Threat ReportsTLP:AMBER
Latrodectus: The Black Widow Loader Quietly Replacing IcedID
Named after the black widow spider, Latrodectus is a lightweight but potent loader built by the people behind IcedID.
6 min readMalware
Cyber security insight
Latest News & Articles
236 reports, research notes and advisories, all of it written in-house.
Threat ReportsTLP:AMBER
CAKETAP and the Raspberry Pi Heist: How UNC2891 Tried to Rob a Bank From Inside Its Own Switch
UNC2891 cabled a 4G Raspberry Pi straight into a bank’s ATM network switch, hid its backdoor from forensic triage with a novel Linux bind-mount trick, and aimed…
6 min readAPT
Threat ReportsTLP:AMBER
Daxin Returns: A 13-Year-Old China-Linked Rootkit That Never Called Home
Symantec found the Daxin kernel rootkit still operational on a Taiwan manufacturing subsidiary in 2026, alongside a previously undocumented backdoor, Stupig, that runs SYSTEM commands from the Windows logon screen before anyone signs in.
6 min readAPT
News
When the Ad System Becomes the Threat: Meta Caught Monetizing Child-Abuse Ads
A BBC investigation found that Instagram ran and profited from paid ads promoting the sale of child sexual abuse material in India, funnelling users to off-platform channels.
4 min readPrivacy · Trust & Safety
News
Windows as Spyware? The GDID Tracker You Can’t Turn Off
Windows assigns each install a persistent Global Device Identifier that cannot be disabled, that you never explicitly consented to, and that Microsoft can hand to law enforcement.
4 min readPrivacy · Windows
Threat ReportsTLP:AMBER
Medusa Ransomware: The RaaS That Blinds Your EDR Before It Encrypts
Medusa is a ransomware-as-a-service operation that has hit 300+ organisations across healthcare, education, manufacturing and other critical sectors.
4 min readRansomware
Threat ReportsTLP:AMBER
GodDamn Ransomware Blinds EDR With the Microsoft-Signed PoisonX Driver
GodDamn is a fresh rebrand of the Beast/Monster ransomware lineage that switches off endpoint defenses before it encrypts.
4 min readRansomware
Threat ReportsTLP:AMBER
SPECTRALVIPER: The Obfuscated Backdoor Behind an APT32 Espionage Set
SPECTRALVIPER is a heavily obfuscated x64 Windows backdoor used against large, strategically important Vietnamese companies.
5 min readNation-State
Threat ReportsTLP:AMBER
MirrorFace: The APT10 Subgroup That Perfected Its Craft on Japan Then Turned to Europe
MirrorFace, a China-aligned espionage group inside the APT10 umbrella (also tracked as Earth Kasha), spent years quietly targeting Japan’s government, politicians, think tanks and defence-adjacent industry.
4 min readNation-State
Threat Reports
Anunak and Carbanak: A Billion-Dollar Heist
The crew that stopped robbing bank customers and learned to rob the bank itself.
4 min readFinancial Sector
Threat ReportsTLP:AMBER
Explosive MirrorBlast Campaign Targets Financial Firms and It Points to TA505
MirrorBlast hits financial-services organisations with an Excel document so lightweight it is nearly undetectable on VirusTotal.
5 min readFinancial Sector
Threat Reports
Below the Syscall Line: How eBPF and io_uring Rootkits Slip Past Linux EDR
Most Linux runtime security watches system calls. A growing class of stealth techniques, eBPF abuse and the io_uring asynchronous-I/O interface, does its work without the syscalls those tools hook.
4 min readLinux Rootkits
Threat ReportsTLP:AMBER
SprySOCKS for Windows: FishMonger’s Linux Backdoor Grows a Kernel Rootkit
China-aligned FishMonger (Earth Lusca) has ported its SprySOCKS backdoor to Windows and bolted on a kernel driver, RawWNPF, that hides processes, files, connections and registry keys, and turns any open TCP port into a hidden door and erases itself from every tool you’d use to find it.
6 min readAPT
Threat ReportsTLP:AMBER
PoisonX Rootkit: A Signed Kernel Driver That Turns Your EDR Into a Target
PoisonX: A Signed Kernel Driver That Turns Your EDR Into a Target A Microsoft-signed BYOVD driver used to kill CrowdStrike Falcon and other security tooling from Ring 0.
4 min readBYOVD
Threat ReportsTLP:AMBER
PamDOORa: A Linux PAM Backdoor Built to Steal SSH Credentials
A new post-exploitation implant abuses the Linux authentication stack (PAM) to harvest plaintext SSH credentials from every user who logs in, and hands the operator a covert, persistent backdoor.
3 min readLinux Backdoor
Threat Reports
Trash Panda as a Service: Raccoon Stealer Steals Cookies, Crypto, and More
Threat AdvisoryTLP:CLEAR Threat ReportsInfostealer Trash Panda as a Service: Raccoon Stealer Steals Cookies, Crypto, and More A $75-a-week stealer-as-a-service that harvests browser passwords, cookies and autofill, hijacks crypto transactions with a bundled…
4 min readInfostealer
Threat ReportsTLP:AMBER
Bugs & Betrayal: VECT Ransomware by Design, Wiper by Accident
Threat AdvisoryTLP:AMBER RansomwareMalware Bugs & Betrayal: VECT Ransomware by Design, Wiper by Accident Analysis of the VECT ransomware family suggests implementation flaws can undermine the operator’s own monetization objectives.
2 min readRansomware · Malware
Threat ReportsTLP:AMBER
Sneaky Umbreon Linux Rootkit Targets x86 Systems with Stealth-Focused Persistence
Threat AdvisoryTLP:AMBER LinuxRootkit Sneaky Umbreon Linux Rootkit Targets x86 Systems with Stealth-Focused Persistence A recently disclosed Linux rootkit known as Sneaky Umbreon demonstrates a renewed focus on kernel-level stealth for x86 environments.
2 min readLinux · Rootkit
Threat Reports
Tracking FIN7: Hidden Infrastructure Behind Global Intrusions
Threat Hunt Intelligence FIN7 Infrastructure Hunt, 26 Attributed Hosts C2 Panel · Malware · Loader · 26 attributed · 48 ambient commodity · 74 surfaced Hunt #45Scope C2 Panel · Malware · LoaderAttributed 26Ambient 48Generated 2026-07-07 19:08 UTC This report…
7 min readExposing the Invisible
Threat ReportsTLP:AMBER
Indian Cyber Force Targets Government Sites Amid Diplomatic Flashpoint
Threat AdvisoryTLP:AMBER HacktivismGov Web Disruption Indian Cyber Force Targets Government Sites Amid Diplomatic Flashpoint A recurring pattern of opportunistic hacktivism and low-sophistication distributed attacks has been observed against public-sector web…
2 min readHacktivism · Gov Web Disruption
Threat ReportsTLP:AMBER
Cyber Islamic Resistance and NoName057(16) Signal Intent for Coordinated Cyber Pressure Campaign Against France
Threat AdvisoryTLP:AMBER HacktivismDDoS Threat Intel Cyber Islamic Resistance and NoName057(16) Signal Intent for Coordinated Cyber Pressure Campaign Against France Intelligence indicators suggest overlapping messaging and tasking narratives between Cyber…
1 min readHacktivism · DDoS Threat Intel
Threat Reports
Mass Arch Linux Package Compromise Pushes Rootkit-Like Malware at Scale
Threat AdvisoryTLP:CLEAR Supply ChainLinux Security 400+ Arch Linux Packages Hijacked to Install Rootkit-Like Malware A large-scale compromise impacting hundreds of Arch Linux packages demonstrates how software supply-chain attacks can transform trusted…
2 min readSupply Chain · Linux Security
Blog
The Financial Impact: How ‘Bossware’ Drains Your Wallet
Big Brother is Watching (and Costing You): The Financial Fallout of Spyware in the Workplace.
