WinRAR

admin Noticias, Trending alineados con CYBERDEFENSA.MX desplegar explotada falla grupos ladrones para por Rusia Ucrania WinRAR

Falla de WinRAR explotada por grupos alineados con Rusia para desplegar ladrones en Ucrania – CYBERDEFENSA.MX

Dos campañas de ciberataques alineadas con Rusia han seguido explotando una falla de seguridad en WinRAR para atacar a organizaciones ucranianas, casi un año después de que se publicaran parches para la vulnerabilidad.

Trend Micro ha atribuido la actividad a Earth Dahu (también conocido como Gamaredon) y SHADOW-EARTH-066 (también conocido como UAC-0226). Implica la explotación de CVE-2025-8088, una falla de recorrido de ruta que permite a un atacante escribir archivos fuera del directorio de extracción a través de NTFS Alternate Data Streams (ADS). WinRAR lo parchó en julio de 2025.

Los hallazgos muestran «cómo el software no administrado mantiene abierto un punto de entrada explotado mucho después de que se envía la solución», dijeron los investigadores de Trend Micro Hiroyuki Kakara y Feike Hacquebord. dicho en un análisis publicado el lunes.

La cadena de exploits WinRAR explotada por SHADOW-EARTH-066 es una desviación de los droppers de macros de Excel utilizados anteriormente por el actor de amenazas para entregar un ladrón de información llamado GIFTEDCROOK. La última versión utiliza archivos RAR diseñados que incluyen un documento PDF señuelo y tres cargas útiles ADS ocultas que se encuentran fuera del directorio de extracción para iniciar la infección.

Esto incluye un archivo de acceso directo de Windows (LNK) que se coloca en la carpeta Inicio para que se ejecute automáticamente cada vez que un usuario inicia sesión. Esto, a su vez, genera un cargador de PowerShell a través de «cmd.exe», que luego usa la carga de DLL en memoria para finalmente iniciar una versión actualizada de GIFTEDCROOK («result.dll»).

El malware se dirige a contraseñas y cookies de navegadores basados en Chromium (Google Chrome, Microsoft Edge y Opera) y Mozilla Firefox, además de recopilar documentos que coinciden con ciertas extensiones de la máquina de la víctima. Una vez que los datos se filtran a un servidor externo, todos los artefactos maliciosos se eliminan para ocultar el rastro forense.

Un cambio notable es el cambio de Telegram como canal de exfiltración a servidores dedicados de comando y control (C2), una modificación clave que probablemente se alinea con el bloqueo de Rusia de la plataforma de mensajería en el país a principios de febrero.

El segundo grupo de hackers afiliado a Rusia que utiliza CVE-2025-8088 como arma es Earth Dahu, que ha incorporado la falla a su arsenal desde al menos septiembre de 2025. El adversario es conocido por su «esfuerzo a escala industrial» para mantener el acceso a largo plazo a las organizaciones comprometidas.

«Earth Dahu utilizó la vulnerabilidad con una cadena de infección de HTA a VBScript que entregaba módulos de espionaje», señaló Trend Micro. «Según las marcas de tiempo internas de los archivos RAR y las convenciones de nomenclatura de archivos, la cadena permaneció activa al menos hasta el 10 de abril de 2026».

Estos ataques, como también documentó recientemente Sekoia la semana pasada, conducen a la implementación de GammaPhish, una aplicación HTML (HTA), que luego se utiliza para recuperar un descargador de VBScript llamado GammaLoad. Posteriormente, el descargador intermedio ofrece módulos adicionales como GammaSteel.

GammaLoad es «una colección de VBScripts diseñada para garantizar el acceso continuo e implementar cargas útiles a lo largo del tiempo aprovechando Dead Drop Resolvers (DDR)», Sekoia dichoagregando que se usa para implementar un cuentagotas diseñado para iniciar un cargador de VBScript responsable de ejecutar GammaAceroun completo ladrón de información que puede monitorear los cambios en los archivos en tiempo real.

