The threat actors behind the Darcula phishing-as-a-service (PhaaS) platform have released new updates to their cybercrime suite with generative artificial intelligence (GenAI) capabilities.
"This addition lowers the technical barrier for creating phishing pages, enabling less tech-savvy criminals to deploy customized scams in minutes," Netcraft said in a fresh report shared with The Hacker News.

Darcula Adds GenAI to Phishing Toolkit, Lowering the Barrier for Cybercriminals

Hackers in the Elusive Comet campaign exploit Zoom’s remote-control feature to steal cryptocurrency, and over $100K lost in…

Hackers in the Elusive Comet campaign exploit Zoom’s remote-control feature to steal cryptocurrency, and over $100K lost in social engineering scam.

A new cybercrime campaign called “Elusive Comet” is targeting professionals in the cryptocurrency space. But, instead of going after blockchain tech directly, the attackers are using Zoom’s remote-control features to gain access to targeted devices.

Cybersecurity firm Security Alliance (SEAL) broke down the details in a report published in March 2025. Security Alliance (SEAL) in March 2025.

The Elusive Comet campaign is a social engineering scam where cybercriminals impersonate legitimate figures to lure victims into Zoom meetings. They often use phishing emails or DMs on X to create a convincing scenario, posing as individuals wanting to interview the victim for a podcast or media feature by Aureon Capital, which claims to be a legitimate venture capital firm.

Once the victim accepts the Zoom invitation, the attackers manipulate their computer by requesting remote control access under the pretence of needing technical assistance or help with a presentation. They change their Zoom display name to “Zoom,” creating a false sense of trust.

Zoom remote-control request dialogue box showing Zoom as the requestor (Source: Trail of Bits)

For your information, Zoom’s remote-control feature is designed for accessibility and collaboration, allowing one participant to control another’s screen with explicit permission. When attackers gain remote control, they install malware onto the victim’s machine, often including infostealers and RATs (Remote Access Trojans), eventually obtaining unauthorized access to the compromised system, exfiltrating crucial information like cryptocurrency wallet credentials, personal data, and private keys.

The effectiveness of this attack is illustrated by the experience of Jake Gallen, CEO of Emblem Vault. Gallen lost over $100,000 in digital assets after falling victim to the Elusive Comet campaign. He agreed to a Zoom interview with a media personality and was granted remote control access following which “GOOPDATE” malware was installed, allowing the attacker to drain his cryptocurrency wallets.

> Working with @\_SEAL\_Org we were able to retrieve a malware file that was installed on my computer during a @Zoom call with a youtube personality of over 90k subs.
> 
> Below I will share details about that person, my experience, and this malicious software known as GOOPDATE ↓ https://t.co/xXoeSWLUXA
> 
> — jake (@jakegallen\_) April 14, 2025

Cybersecurity firm Trail of Bits also encountered the Elusive Comet campaign when their CEO received suspicious invitations to a fake “Bloomberg Crypto” series via Twitter. They identified the attackers’ refusal to communicate via email and the use of unofficial Calendly scheduling pages as key indicators of malicious intent.

SEAL highlighted similarities between these attacks and the notorious North Korean hacking collective Lazarus Group’s past operations but could not conclusively attribute the campaign to Lazarus.

SEAL and Trail of Bits recommend several mitigation strategies for cryptocurrency professionals to protect against cyberattacks. These include disabling Zoom’s Remote-Control feature by default and exercising extreme caution with unsolicited invitations.

Researchers also advise implementing strong authentication measures, considering alternative communication platforms like Google Meet, and restricting application controls over high-risk applications like Zoom by technically blocking remote control.

Max Gannon, Intelligence Manager at Cofense commented on the latest development, stating, “The malicious use of legitimate software is a growing trend we’ve continued to see in 2025. In this case, threat actors are leveraging legitimate Zoom and Calendly links to bypass security controls. As trusted domains, their use in this attack makes it more difficult to detect and block.”

Elusive Comet Attack: Hackers Use Zoom Remote-Control to Steal Crypto

Following the death of Pope Francis, the Vatican is preparing to organize a new conclave in less than 20 days. This is how they’ll tamp down on leaks.

In 2005, cell phones were banned for the first time during the conclave, the process by which the Catholic Church elects its new pope. Twenty years later, after the death of Pope Francis, the election process is underway again. Authorities have two priorities: to protect the integrity of those attending the meeting, and to ensure that it proceeds in strict secrecy (under penalty of excommunication and imprisonment) until the final decision is made.

By 2025, the Gendarmerie corps guarding Vatican City faces unprecedented technological challenges compared to other conclaves. Among them are artificial intelligence systems, drones, military satellites, microscopic microphones, a misinformation epidemic, and a world permanently connected and informed through social media.

