The Russian hacker group called NoName057(16) is carrying out regular distributed denial-of-service (DDoS) attacks on European financial institutions, government websites, and transportation services.

The first messages were posted on August 27, with GhostSec saying it had discovered facial recognition “and various other privacy invading features and tools” within the FANAP group’s software.

Some of the malware families employed by Andariel in its attacks include Gh0st RAT, DTrack, YamaBot, NukeSped, Rifdoor, Phandoor, Andarat, Andaratm, TigerRAT (and its successor MagicRAT), and EarlyRAT.

An Iranian-focused hacking group known as Black Reward, with a history of going after the Iranian government, announced a new attack late Thursday, this time targeting a financial services app used by millions of Iranians for digital transactions.

Maksim Sergeevich Galochkin, a member of the Russian cybercrime syndicate Trickbot, has been identified by cybercrime researchers. The identification of Galochkin comes after a comprehensive investigation into leaked data from the Trickbot group.

Earth Estries uses advanced techniques such as DLL sideloading and has developed three custom malware tools: Zingdoor, TrillClient, and HemiGate. It has been active since at least 2020 and has similarities with another group called FamousSparrow.

The hackers behind Ransomed are probably linked to other data leak websites like BreachForums and Exposed, Flashpot said. Some of these sites have shut down due to money problems or poor management, the researchers said.

A threat actor believed to be tied to the FIN8 hacking group exploits the CVE-2023-3519 remote code execution flaw to compromise unpatched Citrix NetScaler systems in domain-wide attacks.