«WinRAR está profundamente arraigado en las operaciones diarias de las organizaciones ucranianas, lo que lo convierte en un objetivo atractivo para la explotación», afirmó Trend Micro. «La convergencia de grupos establecidos respaldados por el Estado y grupos rastreados de forma independiente en una única vulnerabilidad refleja la escala de las amenazas cibernéticas que enfrenta Ucrania».

admin Noticias, Trending aprovecha contra CYBERDEFENSA.MX entregar Gamaredon GammaSteel GammaWorm para Ucrania WinRAR

Gamaredon aprovecha WinRAR para entregar GammaWorm y GammaSteel contra Ucrania – CYBERDEFENSA.MX

El grupo de hackers ruso conocido como Gamaredón se ha atribuido a la explotación continua de una vulnerabilidad de WinRAR para entregar múltiples familias de malware destinadas al robo y la propagación de datos.

Según Sekoia, la actividad implica la utilización como arma de CVE-2025-8088, una falla de recorrido de ruta en WinRAR, para lanzar una carga útil de aplicación HTML denominada GammaPhish, que luego se utiliza para recuperar un descargador intermedio de Visual Basic Script (VBScript) con nombre en código GammaLoad. La cadena de infección fue observada por la empresa francesa de ciberseguridad en enero de 2026.

«Sus objetivos principales son tomar huellas dactilares del sistema host, actualizar la configuración de red en el registro utilizando resolutores de caída muerta (DDR), recuperar y ejecutar cargas útiles VBScript arbitrarias desde los servidores C2», Sekoia dicho.

Una de las cargas útiles es un gusano VBScript conocido como GammaWorm que establece persistencia a través de tareas programadas y está diseñado para ocultar directorios legítimos en recursos compartidos de red y unidades USB y reemplazarlos con archivos maliciosos de acceso directo de Windows (LNK), lo que resulta en la ejecución de código arbitrario recuperado de un servidor de comando y control (C2).

Para resolver su C2, GammaWorm inicia una solicitud GET a través de curl a un canal público de Telegram codificado. Al utilizar plataformas legítimas como Telegram, la idea es integrarse en el tráfico habitual, evitar la detección y mantener operaciones de espionaje a largo plazo. GammaWorm también se basa en flujos de datos alternativos NTFS (ANUNCIOS) técnica para ocultar sus módulos principales.

Otra familia de malware distribuida a través de GammaLoad es un ladrón de información modular con nombre en código GammaSteel que captura archivos que coinciden con ciertas extensiones y los exfiltra a un depósito S3 de Amazon Web Services (AWS) o a un servidor controlado por un atacante como mecanismo alternativo.

Sekoia dijo que las secuencias de infección podrían usarse para distribuir otras familias de malware, como GammaWipe (también conocido como GamaWiper), dependiendo de los objetivos del actor de la amenaza.

«El vector de despliegue exacto de GammaWorm sigue siendo ambiguo; GammaLoad podría eliminarlo simultáneamente o introducirlo de forma independiente a través de un usuario que ejecute una unidad USB armada», señaló. «Además, al evaluar el flujo de ejecución global, evaluamos con alta confianza que GammaPhish está diseñado para implementar GammaLoad primero».

Gamaredon, un conjunto de intrusiones patrocinado por el estado ruso y vinculado oficialmente al Servicio Federal de Seguridad (FSB), tiene un historial de atacar a Ucrania, particularmente entidades gubernamentales, militares y de infraestructura crítica, utilizando correos electrónicos de phishing que contienen archivos adjuntos maliciosos, en estos archivos RAR con trampas explosivas.

«Esta cadena de infección revela un diseño modular resistente, masivo y altamente confuso», dijo Sekoia. «Debido a su adaptabilidad y la capacidad del operador para actualizar las configuraciones sobre la marcha, es muy probable que esta arquitectura se reutilice en el futuro».

