Watch out for the Russian hackers from the infamous RomRom group, also known as Storm-0978, Tropical Scorpius, or UNC2596, and their use of a custom backdoor.

****SUMMARY****

*   **RomCom Exploits Double Zero-Day:** RomCom, a Russia-linked group used previously unknown vulnerabilities in Firefox and Windows in a sophisticated attack campaign.

*   **Attack Chain:** Visiting a malicious webpage triggered a Firefox flaw, and then a Windows bug allowed the installation of RomCom’s backdoor.

*   **Targeted Sectors:** RomCom targeted government, pharmaceutical, legal, and other sectors in Europe and North America for espionage and cybercrime.

*   **Quick Patches:** Mozilla and Microsoft rapidly released updates to fix the vulnerabilities, highlighting the importance of software updates.

*   **Sophisticated Threat:** The attack shows the advanced capabilities of state-sponsored cyber groups and the need for strong cybersecurity measures.

Cyber security researchers at ESET have exposed a malicious campaign by the Russia-linked **RomCom group**, which combined two previously unknown (zero-day) vulnerabilities to compromise targeted systems including Windows and Firefox.

The attack chain, first detected on October 8th, started with a vulnerability in Mozilla Firefox, Thunderbird, and Tor Browser (**CVE-2024-9680**, CVSS score 9.8). If a user with a vulnerable browser visited a customized webpage, malicious code could run within the browser’s restricted environment without any user interaction. This vulnerability, a “use-after-free” bug in the animation feature of Firefox, was quickly addressed by Mozilla within 24 hours of being notified by ESET.

However, the attack didn’t stop there. RomCom chained this browser vulnerability with another zero-day flaw in Windows (**CVE-2024-49039**, CVSS score 8.8) to bypass the browser’s security “sandbox.” This second vulnerability allowed the attackers to run code with the privileges of the logged-in user, taking control of the system. Microsoft released a fix for this issue on November 12th.

The exploit chain worked by first redirecting users to fake websites, which used domains designed to appear legitimate and included the names of other organizations, before sending them to a server hosting the exploit code.

These fake sites often used the prefix or suffix “redir” or “red” to a legitimate domain, and the redirection at the end of the attack took the victims to the legitimate website, hiding the attack. Once the exploit successfully ran, it installed **RomCom’s custom backdoor**, giving the attackers remote access and control over the infected machine.

Exploit flow (Via ESET)

ESET’s **investigation** shows that RomCom targeted various sectors, including government entities in Ukraine, the pharmaceutical industry in the US, and the legal sector in Germany, for both espionage and cybercrime purposes. The group, also known as **Storm-0978, Tropical Scorpius, or UNC2596**, is known for both opportunistic attacks and targeted espionage.

From October 10th to November 4th, ESET’s data showed that users visiting these malicious websites were primarily located in Europe and North America, with the number of victims ranging from one to as many as 250 in some countries.

This cyberattack campaign goes on to show the importance of quick vulnerability disclosure and patching. It also emphasises the need for users to remain alert and keep their software up to date to prevent exploitation of **zero-day vulnerabilities**.

1.  **Russian Cyber Offensive Shifts Focus to Ukraine’s Military**
2.  **Russian APT29 Use NSO Group-Style Exploits in Attacks, Google**
3.  **Russian Malware Targets Ukrainian Military Recruits via Telegram**
4.  **Russian Hackers Phish Critical Sectors with Microsoft, AWS Lures**
5.  **Russian Midnight Blizzard Breached UK Home Office via Microsoft**

Russian Hackers Exploit Firefox and Windows 0-Days to Deploy Backdoor

Researchers reveal major vulnerabilities in popular corporate VPN clients, allowing remote attacks. Discover the NachoVPN tool and expert…

Researchers reveal major vulnerabilities in popular corporate VPN clients, allowing remote attacks. Discover the NachoVPN tool and expert advisories to mitigate these critical security risks.

In a recent presentation at SANS HackFest Hollywood 2024, cybersecurity researchers at London, England-based firm AmberWolf have revealed critical security vulnerabilities in widely used corporate Virtual Private Network (VPN) clients allowing attackers to target macOS and Windows systems.

These vulnerabilities, found in both traditional SSL-VPN clients and modern Zero Trust solutions, could be exploited by attackers to gain remote code execution and elevated privileges on end-user devices.

The researchers found that VPN clients, while essential for secure remote access, often have deep system access. This makes them attractive and possibly a lucrative target for hackers.

The main problem lies in how these clients trust VPN servers. Attackers can create malicious VPN servers that exploit this trust, allowing them to run commands and gain administrator-level access to a user’s computer with little to no user interaction.

****NachoVPN****

To help the security community understand and mitigate these risks, the researchers have released NachoVPN, an open-source tool that simulates the attack scenarios discussed in their presentation. This tool acts as a malicious VPN server and shows how it can exploit weaknesses in different VPN clients. NachoVPN is designed to be easy to use and can be adapted to test for new vulnerabilities as they are discovered.

_“_NachoVPN serves as a proof-of-concept tool to simulate rogue VPN servers capable of exploiting these vulnerabilities, AmberWolf researchers wrote in their blog post. _“_It showcases how insecure behaviours in VPN clients can be leveraged to gain privileged code execution._“_

Alongside NachoVPN, the researchers have published detailed advisories documenting the specific vulnerabilities disclosed during their presentation. These advisories provide technical descriptions, attack vectors, and mitigation recommendations to help organizations protect themselves against these threats.