The conclave is scheduled to take place approximately 20 days after the pope's death. The Vatican and the Holy See are preparing for the arrival of the cardinals who will vote for the next leader of the Catholic faith. Emergency and control bodies are also working on it with state-of-the-art technology. So far, they have not shared details about their security arrangements, but they are not inexperienced in the task of safeguarding the integrity of high-profile figures in the face of today's technological risks.

In fact, the election in 2013 of Jorge Mario Bergoglio—the real name of Pope Francis—as supreme pontiff gives some indications of the rigorous security strategies that will be presented in the next conclave.

**Signal Jammers and Device Checks**

The Vatican has internet access, but within the areas where the cardinals will reside and vote for the new pope, there will be signal jammers. The technology prevents two devices from communicating with each other through radio frequency interference. The headquarters becomes an electronic bunker. Thus, if someone were to manage to introduce a microphone, telephone, or computer, they would be unable to transmit information.

However, the possibility of administrative staff or the cardinals themselves introducing technology is remote. Authorities inspect the building for days in search of unauthorized microphones or cameras, check every permitted attendee, and double-check participants.

**Privacy Film in the Windows**

Contemporary satellites are capable of taking pictures of people's faces from space, while AI can interpret lip movements. However, since there's currently no technology to see through walls with such high resolution, the best strategy against espionage in the conclave is to close doors and windows.

During meetings and in the sleeping quarters, voters are not allowed to look outside. In addition, before the cardinals arrive, Vatican staff place opaque film over windows so that no journalist, satellite, or drone can take pictures of the interior.

**Locked-Down Vatican**

The Vatican covers only 0.44 square kilometer in area. It is the smallest nation in the world. Until 2018, it had 650 cameras monitoring its streets from an underground command center. In addition, the Vatican City Gendarmerie, which functions as a conventional police force, and the Pontifical Swiss Guard, which acts as an army, are located within the territory. While in photographs they appear to be wearing antique costumes and carrying halberds, the latter group has highly trained personnel with heavy weapons, such as machine guns, rifles, and explosives.

An estimated 200,000 people are expected to be present in the small city-state once the conclave has determined the name of Pope Francis' successor.

_This story originally appeared on_ WIRED _en Español_ _and has been translated from Spanish._

The Tech That Safeguards the Conclave’s Secrecy

Terrance, United States / California, 22nd April 2025, CyberNewsWire

**Terrance, United States / California, April 22nd, 2025, CyberNewsWire**

**Joining Criminal IP at Booth S-634 | South Expo, Moscone Center | April 28 – May 1, 2025**

Criminal IP, the global cybersecurity platform specializing in AI-powered threat intelligence and OSINT-based data analytics, will exhibit at RSAC 2025 Conference, held from April 28 to May 1 at the Moscone Center in San Francisco. The company will welcome attendees at Booth S-634 in the South Expo Hall.

**Strengthening Its Global Presence Through Proven Success**

Following its impactful debut at RSAC 2023, Criminal IP has continued to expand its international footprint, establishing partnerships with over 40 global cybersecurity leaders, including Cisco, Tenable, Fortinet, VirusTotal, and Snowflake. Returning to RSAC 2025, the company will further strengthen its position in the global security market by showcasing its latest innovations in Attack Surface Management (ASM) and Cyber Threat Intelligence (CTI).

**Elevating Threat Intelligence with ASM at RSAC**

With a presence in over 150 countries, Criminal IP has positioned itself as a trusted leader in Attack Surface Management (ASM) and Cyber Threat Intelligence (CTI). At RSAC 2025, the company will highlight how its platform empowers security teams with real-time, actionable insights to proactively detect and respond to today’s most advanced cyber threats.

**Live Demonstrations & Strategic Dialogues**

Throughout the event, Criminal IP will host live demos and interactive sessions led by the CEO, senior developers, and global product experts. Visitors will gain exclusive insights into:

*   Real-world applications of ASM for enterprise security
*   Emerging threat trends and response tactics
*   Enhancing CTI workflows with AI and automation

Attendees will experience firsthand how Criminal IP uncovers exposed assets, detects abnormal behaviors, and delivers complete visibility across digital infrastructures.

**Connecting with the Criminal IP Team**

Attendees can arrange 1:1 meetings directly at Booth S-634 or pre-book sessions in advance through the Knowledge Hub > Conference section of the Criminal IP website. The team will be available to discuss how the platform can be tailored to support diverse cybersecurity goals.

The booth will also feature exclusive giveaways and a roulette-style prize draw for all on-site attendees.