El desarrollo coincide con el objetivo del UAC-0184 de objetivos relacionados con el ejército ucraniano para entregar un ejecutable asociado con un programa legítimo llamado PassMark BurnInTest a través de señuelos LNK. Un segundo grupo de actividades de amenazas que se ha dirigido a Ucrania es el UAC-0247 (anteriormente rastreado como UAC-0244), que ha señalado a los operadores de drones para desplegar Droppers de aplicaciones HTML (HTA) a través de archivos ZIP y una puerta trasera capaz de establecer un shell inverso para la infraestructura controlada por el atacante.

Los cazadores de amenazas también trazó la evolución de PixyNetLoader, un cargador de malware atribuido a APT28 en relación con campañas que explotan una vulnerabilidad de Microsoft Office (CVE-2026-21509), para extraer un implante COVENANT Grunt. Según ExaTrack, la familia de malware se ha detectado en estado salvaje desde diciembre de 2024, y las iteraciones recientes se descubrieron el 15 de abril de 2026.

admin Noticias Chrome Claude Crash CYBERDEFENSA.MX Flaws Kali Linux LockBit Stories Traps WinRAR

Kali Linux + Claude, Chrome Crash Traps, WinRAR Flaws, LockBit & 15+ Stories – CYBERDEFENSA.MX

Nothing here looks dramatic at first glance. That’s the point. Many of this week’s threats begin with something ordinary, like an ad, a meeting invite, or a software update.

Behind the scenes, the tactics are sharper. Access happens faster. Control is established sooner. Cleanup becomes harder.

Here is a quick look at the signals worth paying attention to.

Belarus-linked Android spyware

ResidentBat is an Android spyware implant used by Belarusian authorities for surveillance operations against journalists and civil society. Once installed, it provides operators with access to call logs, microphone recordings, SMS, encrypted messenger traffic, screen captures, and locally stored files. The malware, although first documented in December 2025, is assessed to date back to 2021. According to Censys, ResidentBat-associated infrastructure is concentrated in Europe and Russia: the Netherlands (5 hosts), Germany (2 hosts), Switzerland (2 hosts), and Russia (1 host) in a recent Platform view, using a narrow port range (7000-7257) for control traffic.
Crypto phishing wave

Phishing campaigns are impersonating cryptocurrency brokerage services like Bitpanda to harvest sensitive data under the pretext of reconfirming their information or risk having their accounts blocked. «Attempting to get multiple forms of information and identification, the attackers used tactics that would seem legitimate to the everyday user,» Cofense said. «User information such as name verification, email, and password credentials, and location were all used in this attempt to harvest information under the guise of a multi-factor authentication process.»
Breakout times shrink

In its 2026 Global Threat Report, CrowdStrike said adversaries became faster than ever before in 2025. «The average e-crime breakout time — the period between initial access and lateral movement onto another system — dropped to 29 minutes, a 65% increase in speed from 2024,» the company said. One such intrusion undertaken by Luna Moth (aka Chatty Spider) targeting a law firm moved from initial access to data exfiltration in four minutes. Chief among the factors fueling this dramatic acceleration was the widespread abuse of legitimate credentials, which allowed attackers to blend into normal network traffic and bypass many traditional security controls. This was coupled with threat actors of varied motivations utilizing AI technology to accelerate and optimize their existing techniques. Some of the threat actors that have leveraged AI in their operations include Fancy Bear, Punk Spider (aka Akira), Blind Spider (aka Blind Eagle), Odyssey Spider (aka TA558), and an India-nexus hacking group called Frantic Tiger that has used Netlify and Cloudflare pages for credential-harvesting operations. The cybersecurity company said it observed an 89% increase in the number of attacks by AI-enabled adversaries compared to 2024 and a 42% year-over-year increase in zero-days exploited prior to public disclosure. In tandem, 67% of vulnerabilities exploited by China-nexus adversaries provided immediate system access, and 40% targeted edge devices that typically lack comprehensive monitoring. The vast majority of attacks, 82%, were free of malware — highlighting attackers’ enduring shift toward hands-on-keyboard operations and the abuse of legitimate tools and credentials.
4-minute lateral movement