****Vulnerabilities****

The vulnerabilities affect popular corporate VPN clients, including Palo Alto GlobalProtect and SonicWall NetExtender for Windows. The advisories, identified as CVE-2024-5921 and CVE-2024-29014, highlight the risks of remote code execution and privilege escalation via malicious VPN servers.

****NachoVPN on GitHub****

For more information about NachoVPN and the disclosed vulnerabilities, interested parties can visit the project’s **GitHub** repository and review the detailed advisories. The researchers’ presentation from SANS HackFest Hollywood 2024 is also available on the SANS YouTube channel, providing further insights into their findings and recommendations.

1.  ASUS and NordVPN Partner to Integrate VPN into Routers
2.  Hackers Calling Employees to Steal VPN Logins from Firms
3.  Ivanti VPN Flaws Exploited by DSLog Backdoor, Crypto Miners
4.  Cisco Fixes High-Severity Code Execution, VPN Hijacking Flaws
5.  Hackers Use Stolen VPN Access against Ivanti Users Despite Patches

AmberWolf Launches NachoVPN Tool to Tackle VPN Security Risks

Cebu, Philippines, 27th November 2024, CyberNewsWire

**Cebu, Philippines, November 27th, 2024, CyberNewsWire**

Cebu-based entrepreneur Brian Christopher Aguilar has emerged as a notable figure in the cryptocurrency sector, leveraging blockchain technology to support environmental sustainability. As the founder of Ora Coin Foundation, Brian has turned his humble beginnings into a remarkable empire now valued at PHP 1.3 billion and growing—all within just a few months. His groundbreaking initiative, the One Billion Tree Planting Initiative, across South East Asia and Middle East, aims to leave an indelible mark on the planet and secure a brighter future for generations to come.

Brian’s journey began with his dream to combine technology and environmental stewardship. Ora Coin, the cryptocurrency he created with his partner Mr. Lataza, is more than just digital money. Each of its 21 million rare tokens represents an opportunity to combat deforestation and promote ecological balance. For every coin, a tree is planted under the foundation’s watchful eye, tracked with a 3D GPS monitoring system. But Brian’s vision doesn’t stop at planting; it includes a unique feature where tree sponsors can interact and meditate with their trees online, creating a deeper connection between humans and nature.

In partnership with Cebu Technological University, a leading state college in the Philippines, Brian’s mission has gained significant momentum. This collaboration has not only ensured scientific rigor in the project but also empowered local communities and students to participate in environmental conservation efforts. Together, they are pushing the boundaries of what is possible in eco-friendly blockchain innovation.

Before Ora Coin, Brian was no stranger to entrepreneurship. He made a name for himself in Hong Kong, running the successful Healthy Chicken Group, renowned for its star product, KALE. Starting as a musician, Brian’s story is one of grit, resilience, and a commitment to meaningful impact.

Now leading one of the most inspiring initiatives in both cryptocurrency and environmental activism, Brian is proving that businesses can thrive while giving back to the planet. As the One Billion Tree Planting Initiative marches forward, Ora Coin Foundation is not just planting trees—it’s planting hope for a better world.

> “We owe it to the next generation,” Brian says, “to leave a legacy of sustainability and innovation. Ora Coin is just the beginning.”

****About Ora Coin Foundation****

The Ora Coin Foundation is a blockchain-powered organization committed to environmental sustainability and innovation. Established by Brian Christopher Aguilar, the foundation focuses on using cryptocurrency to drive impactful ecological initiatives, such as the One Billion Tree Planting Initiative. With each Ora Coin token directly tied to the planting of a tree, the foundation leverages cutting-edge technology, including 3D GPS tracking, to ensure transparency and accountability. Through strategic partnerships, such as its collaboration with Cebu Technological University, Ora Coin Foundation empowers communities and fosters a deeper connection between people and nature

**Contact**

**Founder**  
**Brian Christopher Aguilar**  
**Ora Coin Foundation**  
**\[email protected\]**

Philippine Entrepreneur Combines Blockchain Innovation with Environmental Conservation through Ora Coin Foundation

Group-IB collaborated with INTERPOL and AFRIPO in a major crackdown on cybercrime in Africa for “Operation Serengeti.” This…

Group-IB collaborated with INTERPOL and AFRIPO in a major crackdown on cybercrime in Africa for “Operation Serengeti.” This article provides details of the operation, including the arrests, the tactics used to identify cybercriminals, and the impact on global cybersecurity.

Cybersecurity firm Group-IB has shared details of its contribution to a high-profile global effort to combat cybercrime. According to Group-IB’s press release, the company played a crucial role in INTERPOL and AFRIPOL’s “Operation Serengeti.”

It was a two-month operation conducted between September 2nd and October 31st, 2024, and led to the arrest of over 1,000 individuals suspected of involvement in various cybercriminal activities across Africa.

Suspects under custody (Screenshot: INTERPOL)

By analyzing complex cyberattacks Group-IB identified 10,000 DDoS attacks from African servers, over 3,000 phishing domains, and details of data stealers and actors who published **data leaks on Dark Web forums** to help agencies dismantle malicious infrastructure and bring cybercriminals to justice. INTERPOL’s Cyber Analytical Reports, informed by Group-IB’s insights, enabled law enforcement agencies to target the most significant cybercrime actors. 

“The information shared by participating countries about ongoing cases was incorporated into 65 Cyber Analytical Reports prepared by INTERPOL. These reports ensured that on-the-ground actions were intelligence-driven and targeted the most significant cybercrime actors,” Group-IB’s **press release** revealed.

Operation Serengeti resulted in the arrest of 1,006 suspects and the dismantling of 134,089 malicious infrastructure and networks. During this operation, authorities identified around 35,000 victims worldwide with financial losses of around US$193 million and provided them with support and assistance.

