A vulnerability in 7-Zip that could allow attackers to bypass the MotW security feature in Windows has been patched.

A patch is available for a vulnerability in 7-Zip that could have allowed attackers to bypass the Mark-of-the-Web (MotW) security feature in Windows.

The MotW is an attribute added to files by Windows when they have been sourced from an untrusted location, like the internet or a restricted zone. The MotW is what triggers warnings that opening or running such files could lead to potentially dangerous behavior, including installing malware on their devices. 7-Zip added support for MotW in June 2022.

The MotW also makes sure that Office documents that are marked with the MotW will be opened in Protected View, which automatically enables read-only mode and means that all macros will be disabled until the user allows them.

MotW security warning in file properties

For years, attackers were able to bypass the MotW by putting their malicious files in archives. This worked because the MotW is in fact another file that is attached to the main file as an Alternate Data Stream (ADS), and over the years we have seen many vulnerabilities in archivers where the ADS didn’t pass on the individual files when the archive was decompressed.

The same is true this time. Only the attacker will have to prepare an especially crafted nested archive. A nested archive means there is an open archive inside another open archive. Exploitation of the vulnerability also requires user interaction, meaning the target will have to visit a malicious page or open a malicious file.

If you’re a Windows user, check whether you are using version 7-Zip 24.09 or later. If you’re not, then they’ll need to update.

7-Zip does not have an auto-update function, so you will have to download the version that is suitable for your system from the 7-Zip downloads page.

**Other security measures**

There are some general safety tips to keep in mind when you’re handling archived files on a regular basis:

*   Keep track of how and where you obtained the archive.
*   Always be careful when opening archived files that you downloaded from the internet.
*   Make sure you are using an updated anti-malware solution that is capable of scanning inside archives, and you have that setting enabled.

Malwarebytes scan within archives option enabled

*   Keep track of who accesses archived files and when. This can help identify unauthorized access attempts and help monitor unwanted changes.

**We don’t just report on threats—we remove them**

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

 7-Zip bug could allow a bypass of a Windows security feature. Update now 

President Trump pardons Silk Road founder Ross Ulbricht, slamming prosecutors as “scum.” The move reignites debates on cybercrime…

President Trump pardons Silk Road founder Ross Ulbricht, slamming prosecutors as “scum.” The move reignites debates on cybercrime justice, presidential power, and fairness.

U.S. President Donald Trump has issued a full pardon to Ross Ulbricht, the founder of the infamous dark web marketplace **Silk Road**. The decision has kicked off a debate across political, legal, and cybersecurity circles while raising questions about possible pardons for other high-profile figures such as Julian Assange and Edward Snowden.

****The Silk Road Story****

Launched in February 2011, Silk Road was an online marketplace accessible through the Tor network, designed to ensure user anonymity. The platform operated much like eBay but was primarily known for facilitating the trade of illegal goods, particularly drugs. Payments on Silk Road were conducted using Bitcoin, making transactions nearly untraceable.

Ross Ulbricht, operating under the pseudonym “Dread Pirate Roberts,” positioned himself as a libertarian ideologue, claiming the marketplace was a tool to undermine government overreach and provide individuals with greater personal freedoms. However, the site soon became a hub for illegal activities, including drug trafficking, weapons sales, and hacking tools.

****The Arrest****

Ulbricht was **arrested on October 1, 2013**, in the science fiction section of a public library in San Francisco. The dramatic takedown was part of a planned operation by federal agents who had been tracking Ulbricht for months including postings on online forums, metadata from server logs, and evidence found on Ulbricht’s laptop at the time of his arrest.

When captured, Ulbricht’s laptop was open and running, providing agents with incriminating evidence, including logs of Silk Road transactions, communications with administrators, and his personal journal. Ulbricht then faced a litany of charges, including:

*   **Conspiracy to traffic narcotics.**
*   **Conspiracy to commit computer hacking.**
*   **Conspiracy to commit money laundering.**
*   **Continuing a criminal enterprise** (a charge commonly used against organized crime figures).

While the charges focused on his role in enabling large-scale drug trafficking, federal authorities also accused him of attempting to arrange hits on individuals he perceived as threats to Silk Road. Although no murders were carried out, these allegations added significant weight to the prosecution’s case.