In a similar report, ReliaQuest said the fastest intrusions reached lateral movement in just 4 minutes, an 85% acceleration from last year, with data exfiltration taking place in 6 minutes. The statistic is fueled by attackers increasingly weaving AI and automation into their tradecraft. «As attackers increasingly secure valid credentials with elevated privileges, the time to react has drastically dropped,» ReliaQuest said. «In 2025, the average breakout time (initial access to lateral movement) dropped to 34 minutes. In 47% of incidents, they secured high privileges before ever touching the network. This allows them to skip escalation, blend into traffic, and repurpose legitimate tools.»
ClickFix fuels Mac stealers

Mac users searching for popular software like Homebrew, 7-Zip, Notepad++, LibreOffice, and Final Cut Pro are the target of an active malvertising campaign powered by at least 35 hijacked Google advertiser accounts originating from countries including the U.S., Canada, Italy, Poland, Brazil, India, Saudi Arabia, Japan, China, Romania, Malta, Slovenia, Germany, the U.K., and the U.A.E. More than 200 malicious advertisements impersonating legitimate macOS software have been found. The end goal of these efforts is to direct users to fake pages that contain ClickFix-like instructions to deliver MacSync stealer. Another ClickFix campaign has been observed using fake CAPTCHA verification lures on bogus phishing pages to distribute stealer malware that can harvest data from web browsers, gaming apps like Steam, cryptocurrency wallets, and VPN apps. According to ReliaQuest data, a quarter of attacks used social engineering for initial access last year, with ClickFix responsible for delivering 59% of the top malware families.
Encryption debate resurfaces

Meta went ahead with a plan to encrypt the messaging services connected to its Facebook and Instagram apps despite internal warnings that it would hinder the social media giant’s ability to flag child-exploitation cases to law enforcement, Reuters reported. The internal chat exchange dated March 2019 was filed in connection with a lawsuit brought by the U.S. state of New Mexico, accusing it of exposing children and teens to sexual exploitation on its platforms and profiting from it. In response to the concerns raised, Meta said it worked on additional safety features before it launched encrypted messaging on Facebook and Instagram in 2023.
ActiveMQ flaw aids LockBit

Threat actors are exploiting a now-patched security flaw in internet-facing Apache ActiveMQ servers (CVE-2023-46604) to deploy LockBit ransomware. «Despite being evicted after the initial intrusion, they successfully breached the same server on a second occasion 18 days later,» The DFIR Report said. «After compromising the server, the threat actor used Metasploit, possibly along with Meterpreter, to perform post-exploitation activities. These activities included escalating privileges, accessing LSASS process memory, and moving laterally across the network. After regaining access following their eviction, the threat actor swiftly transitioned to deploying ransomware. They leveraged credentials extracted during their previous breach to deploy LockBit ransomware via RDP.» The ransomware is suspected to be crafted using the leaked LockBit builder.
Chrome crash-to-command trick

Two newly flagged Google Chrome extensions, Pixel Shield – Block Ads (ID: nlogodaofdghipmbdclajkkpheneldjd) and PageGuard – Phishing Protection (ID: mlaonedihngoginmmlaacpihnojcoocl), have been found to adopt the same playbook as CrashFix, where the browser is deliberately crashed, and the user is tricked into running a malicious command à la ClickFix. The most concerning aspect of this campaign is that the extensions actually work and offer the advertised functionality. «The original NexShield DoS created a billion chrome.runtime.connect() calls,» Annex Security’s John Tuckner said. «These variants use a different technique I’m calling the Promise Bomb because it crashes the browser by flooding Chrome’s message passing system with millions of unresolvable promises.» While the original NexShield used timer-based activation, the new variants have evolved to push notification-based command-and-control (C2), causing the denial-of-service to be triggered only when the C2 server sends a push notification containing a «newVersion» value ending in «2.» This, in turn, gives the attacker selective remote control over when the crashes happen.
WinRAR patch lag persists