Operation Serengeti has had a stupendous impact, with arrests and disruptions across Africa, including Kenya, Senegal, Nigeria, Cameroon, and Angola. Kenyan law enforcement dismantled an online credit card fraud ring that stole over US$8.6 million, whereas Senegal arrested eight individuals, including five Chinese nationals, in a US$6 million **Ponzi scheme**.

In addition, Nigerian authorities apprehended a man running online investment scams and collecting over US$300,000 from victims. Cameroon dismantled a group involved in a multi-level marketing scam, and Angola disrupted a virtual casino operation, which had defrauded Brazilian and Nigerian gamblers, leading to 150 arrests.

Image via INTERPOL

“From multi-level marketing scams to credit card fraud on an industrial scale, the increasing volume and sophistication of cybercrime attacks are of serious concern,” Valdecy Urquiza, Secretary General of INTERPOL, said. “Operation Serengeti shows what we can achieve by working together, and these arrests alone will save countless potential future victims from real personal and financial pain.”

1.  INTERPOL Arrests 41, Takes Down 22,000 Malicious IPs
2.  Interpol Nets $300 Million, Arrests 3,500 in Cyber Crime Bust
3.  Op Narsil – INTERPOL Busts Decade-Old Child Abuse Network
4.  INTERPOL Dismantles Infamous ’16shop’ Phishing-as-a-Service
5.  Interpol Busts Human Traffickers Luring Victims with Fake Job Ads

INTERPOL Arrests 1,000 and Dismantles Cybercrime Networks Across Africa

Protecting sensitive data is critical for businesses facing constant cyber threats. Automating encryption, audits, and access control strengthens security and reduces human error.

Protecting sensitive data nowadays should be a top priority for businesses of all sizes. Data breaches and cyber threats are no longer occasional occurrences but constant risks that require ongoing attention. The global cost of cyberattacks is expected to hit $9.5 trillion in 2024, largely fueled by ransomware, phishing, and data breaches. To combat these threats, companies need robust, continuous security measures that adapt as threats evolve. 

Traditional security measures, while effective to an extent, often involve manual processes that can be inconsistent, leaving gaps in protection. Automation is changing the landscape as it allows businesses to protect data more effectively through real-time encryption and automated security audits.

Automating data security processes means sensitive information is consistently protected, and security status is constantly monitored without relying solely on human effort. Automation, combined with other technologies like machine learning, offers businesses the ability to stay one step ahead.

Let’s discuss more on this below:

****Using Robotic Process Automation** **

Robotic process automation (RPA) has become a valuable tool in automating repetitive tasks across various business functions, and data security is no exception. RPA can handle tasks such as data encryption, access control management, and audit preparation, which are critical in maintaining a secure data environment. Thanks to RPA, businesses can create automated workflows that perform these tasks quickly and consistently, eliminating human error and freeing up security teams to focus on more complex challenges.

One major advantage of RPA in security is its ability to run 24/7 without interruption. Tasks that are time-consuming or repetitive for human employees can be efficiently managed by RPA, creating a more consistent layer of protection. 

Additionally, it can help businesses stay compliant with data regulations by automatically recording security actions and updates. Instead of relying on team members to complete these steps manually, RPA executes them precisely and on schedule.

****Automating Data Encryption** **

Data encryption is one of the most important elements in a data security strategy, protecting sensitive information by converting it into an unreadable format. With encryption, data remains secure even if accessed by unauthorized users. 

However, manually encrypting data across all systems and applications is not only time-consuming but also prone to inconsistencies. Automating the encryption process enables businesses to apply real-time protection to data without the need for constant manual intervention.

Automated encryption solutions can detect sensitive data as it’s created or transferred and immediately encrypt it, adding a critical layer of security. This real-time approach is particularly valuable for businesses that handle large volumes of data daily. With automated encryption, businesses reduce the risk of accidental exposure, keeping data consistently protected, whether it’s at rest or in transit. Automation also allows companies to apply encryption uniformly across their systems so there are no weak points that hackers can exploit.

****Implementing Automated Security Audits** **

Security audits play an essential role in identifying vulnerabilities, maintaining compliance, and ensuring data integrity. However, conducting regular audits can be a challenge for companies, as it requires significant time and resources. 

Automated audit tools streamline this process, allowing for continuous auditing that keeps an eye on security status in real time. Instead of waiting for scheduled audit periods, automated audits can provide up-to-date reports on security gaps and compliance status.

Real-time auditing brings numerous benefits, especially for companies in highly regulated industries. Automated audits allow businesses to spot potential issues early, minimizing the risk of non-compliance and giving them a proactive approach to risk management. With continuous monitoring, teams can quickly act when issues arise, addressing vulnerabilities before they become major threats. Automated security audits give businesses the confidence that their security measures are consistently monitored and aligned with industry standards, all while reducing the workload on internal teams.

****Utilizing Machine Learning for Anomaly Detection** **

Machine learning (ML) adds another layer of sophistication to automated security audits by identifying patterns and unusual activities that might indicate a security threat. Unlike traditional methods, ML algorithms can learn from data over time, recognizing what constitutes typical behaviour and quickly spotting anomalies that could signal unauthorized access or suspicious actions. This type of real-time detection helps teams stay aware of issues that may otherwise go unnoticed in large datasets.

Incorporating ML into security audits enables businesses to gain a proactive approach to data protection. As soon as an anomaly is detected, ML-powered tools can alert the security team to investigate before any real damage is done. This level of insight is especially valuable in industries handling sensitive data, where even minor incidents could have serious consequences. Automated anomaly detection keeps teams informed, enabling swift action and strengthening the overall security framework.