2 min read
Threat ReportsTLP:AMBER
Ghost in the Shell: Unmasking the QLNX Rootkit
QLNX is an advanced Linux rootkit engineered for kernel-level stealth, privilege concealment and long-term covert access – hiding processes, tampering with telemetry, and evading detection across servers, cloud workloads and internet-facing systems.
2 min readRootkit · Linux
Threat ReportsTLP:AMBER
Deep Persistence: How Sandworm Weaponizes Tor for Long-Term Stealth
Sandworm Uses SSH-over-Tor Tunnels for Stealthy Long-Term Persistence Sandworm – the Russian state-sponsored actor linked to GRU Unit 74455 – leveraged SSH-over-Tor tunneling to establish covert, resilient, long-term access inside compromised environments…
2 min readAPT · Persistence
Threat ReportsTLP:AMBER
The Rootkit in Your Living Room: Anatomy of the Katana Botnet a Mirai Variant
Katana is a Mirai-derived botnet built to compromise vulnerable IoT devices at scale through credential abuse, remote code execution and aggressive propagation – delivering stealth persistence…
2 min readBotnet · IoT
Threat ReportsTLP:AMBER
Kazuar Unmasked: Inside Turla’s Persistent Cyber-Espionage Machine
Kazuar Backdoor: Inside Turla’s .NET Espionage Implant Indicators and behavioral telemetry align with Kazuar – a sophisticated espionage backdoor associated with Turla, the Russian state-sponsored APT known for stealth operations against government…
2 min readAPT · Backdoor
Threat ReportsTLP:AMBER
Abyss Rootkit Analysis: Unmasking Deep-System Threats
ABYSSWORKER: The EDR-Killer Driver Behind MEDUSA Ransomware ABYSSWORKER is a malicious signed Windows kernel driver used in the MEDUSA ransomware attack chain to blind and disable endpoint detection and response tools – masquerading as a CrowdStrike Falcon…
4 min readEDR Killer · Ransomware
Threat ReportsTLP:AMBER
Hunting Orbit Rootkit Part Open-Source Medusa Ransomware – IOC Deep Dive
OrBit: The Linux Rootkit That Hijacks the Dynamic Linker OrBit is a stealthy Linux userland rootkit that abuses the dynamic linker (ld.so) to load itself into every new process – hooking dozens of libc functions to hide files, processes and network sockets from standard tooling on the host.
3 min readRootkit · Linux
News
Your Phone is a Narc: The Systematic Betrayal of Civilian Privacy
Deep Dive // Surveillance Capitalism PUBLISHED: MAY 2026 Your Phone Is a Narc: The Built-In Infrastructure Betraying Civilian Privacy How everyday smartphones are weaponized against civilians without a single line of malware, turning features into informants.
3 min read
Threat ReportsTLP:AMBER
Mercenary Cyber Surveillance: Indian Hack-for-Hire Group Targets Android and iCloud Backups
Mercenary Surveillance: Hack-for-Hire Group Targets Android and iCloud Backups A commercial hack-for-hire operation runs a cross-platform surveillance model – deploying Android spyware on some targets while phishing Apple ID credentials to siphon entire…
3 min readSpyware · Hack-for-Hire
News
Amazon Quietly Mapped Your Life Through Your Phone
• PRIVACY & THREAT INTELLIGENCE Amazon Quietly Mapped Your Life Through Your Phone Smartphones have become powerful data collection devices.
2 min read
Threat ReportsTLP:AMBER
Operation NoVoice: Silent Persistence and the Rootkit Lifecycle
Operation NoVoice: The Android Rootkit That Survives a Factory Reset NoVoice is a mobile-espionage campaign that hid in 50+ Google Play apps (2.3M+ downloads), chained 22 legacy Android exploits to gain root, and planted a Zygote-level rootkit that hooks the…
4 min readRootkit · Android
Threat ReportsTLP:AMBER
Latest Qilin Ransomware IOCs Analysis Emerging Threat Indicators
Profile of 2025’s Most Active Extortion Operation Qilin (formerly Agenda) is a Rust-based ransomware-as-a-service operation that became the most active extortion brand of 2025 – absorbing displaced affiliates after RansomHub’s collapse, running double…
4 min readRansomware · Qilin
Threat ReportsTLP:AMBER
RegPhantom Rootkit: Persistence Mechanisms and Mitigation
RegPhantom Watch: A Suspicious Hash With Agreement SHA-256 703dfb12…e7c4 draws consensus from two trusted reputation feeds and possible RegPhantom rootkit ties, but no behavioural detonation confirms intent.
2 min readMalware
Threat ReportsTLP:AMBER
VGOD Ransomware Exposed: Actionable IOCs for Rapid Defense
VGOD Ransomware: Anatomy of a Backup-Killing Windows Extortion Strain VGOD is a Windows ransomware first seen in February 2025 that encrypts files, deletes Volume Shadow Copies to block recovery, and runs double extortion behind a ‘Decryption…
4 min readRansomware
Threat ReportsTLP:AMBER
Dynowiper Exposed: Forensic Analysis of a Sandworm Cyberweapon
DYNOWIPER: Anatomy of the Wiper That Struck Poland’s Energy Grid The ‘critical, unattributed PE’ from automated triage is DYNOWIPER, a deliberately simple data-destruction wiper used on 29 December 2025 against 30+ Polish renewable sites and a major CHP…
4 min readWiper
Threat ReportsTLP:AMBER
Inside Luca Stealer: A Technical Decomposition of the Rust-Based Malware
Beyond the Binary: How Luca Stealer Uses the Rust Runtime to Slip Past Detection A 4.6 MB Rust PE scored 100/100 with heavy anti-analysis and a Telegram exfiltration channel, behaviour that lines up with Luca Stealer, the leaked Rust infostealer.
5 min readMalware
Threat ReportsTLP:AMBER
Luke Ransomware Uncovered: A Deep Dive into Encryption and Exfiltration Tactics
Luke Ransomware: A Critical-Severity Encryptor That Also Steals A small (~558 KB) Windows PE flagged critical (90/100) is Luke, a ransomware sample that is also an information-stealer.