Cybersecurity firm Stairwell said more than 80% of the IT networks it monitors run versions of WinRAR vulnerable to CVE-2025-8088, a vulnerability that has been widely exploited by cybercrime and cyber espionage groups. «This finding underscores a persistent challenge in enterprise security when widely deployed, trusted software that quietly falls out of date and becomes a high-value target for attackers,» Alex Hegyi said.
Crypto IV reuse risk

A new analysis from Trail of Bits has revealed that more than 723,000 open-source projects use cryptographic libraries with insecure defaults. The aes-js and pyaes libraries have been found to provide a default initialization vector (IV) in their AES-CTR API, leading to a large number of key/IV reuse bugs. «Reusing a key/IV pair leads to serious security issues: if you encrypt two messages in CTR mode or GCM with the same key and IV, then anybody with access to the ciphertexts can recover the XOR of the plaintexts, and that’s a very bad thing,» Trail of Bits said. While neither library has been updated in years, strongSwan has released an update to address the problem in strongMan (CVE-2026-25998).
AI audits smart contracts

OpenAI and Paradigm have jointly announced EVMbench, a benchmark that measures how well AI agents can detect, exploit, and patch high-severity smart contract vulnerabilities. «EVMbench draws on 120 curated vulnerabilities from 40 audits, with most sourced from open code audit competitions,» OpenAI said. «EVMbench is intended both as a measurement tool and as a call to action. As agents improve, it becomes increasingly important for developers and security researchers to incorporate AI-assisted auditing into their workflows.»
Fake FSB extortion plot

A Russian national has been accused of trying to extort money from the notorious Conti ransomware group by posing as an officer of Russia’s Federal Security Service (FSB), according to local media reports. RBC reported that the suspect, Ruslan Satuchin, posed as an FSB officer and demanded a large payment from Conti. Although an investigation was formally launched in September 2025, the incident allegedly began in September 2022 when Satuchin contacted one of the members of the hacker group and extorted them to avoid criminal liability. Once a prolific ransomware gang, Conti shut down its operations in mid-2022 after splintering into small groups.
Ad cloaking service exposed

Varonis has disclosed details of a newly identified cybercrime service known as 1Campaign that enables threat actors to run malicious Google Ads for extended periods of time while evading scrutiny. The cloaking platform «passes Google’s screening, filters out security researchers, and keeps phishing and crypto drainer pages online for as long as possible, funneling real users to attacker-controlled sites,» Varonis security researcher Daniel Kelley said. «It combines real-time visitor filtering, fraud scoring, geographic targeting, and a bot guard script generator into a single dashboard.» It’s developed and maintained by a threat actor named DuppyMeister for over three years, along with offering Telegram channels for support. Traffic linked to 1Campaign has been distributed across the U.S., Canada, the Netherlands, China, Germany, France, Japan, Hungary, and Albania.
Teams call drops macOS malware

A social engineering campaign has been observed using Microsoft Teams meetings to trick attendants into installing macOS malware. Daylight Security has assessed that the activity is consistent with an ongoing attack campaign orchestrated by North Korean threat actors under the name GhostCall. «During the call, the attacker claimed audio issues and coached the victim into running terminal commands that downloaded and executed malicious binaries,» Daylight researchers Kyle Henson and Oren Biderman said. «Analysts observed staged downloads and execution from macOS cache and temporary paths, Keychain credential access, and outbound connections to newly created attacker-controlled domains.»
RAMP fallout reshapes underground

Last month, law enforcement authorities from the U.S. seized the notorious RAMP cybercrime forum. The event has had a cascading impact, destabilising trust and accelerating fragmentation across the underground cybercrime ecosystem. There are also speculations that RAMP may have functioned as a honeypot or had been compromised long before its seizure. «Rather than consolidating around a single successor, ransomware actors are redistributing across both gated platforms like T1erOne and accessible forums such as Rehub,» Rapid7 said. «This shift reflects adaptation, not decline. Disruption fractures trust and redistributes coordination across multiple platforms.»
Anonymous Fénix members detained

