The Iranian nation-sponsored hacker group MuddyWater was spotted joining hands with another emerging threat actor DEV-1084 to conduct destructive attacks disguised as ransomware attacks. DEV-1084 abuses the compromised credentials from high-privilege a…

Operating as a Ransomware-as-a-Service, the group consists of a central team that crafts the malware and manages its website. Meanwhile, the group also grants access to its code to affiliates who help execute the cyberattacks.

That’s according to new findings from the Microsoft Threat Intelligence team, which discovered the MuddyWater threat group targeting both on-premises and cloud infrastructures in partnership with another emerging activity cluster dubbed DEV-1084.

The group accepts cryptocurrency payments from members who want to access the offered data or purchase one of the available services, which span vulnerability exploitation, pen-testing, malware development, and DDoS attacks.

Google’s TAG identified a new campaign by the North Korean ARCHIPELAGO threat cluster (aka APT43) targeting U.S. and South Korean governments, think tanks, military personnel, academics, policymakers, and researchers. Most notably, ARCHIPELAGO used fra…

Attack chains mounted by ARCHIPELAGO involve the use of phishing emails containing malicious links that, when clicked by the recipients, redirect to fake login pages that are designed to harvest credentials.

The STYX marketplace was launched at the beginning of 2023. This discovery illustrates the post-pandemic menace of cyber-enabled financial crime and the threat it poses to financial institutions and their customers.

In recent news, a hacking group with alleged Turkish origins has surfaced, claiming to target banks, servers, government agencies, and facilities. Most of their attacks, which have been reported on Twitter, appear to be defacement attacks.

The Mantis cyber-espionage group (aka Arid Viper, Desert Falcon, APT-C-23) is believed to be operating out of the Palestinian territories. It continues to mount attacks with a refreshed toolset and maintains persistence on targeted networks.

Fake extortionists are piggybacking on data breaches and ransomware incidents, threatening U.S. companies with publishing or selling allegedly stolen data unless they get paid.