****Improving Data Access Control** **

Statistics show that over 70% of organizations with access control experience fewer than five major incidents annually. Access control is a fundamental element of data security as it determines who can view or modify sensitive information within an organization. Automated access control systems make this process more secure by continuously monitoring and adjusting permissions based on predefined rules. For instance, when an employee changes roles or leaves the company, automated systems can immediately update or revoke access rights, reducing the risk of unauthorized access.

Automating access control brings consistency and reduces human error, which can often lead to accidental exposure of sensitive information. By leveraging automated systems, companies create a more adaptable and secure environment where access is restricted to those who genuinely need it. This method also simplifies compliance with regulatory standards that require strict access controls. In this way, businesses can manage data access dynamically and respond quickly to personnel or organizational changes.

****Automated Reporting** **

Automated reporting is a powerful tool for maintaining a clear view of an organization’s security health. With real-time data feeding directly into dashboards and reports, security teams gain immediate insights into the status of various security measures, compliance levels, and potential risks. Instead of spending hours manually compiling data for reports, automated systems handle this work, generating up-to-date summaries that decision-makers can access at any time.

Automated reports not only save time but also improve the quality of information used in decision-making. These reports are frequently customizable, allowing teams to focus on specific metrics or risks that are most relevant to their organization. This flexibility makes it easier to make informed decisions, as leaders have a continuous, accurate view of security issues and trends. 

Automating data encryption and security audits has transformed the way businesses approach data protection. With tools like robotic process automation, machine learning, and automated reporting, companies can create a dynamic, secure environment that operates around the clock. These methods bring real-time data security and compliance monitoring within reach, helping organizations respond to risks proactively rather than reactively. 

1.  Top 9 Compliance Automation Software in 2024
2.  Safe Data Sharing Practices: How to Avoid Data Leaks
3.  How To Prevent Growing Issue of Encryption Based Malware
4.  How FHE Technology Is Making End-to-End Encryption a Reality
5.  Cybersecurity, Big Data & Automation Tools: What You Need To Know

Automating Data Encryption and Security Audits for Continuous Protection

Cryptocurrencies are a relatively new asset class, and over the years, they have continued to be the subject…

Cryptocurrencies are a relatively new asset class, and over the years, they have continued to be the subject of scrutiny and criticism. Despite the success they’ve recorded over the years, many **still believe** that digital assets and tokens are entirely unreliable and that everyone who invests in them is willingly subjecting themselves to a scam of serious proportion.

While there’s no denying the fact that cryptocurrencies are associated with elevated volatility and fluctuations, the latest **Bitcoin price chart** figures indicate that the number of investors willing to add capital to a crypto venture and include digital assets among their list of holdings continues to rise. 

There are many reasons for this development, with the general economy continuing to be somewhat weak and uncertain being one of the primary ones. When standard marketplaces are not doing very well, people tend to gravitate towards asset classes that they may not even have considered in the past as a result of them being too risky or volatile.

But is this not an indicator of the fact that desperate people resort to desperate measures instead of a testament to the reliability and **usability of cryptocurrencies**? Are crypto coins still a valid form of investment, and is Bitcoin still a potential wealth creator? Or is it time for investors to set their sights elsewhere? 

Image via Unsplash

****The overview** **

**Bitcoin** has been going through a rollercoaster ride over the last couple of years. 2020 was a halving year, and most community members expected things to unfold positively. Luckily, their predictions turned out to be true when the marketplace skyrocketed to new levels only a few months later.

2021 was a significant time for Bitcoin users as the price **reached** $69,000, an incredible level that led many to consider BTC as a reliable investment option on par with traditional assets and holdings. However, this didn’t last long, and in fact, this period can be regarded as the calm before the storm in retrospect. 

That’s because, in 2022, Bitcoin **lost** a considerable part of its value, with losses of around 70% during the most intense part of the bear market. The environment plunged into a crypto winter, one that was named the most severe in the entire history of cryptocurrencies by some analysts.

While others pointed out that technical analysis indicates other events of this kind that took place in the past lasted longer, what set the one in 2022 apart was the fact that BTC had reached such a high level only one year earlier. To see all that melt away so quickly was tough for investors from all over the world, many of whom lost significant portions of their capital. 

Some of them decided to abandon crypto altogether out of fear that they’ll have to deal with even bigger losses in the future. Bitcoin reached a new bottom in 2022, settling at $16,000. For this reason, investors eagerly waited for the start of the new year, which was predicted to help the price bounce back.

January offered an opportunity for this, and BTC climbed to $20,000. By April, it touched the resistance area at $30,000, a level that hadn’t been reached since June 2022, right before prices had started dropping severely. 

While Bitcoin achieved a lot during 2023, investors continued to hope for better. 2024 kickstarted the beginning of a new era for BTC, as the approval of the exchange-traded funds caused a spike that took the price to a new all-time high, a little over $70K. The gains didn’t last long though, and were followed by considerable corrections.

As of November, the **Bitcoin price** has been showing stronger performance levels than ever before and managed to surpass all of its previous records. On November 18th, the BTC price **was** around $89,500, leading investors to believe that a six-figure value would become reality much sooner than expected. 

****Investor sentiment** **

Since the crypto market is entirely decentralized, how the prices change and evolve is the result of a large number of factors. Volume, the general economic situation, and market sentiment are among the most essential aspects, and investors are careful to check these metrics before making important decisions.