****The Sentencing****

In 2015, Ross Ulbricht was convicted on all charges and sentenced to **two life sentences plus 40 years** without the possibility of parole. The severity of the sentence shocked many observers, who argued that it was disproportionately harsh compared to other cases involving similar offenses. Civil liberties advocates and digital rights groups questioned whether the punishment was intended to set an example for others operating in the digital underground.

Seized Silk Road market (Screenshot: Hackread.com)

****The Pardon****

Trump’s decision to pardon Ross Ulbricht was announced on January 21, 2025. In a post on Truth Social, Trump described the prosecution and conviction of Ulbricht as a “scum,” criticizing the authorities involved in the case.

> _“I just called the mother of Ross William Ulbricht to let her know that in honor of her and the Libertarian Movement, which supported me so strongly, it was my pleasure to have just signed a full and unconditional pardon of her son, Ross. The scum that worked to convict him were some of the same lunatics who were involved in the modern day weaponization of government against me. He was given two life sentences, plus 40 years. Ridiculous!”_
> 
> Donald Trump

The Ulbricht pardon raises fundamental questions about justice in the digital age. How should courts balance technological innovation, personal freedom, and the responsibility for harm caused?

1.  **Obama Pardons** **Chelsea Manning**
2.  **CIA Whistleblower Guilty of Leaking Vault 7 Docs to WikiLeaks**
3.  **Dark Web Hydra Market Mastermind Sentenced to Life by Russia**
4.  **British judge says Julian Assange will not be extradited to the US**
5.  **23-Year-Old Arrested for Running 100M Incognito Dark Web Market**

Trump Pardons Silk Road Founder Ross Ulbricht, Calls Prosecutors ‘Scum’

As GenAI tools and SaaS platforms become a staple component in the employee toolkit, the risks associated with data exposure, identity vulnerabilities, and unmonitored browsing behavior have skyrocketed. Forward-thinking security teams are looking for security controls and strategies to address these risks, but they do not always know which risks to prioritize. In some cases, they might have

Discover Hidden Browsing Threats: Free Risk Assessment for GenAI, Identity, Web, and SaaS Risks

Despite lagging in technology adoption, African and Middle Eastern organizations are catching up, driven by smartphone acceptance and national identity systems.

Source: Ground Picture via Shutterstock

National governments and companies in the Middle East and Africa continue to push for more widely available digital identity systems to allow citizens to connect and authenticate to digital government services and commercial services.

In Morocco, the government issued more than 4.6 million electronic identity cards in 2024 and expanded its digital infrastructure with a trusted third-party authentication platform in an effort to offer new services and cut cybercrime rates. More than 7.2 million people are now enrolled in the United Arab Emirates' official digital ID, known as UAE Pass, and can authenticate to websites. And the National Bank of Egypt has adopted a single sign-on infrastructure that will allow its employees to use a variety of authentication methods, and which will eventually be rolled out to its millions of customers.

The increasing use of multifactor authentication, especially efforts tied to smartphones or biometrics, have had success in the region because — in many cases — organizations have no technical debt to overcome, says Jim Sullivan, senior vice president of strategy and compliance at BIO-Key, which provided the technology for the National Bank of Egypt, as well as the largest bank in South Africa and the government of Nigeria.

"These are greenfield opportunities — it's tremendous," he says. "There's national initiatives that are well funded that are really bringing more biometrics to the fore, more awareness of the power of this technology."

Better authentication and the use of biometrics has taken off in the Middle East and Africa due to government concerns over cybercrime and fraud and international concerns over the lack of legal identities for more than 540 million people in the region. In Africa, cyber-risk is the No. 1 concern among businesses leaders, with 61% aiming to mitigate the threat in 2025, according to PwC's "2025 Digital Trust Insights: South Africa and Africa" report. In the Middle East, cyber-risk has fallen to the second greatest concern, behind digital and technology risks and tied with inflation and macroeconomic volatility, with 42% of organizations making mitigation of the cyber risks a priority, according to PwC's "2025 Digital Trust Insights: Middle East" report.

Despite that, only 19% of companies in Africa and 12% of companies in the Middle East are prioritizing investments in identity and access management (IAM) technologies, according to the PwC reports. Most companies are prioritizing the acquisition of data protection technologies, generative AI systems, and network security in the region, with the Middle East also prioritizing the addition of cyber insurance for the business.