> “RSAC continues to be a vital platform for exchanging ideas around proactive security,” said Byungtak Kang, CEO of AI SPERA. “We look forward to showcasing how our ASM-powered threat intelligence helps global organizations safeguard their external attack surfaces.”

**About Criminal IP**

Criminal IP is an all-in-one AI-driven threat intelligence platform that enables organizations to detect, assess, and respond to cyber threats in real time. Powered by massive-scale OSINT data and machine learning, the platform provides complete visibility into exposed assets, suspicious behaviors, and indicators of compromise.

**Contact**

**Michael Sena**  
**AI SPERA**  
**\[email protected\]**

Criminal IP to Showcase Advanced Threat Intelligence at RSAC™ 2025

Artificial intelligence is transforming industries, but its adoption also raises ethical and cybersecurity concerns, especially in the regulated…

Artificial intelligence is transforming industries, but its adoption also raises ethical and cybersecurity concerns, especially in the regulated financial sector. Balancing innovation with responsibility is important as organizations harness AI’s potential while protecting data, ensuring fairness, and mitigating risks. 

Navigating this intersection of AI ethics, cybersecurity, and finance requires careful strategy.

****AI in Financial Systems****

AI has revolutionized financial systems by enhancing decision-making processes, optimizing resource allocation, and improving fraud detection capabilities. One prominent area where AI thrives is in trading and market analysis. Algorithms powered by AI can analyze massive datasets in real time, identifying trends and making predictions with remarkable accuracy. 

For example, traders often ask, Can you short futures effectively use AI? The answer lies in leveraging sophisticated machine learning models that evaluate market conditions, predict price movements, and execute trades with precision. 

However, employing AI in such high-stakes environments also brings ethical considerations, such as ensuring transparency in algorithmic decisions and addressing the potential for systemic risks caused by automation. Balancing these advancements with robust governance is essential to maintaining trust and stability in the financial sector.

****Why AI Ethics Matters****

AI Ethics emphasizes fairness, accountability, and transparency in developing and using artificial intelligence systems. It prompts questions like, “Is this decision fair?” or “What are the risks if this algorithm fails?” 

These issues are especially critical in finance, where AI-driven decisions can directly impact people’s financial well-being. Financial tools affect nearly every part of life from securing loans to managing investments making ethical practices essential. 

Financial platforms must ensure their AI systems don’t discriminate based on factors like ethnicity, gender, or socioeconomic status. For instance, algorithms used to determine creditworthiness or loan approvals should be carefully designed and tested to prevent bias. Accountability is just as important; companies need systems to evaluate their AI’s impact and correct mistakes. 

Transparency is another cornerstone of AI Ethics. Consumers should know how their data is collected, used, and analyzed. They also deserve clarity on AI-driven decisions and the reasoning behind them. By prioritizing fairness, accountability, and transparency, companies can build trust and ensure their tools serve users responsibly and equitably.

****The Financial Costs of Cyber Threats****

AI doesn’t just create opportunities; it generates risks too. Cybersecurity is a constant challenge. It’s already critical in finance, but AI raises the stakes further. Imagine someone hacking an AI-driven trading system. This could cause widespread market turmoil in minutes.

The costs don’t stop at financial losses. A data breach can damage a company’s reputation. People lose trust, and rebuilding that trust can take years. Businesses need strong security measures to protect against breaches and ensure their AI systems are strengthened.

****Finding Balance Between Tech and Security****

Innovation and security can often feel at odds. New technologies drive progress but can also create vulnerabilities, as cyber threats evolve just as quickly. Cybersecurity teams must not only respond to threats but also anticipate and address issues before they escalate. 

This challenge becomes even greater with AI-powered systems. While transformative, their complexity makes them prime targets for attacks like data poisoning, adversarial manipulation, or algorithm flaws any of which can have serious consequences. 

To secure these systems, organizations should take a layered approach: regular audits to find vulnerabilities, secure coding to reduce risks, and employee training on handling sensitive data. By acting proactively, businesses can innovate without compromising security.

****The Future of AI Responsibility****

The future of AI is tied to how well we manage its capabilities and risks. Industries must keep asking tough questions. How much control should AI have? How do we hold businesses accountable when things go wrong?

This future depends on a collaborative effort. Governments, businesses, and researchers need to work together. Clear regulations should guide how AI is developed and used. Companies should prioritize ethical practices without cutting corners in pursuit of profits. Transparency, fairness, and strong cybersecurity protocols must remain non-negotiable.

The future of AI is both exciting and daunting. While it holds immense potential to improve our lives, it also poses significant challenges that must be addressed. As we continue to integrate AI into our society, we must do so with caution and responsibility.

We must continue having open discussions about the ethical implications of AI and actively work towards creating regulations and guidelines that prioritize human well-being. We must also hold businesses accountable for their actions and ensure that they uphold ethical practices in the development and use of AI.