Some researchers have attributed Bitcoin’s current weak performance to whales and their activities, as this investor demographic finished a long phase of accumulation and has, therefore, reduced their positions. An address linked to one “**Mr. 100**” reached a peak of more than 73,000 BTC after accumulating over nearly a week. Paired with the exchange-traded funds’ outflows, analysts believe that this investor created turmoil within the community. 

Bitcoin portfolio of Mr. 100% (Screenshot via Reddit)

The derivatives and stablecoin flows have generally shown signals of decreased confidence levels among traders. Options data confirms an increase in temporary demands for downside protections as investors want to secure their portfolios. In the past, times of negative funding rates were typically short-lived, indicating that the bears don’t believe it is safe to start selling anywhere below the $60,000 mark. 

****Uptober** **

October has traditionally been recognised as a positive time for cryptocurrencies, a month during which digital assets perform well and investors see significant gains. This is particularly noteworthy in the context of the fact that September has the opposite reputation of being a time when the crypto market is doing quite poorly.

However, this year, some traders have said that it would be a mistake to overinflate the importance of the entire month. This is because, under closer scrutiny, it is revealed that only the later part of October is recording bullish tendencies, not the first weeks. Data shows that Uptober tends to start around the 19th at the earliest, so it is vital for investors to remain patient and avoid making any impulsive decisions.

The statistics show that this is actually true for 2024 and that the marketplace is currently navigating the slowest October in the last decade. The prices of both Bitcoin and Ethereum have declined since the beginning of the month, but the second half of October is more likely to make room for more robust growth. The last week of October may kickstart the beginning of the bullish cycle that continues until the end of the year, and then Bitcoin prices will be taken into the six-figure area that most investors expect. 

Bitcoin is the **most important cryptocurrency** in the world, with the highest market capitalisation level. Investors have started trusting its abilities and believing in its value in increasing numbers, so although the market has been dealing with some challenges, it remains robust. In order to be successful in your trading ventures, though, you must still be ready to create a comprehensive strategy that is personalised to suit your goals and takes the long-term picture into account. 

1.  **5 Types of Crypto You Didn’t Know Existed**
2.  **Is the Blockchain Secure? Yes, and Here’s Why**
3.  **12 Tips for Managing Cryptocurrency Market Volatility**
4.  **Step-by-Step Guide to Creating Your First Crypto Wallet**
5.  **Bitcoin’s digital signature feature facilitates Web3 adoption**

Is Bitcoin Still a Secure and Reliable Trading Option? 

Aqua Nautilus researchers have discovered a campaign powering a series of large-scale DDoS attacks launched by Matrix, which…

Aqua Nautilus researchers have discovered a campaign powering a series of large-scale DDoS attacks launched by Matrix, which could be a Russian threat actor. Learn about the vulnerabilities exploited, the techniques used, and the possible impact on businesses worldwide.

Cybersecurity researchers at Aqua Nautilus have discovered a new Distributed Denial of Services (**DDoS**) campaign launched by a threat actor known as Matrix, exploiting readily available tools and minimal technical expertise.

According to Aqua Nautilus’ investigation, shared with Hackread.com, Matrix, which the researchers have labeled as script kiddies, targets a large network of internet-connected devices, including IoT devices, cameras, routers, DVRs, and enterprise systems, marking a transformation in focus for DDoS attacks.

The attackers use different techniques, mapped to the MITRE ATT&CK framework, primarily relying on **brute-force attacks**, exploiting weak default credentials and misconfigurations to gain initial access.

Once compromised, devices are incorporated into a larger botnet. The attackers also utilize various public scripts and tools to scan for vulnerable systems, deploy malware, and execute attacks. 

According to Aqua Nautilus’ **blog post**, despite initial indications of Russian affiliation, the lack of Ukrainian targets suggests a primary focus on financial gain rather than political objectives. Matrix has created a Telegram bot, Kraken Autobuy, to sell DDoS attack services targeting Layer 4 (Transport Layer) and Layer 7 (Application Layer) attacks, further emphasizing the commercialization of this campaign.

(Via Aqua Nautilus)

The campaign exploits a mix of recent and older vulnerabilities, including the following:

*   **CVE-2014-8361**
*   **CVE-2017-17215**
*   **CVE-2018-10562**
*   **CVE-2022-30525**
*   **CVE-2024-27348**
*   **CVE-2018-10561**
*   **CVE-2018-9995**
*   **CVE-2018-9995**
*   **CVE-2017-18368**
*   **CVE-2017-17106**

These vulnerabilities, combined with the widespread use of weak credentials, create a significant attack surface for malicious actors. Most activity (around 95%) occurs during weekdays, suggesting a more structured approach

Matrix utilizes a GitHub account to store and manage malicious tools and scripts, mainly written in Python, Shell, and Golang.

“A significant focus has been placed on repositories such as _scanner_, _gggggsgdfhgrehgregswegwe_, _musersponsukahaxuidfdffdf_, and _DHJIF_. These repositories house various tools designed for scanning, exploiting, and deploying malware—primarily Mirai and other DDoS-related tools—on IoT devices and servers,” researchers noted.

The screenshot shows successful login into a camera panel using weak credentials (Via Aqua Nautilus)

On the other hand, Virus Total identified various tools being used for launching DDoS attacks, including DDoS Agent, SSH Scan Hacktool, **PyBot**, PYnet, DiscordGo Botnet, HTTP/HTTPS Flood Attack, and the Homo Network. These tools allow for controlling compromised devices, launching large-scale DDoS attacks against targets of choice, and utilizing Discord for communication and remote control. 