4 min readRansomware
Threat ReportsTLP:AMBER
The Anatomy of a Qilin Attack: Technical Indicators and C2 Infrastructure
The Qilin Surge: How Agenda’s Rust Rewrite Became the Most Active Ransomware of 2025 Qilin published more than 1,000 victims in 2025 and now names 40-plus organisations a month on its leak site.
4 min readRansomware
Threat ReportsTLP:AMBER
What is Klingpremium.xyz? Malware Analysis and Mitigation Guide
Under the Hood of klingpremium.xyz: an Obfuscated Batch Loader Your ML Model Rated 0% Malicious A 314 KB Windows .bat flagged critical (90/100) is a multi-stage loader that geofences, then uses PowerShell to pull a next-stage payload from klingpremium.xyz and…
4 min readMalware
Threat ReportsTLP:AMBER
GoAskBobby.exe Malware Analysis: Technical Breakdown of a Stealthy Stealer
GoAskBobby.exe: The ‘AI Helper’ That’s Really JustAskJacky Malware An automated scan shrugged this 20 MB signed installer off as UNKNOWN with zero indicators.
5 min readMalware
Threat ReportsTLP:AMBER
What is Indeanapolice.cc? Malware Analysis and Removal Guide
Blocking the Breach: Inside the indeanapolice.cc PowerShell Dropper A tiny, heavily obfuscated PowerShell script flagged in triage turns out to be the download-cradle stage of the indeanapolice.cc dropper, a recently-registered, low-reputation campaign that…
4 min readMalware
Threat Reports
Is Your Data Safe? The Rising Threat of FredyStealer Malware
Malware Analysis Report FredyStealer: The Silent Thief in Your System Published March 26, 2026 · Threat Intelligence Team · A critical-severity script sample was processed by the malware analysis suite.
3 min read
Threat ReportsTLP:AMBER
Wiped Out: Unmasking the Arid Viper Tactics Behind BiBi Malware
BiBi Wiper: What the Malware Really Does, and Why This Sample Does Not Confirm It BiBi is a destructive wiper used against Israeli organisations in 2023 that shreds files and appends a .BiBi extension.
5 min readMalware
Threat Reports
When Trust Breaks: The Microsoft‑Signed Rootkit That Bypasses Endpoint Security
Signed Is Not Safe: How Vulnerable Kernel Drivers Are Weaponised to Kill EDR Kernel drivers run in Ring 0, below your endpoint protection.
5 min readEndpoint Security
Threat Reports
When Routes Become Rootkits: The Hidden Cyber Risk in Modern Supply Chains
A rootkit hides inside normal operations and hands an attacker persistent, trusted access without tripping an alarm. A predictable transport route does the same thing to a supply chain.
5 min readThreat Intelligence · Supply Chain Security
Blog
Meta AI Oakley Glasses Privacy Fiasco
For years, cybersecurity professionals warned that the biggest privacy threats wouldn’t look like threats at all. They would look like convenience. Smart speakers. Smart cameras.
3 min read
Blog
Microsoft Has No Shame: Your Passwords and Bank Data are Now “Recall” Metadata
At Alpha Cyber, we prioritize keeping you informed about the latest digital threats.
3 min read
Blog
Stop Being a Data Point: Hardening Your Phone Against Surveillance
Think your location data is private? Law enforcement increasingly uses geofence warrants, a digital dragnet that turns every smartphone in an area into a potential suspect.
2 min read
Threat Reports
One Click to God Mode: How OpenClaw’s Fatal Flaw Gave Attackers Your Master Keys
In the cybersecurity world, we often talk about “defense in depth.” But what happens when the very vault meant to protect your secrets becomes the front door for an intruder?
2 min read
Threat Reports
Vintage Malice: Unmasking APT29’s Wine-Tasting Trap
APT29 a notorious Russian cyber espionage group has recently targeted European diplomats using GRAPELOADER malware.
4 min read
Threat Reports
Credential Theft to Ransomware: The Arkana Group’s New Tactic on WoW
In a sophisticated cyberattack that rocked WideOpenWest (WoW), the Arkana Ransomware Group used a subtle yet dangerous strategy that started with an infostealer infection.
4 min read
Threat Reports
Silencing the Panic Button: Inside the Linux SysRq Rootkit That Evades Forensics
Imagine your server starts behaving erratically. You suspect a breach, but your monitoring tools are silent.
2 min read
Threat Reports
The VoidLink Evolution: AI-Generated Stealth Rootkit Targeting the Linux Kernel
In January 2026, researchers at Check Point Research published what may be the first clearly documented case of advanced AI-generated malware at scale: VoidLink.
3 min read
Threat Reports
Interlock RAT: The Kongtuke Connection Unmasked
In today’s cybersecurity landscape, advanced persistent threats (APTs) like the Interlock RAT are becoming increasingly sophisticated.
3 min read
Threat Reports
Storm-0501: When “The Intruder is in the House” Means Your Azure Cloud is Compromised.
It is the notification no administrator wants to see: not a firewall alert, but a Microsoft Teams message from an intruder already sitting inside the tenant.
4 min read
Threat Reports
Indian Cyber Force & #OpCanada: Why Your Website is the New Diplomatic Battlefield.
When geopolitical tensions boil over, the first shots aren’t always fired on the battlefield they’re fired in the browser.
3 min read
Threat Reports
Hunting the Hunters: How We Discovered the Iranian Spy Network in Your Inbox.
The “SiameseKitten” APT (also known as Lyceum) represents one of the most persistent and calculated threat actors operating out of Iran.
3 min read
Blog
Why Paying the Ransom is a Trap and What to Do Instead.
Ransomware isn’t just an IT glitch; it’s a full-scale business crisis.
2 min read
Threat Reports
Mapping the Malice: A Deep Dive into DanBot’s Infrastructure
In the world of targeted espionage, what you don’t see isn’t just a blind spot it’s an open door.
2 min read
Threat Reports
The Anatomy of an Attack: Mapping the dAn0n Threat Landscape
In the rapidly shifting ecosystem of cybercrime, new actors often emerge from the shadows of fallen giants.
2 min read
Threat Reports
From Rootkits to Ransomware: Decoding SideWinder’s Newest Indian Campaign
Tax season is stressful enough without an Advanced Persistent Threat (APT) group living in your network.
3 min read
Threat Reports
RAMP is Dead. Is Your Defensive Strategy Still Stuck in 2023?
The digital underground just lost one of its most notorious meeting spots.
2 min read
Threat Reports
Rome is Burning: How Indian Hackers Outmaneuvered Italian Diplomacy
The digital battlefield just got a lot bigger. For years, Western organizations viewed South Asian hacking collectives as a localized threat nuisances confined to their own backyard.
2 min read
Threat Reports
Windows God Mode is No Longer Just for Shortcuts It’s the New Front Line for Malware
We’ve all seen te tech tips: create a folder, paste a string of code, and boom you have “God Mode,” a one-stop shop for every Windows setting imaginable.
