Specialists at Positive Technologies have revealed details of a previously undocumented toolset used by the hacker group Goffee (also known as Paper Werewolf). According to the researchers, these tools were deployed in the later stages of attacks, enabling the group to maintain long-term persistence inside victim networks while avoiding detection.
The issue of car theft using the Flipper Zero has resurfaced in global headlines. This time, hackers claim to be selling a “secret firmware” for the device that allegedly works against cars from Ford, Audi, Volkswagen, Subaru, Hyundai, Kia, and several other manufacturers. The developers behind Flipper Zero say these
The U.S. Department of Justice has charged the alleged developer and administrator of the RapperBot botnet, a Mirai-based network rented out to cybercriminals for large-scale DDoS attacks. The botnet itself was seized by law enforcement in early August during Operation PowerOff. Origins and Evolution RapperBot—also known as Eleven
The developers of the Python Package Index (PyPI) have announced new measures to combat domain reclaiming attacks—an overlooked threat that allows malicious actors to hijack user accounts through password resets. As the official repository for Python packages, PyPI is a critical resource for software developers, project maintainers, and companies
What began as a stunt to score free nuggets ended in a full-scale security investigation that exposed dozens of vulnerabilities in McDonald’s digital infrastructure. On August 17, 2025, a user going by the nickname BobDaHacker published a detailed step-by-step report describing how a trivial error in the fast-food giant’
Users have reported that recent Windows 11 24H2 updates can cause data corruption and crashes on certain SSD and HDD models. Microsoft has not yet reproduced the problem internally and is asking affected users to submit detailed reports of malfunctions. Early Warning The first public warning came from a Japanese
Researchers at Koi Security have discovered that the popular Chrome extension FreeVPN.One has recently changed its behavior, secretly taking screenshots of users’ browsing activity and transmitting them to a remote server. “The FreeVPN.One case illustrates how a product meant to protect privacy can turn into a trap,” the
A newly emerged company, Advanced Security Solutions (UAE), is offering rewards of up to $20 million USD for zero-day vulnerabilities that enable hacking any smartphone via a single text message. This figure places it among the highest-paying vulnerability brokers—at least among those that disclose pricing publicly. Record-Breaking Bounties In
Researchers from the Great Firewall Report team observed an unusual incident on the night of August 20: for 74 minutes, China was effectively cut off from most of the global internet after all traffic on TCP port 443 was blocked. According to their analysis, the disruption began at 00:34
Apple has released out-of-band security updates to fix a zero-day vulnerability that has already been exploited in what the company described as a “highly sophisticated attack.” The flaw, tracked as CVE-2025-43300, is an out-of-bounds write error discovered by Apple’s own security team. It was found in the Image I/
Guardio researchers tested a browser equipped with an AI agent and found it vulnerable to both classic and modern attack methods. These weaknesses allow attackers to manipulate the agent into interacting with malicious pages and prompts. AI-powered browsers can autonomously surf the web, make purchases, and handle tasks such as
A new Remote Access Trojan (RAT) is being distributed through malicious .scr files disguised as financial documents. Until March 2025, attackers spread these files via Skype, but after the platform’s shutdown, they shifted to alternative delivery channels. Discovery and Targets Researchers at Kaspersky have identified the malware, dubbed GodRAT,
Researchers at Citizen Lab have revealed that more than 20 VPN applications available on Google Play contain serious security flaws that compromise user privacy and could allow attackers to decrypt transmitted data. Collectively, these apps have been downloaded nearly 1 billion times (972 million installations). Interconnected Providers Although these VPN
Researchers at Red Canary have identified a new Linux malware strain dubbed DripDropper, which is being used in an unusual campaign. In these attacks, hackers exploit a critical vulnerability in Apache ActiveMQ—then patch the very flaw they leveraged. Exploiting and Closing the Door The attackers are exploiting an old
The Raspberry Pi Foundation has introduced a new touch component designed for single-board computer enthusiasts building compact touchscreen devices. The 5-inch Raspberry Pi Touch Display 2 features a 720×1280 resolution, an IPS multi-touch panel, and native support for Raspberry Pi OS. The display is priced at $40 USD and
Microsoft has acknowledged that the August security updates for Windows are disrupting the reset and recovery functions on Windows 10 and older versions of Windows 11. “After installing the August security update for Windows on any of the client versions mentioned below in the ‘Affected Platforms’ section, attempts to reset
Yegor Filatov, a specialist at Positive Technologies, has discovered and helped remediate a serious vulnerability in Tunnelblick, a graphical interface for working with OpenVPN. The flaw allowed privilege escalation on macOS systems and the potential for data theft. What made the issue especially dangerous was that it could still be
The U.S. Department of Justice (DOJ) has seized more than $2.8 million in cryptocurrency from Yannis Aleksandrovich Antropenko, the alleged operator of the Zeppelin ransomware. Antropenko faces charges in Texas for computer fraud and money laundering. He is accused of operating Zeppelin, a now-defunct ransomware strain active between
Between May and July 2025, specialists at Positive Technologies uncovered more than 180 compromised systems within Russian organizations. The malicious activity was traced back to the hacker group PhantomCore, which appears to have focused exclusively on targeting Russia’s critical infrastructure. Who Was Targeted The victims spanned a wide range
In 2023, researchers dropped a bombshell on the world of secure communications. They revealed TETRA:BURST, a set of vulnerabilities in the Terrestrial Trunked Radio (TETRA) standard — the digital radio system used by law enforcement, the military, and operators of critical infrastructure in more than 100 countries. The flaws meant
Experts from Kaspersky and BI.ZONE are warning about renewed activity linked to the PipeMagic backdoor. Kaspersky highlights the malware’s evolution and the shifting tactics of its operators, while BI.ZONE has published a technical analysis of the latest flaw exploited in attacks—CVE-2025-29824. A Persistent Threat Since 2022
Cybercriminals are exploiting the Unicode character «ん» from the Japanese hiragana script to disguise phishing links as legitimate. In certain systems and fonts, this character can resemble a forward slash, tricking users into believing a malicious URL is authentic. Homoglyph Tricks in Action This technique is part of a broader
Mozilla representatives report that a recent ruling by Germany's Federal Court of Justice (BGH) has reignited an old legal dispute over whether browser-based ad blockers violate copyright law. The organization warns this development could eventually lead to a ban on such tools in the country. The Legal Battle
In the second quarter of 2025, specialists at Positive Technologies observed a sharp increase in cybercriminal and hacktivist activity targeting Russian organizations. Phishing emails emerged as the most common initial attack vector, used in both mass campaigns and more sophisticated zero-day operations. Phishing Tactics on the Rise Attackers employed several