The potential impact of this campaign is significant, with millions of internet-connected devices potentially vulnerable to exploitation. “Nearly 35 million devices are vulnerable. If 1% are compromised, the botnet could reach 350,000 devices; at 5%, it could grow to 1.7 million, rivalling major past attacks,” researchers noted.

The primary impact is denial-of-service to servers, disrupting businesses and online operations. Compromised servers can lead to service provider deactivation, impacting businesses relying on them. A limited cryptocurrency mining operation targeting ZEPHYR was observed, yielding minimal financial gain.

To stay safe, organizations should prioritize strong security practices like regular patching, strong password policies, network segmentation, intrusion detection systems, web application firewalls, and regular security audits to reduce their exposure to **DDoS attacks** and other cyber threats.

1.  **Mirai-Inspired Gorilla Botnet Hits 0.3M Devices Globally**
2.  **Goldoon Botnet Hit D-Link Devices by Exploiting 9-Year-Old Flaw**
3.  **Russian Hackers Target Ubiquiti Routers for Data, Botnet Creation**
4.  **Golang Botnet “Zergeca” Discovered, Delivers Brutal DDoS Attacks**
5.  **Mirai-like Botnet Hits Zyxel NAS Devices in Europe for DDoS Attacks**
6.  **US Charges Duo Behind Anonymous Sudan for 35,000 DDoS Attacks**

‘Matrix’ Hackers Deploy Massive New IoT Botnet for DDoS Attacks

Ransomware attack cripples Starbucks operations, forcing the coffee giant to rely on manual processes for employee scheduling and…

Ransomware attack cripples Starbucks operations, forcing the coffee giant to rely on manual processes for employee scheduling and payroll. Learn how this cyberattack is impacting businesses worldwide and the steps being taken to mitigate the damage.

As the holiday season kicks off, a ransomware attack on Blue Yonder, the world’s leading supply chain management software provider, has disrupted operations for Starbucks and other retailers worldwide.

The attack, reportedly, affected the private cloud computing service Blue Yonder provided to some customers including Starbucks, but not the company’s public cloud environment.

It is worth noting that the Arizona-based Blue Yonder boasts an extensive client base comprising most Fortune 500 firms. It offers food services to 46 of the world’s top 100 manufacturers, 64 of the leading 100 consumer product goods makers, and overall 76 of the top 100 global retail giants. 

The cyberattack, which struck on November 21st, crippled one of its clients, Starbucks’ back-end systems, specifically those responsible for employee scheduling and payroll. As a result, store managers have been forced to rely on manual processes for tracking employee hours and payments.

The collateral damage of the attack extends beyond Starbucks, impacting major retailers and supermarket chains. According to the Wall Street Journal report, UK’s Morrisons and Sainsbury’s have experienced disruptions to their warehouse management systems and were forced to implement backup systems to mitigate the impact. 

Blue Yonder, which was acquired by Panasonic in September 2021, has been working tirelessly to address the issue. The company has engaged external cybersecurity firm CrowdStrike to assist in recovery efforts and has implemented defensive measures to prevent future attacks. However, a specific timeline for full-service restoration is not yet provided.

“We are working around the clock to respond to this incident and continue to make progress. There are no additional updates to share at this time with regard to our restoration timeline following our post yesterday,” the company’s statement read.

Starbucks’ new CEO, Brian Niccol is implementing measures to address this setback as soon as possible. The company’s spokesperson Jaci Anderson states that they remain committed to ensuring their employees are paid accurately for their hours worked.

The coffee chain is actively working to minimize disruptions and inconsistencies in the payroll process, despite the limitations imposed by the ransomware attack and has advised employees to work around the outage manually.

Nonetheless, the attack adds to a growing list of cybersecurity incidents affecting major food service companies, including McDonald’s and Panera, which experienced technical glitches earlier this year and Panera potentially facing a class action lawsuit resultantly. 

The timing of this attack is also crucial because as per the latest research, around 86% of ransomware attacks occur during holidays or weekends with cybercriminals minting a whopping $1.1 billion in ransom payments last year.

James McQuiggan, security awareness advocate at KnowBe4 weighed in on the situation stating, “Ransomware attacks show cybercriminals have been in the network for some time. Organizations must prepare with a tested Incident Response plan, backup processes, and recovery systems to minimize damage and downtime.”

1.  Homeland Security Spent $30K on Starbucks Coffee
2.  Nespresso Domain Hijacked, Targeting Microsoft Logins
3.  Starbucks mobile app got hacked, credit card data stolen
4.  White hat hacker infects smart coffee machine with ransowmare
5.  How A Coffee Machine Infected Factory Computers with Ransomware

Starbucks Shifts to Manual Processes After Contractor Ransomware Attack

Protect your social media presence with tools like privacy checkups, monitoring services, and digital footprint scanners. Stay secure by avoiding oversharing, limiting third-party app permissions, and using strong passwords.

Social media is where we connect, share, and sometimes overshare. It’s a space to celebrate birthdays, post selfies, or argue about whether pineapple belongs on pizza (it does, by the way). But while we’re busy scrolling and double-tapping, it’s easy to forget that social media can also be a minefield for privacy and security risks.

With **so many apps** and services available, it can be tough to know which ones are worth your time. Here’s a breakdown of some of the most effective tools to enhance your social media safety, including apps and services tailored to specific needs.

****Twitter Viewer Apps****

Twitter (now X) viewer apps are third-party tools that help you track your activity, analyze engagement, and monitor mentions. If you’re looking to keep an eye on Twitter activity—whether it’s for your account, parental monitoring, or just to make sure everything’s on the up and up—some tools can help.