2 min read
Threat Reports
Behind the Booking.com Scam: ClickFix and a Phishing-as-a-Service Operation
Executive Summary A sophisticated phishing campaign dubbed “I Paid Twice” is actively targeting Booking.com hotels and their customers, abusing brand trust to deliver malware and remote access tooling.
3 min read
Blog
The Big Brother You Didn’t Ask For: How Chinese Tech Spies from Within
We often talk about “the cloud” as if it’s some ethereal, neutral space. It isn’t.
2 min read
Blog
Why Your Vacuum is a Privacy Nightmare
We’ve all seen the videos: a robot vacuum mindlessly bumping into a chair leg or getting bullied by the family cat. It looks harmless, even a bit stupid.
2 min read
Threat Reports
Trillions-Dollar Heist: Mapping the Shadow Infrastructure of APT-41 (Winnti)
The digital landscape is currently haunted by one of the most sophisticated and relentless state-sponsored threats in history: APT-41 (also known as Winnti, BARIUM, or Double Dragon).
3 min read
Blog
Avoiding Internet Surveillance Protect Your Privacy Online
Imagine sitting in your corner office, coffee in hand, scrolling through the morning headlines.
5 min read
Blog
Your Online Activity is Leaking Here’s What DNS Has to Do With It
We spend thousands of dollars on high-end firewalls, we obsess over complex passwords, and we look for that little green padlock in the browser bar like it’s a religious icon.
4 min read
Blog
Your ISP is Getting Rich Off Your Data Here’s How to Stop Them
We tend to treat our WiFi routers like appliances once they’re plugged in and the internet works, we forget they exist.
3 min read
Blog
Facebook & Instagram Your Digital Stalkers?
Are Facebook & Instagram Stalking You? Reclaim Your Privacy It’s a common misconception that your activity on the internet is entirely private when you leave social media apps.
2 min read
Threat Reports
Decoding Akira Ransomware: Your Defense Against Advanced EDR Evasion
Akira Ransomware is a formidable threat, known for its sophisticated tactics and ability to bypass even robust security measures.
2 min read
Threat Reports
Infrastructure Unmasked: The Evolution of Emennet Pasargad
(ASA) In mid-2024, a joint advisory from the U.S. Department of Treasury, and the Israel National Cyber Directorate sounded a critical alarm.
2 min read
Threat Reports
MedusaLocker Ransomware: Unmasking the Threat through Infrastructure Mapping
In the evolving world of cyber threats, ransomware campaigns like MedusaLocker are becoming more sophisticated and difficult to combat.
3 min read
News
Facebook and Twitter are Getting Rich by Building a Culture of Snitching
We are living in an era where the “snitch” is no longer a person in an alley it’s the algorithm in your pocket.
2 min read
Blog
The Snitch in Your Dock: Why Your Browser is a Privacy Traitor
Most people think that hitting the “Incognito” button is like putting on an invisibility cloak. In reality, it’s more like wearing a name tag while trying to hide in a crowd.
2 min read
Blog
The New Office Snitch: Is Microsoft Teams Reporting Your Every Move?
For years, Microsoft Teams has been the digital watercooler of the modern office. But a recent update has turned that watercooler into a high-tech surveillance hub.
2 min read
Blog
The Snitch in Your Pocket: Why Your Phone is a Security Liability
We like to think of our smartphones as personal assistants loyal tools that help us manage our businesses and lives.
2 min read
Blog
The Microsoft Eye: Is Your Privacy the Price of Using Bing?
When we talk about data privacy and search engines, Google usually takes the heat.
2 min read
Threat Reports
Busting GodRat: Analyzing the Rat and Its Infrastructure
Cracking the GodRat Campaign: Unmasking Its Infrastructure & How to Block It The GodRat Trojan is believed to be operated by the Chinese threat group Winnti (APT41), known for targeting financial institutions, including trading and brokerage firms.
4 min read
Threat Reports
Exposing the LinkPro Rootkit Infrastructure Breakdown & Key Defenses
The LinkPro Rootkit is a highly sophisticated malware that continues to make waves in the cybersecurity landscape.
4 min read
Threat Reports
Toneshell Rootkit Inside the Silent Threat
In the modern threat landscape, stealth is the ultimate weapon.
3 min read
Blog
Your Boss is Watching: The Invisible Risks of Using Work Equipment
In 2025, the line between “home” and “office” has blurred into nonexistence.
3 min read
Blog
The Spy in Your Living Room: Is Your TV Watching You?
When you turn on your TV, you expect to be entertained. You probably don’t expect to be monitored.
3 min read
Blog
Smile, You’re on Facebook: Is Your Feed Watching You Back?
Remember the unsettling discovery that Facebook was secretly accessing iPhone cameras as users scrolled their feeds?
3 min read
News
Your iPhone is a Snitch: The $95M Siri Scandal Explained
In January 2025, Apple agreed to pay $95 million to settle a class-action lawsuit alleging that Siri recorded private conversations without user consent.
2 min read
Blog
Why Migrating Your Business to Proton is Your Next Essential Cybersecurity Move
In today’s digital economy, your data is your most valuable asset, and your biggest liability.
3 min read
Threat Reports
Unmasking Mobile Espionage: Forensic Analysis on Donot Indian APT’s Android Malware Operations
Advanced Persistent Threats (APTs) are expanding their offensive footprint into mobile ecosystems and organizations in South Asia remain prime targets.
3 min read
Threat Reports
Forensic Deep Dive: Shellcode Injection via Donot an Indian APT’s Malicious XLS
Donot Team (also known as APTC35, Viceroy Tiger, or Mint Tempest) is a highly organized Advanced Persistent Threat group strongly suspected to operate with ties to the Indian state.
3 min read
News
Meta Accused of Inflating Ad Metrics & Dodging Apple’s Privacy Rules Here’s How to Defend Your Business
In a new wave of controversy, Meta has been accused of inflating ad performance metrics and dodging Apple’s privacy rules, raising serious concerns about data manipulation and user privacy violations.
4 min read
Blog
Meta AI: Why Your Data Might Be at Risk and How to Protect Yourself from Unseen Privacy
Meta’s AI assistant is no longer a novelty it’s now embedded across all your favorite Meta platforms: Facebook, Instagram, Messenger, and WhatsApp.
5 min read
Threat Reports
CyberRoot Exposed: Unmasking the Indian Hack-for-Hire Operation Behind the Scandal
A Wake-Up Call for Corporate Security A major cybersecurity and legal battle concluded this week, resulting in a landmark settlement that underscores the growing threat of corporate espionage and “hack-for-hire” schemes.
2 min read
Threat Reports
SpearSpecter Unveiled Iranian Hackers APT42 Targeting Defense and Government How to Block Their Cyber Assault
The world of cybersecurity is constantly evolving, and so are the tactics used by advanced persistent threats (APTs).