(Image by Gerd Altmann from Pixabay)

AI Ethics, Cybersecurity and Finance: Navigating the Intersection

A security architect with the National Labor Relations Board (NLRB) alleges that employees from Elon Musk's Department of Government Efficiency (DOGE) transferred gigabytes of sensitive data from agency case files in early March, using short-lived accounts configured to leave few traces of network activity. The NLRB whistleblower said the unusual large data outflows coincided with multiple blocked login attempts from an Internet address in Russia that tried to use valid credentials for a newly-created DOGE user account.

A security architect with the **National Labor Relations Board** (NLRB) alleges that employees from **Elon Musk**‘s **Department of Government Efficiency** (DOGE) transferred gigabytes of sensitive data from agency case files in early March, using short-lived accounts configured to leave few traces of network activity. The NLRB whistleblower said the unusual large data outflows coincided with multiple blocked login attempts from an Internet address in Russia that tried to use valid credentials for a newly-created DOGE user account.

The cover letter from Berulis’s whistleblower statement, sent to the leaders of the Senate Select Committee on Intelligence.

The allegations came in an April 14 letter to the Senate Select Committee on Intelligence, signed by **Daniel J. Berulis**, a 38-year-old security architect at the NLRB.

**NPR**, which was the first to report on Berulis’s whistleblower complaint, says NLRB is a small, independent federal agency that investigates and adjudicates complaints about unfair labor practices, and stores “reams of potentially sensitive data, from confidential information about employees who want to form unions to proprietary business information.”

The complaint documents a one-month period beginning March 3, during which DOGE officials reportedly demanded the creation of all-powerful “tenant admin” accounts in NLRB systems that were to be exempted from network logging activity that would otherwise keep a detailed record of all actions taken by those accounts.

Berulis said the new DOGE accounts had unrestricted permission to read, copy, and alter information contained in NLRB databases. The new accounts also could restrict log visibility, delay retention, route logs elsewhere, or even remove them entirely — top-tier user privileges that neither Berulis nor his boss possessed.

Berulis writes that on March 3, a black SUV accompanied by a police escort arrived at his building — the NLRB headquarters in Southeast Washington, D.C. The DOGE staffers did not speak with Berulis or anyone else in NLRB’s IT staff, but instead met with the agency leadership.

“Our acting chief information officer told us not to adhere to standard operating procedure with the DOGE account creation, and there was to be no logs or records made of the accounts created for DOGE employees, who required the highest level of access,” Berulis wrote of their instructions after that meeting.

“We have built in roles that auditors can use and have used extensively in the past but would not give the ability to make changes or access subsystems without approval,” he continued. “The suggestion that they use these accounts was not open to discussion.”

Berulis found that on March 3 one of the DOGE accounts created an opaque, virtual environment known as a “container,” which can be used to build and run programs or scripts without revealing its activities to the rest of the world. Berulis said the container caught his attention because he polled his colleagues and found none of them had ever used containers within the NLRB network.

Berulis said he also noticed that early the next morning — between approximately 3 a.m. and 4 a.m. EST on Tuesday, March 4  — there was a large increase in outgoing traffic from the agency. He said it took several days of investigating with his colleagues to determine that one of the new accounts had transferred approximately 10 gigabytes worth of data from the NLRB’s **NxGen** case management system.

Berulis said neither he nor his co-workers had the necessary network access rights to review which files were touched or transferred — or even where they went. But his complaint notes the NxGen database contains sensitive information on unions, ongoing legal cases, and corporate secrets.

“I also don’t know if the data was only 10gb in total or whether or not they were consolidated and compressed prior,” Berulis told the senators. “This opens up the possibility that even more data was exfiltrated. Regardless, that kind of spike is extremely unusual because data almost never directly leaves NLRB’s databases.”

Berulis said he and his colleagues grew even more alarmed when they noticed nearly two dozen login attempts from a Russian Internet address (83.149.30,186) that presented valid login credentials for a DOGE employee account — one that had been created just minutes earlier. Berulis said those attempts were all blocked thanks to rules in place that prohibit logins from non-U.S. locations.

“Whoever was attempting to log in was using one of the newly created accounts that were used in the other DOGE related activities and it appeared they had the correct username and password due to the authentication flow only stopping them due to our no-out-of-country logins policy activating,” Berulis wrote. “There were more than 20 such attempts, and what is particularly concerning is that many of these login attempts occurred within 15 minutes of the accounts being created by DOGE engineers.”