Twitter viewer apps can track down social media profiles connected to a person. This is super helpful if you’re trying to figure out if a profile is fake or just want to do a little online sleuthing. Ademilade Shodipe-Dosunmu from Techopedia says the best **Twitter viewer apps** in 2024 should be compatible with both iOS and Android devices, prioritize security, and be user-friendly. 

****Privacy Checkup Tools****

Most major platforms have built-in privacy checkup tools that make it easy to review and update your privacy settings.

*   Facebook Privacy Checkup: This tool walks you through settings for posts, profile details, app permissions, and more.

*   Google Privacy Checkup: Perfect for reviewing privacy settings for YouTube, Google Photos, and connected apps.

*   Instagram Privacy Settings: Found under Settings > Privacy, this section lets you control who sees your content, tags you, or sends direct messages.

Regularly revisiting these tools ensures your account stays secure, especially when platforms roll out new features or privacy policies.

If you’re serious about tracking your online presence, social media monitoring tools are invaluable. These tools scan platforms for mentions of your name, brand, or specific keywords, helping you **spot fake accounts**, leaks, or negative content.

*   Mention and Brand24: Great for keeping tabs on mentions of your name or brand.

*   Hootsuite and Sprout Social: These tools combine monitoring with post-scheduling, making them ideal for managing your accounts professionally.

*   Google Alerts: Set up alerts for your name or other identifiers to stay informed about where you’re being mentioned online.

****Digital Footprint Scanners****

Your digital footprint includes everything about you that’s publicly accessible online. From old social media accounts to forgotten forum posts, these breadcrumbs can reveal more than you’d like. Digital footprint scanners help identify and clean up these traces.

*   Mine: This tool shows which companies and platforms have your data and helps you request its removal.

*   BrandYourself: Ideal for individuals looking to improve their online reputation, this tool scans for public mentions of your name and offers suggestions to optimize your footprint.

*   DeleteMe: Helps remove your personal information from data brokers and people-search websites.

****Lock Down Your Privacy Settings****

Privacy settings are your first line of defence against unwanted snoopers. Most social media platforms let you control who sees your posts, what information is visible on your profile, and who can tag you. But let’s be honest—how many of us have checked these settings?

On Instagram, switch to a private account if you want to approve followers before they can see your posts. You can also limit who can message you or tag you in photos. On Facebook, head to the “Privacy Checkup” tool. It walks you through everything, from post visibility to who can find you using your email or phone number.

On Twitter, make your account private if you don’t want strangers replying to your tweets. Only approved followers will see your posts. On TikTok, set your account to private in the settings, so only approved followers can watch your videos.

****Think Before You Post****

This one’s a classic but so important: **don’t overshare**. Posting about your exact location, showing off expensive purchases, or spilling too much personal info can make you a target for scammers, thieves, or stalkers.

Delay location tags. If you’re posting about your vacation, wait until you’re back home. No need to let everyone know your house is empty. Skip the personal details. Your birthdate, address, or phone number shouldn’t be public.

Scammers can use this info for **identity theft**. Be cautious with kids’ photos. If you’re sharing pictures of your kids, avoid posting school names, uniforms, or anything that reveals their location. If you wouldn’t want it shouted from a rooftop, think twice about sharing it online.

****Watch Out for Scams****

Social media is a playground for scammers. Fake giveaways, phishing links, or “urgent” messages from what looks like a trusted company—these are all common traps.

If something seems too good to be true, it probably is. “Win a free iPhone!” or “Click here for a $500 gift card” are almost always scams. Double-check links by hovering over them before clicking. If the URL looks suspicious or doesn’t match the supposed source, don’t click it. **Beware of fake accounts**. Scammers often create fake profiles that look like real people or companies. Verify their authenticity before engaging. When in doubt, ignore or report the suspicious activity. Better safe than sorry!

****Limit Third-Party Apps and Permissions****

Ever taken one of those fun “What’s your spirit animal?” quizzes or used an app to find your Instagram top nine? While they’re entertaining, they often ask for access to your account info—and not all of them are trustworthy. Take a few minutes to review which apps and services you’ve connected to your social media accounts.

On Facebook, for example, go to the “Apps and Websites” section in your settings and remove anything you don’t recognize or no longer use. Keep it clean and minimize potential vulnerabilities.

****Be Mindful of Your Friends List****

It’s tempting to accept every friend request or follow back everyone who follows you, but not everyone has good intentions. Do a little social media “spring cleaning” every now and then. Unfriend or unfollow accounts you don’t recognize. Avoid adding people you don’t know IRL. Watch out for accounts with no profile picture, minimal activity, or lots of generic comments—they’re likely bots or fake profiles.

****Monitor Your Accounts Regularly****

Even with all these precautions, it’s important to keep an eye on your accounts for any suspicious activity. Check your login history (most platforms show recent logins) and look out for things like messages you didn’t send, posts or comments you didn’t make, and changes to your profile info. If something seems off, change your password immediately and report the issue to the platform.

****Know How to Report and Block****

Don’t hesitate to use the report and block features on social media. If someone’s harassing you, sending spam, or acting shady, block them. You can also report problematic accounts or content. Whether it’s hate speech, **fake news**, or inappropriate behaviour, your report helps platforms identify and remove harmful users.

****Educate Yourself and Your Circle****

The more you know about social media safety, the better protected you’ll be—and the same goes for your friends and family. Share tips with your loved ones, especially if they’re not tech-savvy. Teaching someone how to set up 2FA or spot a phishing scam could save them from a lot of trouble.