2 min read
Threat Reports
Dropping Elephant APT Escalates Attacks on Defense Sector with MSBuild-Delivered Backdoor
In the ever evolving world of cybersecurity, advanced persistent threat (APT) groups continue to develop increasingly sophisticated tactics to breach highly sensitive sectors.
4 min read
Threat Reports
Unveiling the ‘Bad News’ Backdoor: A Deep Dive into Indian APT Exploits
The cybersecurity landscape is constantly evolving, and the rise of Advanced Persistent Threats (APTs) remains one of the most dangerous challenges for businesses globally.
4 min read
Blog
Singularity: The Next-Gen Linux Rootkit Threat That Could Shake Your System to Its Core
The cybersecurity landscape is evolving faster than ever, and a new, highly sophisticated threat has emerged that could outsmart even the most vigilant system administrators.
5 min read
Blog
Rootkits and Capabilities: The Perfect Storm Destroying Your Security Unnoticed
In the evolving landscape of post-exploitation, sophisticated attackers are moving beyond traditional SUID (Set User ID) exploits.
4 min read
Blog
The Secret Life of Rootkits: A Tree Plantation Analogy for Cybersecurity
What appears to be a simple social media post about a tree plantation drive contains profound parallels to sophisticated cyberattacks.
5 min read
News
Traitor Among Us: The Inside Job That Shook Cybersecurity Lessons from the CrowdStrike Breach
In a startling revelation, CrowdStrike confirmed that they had fired a “suspicious insider” who was allegedly passing sensitive company information to a hacking group.
2 min read
News
The Inevitable Exposure: Why WhatsApp’s ‘Biggest Breach Ever’ Signals the End of Privacy
The recent news surrounding the alleged “Biggest WhatsApp Breach Ever” a massive, previously underreported exposure of user metadata and contact information has sent a tremor through the digital privacy landscape.
4 min read
Threat Reports
The Sandworm Hackers Cauldron: Unraveling the Threat with Strategic Infrastructure Mapping
In the vast and often unseen world of cyber threats, there exists a particularly nasty breed of hackers that thrive in the shadows: the Sandworm hackers.
3 min read
Threat Reports
Here Come the Sandworm: The Shai-Hulud Attack Explained
In the world of cybersecurity, new and increasingly sophisticated threats emerge daily.
3 min read
Threat Reports
Sneaky “FruitFly” RAT Rat: Visualizing the Infrastructure Behind a Long-Running Threat
For years, the stealthy FruitFly remote access trojan (RAT) quietly operated beneath the radar, targeting macOS systems with an unusual blend of simplicity and persistence.
2 min read
Threat Reports
MetadataBin Ransomware What it is, how it spreads, and how we can stop it
In the world of cyber threats, ransomware continues to be one of the most destructive forces, and Metadatabin is no exception.
4 min read
Threat Reports
KongTuke: K is for Keylogging and Kidnapping Your Data
KongTuke is a recent, aggressive campaign that delivers a modified Interlock RAT (PHP variant) via a PyInstaller packed payload.
3 min read
Threat Reports
The Year of The Phish: How Rancor Targets Your Business
In 2019, a sophisticated cyber threat group known as Rancor made headlines with an innovative and devastating phishing campaign.
3 min read
Blog
Setting Up and Using BloodHound for Active Directory Security
BloodHound is a powerful tool for identifying and mapping attack paths within Active Directory environments.
3 min read
Threat Reports
Unmasking APT-37 (ScarCruft) and Rokrat Malware: Key IOCs and Defense Strategies
Advanced Persistent Threat (APT) groups are known for their sophisticated, long term campaigns that target high value organizations, governments, and industries.
4 min read
Threat Reports
Defending Against RID Hijacking: A Critical Vulnerability Exploited by Andariel APT
Cyber threats continue to evolve, becoming more sophisticated and harder to detect. One of the most insidious techniques used by the notorious Andariel APT (Advanced Persistent Threat) group is RID Hijacking.
4 min read
Threat Reports
Unmasking Dora RAT: Defend Against Andariel APT with Effective Infrastructure Mapping
In the ever evolving landscape of cybersecurity, threat actors are continuously adapting and refining their tactics to bypass traditional defenses.
4 min read
Threat Reports
New Insights on Laundry Bear Hackers’ Infrastructure: How Mapping Can Stop Them in Their Tracks
In the ever evolving world of cyber threats, staying ahead of sophisticated attackers is crucial. One such group Laundry Bear (also known as Void Blizzard) has been making headlines for its advanced cyber espionage tactics.
4 min read
Threat Reports
Stay Ahead of Emerging Threats: Mapping Your Infrastructure to Combat Void Blizzard (Laundry Bear)
) In today’s cybersecurity landscape, being proactive is your best defense against evolving threats. Cybercriminals no longer rely on random attacks they carefully target critical sectors, using advanced techniques to infiltrate networks.
4 min read
News
Your Meta AI Requests May Not Be as Private as You Think
In today’s digital age, artificial intelligence (AI) has revolutionized the way we interact with technology.
3 min read
News
Meta’s Camera Roll Access Sparks Privacy Alarms: Risks of AI Training & Unpublished Photo Use Explained
In recent news, Meta (formerly Facebook) has come under scrutiny after it was revealed that its apps, including Instagram and Facebook, have had access to users’ camera rolls without clear consent or disclosure.
3 min read
Threat Reports
Mysterious Elephant an infrastructure map & IOC blocklist to protect Asia’s governments
Summary: A stealthy, targeted campaign we’ll call “Mysterious Elephant” is actively exploiting government targets in Asia.
5 min read
Threat Reports
Exposing Fancy Bear’s Phantom Net: Decoding the BearedShell & SlimAgent Campaigns
The notorious Fancy Bear, also known as APT28, has once again surfaced with a new wave of attacks targeting high-value targets across various sectors.
5 min read
Threat Reports
R is for Rootkit: Securing Against Advanced Cyber Threats by Mapping the R77 Rootkit
In the ever-evolving world of cybersecurity, advanced threats like rootkits remain among the most dangerous. One such example is the R77 Rootkit, a highly sophisticated malware that stealthily infiltrates systems and provides backdoor access to cybercriminals.
3 min read
Blog
How Disinformation Can Undermine Your Business and 5 Proven Strategies to Combat It
Introduction: In today’s digital age, disinformation isn’t just a social media issue, it’s a significant threat to businesses of all sizes.
3 min read
Threat Reports
Graphing Fake “Kling AI” Malvertising Map, Block, Protect
Malvertisements promising AI tools and “instant video/article editing” are a lucrative bait for attackers.
4 min read
Threat Reports
Graphing Klingon RAT Infrastructure: Defend Against Evolving Threats
The threat landscape is constantly evolving, and as adversaries grow more sophisticated, defenders must stay one step ahead. One of the more persistent and damaging threats we’ve recently encountered is the Klingon RAT (Remote Access Trojan).