**Biometrics Embraced by Mideast, African Markets**

A shift to biometrics, however, could change that. The significant reliance of smartphones for Internet access and digital transactions is leading many governments and organizations to adopt biometric-based identity systems and to use biometrics as a second factor of authentication for digital services.

Digital identity platforms, such as UAE Pass in the United Arab Emirates and Nafath in Saudi Arabia, integrate with existing fingerprint and facial-recognition systems and can reduce the reliance on passwords, says Chris Murphy, a managing director with the cybersecurity practice at FTI Consulting in Dubai.

"With mobile devices serving as the primary gateway to digital services, smartphone-based biometric authentication is the most widely used method in public and private sectors," he says. "Some countries, such as the UAE and Saudi Arabia, are early adopters of passwordless authentication, leveraging AI-based facial recognition and behavioral analytics for seamless and secure identity verification."

African nations have also rolled out national identity cards based on biometrics. In South Africa, for example, customers can walk into a bank and open an account by using their fingerprint and linking it to the national ID database, which acts as the root of trust, says BIO-Key's Sullivan.

"After they verify that that person is who they say they are with the Home Affairs Ministry, they can store that fingerprint \[in the system\]," he says. "From then on, anytime they want to authenticate that user, they just touch a finger. They've just now started rolling out the ability to do that without even presenting your card for subsequent business."

**An Easy Upgrade Path**

While the links to national identity systems means biometrics make sense, companies do not need to jump feet first into biometric-based authentication, BIO-Key's Sullivan says. In many cases, enterprise customers start with a single sign-on system that then transitions to biometrics for identity or as a second factor.

"The use case is typically one where you have users that are moving around, and you don't want them to carry a phone or a token — finance, retail point-of-sale, banking, and manufacturing, where you have workforces that are roving around a manufacturing shop floor," he says. "We have to accommodate the fact that a lot of companies still use traditional technologies and don't want to just make a big-bang switch, so we we allow them to sort of start with what they're doing now ... \[and\] as they start to see the power of having a biometric option, they can evolve to that."

The push for stronger authentication is not limited to the Middle East and Africa. Worldwide, Microsoft sees 600 million identity attacks per day, of which 99.9% could be blocked with strong identity protections, such as multifactor authentication. Yet adoption has been slow: At the beginning of 2023, for example, Microsoft found that only 28% of the company's Azure Active Directory customers had turned on strong identity protections, up from 22% in 2022. Starting in February, the company will require MFA for all user accounts accessing the Microsoft 365 admin center, according to the company.

Saudi Arabia has established strong identity standards through its National Cybersecurity Authority's Essential Cybersecurity Controls (ECC-1:2018), while the UAE has implemented similar requirements through the Information Assurance Regulation (IAR), FTI Consulting's Murphy says.

Next up: AI-augmented identity platforms, he says. AI-driven authentication solutions, including liveness detection and real-time facial recognition, will likely be part of the mix.

"As digital identity ecosystems expand," Murphy says, "AI-based authentication and real-time identity verification will become critical components of cybersecurity, ensuring both security and usability across industries."

**About the Author**

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline Journalism (Online) in 2003 for coverage of the Blaster worm. Crunches numbers on various trends using Python and R. Recent reports include analyses of the shortage in cybersecurity workers and annual vulnerability trends.

Mandatory MFA, Biometrics Make Headway in Middle East, Africa

Torrance, United States / California, 22nd January 2025, CyberNewsWire

**Torrance, United States / California, January 22nd, 2025, CyberNewsWire**

AI SPERA, a leading Cyber Threat Intelligence (CTI) provider, has collaborated with OnTheHub, a global provider of software in education, to deliver its integrated cybersecurity solution, Criminal IP, to students and educational institutions. This strategic initiative aims to enhance cybersecurity awareness and protection in the education sector by offering internationally compliant solutions at affordable prices.

Criminal IP will now extend its reach to educational institutions worldwide, reinforcing its growing presence in the global security market. Since its launch, Criminal IP has gained users in over 150 countries and formed strategic alliances with more than 40 global cybersecurity companies, including Cisco, Snowflake, Tenable, and VirusTotal.