According to Berulis, the naming structure of one Microsoft user account connected to the suspicious activity suggested it had been created and later deleted for DOGE use in the NLRB’s cloud systems: “**DogeSA\_2d5c3e0446f9@nlrb.microsoft.com**.” He also found other new Microsoft cloud administrator accounts with nonstandard usernames, including “**Whitesox, Chicago M.**” and “**Dancehall, Jamaica R**.”

A screenshot shared by Berulis showing the suspicious user accounts.

On March 5, Berulis documented that a large section of logs for recently created network resources were missing, and a network watcher in **Microsoft Azure** was set to the “off” state, meaning it was no longer collecting and recording data like it should have.

Berulis said he discovered someone had downloaded three external code libraries from **GitHub** that neither NLRB nor its contractors ever use. A “readme” file in one of the code bundles explained it was created to rotate connections through a large pool of cloud Internet addresses that serve “as a proxy to generate pseudo-infinite IPs for web scraping and brute forcing.” Brute force attacks involve automated login attempts that try many credential combinations in rapid sequence.

The complaint alleges that by March 17 it became clear the NLRB no longer had the resources or network access needed to fully investigate the odd activity from the DOGE accounts, and that on March 24, the agency’s associate chief information officer had agreed the matter should be reported to **US-CERT**. Operated by the Department of Homeland Security’s **Cybersecurity and Infrastructure Security Agency** (CISA), US-CERT provides on-site cyber incident response capabilities to federal and state agencies.

But Berulis said that between April 3 and 4, he and the associate CIO were informed that “instructions had come down to drop the US-CERT reporting and investigation and we were directed not to move forward or create an official report.” Berulis said it was at this point he decided to go public with his findings.

An email from Daniel Berulis to his colleagues dated March 28, referencing the unexplained traffic spike earlier in the month and the unauthorized changing of security controls for user accounts.

**Tim Bearese**, the NLRB’s acting press secretary, told NPR that DOGE neither requested nor received access to its systems, and that “the agency conducted an investigation after Berulis raised his concerns but ‘determined that no breach of agency systems occurred.'” The NLRB did not respond to questions from KrebsOnSecurity.

Nevertheless, Berulis has shared a number of supporting screenshots showing agency email discussions about the unexplained account activity attributed to the DOGE accounts, as well as NLRB security alerts from Microsoft about network anomalies observed during the timeframes described.

As **CNN** reported last month, the NLRB has been effectively hobbled since **President Trump** fired three board members, leaving the agency without the quorum it needs to function.

“Despite its limitations, the agency had become a thorn in the side of some of the richest and most powerful people in the nation — notably Elon Musk, Trump’s key supporter both financially and arguably politically,” CNN wrote.

Both **Amazon** and Musk’s **SpaceX** have been suing the NLRB over complaints the agency filed in disputes about workers’ rights and union organizing, arguing that the NLRB’s very existence is unconstitutional. On March 5, a U.S. appeals court unanimously rejected Musk’s claim that the NLRB’s structure somehow violates the Constitution.

Berulis shared screenshots with KrebsOnSecurity showing that on the day the NPR published its story about his claims (April 14), the deputy CIO at NLRB sent an email stating that administrative control had been removed from all employee accounts. Meaning, suddenly none of the IT employees at the agency could do their jobs properly anymore, Berulis said.

An email from the NLRB’s associate chief information officer Eric Marks, notifying employees they will lose security administrator privileges.

Berulis shared a screenshot of an agency-wide email dated April 16 from NLRB director **Lasharn Hamilton** saying DOGE officials had requested a meeting, and reiterating claims that the agency had no prior “official” contact with any DOGE personnel. The message informed NLRB employees that two DOGE representatives would be detailed to the agency part-time for several months.

An email from the NLRB Director Lasharn Hamilton on April 16, stating that the agency previously had no contact with DOGE personnel.

Berulis told KrebsOnSecurity he was in the process of filing a support ticket with Microsoft to request more information about the DOGE accounts when his network administrator access was restricted. Now, he’s hoping lawmakers will ask Microsoft to provide more information about what really happened with the accounts.

“That would give us way more insight,” he said. “Microsoft has to be able to see the picture better than we can. That’s my goal, anyway.”

Berulis’s attorney told lawmakers that on April 7, while his client and legal team were preparing the whistleblower complaint, someone physically taped a threatening note to Mr. Berulis’s home door with photographs — taken via drone — of him walking in his neighborhood.

“The threatening note made clear reference to this very disclosure he was preparing for you, as the proper oversight authority,” reads a preface by Berulis’s attorney **Andrew P. Bakaj**. “While we do not know specifically who did this, we can only speculate that it involved someone with the ability to access NLRB systems.”

Berulis said the response from friends, colleagues and even the public has been largely supportive, and that he doesn’t regret his decision to come forward.