Spanish authorities have announced the arrest of four members of the Anonymous Fénix group for their involvement in distributed denial-of-service (DDoS) attacks. The suspects, whose names were not disclosed, targeted the websites of government ministries, political parties, and public institutions. Two of the group leaders were arrested in May 2025. The first attacks occurred in April 2023. The group is said to have intensified its activities beginning in September 2024, recruiting volunteers to mount DDoS attacks against targets of interest.
Judicial spear-phish drops RAT

A spear-phishing campaign has been observed targeting Argentina’s judicial sector that delivers a ZIP archive containing a Windows shortcut that, when launched, displays a decoy PDF to the victims, while stealthily dropping a Rust-based remote access trojan (RAT). «The campaign leverages highly authentic judicial decoy documents to exploit trust in court communications, enabling successful delivery of a covert remote access trojan and facilitating long-term access to sensitive legal and institutional data,» Seqrite Labs said.
Typosquat spreads ValleyRAT

A persuasive lookalike website of Huorong Security antivirus («huoronga[.]com») has been used to deliver a RAT malware known as ValleyRAT. The campaign is the work of a Chinese cybercrime group called Silver Fox, which has a history of distributing trojanized versions of popular Chinese software and other popular programs through typosquatted domains to distribute trojanized installers responsible for deploying ValleyRAT. «Once it’s installed, attackers can monitor the victim, steal sensitive information, and remotely control the system,» Malwarebytes said.
Repo-squatting via Google Ads

Users searching for developer tools have become the target of an ongoing campaign dubbed GPUGate that uses a malicious installer to deliver Hijack Loader and Atomic Stealer. «The attacker creates a throwaway GitHub account and forks the official GitHub Desktop repository,» GMO Cybersecurity by Ierae said. «The attacker edits the download link in the README to point to their malicious installer and commits the change. Lastly, the attacker used sponsored ads for ‘GitHub Desktop’ to promote their commit, using an anchor in README.md to skip past GitHub’s cautions.» Victims who downloaded the malicious Windows installer would execute a multi-stage loader, while Mac victims received Atomic Stealer.

These stories may seem separate, but they point in the same direction. Speed is increasing. Deception is improving. And attackers are finding new ways to blend into everyday activity.

The warning signs are there for those who look closely. Small gaps, delayed patches, misplaced trust, and rushed clicks still make the biggest difference.

Staying aware of these shifts is no longer optional. The details change each week. The pressure does not.

Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories – CYBERDEFENSA.MX

Noticias, Trending

Breaking News

Falla de WinRAR explotada por grupos alineados con Rusia para desplegar ladrones en Ucrania – CYBERDEFENSA.MX

Gamaredon aprovecha WinRAR para entregar GammaWorm y GammaSteel contra Ucrania – CYBERDEFENSA.MX

Kali Linux + Claude, Chrome Crash Traps, WinRAR Flaws, LockBit & 15+ Stories – CYBERDEFENSA.MX

Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories – CYBERDEFENSA.MX

Critical CVEs, Linux DDoS Botnet, Device-Code Phishing, Android Spyware and More – CYBERDEFENSA.MX

Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories – CYBERDEFENSA.MX

Detectan el primer malware diseñado para las pantallas multimedia de los vehículos

Un ciberataque de hackers iraníes paraliza una central eléctrica británica durante cuatro días

Pillan a AliExpress ‘espiando’ los audios de sus usuarios

JabaROOT DZ publica un enlace para acceder a los datos de 70.000 supuestos agentes marroquíes

Descubierta una campaña de phishing a gran escala dirigida contra más de 9.000 organizaciones en todo el mundo

This2Shell, That2Shell, Everything’s an RCE? Rogue AI, Supply Chain Chaos and More – CYBERDEFENSA.MX

Piratean la cuenta de HBO Max en Reddit para difundir malware

Or Check Our Popuplar Categories...

Tag Archives: WinRAR