Cato CTRL Threat Report, the inaugural annual publication from Cato Networks’ threat intelligence team, emphasizes the critical need for proactive and comprehensive AI security strategies. These include preventing LLM jailbreaking by building a reliable dataset with expected prompts and responses and testing AI systems thoroughly.

Regular AI red teaming is also important, as it helps find vulnerabilities and other security issues. Additionally, clear disclaimers and terms of use should be in place to inform users they are interacting with an AI and define acceptable behaviours to prevent misuse.

Researchers Use AI Jailbreak on Top LLMs to Create Chrome Infostealer

Hackers are using .VHD files to spread VenomRAT malware, bypassing security software, reveals Forcepoint X-Labs. Learn how this stealthy attack works and how to protect yourself.

Cybersecurity researchers at Forcepoint X-Labs have spotted a new and tricky malware campaign that has been spreading and infecting targeted devices with VenomRAT, a remote access trojan known for targeting researchers in fake PoC (Proof of Concept) attacks

In this campaign, instead of the usually infected documents or executable files, cybercriminals are delivering the dangerous VenomRAT hidden inside a virtual hard disk image file (.vhd).

The campaign begins with a phishing email. This time, the bait is an apparently harmless purchase order. However, opening the attached archive doesn’t reveal a typical document. Instead, users find a .vhd file – a container that mimics a physical hard drive.

When a user opens the .vhd file, their computer treats it like a new drive. But this isn’t a drive full of legitimate files; it contains a malicious batch script designed to cause harm. Using a .vhd file to spread malware is a new trick. Since these files are commonly used for disk imaging and virtualization, security software doesn’t always flag them as a threat.

“This is a unique approach,” explains Prashant Kumar, a Security Researcher at Forcepoint X-Labs. “Attackers are constantly looking for ways to evade detection, and hiding malware within a virtual hard disk image is a good example of that.”

****The Attack and Stealing User Data****

According to research from Forcepoint X-Labs, shared with Hackread.com, the malware script is disguised with multiple layers of code and executes a series of malicious activities once activated. It starts by self-replicating, making sure a copy remains available at all times.

Then, it launches PowerShell, a legitimate Windows tool often exploited by attackers, and establishes persistence by placing a malicious script in the Startup folder, allowing it to run automatically whenever the user logs in. To dig in even more, the script modifies Windows registry settings, making it harder to detect and remove.

The malware also employs hidden communication by connecting to Pastebin, a popular text-sharing platform, to fetch instructions from a remote command-and-control (C2) server, which serves as the attacker’s command hub. Once established, the malware initiates data theft, logging keystrokes and storing sensitive information in a configuration file. It also downloads additional components, including a .NET executable, to assist in encryption and system manipulation.

Researchers noted that this VenomRAT variant uses HVNC (Hidden Virtual Network Computing), a remote control service that allows attackers to control the infected system without detection.

Phishing email and attack vector used in the campaign (Screenshots via Forcepoint X-Labs)

****What’s Next for Unsuspected Users?****

Be careful with email attachments, even if they seem legitimate; especially if they come from unknown senders. If you receive an unexpected invoice or purchase order, don’t trust the contact details in the email; verify it directly with the sender using a known phone number or email.

Keeping your operating system, antivirus, and security tools up to date is critical for blocking threats from executing on your system. Lastly, make sure your team knows how to spot and report phishing attempts. Awareness and common sense are two of the best cybersecurity measures anyone can use, anywhere and at all times.

Hackers Hide VenomRAT Malware Inside Virtual Hard Disk Image File

Austin, TX, United States, 19th March 2025, CyberNewsWire

**Austin, TX, United States, March 19th, 2025, CyberNewsWire**

The average corporate user now has 146 stolen records linked to their identity, an average 12x increase from previous estimates, reflecting a surge in holistic identity exposures.

SpyCloud, the leading identity threat protection company, today released its **2025 SpyCloud Annual Identity Exposure Report**, highlighting the rise of darknet-exposed identity data as the primary cyber risk facing enterprises today. As cybercriminals move beyond single data points and leverage stolen data from a number of sources – breaches, malware and phishes – they are embracing a more sophisticated approach to identity exploitation, and organizations must shift their focus to a comprehensive and holistic defense strategy that accounts for the interconnected nature of digital identities.

**Holistic Identity: The New Cyber Battleground**

Organizations have traditionally focused on securing individual account credentials, but SpyCloud’s research indicates that cybercriminals have expanded their tactics beyond conventional account takeover. Attackers now have access to extensive identity data from multiple sources—including data breaches, infostealer malware infections, phishing campaigns, and combolists—posing a challenge for organizations whose security measures have not yet adapted to address the full scope of interconnected identity exposures holistically.

SpyCloud’s collection of recaptured darknet data grew **22% in the past year**, now encompassing more than **53.3 billion distinct identity records and over 750+ billion total stolen assets** that are now circulating in the criminal underground, fueling identity-based cybercrime. These assets are a vast array of personal and professional credentials, session cookies, personally identifiable information (PII), financial data, IP addresses, national IDs and more that criminals are weaponizing in attacks against individuals and businesses. 