“I didn’t expect the letter on my door or the pushback from \[agency\] leaders,” he said. “If I had to do it over, would I do it again? Yes, because it wasn’t really even a choice the first time.”

For now, Mr. Berulis is taking some paid family leave from the NLRB. Which is just as well, he said, considering he was stripped of the tools needed to do his job at the agency.

“They came in and took full administrative control and locked everyone out, and said limited permission will be assigned on a need basis going forward” Berulis said of the DOGE employees. “We can’t really do anything, so we’re literally getting paid to count ceiling tiles.”

Further reading: Berulis’s complaint (PDF).

Whistleblower: DOGE Siphoned NLRB Case Data

Cybersecurity researchers have flagged a new malicious campaign related to the North Korean state-sponsored threat actor known as Kimsuky that exploits a now-patched vulnerability impacting Microsoft Remote Desktop Services to gain initial access.
The activity has been named Larva-24005 by the AhnLab Security Intelligence Center (ASEC).
"In some systems, initial access was gained through

Kimsuky Exploits BlueKeep RDP Vulnerability to Breach Systems in South Korea and Japan

Dallas, United States, TX, 21st April 2025, CyberNewsWire

**Dallas, United States, TX, April 21st, 2025, CyberNewsWire**

Brings Automated Response to Your Assets, Identity, Vulnerabilities, Alerts, and More to Redefine Risk Prioritization.

For years, security teams have operated in reactive mode, contending with siloed tools, fragmented intelligence, and a never-ending backlog of alerts. Traditional Security Operations platforms were supposed to unify data and streamline response—but they often introduced their own complexity, requiring heavy customization and manual oversight. “Hyper automation” delivered much of the same empty promises, leaving most security teams firefighting today’s incidents with limited bandwidth to proactively manage tomorrow’s risks.

At the 2025 RSA Conference, StrikeReady is introducing its next-generation Security Command Center v2. This AI-powered platform is engineered to go beyond basic alert processing, offering integrated asset and identity visibility, comprehensive vulnerability management, and coordinated automated response capabilities—enabling organizations to address threats with a focus on effective risk resolution.

> “We built StrikeReady to help security teams escape the cycle of perpetual reactivity,” said Alex Lanstein, CTO at StrikeReady. “With our platform, you don’t just see threats faster—you control and reduce risk in real time, closing gaps before they’re exploited. It’s a complete shift from dousing fires to preventing them from igniting.”

**v2 Key Business Outcomes and Metrics**

**1\. Proactive Risk Visibility**

A consolidated risk view across your identities, assets, and vulnerabilities, validated in a single unified interface/command center. Enable informed, strategic planning, rather than being in constant firefighting mode.

**2\. Radical Time Reduction**

Validating risk with threat intelligence, like threat intelligence reports, is cut from four to six hours to four to six minutes.

Alert processing drops from one hour to one minute, freeing analysts to focus on hunting.

All alerts, from any source—high, medium, and low severity—are all processed without differentiation, and at machine speed and accuracy.

**3\. Better, Faster, and More Cost-Effective Deployments**

Automated workflows and capabilities can be live in as little as 60 minutes, unlike traditional automation systems that often require six to 18 months of customization and cost upwards of $1 million.

**4\. Lower Operational Expenses**

One of many examples is phishing alert backlogs cleared in minutes, reducing manual efforts and saving over $180,000 annually.

Analysts spend less time on foundational work, false positives, and repetitive tasks, slashing overhead and burnout.

**5\. Native Case Management, Collaboration, and Real-Time Validation**

Built-in case management means no external ticketing, and zero trust collaboration with any internal or external team, with auto-documentation as standard (auditable).

**6\. Validate Your Security Controls** 

Use prepackaged or custom live attack content across your endpoints, cloud, and network to assess your security posture, resolve risk, and report improvements to your business.

**7\. Moving from Alerts to Strategic Defense**

While many AI-based security solutions focus on short-term alert handling, StrikeReady frames cybersecurity as an end-to-end risk management process. The platform’s proprietary Large Action Model (LAM) goes beyond mere analysis—directly executing defensive actions across the environment based on user prompts. This proactive approach helps organizations:

**Optimize** existing security investments by centralizing management.

**Preemptively** counter sophisticated threats, rather than reacting after the fact.

**Continuously** improve security efficiency through automation and instant control validation.

> “Success in cybersecurity today isn’t about chasing the latest threat—it’s about operationalizing intelligence, standardizing incident resolution, and eliminating friction at every step,” said Adil Mufti, CISO at StrikeReady. “StrikeReady makes this shift possible by consolidating the entire security lifecycle under one roof.”