1.  **Best SEO Experts to Follow on Twitter (X) in 2025**
2.  **4 Benefits of Having a Social Media Marketing Strategy**
3.  **Snapchat Safety for Parents: How to Safeguard Your Child**
4.  **Your Guide To Navigating Mastodon, an Alternative to Twitter**
5.  **Half of Online Child Grooming Cases Now** **Happen** **on Snapchat**
6.  **How businesses should deal with negative feedback on social media**

Tips and Tools for Social Media Safety

Google reveals GLASSBRIDGE: A network of thousands of fake news sites pushing pro-China narratives globally. These sites, run by PR firms, spread disinformation and lack transparency.

****Summary****

*   **Google has uncovered a network of over 1,000 fake news websites spreading pro-China narratives.**

*   **The sites are operated by four PR firms acting on behalf of an unknown client.**

*   **These firms create websites that mimic legitimate news outlets and publish a mix of repurposed and pro-China content.**

*   **Google has blocked the sites from appearing on its news platforms due to policy violations.**

*   **The operation highlights the use of PR firms to spread disinformation and obscure the source of the content.**

Google’s Threat Intelligence Group (TAG), in collaboration with its **cybersecurity firm Mandiant**, has discovered a large-scale network of fake news websites operated by four different public relations (PR) firms spreading propaganda aligned with the interests of the Chinese government.

Dubbed GLASSBRIDGE, this network of PR firms has been creating and distributing inauthentic content globally to shape public opinion on key geopolitical issues. Since 2022, Google has banned and deindexed over 1,000 websites linked to GLASSBRIDGE from appearing in Google News and Google Discover for violating policies against deceptive practices and lack of editorial transparency.

These sites pose as independent media outlets but push narratives that align with Beijing’s political agenda, including topics like Taiwan, the South China Sea, and COVID-19. It is worth noting that this news emerged just weeks after **reports revealed** North Korean hackers using fake news to distribute malware.

“These campaigns show how private PR firms are being used to conduct coordinated influence campaigns,” Google said in a **blog post**. “By using these firms, the actors behind the information operations gain deniability, obscuring their role in spreading inauthentic content.”

The campaigns rely on newswire services to syndicate their content, with two PR firms directly operating these services. The fake news network targets audiences in over 30 countries, including the United States, Australia, Germany, Japan, and Brazil, as well as Chinese-speaking diasporas worldwide.

The four firms within the GLASSBRIDGE network are:

****1. Shanghai Haixun Technology****

Shanghai Haixun Technology is the most prolific PR firm in the network, with more than 600 domains linked to its operations already removed by Google. These sites target both English- and Chinese-speaking audiences, as well as countries across Asia, Europe, and the Americas.

Haixun’s websites are often filled with low-quality, repetitive content that mixes irrelevant filler articles with pro-China stories. The firm has also been caught using freelance platforms such as Fiverr to hire social media accounts to amplify its messaging.

In July 2023, Haixun’s influence campaigns were spotted infiltrating legitimate news outlets through subdomains provided by its newswire services, Times Newswire and World Newswire, allowing it to piggyback on the credibility of established media brands.

****2. Times Newswire and Shenzhen Haimai Yunxiang Media****

Google researchers identified Times Newswire and its operator, Shenzhen Haimai Yunxiang Media, as key players in distributing pro-China propaganda. These entities were tied to the PAPERWALL campaign, a network of over 100 fake websites **reported** by Citizen Lab earlier this year.

These fraud sites, which spanned more than 30 countries, published a combination of copied local news, conspiracy theories, and smear campaigns targeting individuals critical of Beijing. Many of these articles were short, appearing briefly on the sites before being removed to avoid detection.

****3. DURINBRIDGE****

DURINBRIDGE, another PR and marketing firm in the network, operates over 200 fake news sites. While most of its content consists of press releases and generic news, a portion is dedicated to spreading pro-China narratives, including articles linked to **DRAGONBRIDGE**, a long-standing influence operation tracked by Google.

These sites have also been used to promote politically motivated smear campaigns, such as targeting Taiwanese presidential candidates in the lead-up to elections.

****4. Shenzhen Bowen Media****

Shenzhen Bowen Media controls a network of more than 100 imitation news sites designed to cater to specific countries and cities. Articles are published in local languages, including French, German, Japanese, and Thai, to appear more credible to regional audiences.

The content often blends legitimate-looking local news with pro-Beijing narratives sourced from its newswire service, World Newswire, which is also used by Haixun.

Campaign flow and 2 fake news sites in German and Portuguese language targeting Brazilian readers (Screenshot: Google)

**The Bigger Picture**

This operation is part of a growing trend where nation-states outsource influence campaigns to private PR firms, allowing deniability. By using fake news sites instead of traditional social media disinformation, these campaigns can target audiences more effectively, tailoring content to local languages and issues.

The operation also refreshes the memory of The EU DisinfoLab, a Brussels-based NGO specializing in disinformation research, which **exposed** a massive pro-Indian influence operation known as “Indian Chronicles.” This extensive campaign, active for over 15 years, aimed to discredit Pakistan and influence international institutions, including the United Nations and the European Parliament.

Google’s action to block these websites from its news platforms shows disinformation campaigns are a reality. The exposure of the GLASSBRIDGE network. For readers, the lesson is to critically evaluate the sources of news and verify information across multiple outlets.

1.  **Malicious Abrax666 AI Chatbot Exposed as Potential Scam**
2.  **Hackers used fake job websites to scam jobless US veterans**
3.  **SEC Twitter Hacked, Spreads Fake News About Bitcoin ETFs**
4.  **Android XHelper App Exposed as Money Laundering Network**
5.  **Fake News Site Hit Android and Windows Users with Malware**

Source

HackRead