(Criminal IP Lite Plan on OnTheHub)

OnTheHub is a worldwide operating platform that provides software and learning materials at discounted rates to educational organizations and their members. Through this collaboration, Criminal IP and OnTheHub seek to strengthen the cybersecurity frameworks of educational organizations on the platform, aligning with the ongoing digital transformation (DT) in education, particularly regarding Learning Management Systems (LMS). Students and researchers can access Criminal IP by redeeming coupons purchased through OnTheHub on the Criminal IP website, enabling them to utilize a globally recognized CTI platform at an affordable cost.

Criminal IP offers real-time risk analysis and vulnerability insights for global IP addresses and domains. Utilizing AI and machine learning technologies, the solution scans for security threats across various ports and devices, quickly identifying malicious IPs and domains while categorizing threat levels into five distinct tiers. Additionally, organizations can leverage Criminal IP ASM to oversee and manage IT assets, and Criminal IP FDS to detect unauthorized network access attempts during login or payment processes, all provided through a user-friendly SaaS model.

In terms of compatibility, Criminal IP offers an intuitive user interface (UI) and an integrated API, facilitating seamless integration with a variety of software and security solutions. This enables users to comprehensively evaluate security risks, including threat scores for IT assets, exposure of IoT devices, and phishing domain identification. Consequently, students and researchers associated with OnTheHub’s partner institutions will gain access to high-quality threat intelligence data and a robust platform for academic activities such as threat hunting, development, and research.

> AI SPERA CEO Byung-tak Kang commented, “Through this partnership, we are excited to provide more students and educational institutions with a globally recognized security solution at a reasonable price. We hope that Criminal IP will help students and researchers prevent security threats in educational environments and ensure a safe digital space for learning.”

**About AI SPERA**

AI SPERA, renowned for its advanced solutions, has expanded internationally, with ‘Criminal IP’ as its flagship offering. Operating in more than 150 countries, ‘Criminal IP’ is backed by enterprise-grade security solutions like ‘Criminal IP ASM’ and ‘Criminal IP FDS’. Strategic partnerships with global leaders such as Cisco, VirusTotal, and Quad9 have significantly enhanced ‘Criminal IP’s capabilities. AI SPERA’s ‘Criminal IP’ has recently entered the marketplace of major US data warehousing platforms, including Amazon Web Services (AWS), Microsoft Azure, and Snowflake, expanding its global reach for threat data.

**Contact**

**Michael Sena**  
**\[email protected\]**

Criminal IP and OnTheHub Partner to Deliver Advanced Cybersecurity Solutions for Education

Web infrastructure and security company Cloudflare on Tuesday said it detected and blocked a 5.6 Terabit per second (Tbps) distributed denial-of-service (DDoS) attack, the largest ever attack to be reported to date.
The UDP protocol-based attack took place on October 29, 2024, targeting one of its customers, an unnamed internet service provider (ISP) from Eastern Asia. The activity originated

Mirai Botnet Launches Record 5.6 Tbps DDoS Attack with 13,000+ IoT Devices

Donald Trump pardoned the creator of the world’s first dark-web drug market, who is now a libertarian cause célèbre in some parts of the crypto community.

A little over 11 years and three months ago, Ross Ulbricht was arrested in the science fiction section of a public library in San Francisco, caught with his laptop still logged in to the Silk Road, the world’s first dark-web drug market that he created and ran under the pseudonym the Dread Pirate Roberts.

Now, after being sentenced to life in prison and spending more than a decade behind bars, Ulbricht will walk free, thanks to Donald Trump—and to the president’s ever-closer ties to the American cryptocurrency world.

“I just called the mother of Ross William Ulbright to let her know that in honor of her and the Libertarian Movement, which supported me so strongly, it was my pleasure to have just signed a full and unconditional pardon of her son, Ross,” president Trump wrote on Truth Social on Tuesday evening, misspelling Ulbricht's last name. “The scum that worked to convict him were some of the same lunatics who were involved in the modern day weaponization of government against me. He was given two life sentences, plus 40 years. Ridiculous!”

For close to two and a half years after Ulbricht created the Silk Road in 2011, the dark-web site facilitated the sale of vast amounts of narcotics, as well as counterfeit documents, money laundering services and, at times, guns, for hundreds of millions of dollars in bitcoin payments. After the FBI located the Silk Road’s server in Iceland in 2013 and arrested then 29-year-old Ulbricht in San Francisco, he was convicted on seven charges relating to the distribution of narcotics, money laundering, and computer hacking, as well as a “continuing criminal enterprise” statute—sometimes known as the “kingpin statute”—usually reserved for mob bosses and cartel leaders. In 2015, he was sentenced to life in prison, a punishment beyond even the 20-plus years that prosecutors in the case requested.