**Experience StrikeReady at RSA Conference**

At **RSA Conference 2025**, StrikeReady will demonstrate live how the platform unifies risk visibility, orchestrates proactive actions, and frees analysts to make strategic decisions. Attendees can learn how to lower mean time to respond (MTTR), reduce false positives, and transform their SOC from a reactive entity into a proactive defense powerhouse.

**About StrikeReady**

Founded in 2019, StrikeReady introduced the first unified, vendor-agnostic, AI-powered Security Command Center delivering full-spectrum risk visibility, intelligent threat management, and automated response from a single, integrated platform.

By unifying identities, assets, vulnerabilities, and advanced simulations in one place, StrikeReady empowers organizations to proactively defend against modern threats and stay ahead of an ever-shifting cyber landscape. Moving beyond conventional AI, StrikeReady leverages its Large Action Model (LAM) to automate actions across the tech stack, creating a force multiplier for security teams seeking truly proactive risk management.

Recognized by Gartner as the only Virtual Security Assistant in its Emerging Technologies report, StrikeReady is dedicated to reshaping the future of cybersecurity.

**For more information users can visit**: https://strikeready.com/

**To schedule a demo at RSA, users can contact:** 

Lee Weyers | \[email protected\] | +1 (702) 588-1131

**Contact**

**Director, Public Relations**  
**Cara Harbor**  
**StrikeReady**  
**\[email protected\]**

Industry First: StrikeReady AI Platform Moves Security Teams Beyond Basic, One-Dimensional AI-Driven Triage Solutions

Kaspersky researchers report the reappearance of MysterySnail RAT, a malware linked to Chinese IronHusky APT, targeting Mongolia and…

Kaspersky researchers report the reappearance of MysterySnail RAT, a malware linked to Chinese IronHusky APT, targeting Mongolia and Russia after years of silence. Learn about its new tactics and modular design.

Cybercriminals are constantly developing new malware for cyberattacks. These malicious tools have varying lifespans; some malware families have been tracked for decades, while others vanish from public awareness relatively quickly. In 2021, Kaspersky researchers discovered one such short-lived implant during their investigation of the CVE-2021-40449 zero-day vulnerability, which they dubbed MysterySnail RAT.

At the time of its discovery, MysterySnail RAT was linked to IronHusky APT, a Chinese-speaking threat group active since at least 2017. After the initial report, no further public details about this malware emerged.

However, recent observations have uncovered attempted deployments of a new version of MysterySnail RAT targeting government entities in Mongolia and Russia. This targeting aligns with previous intelligence indicating IronHusky’s specific interest in these two countries dating back to 2018, suggesting the RAT has been active covertly for several years.

A recent infection began with a malicious MMC script disguised as a document from Mongolia’s National Land Agency (ALAMGAC). This script downloaded a ZIP archive from fileio, which contained a secondary malicious component and a decoy DOCX file. The script would then extract the archive, placing the decoy in %AppData%\Cisco\Plugins\X86\bin\etc\Update, and execute CiscoCollabHost.exe from the archive. For persistence, it configured CiscoCollabHost.exe to run at start-up and opened the decoy document to deceive the user.

While CiscoCollabHost.exe was legitimate, the archive also held a malicious DLL named CiscoSparkLauncher.dll, designed for DLL Sideloading by the legitimate process, acting as a new intermediary backdoor. This backdoor facilitated C2 communication by leveraging the open-source piping-server project.

The new version can execute around 40 commands, enabling various malicious activities like file system management, command execution via cmd.exe process creation and termination, service management, and network resource connection.

Unlike the 2021 samples, the new version uses five additional DLL modules for command execution, a key upgrade from the previous version’s single malicious component.

Moreover, it was configured to establish persistence on infected machines as a service, and the malicious DLL loads a payload encrypted using RC4 and XOR algorithms. Upon decryption, it gets loaded into memory through DLL hollowing, facilitated by code within the run_pe library.

Following the disruption of recent MysterySnail RAT intrusions, the threat actors persisted by deploying a modified, single-component variant named MysteryMonoSnail. This streamlined version communicated with the same C2 servers as the original RAT but utilised the WebSocket protocol instead of HTTP and possessed a reduced set of only 13 basic commands, enabling actions like listing directories, writing files, and launching processes and remote shells.

The return of MysterySnail RAT shows how old malware doesn’t just disappear; they evolve. It’s also a reminder that staying on top of new and resurfacing cybersecurity threats is key to keeping systems secure.

Chinese APT IronHusky Deploys Updated MysterySnail RAT on Russia

Plus: A US judge rules against police cell phone “tower dumps,” China names alleged NSA agents it says were involved in cyberattacks, and Customs and Border Protection reveals its social media spying tools.