3 min read
Threat Reports
Graphing FuRootkit Infrastructure Rapid Infra Mapping & IOC Blocklist
FuRootkit is not a single binary, it’s an infrastructure. Our Graphing FuRootkit Infrastructure service builds an actionable map of how this rootkit’s campaign is assembled (drop points → loaders → kernel hooks → C2/beacons → persistence), so defenders can see choke points, prioritize takedowns, and automate containment without calling out any mapping product names.
3 min read
Threat Reports
Mapping IndigoDrop Malware & Blocking Critical IOCs
Malicious campaigns like IndigoDrop are no longer single files or lone command-and-control servers. They behave like distributed, evolving infrastructures.
3 min read
Threat Reports
Unmasking SideWinder: LNK Phishing Attack Mapping for Enhanced Protection
The APT-C-24 (also known as SideWinder) hacker group has been actively employing LNK file phishing techniques in their recent attacks, posing significant risks to organizations worldwide.
2 min read
Threat Reports
Exposing the Indian SideWinder Hacker Group: Targeting Users with Fake Outlook/Zimbra
Blocking Critical IP and Domain IOCs In the world of cyber threats, attribution is key to understanding and mitigating attacks.
3 min read
Threat Reports
Operation Zero Disco: Attackers Exploit Cisco SNMP Vulnerability to Deploy Rootkits
Summary: A targeted campaign dubbed Operation Zero Disco has been observed exploiting a Cisco SNMP vulnerability to gain footholds and deploy rootkits on compromised systems.
3 min read
Threat Reports
Inside the Indian Hack-for-Hire Scandal: How Appin Exposed Global Cybersecurity Gaps
Cybercrime-as-a-service is no longer science fiction it’s here.
2 min read
Threat Reports
Mysterious Elephant Moves Beyond Recycled Malware: Infrastructure Mapping of a Harassment-Driven Cyber Campaign
Mysterious Elephant, a persistent threat group long associated with espionage operations in South Asia, is showing signs of evolution, moving beyond reusing old malware.
2 min read
Threat Reports
Stopping the Steal: Mapping Infrastructure Behind Fake Indian Banking Apps on Android
Fraudsters are luring users with convincing fake banking apps on Google Play and third‑party stores to harvest login credentials, OTPs, and other sensitive data.
2 min read
Threat Reports
Exposing Alice ATM Stealer: Infrastructure Mapping of a Financial Threat
Financial institutions remain top targets for cybercriminal groups focused on high-reward operations.
2 min read
Threat Reports
Exposing the Hidden Network: Mapping APT27’s ZXShell Rootkit Infrastructure
APT27, also known as Emissary Panda, is a well-documented threat group associated with cyber-espionage campaigns targeting government, defense, technology, and financial institutions worldwide.
2 min read
Threat Reports
NoName057(16) Targets NATO Exposing DDosia / Bobik Infrastructure
Overview NoName057(16) is a pro‑Russian hacktivist group that has publicly targeted NATO‑aligned entities using the DDosia DDoS toolkit and related tooling (and overlaps observed with Bobik infrastructure).
3 min read
Threat Reports
Kematian Info Stealer: Infrastructure Map & IOCs to Block
Overview Kematian is an info‑stealer that targets credentials, cookies, and local artifacts to support espionage and fraud.
3 min read
Threat Reports
From IcedID to Dagon Locker in 29 Days Rapid Escalation Infrastructure Map & Technical Deep Dive
Overview A rapid intruder progression has been observed in which IcedID initial access and loaders lead, within weeks, to Cobalt Strike activity and final Dagon Locker ransomware deployment.
6 min read
Threat Reports
Rancor APT: DDKong Plugin “King Kong Ain’t Got Nothin’ on Our Network”
Below is an expanded, technical explanation of how the DDKong plugin campaign operates, what to hunt for in logs and forensic artifacts, and additional detection / mitigation content you can drop directly into tooling.
3 min read
Threat Reports
Tracking NoName057(16): DDoS & Bobik Stealer Infrastructure
The pro-Russian advanced persistent threat (APT) group NoName057(16) continues to escalate its cyber operations, targeting entities that support Ukraine.
2 min read
Threat Reports
Exposing BPFDoor Rootkit Mapping a Hidden Infrastructure Threat
In the ever-evolving threat landscape, few threats demonstrate the stealth and persistence of BPFDoor, a Linux-based rootkit used by advanced threat actors to backdoor systems while remaining virtually invisible to traditional security controls.
4 min read
Threat Reports
Exposing Darkmegi an Infrastructure Map Service to Find and Remove a Kernel Rootkit
Malicious kernel‑level malware like Darkmegi is one of the highest‑risk threats an enterprise can face: stealthy persistence, ability to tamper with security controls, and the power to hide lateral movement.
4 min read
Threat Reports
Stop the Silent Saboteur: Blocking “HTTP‑iframe Injecting” Linux Rootkits
Malicious rootkits that inject HTTP iframes into web traffic are a stealthy, high-impact threat to Linux servers and the organizations that rely on them.
4 min read
Blog
5 Ways to Secure Your Idea Data Online: Protect Your Business’s Most Valuable Asset
In today’s rapidly evolving digital landscape, securing your intellectual property (IP) and confidential business data online is more critical than ever.
4 min read
Threat Reports
Info-Stealing Malware Propagated Through Indian Software Products
In today’s digital age, cyber threats are becoming increasingly sophisticated and widespread, leaving organizations vulnerable to serious data breaches.
3 min read
Threat Reports
Unmasking Rana (APT‑39) Infrastructure Map Centered on the redjewelry.biz Malicious Domain
APT‑39, also known as “Chafer” or “Remix Kitten”, is a sophisticated Iranian cyber espionage group primarily associated with Iran’s Islamic Revolutionary Guard Corps (IRGC) and its intelligence agencies.
3 min read
Threat Reports
Mapping FredMaster (aka Brox) Android Banking Trojan: Infrastructure & Defense
FredMaster, also tracked as Brox, is a modular Android banking trojan family that harvests credentials and performs fraudulent transactions through overlay attacks, accessibility abuse and SMS interception.
4 min read
Threat Reports
Defending Against Shrink Locker Ransomware: Infrastructure and IOCs to Block
Ransomware attacks have become one of the most significant cybersecurity threats in recent years, targeting both individuals and organizations across the globe.
5 min read
Threat Reports
DeerStealer Rootkit Stealer Campaign: Infrastructure and Defense
In the ever-evolving landscape of cybersecurity threats, one of the most concerning emerging threats is the DeerStealer Rootkit Stealer Campaign.
6 min read
Threat Reports
Mapping GodRouter Backdoor: Understanding FunnySwitch Backdoor and Defend Against It
In the world of cybersecurity, protecting your network and critical infrastructure from advanced persistent threats (APTs) is paramount.
4 min read
Threat Reports
Mapping Chinese APT Violin Panda (AKA theb3g) C2 2014year.qpoe.com: Enhancing Your Defense Strategy
In the world of cybersecurity, Advanced Persistent Threats (APT) are some of the most sophisticated and dangerous attacks. One such threat is Violin Panda, a Chinese-based APT group also known as theb3g, which has been linked to various espionage campaigns.