Since then, a Free Ross movement has steadily pressed for Ulbricht’s release, first in a failed appeal, then in petitions for clemency. Many of Ulbricht’s supporters have long argued that the Silk Road was a principled libertarian experiment in free trade, one in which Ulbricht allowed only “victimless crime”—despite prosecutors arguing during his trial that at least six people died of opioid overdoses from drugs linked to the Silk Road. They point out that Ulbricht never actually sold or possessed drugs himself, and rather ran a website that facilitated their sale. And they argue that by moving the sale of narcotics online, he reduced violence in the drug trade and committed no violence himself.

That argument has been complicated, however, by allegations that Ulbricht tried to have six people killed who presented a threat to him or the Silk Road. Ultimately all six alleged murders-for-hire were fake—one was staged by undercover DEA agents and five more were a scam. Ulbricht was charged with only one of those alleged paid killings in a separate prosecution in Maryland, which was then dropped after he received a life sentence in his New York trial. But evidence presented at Ulbricht’s trial showed him allegedly arranging those killings and even pinpointed transactions on Bitcoin’s blockchain that showed a payment for them from Ulbricht’s laptop to the would-be killer.

Those allegations of murders-for-hire, in fact, dissuaded the first Trump administration from granting clemency to Ulbricht. The White House in 2020 considered freeing Ulbricht but ultimately rejected the idea because of the alleged role of violence in the case, according to one former government official involved in the process who spoke to WIRED on condition of anonymity.

Since then, however, the Trump administration has shifted its stance on Ulbricht’s case—in part, perhaps, due to its embrace of the libertarian cryptocurrency community, for whom Ulbricht has become a martyr and cause célèbre. At the Libertarian National Convention in Washington, DC, last May, then presidential candidate Trump promised to commute Ulbricht’s sentence “on day one” if reelected. (Ultimately, day one passed with no clemency for Ulbricht, even as Trump pardoned more than a thousand participants in the January 6, 2021, insurrection at the US Capitol, though Trump ally Elon Musk promised in a post to X on Monday evening that “Ross will be freed too.”)

Just what role Ulbricht will play in the free world is far from clear. Even in his statement to the judge at his sentencing hearing in 2015, Ulbricht never fully acknowledged the harm inflicted by the Silk Road’s drug sales. And according to Jared Der-Yeghiayan, a former Homeland Security Investigations agent who infiltrated the Silk Road during the investigation, Ulbricht still shows little remorse for his actions in his public posts to X.

“The idea of him being released doesn’t bother me in the least,” says Der-Yeghiayan, who now works as the head of strategic intelligence at cryptocurrency tracing firm Chainalysis. “I do get bothered if there’s now a perception that he did nothing wrong; that doesn’t acknowledge the facts of the case.”

Among some advocates of criminal justice reform, however, Ulbricht has become an exemplar of oversentencing, particularly given that he was technically charged with nonviolent crimes. “Ross has served more than enough time. He has been a model prisoner. He’s a first-time, nonviolent offender. He poses zero safety risk to the community,” Alice Johnson, CEO of the justice reform foundation Taking Action for Good, told WIRED in November. Johnson spent two decades in prison herself for attempted possession with intent to distribute before Trump commuted her life sentence in 2018 and pardoned her in 2020. “I believe that Ross’ case is going to pave the way for many others who have been unjustly given these draconian sentences to come home.”

On Tuesday night, Ulbricht's supporters celebrated his freedom and voiced their gratitude to Trump for his clemency. “Words cannot express how grateful we are,” reads a tweet from @Free\_Ross, an X account devoted to the more than decade-long effort on Ulbricht's behalf. “President Trump is a man of his word and he just saved Ross's life. ROSS IS A FREE MAN!!!!!"