Just three months into the Trump administration's promised crackdown on immigration to the United States, Immigrations and Customs Enforcement now has a $30 million contract with Palantir to build a “near-real time” surveillance platform called ImmigrationOS that would track information about people self-deporting (electing to leave the US). Meanwhile, the Department of Homeland Security has been sending aggressive emails telling people with temporary legal status to leave the US. It is unclear who has actually been sent the messages, though, given that a number of people who are US-born citizens have reported receiving them.

The US Cybersecurity and Infrastructure Security Agency briefly seemed poised this week to cancel funding for the critical software vulnerability tracking project known as the CVE Program. CISA eventually came through with the funding, but some members of the CVE Program's governing board are planning to make the project into an independent nonprofit.

A lawsuit over the Trump administration’s Houthi Signal group chat is revealing details on steps that federal departments did—and did not—take to preserve the messages per records laws.

WIRED took a look at the most dangerous hackers you've never heard of, diving deep on the unrelenting and two-faced Russian intelligence group Gamaredon; the incredibly prolific Chinese Smishing Triad text message scammers; the dangerous members of fallen ransomware giant Black Basta; the Iranian critical infrastructure hackers known as CyberAv3ngers; the TraderTraitor North Korean cryptocurrency hackers responsible for a staggering number of massive heists; and the notorious, longtime Chinese criminal and state-backed crossover hackers known as Brass Typhoon.

On top of all of that, a suspected 4chan hack may have devastating consequences for the controversial image board. The AI company Massive Blue is helping cops generate AI-powered social media bots to pose as sympathetic figures and talk to people of interest. And the New Jersey attorney general is suing Discord, claiming that the platform doesn't have adequate safeguards in place to protect children under 13 from sexual predators and harmful content.

But wait, there's more! Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories, and stay safe out there.

**Draft Legislation in Florida Explicitly Demands Encryption Backdoors**

A draft bill in the state of Florida would require social media companies to provide law enforcement with encryption backdoors so cops could access users’ accounts. The bill advanced unanimously from committee this week and will now go to the state Senate for a vote. If passed, the Social Media Use by Minors bill, which is sponsored by state senator Blaise Ingoglia, would require “social media platforms to provide a mechanism to decrypt end-to-end encryption when law enforcement obtains a subpoena.” The bill would also ban disappearing messages in accounts designed for children and would require social media companies to create a mechanism for parents or guardians to access children's accounts. Experts have long warned that encryption backdoors make everyone less secure, including those they are intended to help. Yet waves of attacks on encryption have repeatedly emerged over the years, including a recent trend in the European Union and United Kingdom.

**Judge Finds Broad Searches of Cell Tower Data Are Unconstitutional**

A Nevada district judge said this week that the practice of “tower dumps,” in which law enforcement pulls vast quantities of personal caller data from cell towers, violates the Fourth Amendment and is, thus, unconstitutional. Cell towers collect large quantities of information about users, including phone numbers and phone locations, so when cops request data from a tower during a specific time period, they often receive information on thousands of devices or more. In spite of the decision this week, though, Judge Miranda M. Du said that law enforcement could still use the evidence they had collected through a tower dump in their case.

**China Hits US With Accusations of Cyberattacks, Naming Alleged NSA Agents**

China claimed this week that the US National Security Agency perpetrated “advanced” cyberattacks against critical industries in February during the Asian Winter Games. Law enforcement from the northeastern city of Harbin put three alleged NSA agents—Katheryn A. Wilson, Robert J. Snelling, and Stephen W. Johnson—on a wanted list and claimed that the University of California and Virginia Tech were involved in the attacks. “We urge the US to take a responsible attitude on the issue of cyber security and … stop unprovoked smears and attacks on China,” ministry spokesperson Lin Jian said during a news briefing about multiple topics, according to Reuters. The US government frequently calls out Chinese state-backed hacking and names individual alleged perpetrators, but China has been less consistent about such statements. The move this week comes amid escalating tensions between the two countries, including the Trump's administration's trade war.

**US Customs and Border Protection Is Using a Number of AI Tools to Monitor Social Media**

CBP is using multiple artificial intelligence tools to scan social media and identify people of interest online, according to information from the agency and marketing materials reviewed by 404 Media from the contractors. CBP released information about the platforms this week in parallel to the US Department of Homeland Security’s announcement that it will “begin screening aliens’ social media activity for Antisemitism.” That statement also says that US Citizenship and Immigration Services is conducting “antisemitism” social media searches. CBP told 404 Media in an email that “neither tool is used for vetting or travel application processing,” referring to Dataminr and Onyx, but did not elaborate beyond that. The platforms use AI to parse large troves of data and can be used to develop leads on people who may be in violation of US immigration laws.

Tag

#intel