> “The cybersecurity industry has spent years defending against traditional credential-based threats, but the reality is that attackers have advanced as the data they have access to has exploded in volume,” said Damon Fleury, Chief Product Officer, SpyCloud. “Identity is the ultimate frontier of cyber risk, with users’ exposure across past and present, personal and professional identities the new attack surface. It requires organizations to rethink the risks posed by employees, consumers, partners and suppliers.”

> Fleury continues, “At SpyCloud, we’ve created holistic identity analytics built on the industry’s largest collection of recaptured darknet data, enabling our customers to correlate disparate data points that encompass an individual’s digital footprint—providing a truly holistic view of identity risk.”

**New Definition for Identity Risk Emerges**

With the explosion of available identity data, attackers can now piece together historical and present-day records to bypass security barriers. Traditionally, cybersecurity teams were only able to see a fraction of an individual’s darknet exposures – primarily only the exposed assets tied to a corporate identity – which were not comprehensive nor in correlation with other exposures. SpyCloud’s report shows that an individual’s identity exposure is more expansive than traditional cyber risk tools would indicate; in fact, it’s a sprawling web of interrelated assets that provide cybercriminals with a roadmap to exploit vulnerabilities and the keys to unlock valuable access.

*   Of particular concern for businesses, a single corporate user now has an **average of 146 stolen records** linked to their identity – across **13 unique emails and 141 credential pairs** (a username or email and its associated password) per corporate user, which highlights how attackers correlate historical data to uncover active enterprise access points.
*   In the consumer realm, the numbers are even higher with **229 records per consumer**, frequently including exposed PII such as full names, dates of birth, and phone numbers, as well as Social Security/ID numbers, addresses, and credit card or bank information. Consumer exposure averages **27 unique emails and 227 credential pairs per user.**

> “The record-breaking breaches of 2024, including the Mother of All Breaches (MOAB) and the National Public Data Breach, along with the growing use of infostealing malware and crafty phishing campaigns illustrate just how vast the pool of exposed identity data has become,” said Trevor Hilligoss, Senior Vice President of Security Research, SpyCloud Labs at SpyCloud. “By understanding how cybercriminals aggregate stolen data and the new tactics and trends they are leveraging to assume even more valuable information and access, organizations can take proactive steps to mitigate identity-based threats from these large underground sources before they escalate.” 

**Additional Report Findings:**

*   **17.3 billion cookies** were recaptured from malware-infected devices, enabling attackers to bypass MFA and hijack active user sessions.
*   **548 million credentials** were exfiltrated via infostealer malware, highlighting the growing role of stealthy, targeted data theft in enterprise attacks.
*   **3.1 billion passwords** were recaptured in 2024, marking a **125% increase from the previous year**.
*   **70% of users** whose credentials were exposed in breaches last year reused previously compromised passwords, significantly increasing their risk of account takeover attacks **–** a 9+ jump from 2023.
*   **44.8 billion PII assets – a 39% increase from 2023** are opening the door for new fraudulent activities.
*   **97%** of recaptured phished data logs in 2024, from popular phishing-as-a-service (PHaaS) platforms like ONNX, included an email address and **64%** had an associated IP address, giving criminals direct opportunities to perpetrate as the user and make lateral movements within an organization.
*   In the public sector, SpyCloud recaptured **127K .gov credentials** and observed **a 67% all-time password reuse rate** – an increase of 13% over the previous year – highlighting persistent security risks for our federal agencies and national security.

**Evolving Cybersecurity Strategies**

The findings highlight that cybercriminals are moving well-beyond their own legacy tactics and businesses must recognize that traditional defenses are no longer enough. SpyCloud’s approach leverages **holistic identity analytics**, powered by the industry’s largest collection of recaptured darknet data, to help organizations correlate disparate identity elements and shore up identity threat protection measures, while mitigating risk more effectively.

For further insights, the full **2025 SpyCloud Identity Exposure Report** is available here.

**About SpyCloud**

SpyCloud transforms recaptured darknet data to disrupt cybercrime. Its automated holistic identity threat protection solutions leverage advanced analytics to proactively prevent ransomware and account takeover, safeguard employee and consumer accounts, and accelerate cybercrime investigations. SpyCloud’s data from breaches, malware-infected devices, and successful phishes also powers many popular dark web monitoring and identity theft protection offerings. Customers include seven of the Fortune 10, along with hundreds of global enterprises, mid-sized companies, and government agencies worldwide. Headquartered in Austin, TX, SpyCloud is home to more than 200 cybersecurity experts whose mission is to protect businesses and consumers from the stolen identity data criminals are using to target them now.

To learn more and see insights, users can visit spycloud.com.

**Contact**

**Emily Brown**  
**REQ on behalf of SpyCloud**  
**\[email protected\]**

Source

HackRead