_Additional reporting by Joel Khalili_

Trump Frees Silk Road Creator Ross Ulbricht After 11 Years in Prison

BreachForums admin Conor Fitzpatrick (Pompompurin) faces resentencing after his lenient 17-day sentence was vacated, highlighting the serious consequences…

BreachForums admin Conor Fitzpatrick (Pompompurin) faces resentencing after his lenient 17-day sentence was vacated, highlighting the serious consequences of his cybercrime.

Conor Brian Fitzpatrick, the 21-year-old founder of **BreachForums**, a notorious marketplace for stolen personal data, is set to be resentenced following a federal appeals court decision to vacate his previous punishment. The ruling comes after concerns that the original 17-day sentence failed to adequately reflect the seriousness of his crimes or serve as a deterrent.

****BreachForums: A Haven for Stolen Data****

Fitzpatrick, operating under the alias “Pompompurin,” launched BreachForums in March 2022 after the **FBI shut down RaidForums,** a similar platform. BreachForums quickly grew to become the largest English-language data-breach marketplace. Over its one-year operation, the forum hosted over 14 billion individual records, including sensitive information such as databases, Social Security numbers (SSNs), birth dates, and banking details.

The platform also served as a hub for hackers to buy and sell stolen data, often facilitated by Fitzpatrick himself. Federal investigators revealed that Fitzpatrick earned approximately $698,000 during this period, causing significant financial and reputational harm to victims. Undercover FBI agents infiltrated the site in July 2022 and purchased records of 15 million Americans for $5,000, setting the stage for his eventual **arrest in March 2023** at his home in Peekskill, New York.

Conor Fitzpatrick’s profile on BreachForums

****The Arrest and Initial Sentencing****

Following his arrest, Fitzpatrick faced multiple federal charges, including:

*   **Conspiracy to traffic stolen personally identifiable information in violation of 18 U.S.C. § 1029.**

*   **Fraudulent solicitation of personally identifiable information.**

*   **Possession of child sexual abuse material (CASM), involving over 600 explicit images and videos of minors.**

Fitzpatrick **pleaded guilty to all charges** and was released on bond, subject to strict conditions. However, he repeatedly violated these conditions by using unauthorized devices, accessing the internet through a virtual private network (VPN), and participating in chatrooms where he joked about selling government secrets.

At sentencing, the district court recognized Fitzpatrick’s crimes but expressed concern over his autism spectrum disorder and young age. The court sentenced him to 17 days of time served and **20 years of supervised release**. It justified the lenient sentence by citing the Bureau of Prisons’ alleged inability to provide adequate treatment for Fitzpatrick’s condition and the likelihood of his victimization in prison.

****The Government’s Appeal and Appellate Ruling****

The U.S. government appealed the sentence, arguing it was excessively lenient and failed to meet federal sentencing guidelines, recommending 188 to 235 months in prison. Prosecutors highlighted the gravity of Fitzpatrick’s offenses, the need to deter cybercrime, and the failure of supervised release to address his pattern of violations.

> _“A 17-day sentence for the commission of three serious felonies signals to would-be criminals that they might get one free pass before facing any serious penalties.”_
> 
> **Joseph Attias**, the Assistant U.S. Attorney

On January 21, 2025, the Fourth Circuit Court of Appeals vacated the sentence, deeming it substantively unreasonable. The court criticized the district court’s heavy reliance on Fitzpatrick’s characteristics while overlooking the seriousness of his crimes, the need for deterrence, and public protection. The appellate court remanded the case for resentencing, indicating that a harsher punishment was warranted.

****What Comes Next?****

As the case returns to the district court, Fitzpatrick faces the possibility of a significantly longer prison term. The appellate ruling suggests that mitigating factors such as autism and youth cannot overshadow the severity of his crimes or the risks posed to public safety. Legal experts predict a sentence more aligned with federal guidelines, likely spanning several years in prison.

The resentencing of Conor Fitzpatrick will not only determine his future but may also set a precedent for how courts balance individual circumstances with the need to address grave cybercrimes. Nevertheless, the case shows the importance of enforcing strict legal penalties to protect online systems from misuse and exploitation.

Stay tuned as this story develops.