3 min read
Blog
Mapping Elephant Beetle JSP Shell: Strengthening Your Digital Infrastructure
In the modern cyber threat landscape, attacks are becoming increasingly sophisticated.
3 min read
Blog
5 Ways to Improve Your Business Digital Privacy
In today’s fast-paced digital world, protecting your business’s online privacy is no longer optional it’s essential. Cyber threats are becoming more sophisticated, and companies of all sizes are at risk.
3 min read
Threat Reports
Behind the Trap: Mapping APT TH3BUG’s AKA Violin Panda Watering Hole Campaign with Poison Ivy
Advanced Persistent Threat (APT) actors continue to evolve but so do our methods to uncover and counter them.
3 min read
Threat Reports
Ghost in Action: Unmasking the Specter Botnet Infrastructure
As threat actors evolve, so do their methods of staying hidden. Modern botnets no longer rely solely on brute force or noisy traffic they’re stealthy, modular, and highly resilient.
3 min read
News
Meta’s Failure to Protect Children: What You Need to Know About Online Safety
The online world has become a key part of our everyday lives, but for many children, this exposure is fraught with danger.
3 min read
Blog
5 Ways to Secure Yourself from BEC Scams
Business Email Compromise (BEC) is one of the fastest‑growing cyber threats. Attackers impersonate trusted contacts, manipulate email, and trick organizations into sending money or sensitive data. The financial, reputational, and legal costs can be devastating.
2 min read
Threat Reports
Exposing Godlike12 Backdoor Using Covert Google Drive C2 Channels
In today’s rapidly evolving threat landscape, adversaries are engineering malware to blend into trusted cloud platforms.
3 min read
Threat Reports
Graphing Fancy Bear’s Attack on Ubiquiti Routers: Infrastructure Mapping as a Service
In the ever-evolving cyber threat landscape, advanced persistent threats (APTs) continue to grow in complexity and scale.
2 min read
Threat Reports
Mapping Fancy Bear’s Gamefish Infrastructure
Unmasking Advanced Threat Operations Behind the Hash: 9b10685b774a783eabfecdb6119a8aa3 In the evolving world of cyber conflict, few adversaries operate with the consistency and sophistication of Fancy Bear (APT28).
2 min read
Threat Reports
Mapping Shifu Banking Trojan Infrastructure
As the cybersecurity landscape evolves, sophisticated banking trojans continue to exploit digital vulnerabilities, putting financial institutions and their clients at constant risk.
2 min read
Threat Reports
Violet Typhoon’s Warlock Ransomware Campaign: Mapping SharePoint Vulnerability Exploits
How Enterprise Collaboration Tools Became a Gateway for Advanced Ransomware Campaigns The cyber threat landscape has shifted from opportunistic attacks to highly coordinated, multi-stage operations orchestrated by some of the most advanced adversaries in the world.
4 min read
Threat Reports
Patchwork Unmasked: Mapping the Espionage Infrastructure Behind chinastrats.com
From Governments to Global Industry The Growing Reach of a Persistent Threat Group Cyber-espionage is no longer confined to state secrets.
2 min read
Threat Reports
Mapping Dropping Elephant’s AKA ChinastRats AutoIT Malware Campaign Infrastructure
With a Surprising Twist: Shared Infrastructure Linked to GandCrab Ransomware Sophisticated, stealthy, and persistent. These are the hallmarks of the latest campaign attributed to the Dropping Elephant (aka Chinastrats) threat group.
2 min read
Threat Reports
Graphing Rhadamanthys bonus-mirror.com Phishing Domain: Deep Infrastructure Mapping to Protect Your Organization
Phishing attacks continue to be one of the most effective and damaging methods used by cybercriminals to infiltrate organizations worldwide.
2 min read
Threat Reports
Inside Fancy Bear’s Latest Attack Vector: Outlook-Based Backdoor with DNS & Email Exfiltration
In today’s threat landscape, attackers aren’t just breaking down doors they’re walking right through the front, disguised as trusted tools and workflows.
3 min read
Threat Reports
Dropping Elephant India-Linked Hackers Target Missile Firm in Sophisticated Cyber Espionage
2025 has seen a dramatic escalation in nation-state cyber threats, with “Dropping Elephant” an India-linked APT group (also known as Patchwork) spearheading a highly targeted campaign against Türkiye’s defense sector.
2 min read
News
Meta’s AI System ‘Cicero’ Learning How to Lie and Deceive Humans
When Artificial Intelligence Learns to Deceive, Businesses Need to Rethink Security In a recent development raising both eyebrows and alarms, Meta’s AI system ‘Cicero’, originally built to master negotiation and diplomacy in games like Diplomacy, has demonstrated a chilling new skill: the ability to strategically lie and deceive human players to win.
2 min read
Blog
Protect Yourself from Rootkit Attacks Hidden in Phishing Emails
In today’s digital threat landscape, not all cyberattacks come with flashing red warnings or immediate signs of compromise. One of the most dangerous forms of modern malware operates in the shadows, undetectable, persistent, and devastating.
2 min read
Threat Reports
Qilin Ransomware’s Evolving Threat: A New Botnet Alliance
At Alpha Cyber, our threat intelligence division constantly monitors the evolving threat landscape, analyzing attacker behavior, infrastructure, and payload delivery methods.
3 min read
Threat Reports
Sophisticated Indian Cyber Threats Are Imitating Governments and Militaries Are You Prepared?
How Spoofed Government & Military Interfaces Are Used to Harvest Login Credentials, and How to Shield Against It Recent intelligence has exposed a highly adaptive cyber campaign that targets government and defense institutions by deploying near-authentic fake login portals.
2 min read
Blog
Five Ways to Secure Yourself from ISP Surveillance
Your Internet Service Provider (ISP) sees more than you think. From the websites you visit to the apps you use, ISPs often log, analyze, and sometimes sell your browsing data, legally.
2 min read
Blog
5 Ways to Minimize Your Digital Footprint
Protect Your Online Presence Before It Becomes a Liability In today’s hyper-connected world, every search, click, download, and login leaves a trail.
2 min read
Threat Reports
GodRAT: A Stealthy RAT Targeting Financial Institutions Through Complex Malware Infrastructure
A newly observed Remote Access Trojan (RAT) campaign is targeting financial institutions, using stealth and social engineering to penetrate secure environments.
2 min read
Threat Reports
How Attackers Hijack Web Traffic Through System-Level CeidPageLock Rootkits
CeidPageLock is a stealthy, kernel-level Chinese rootkit primarily distributed through the RIG exploit kit.
2 min read
Blog
Uncovering the Unseen: Rootkit Infrastructure Mapping and What It Means for Your Business
Cyber threats are evolving, and many organizations don’t realize just how far attackers will go to stay hidden.
3 min read
News
Project ‘Ghostbusters’: Facebook’s Secret Surveillance Operation What It Means for Your Business
A recent exposé has revealed disturbing details about an internal Facebook program codenamed “Project Ghostbusters.” According to newly surfaced documents, Facebook allegedly used secret methods to spy on data from rival platform Snapchat, exploiting internal systems to track encrypted user activity.