1.  **GTA 6 Hacker from Lapsus$ Gang Sentenced to Hospital**
2.  **Mastermind of 2020’s top celebrity Twitter hack Jailed to 3 years**
3.  **Dispute moderator for Alphabay market jailed to 11 years in prison**
4.  **US Man Sentenced to 21 Years for Dark Web Distribution of CSAM**
5.  **iSpoof Fraud Website’s Mastermind Sentenced to 13 Years in the UK**

BreachForums Admin Conor Fitzpatrick (Pompompurin) to Be Resentenced

Copyright © 2025. This website is owned and operated by Informa TechTarget, part of a global network that informs, influences and connects the world’s technology buyers and sellers. All copyright resides with them. Informa PLC’s registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. TechTarget, Inc.’s registered office is 275 Grove St. Newton, MA 02466.

[Virtual Event]: Cybersecurity's Most Promising New and Emerging Technologies

The advanced persistent threat (APT) group is likely India-based and targeting individuals with connections to the country's intelligence community.

Source: SROOLOVE via Shutterstock

Advanced persistent threat group "DONOT Team" is leveraging two nearly identical Android applications to conduct intelligence-gathering operations targeting individuals and groups in India who appear to be of national security interest to the country.

The "Tanzeem" and "Tanzeem Update" apps purport to be chat apps but do not work as advertised. Instead, once installed on a system they prompt the user to turn on the device's accessibility feature and grant access to several easily misused permissions. The apps then shut down and proceed to stealthily harvest information from the compromised device, according to researchers at Cyfirma, who recently spotted the new DONOT campaign.

**Intelligence Gathering and Beyond**

"The ongoing efforts by the notorious DONOT APT extend beyond gathering intelligence on internal threats; they have also targeted various organizations in South Asia," Cyfirma noted in a blog post on Jan. 17. The goal appears to be to collect intelligence of strategic importance to India, the security vendor said.

Cyfirma's analysis of Tanzeem and Tanzeem Update showed the apps using OneSignal, a popular customer engagement platform, to send push notifications to users who install either app on their devices. OneSignal basically allows developers and businesses to send in-app messages, emails, and SMS messages to users across mobile devices, Web browsers, desktop apps, and other platforms.

When a user installs Tanzeem or Tanzeem Update on their device, they receive a push notification via OneSignal that prompts them to start a fake chat. Users tricked into clicking on the "Start Chat" prompt receive a subsequent prompt asking them to enable Android accessibility services to use the app. The victim is then directed to the accessibility settings page from which the app accesses several dangerous permissions. These include permissions that allow the two malicious Android apps to read and fetch call logs from the compromised device; to read and fetch contact information; and to search for and fetch data from the file manager.

Researchers at Cyfirma also found the apps to access several other permissions such as those that allow the threat actor to delete and read both incoming and outgoing text messages. They also can access the Android device's internal storage to extract its exact location and monitor its movement on a real-time basis.

Significantly, Cyfirma found the malicious apps using push notifications to try and get victims to install additional malicious payloads on compromised devices to ensure persistence. "This tactic enhances the malware's ability to remain active on the targeted device, indicating the threat group's evolving intentions to continue participating in intelligence gathering for national interests," Cyfirma noted.

**A Persistent South Asian Threat**

DONOT Team, which some vendors track as APT-C-35, SectorE02, and Viceroy Tiger, is a threat group with a likely nexus to India that has been operational since at least 2016. Several vendors have associated the group with attacks and data theft campaigns targeting entities in South Asia. In November 2024, Cyble linked DONOT Team to a campaign targeting manufacturing companies in Pakistan associated with the country's defense and maritime industries.

Others, such as ESET have reported on DONOT Team using sophisticated Windows and Android malware in espionage campaigns targeting organizations in Sri Lanka, Bangladesh, Pakistan, and Nepal. In 2023, Cyfirma reported finding three malicious Android apps on Google's Play store that the threat actor used against targeted individuals in Kashmir and Pakistan.

DONOT Team is one of several APT groups believed to be operating out of India that is engaged in a range of malicious activities, including online extortion scams, hacktivism, and increasingly, cyber espionage and surveillance. Security experts believe that at least some of the activity is tied to geopolitical tensions in the region and to a broader growth in all kinds of cybercrime in South Asia in recent years.

**About the Author**

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year career at Computerworld, Jai also covered a variety of other technology topics, including big data, Hadoop, Internet of Things, e-voting, and data analytics. Prior to Computerworld, Jai covered technology issues for The Economic Times in Bangalore, India. Jai has a Master's degree in Statistics and lives in Naperville, Ill.

Tag

#web