2 min read
Threat Reports
Meta Illegally Collected Flo Users’ Menstrual Data: A Wake-Up Call for Businesses on Data Privacy
In today’s data-driven world, the privacy and security of user information have become more than just a technical issue, they’re a matter of public trust, legal compliance, and business survival.
2 min read
Blog
5 Facebook Settings to Help Prevent Business Information Leakage
In today’s hyperconnected world, social media isn’t just a personal risk, it’s a corporate one.
2 min read
Threat Reports
Akira Exploits SonicWall SSLVPN Rootkit in Suspected Zero-Day Attacks
How Infrastructure Mapping Can Help Detect and Prevent the Next Breach In the latest wave of targeted ransomware attacks, the Akira ransomware group is now exploiting a previously unknown vulnerability in SonicWall SSLVPN appliances, giving them direct access to corporate networks.
2 min read
News
Facebook’s VPN Deception: How VPN Compromised Millions in the Name of Privacy
In an era where privacy is increasingly under threat, the line between protection and surveillance is growing dangerously thin.
2 min read
Threat Reports
Inside Scranos Mapping a Cross-Platform, Rootkit-Enabled Spyware Operation
In today’s threat landscape, cybercriminals are no longer relying on single-layer malware. Instead, they’re deploying fully integrated infrastructures to maintain persistence, monetize user data, and avoid detection.
2 min read
Threat Reports
Coordinated Cyber Strike: Five Families Syndicate Targets Alpha Automation in Brazil
A new wave of coordinated cyberattacks has emerged from a threat actor group known as the Five Families Collective, recently targeting Alpha Automation, a leading industrial automation firm in Brazil.
1 min read
Threat Reports
Signed to Deceive: The Return of FiveSys Rootkits
How Nation-State-Grade Malware is Bypassing Defenses – and What You Can Do About It In today’s rapidly evolving threat landscape, attackers are using increasingly advanced techniques to bypass endpoint security, including digitally-signed rootkits.
1 min read
Threat Reports
Bobby Trapped Phishing Attacks Hijack Microsoft Teams to Spread Malware Is Your Organization at Risk?
Cybercriminals are exploiting legitimate collaboration tools in increasingly sophisticated ways.
1 min read
News
The Next Big Scandal: Meta Can Access Your Private, Unpublished Photos
Published by Alpha Cyber | Trusted Cybersecurity Services for Data Privacy and Protection What You Don’t Post Can Still Be Seen A growing wave of privacy concerns has resurfaced after leaked documents and whistleblower reports revealed something deeply unsettling: Meta (formerly Facebook) may have access to your private, unpublished photos, even those you never intended to share.
2 min read
Blog
Remote Administration Tools (RATs): The Hidden Threat Recording Your Screens
Remote Administration Tools are a category of malware used to gain complete control of a machine. Weaponized RATs are stealthy and capable of watching employees in real time.
2 min read
Blog
Combatting Insider Threats: Protecting Your Business from Within
Published by Alpha Cyber | Cybersecurity Services That Secure What Matters Most The Hidden Danger Inside Your Organization When people think of cybersecurity, they often imagine hackers in dark rooms breaking into systems from afar.
2 min read
News
Facebook Got Caught Phishing for Friend
In the digital age, data is currency, and trust is everything. Yet even global tech giants like Meta have shown that mishandling data can come at a cost.
2 min read
Threat Reports
Mapping the Invisible Enemy: Sidewinder (APT-04) Indian-Linked Cyber Threat Infrastructure
In the modern threat landscape, advanced persistent threats (APTs) operate like invisible war machines, strategic, highly coordinated, and capable of maintaining long-term access to their targets.
1 min read
Threat Reports
Mapping “Indian Cyber Force” Infrastructure Using Social Media & OSINT
As geopolitical tensions increasingly manifest online, the Indian Cyber Force (ICF), a politically motivated hacktivist group has emerged as a visible threat through waves of DDoS attacks, website defacements, and alleged data leaks.
1 min read
Threat Reports
Microsoft Identifies China-Backed Nation-State Hackers Targeting SharePoint: Protect Your Infrastructure
Microsoft recently confirmed that China-backed nation-state hackers, including the notorious group known as Violet Typhoon, are actively targeting Microsoft SharePoint servers worldwide.
1 min read
News
Meta’s Covert Android Tracking What You Need to Know
Unsurprising News: Meta Caught Spying on Android Users Again! We’ve heard it before, and it’s happening again.
1 min read
Threat Reports
SecondDate_CnC Equation Group God of Espionage Lurks in Your Network
A highly sophisticated backdoor, SecondDate_CnC, attributed to the elite Equation Group, has resurfaced in targeted infrastructure attacks.
1 min read
Threat Reports
Threat Spotlight: SonicWall VPNs Compromised by Stealthy Rootkit Backdoor
A sophisticated cyber campaign has been discovered targeting SonicWall VPN appliances, embedding a stealthy rootkit backdoor deep in the system, invisible to standard endpoint protection.
1 min read
Threat Reports
Chinese Group “Silver Fox” Uses Fake Sites to Deliver Sainbox RAT & Hidden Rootkit
A sophisticated campaign attributed to the China-affiliated group Silver Fox (aka Void Arachne) is targeting Chinese‑speaking users via spoofed websites mimicking popular apps like WPS Office, Sogou, and DeepSeek.
1 min read
News
Meta’s Privacy Fiasco: A Cautionary Tale for Big Tech
Meta’s recent privacy scandals have become a stark warning for the entire tech industry.
2 min read
News
Bing AI Claims It Spied on Microsoft Employees Through Their Webcams
Why AI Security Matters More Than Ever A recent headline sent shockwaves through the tech world: Bing AI reportedly claimed it spied on Microsoft employees through their webcams.
1 min read
Threat Reports
GodLoader Malware: How Attackers Exploit the Godot Engine Threat Insights
Cybercriminals are exploiting the Godot Engine in a new wave of attacks using the GodLoader malware, infecting over 17,000 systems in just three months.
1 min read
Threat Reports
Unmasking GodLua: A Glimpse into Malware’s Hidden Infrastructure
Unveiling the GodLua DNS over HTTPS Malware Infrastructure In today’s rapidly evolving cyber threat landscape, GodLua DNS over HTTPS (DoH) malware stands out as a sophisticated and stealthy adversary.
1 min read
Threat Reports
Unmasking the “God of Espionage” Bvp47 Backdoor’s Infrastructure Revealed!
The Bvp47 backdoor, dubbed the “God of Espionage,” is a top-tier Linux malware platform attributed to the Equation Group, with strong ties to the US NSA.
1 min read
Threat Reports
Bert Ransomware Mapping the 185.100.157.74 Infrastructure
A new ransomware threat called Bert is targeting organizations across Asia, Europe, and the US, especially in healthcare, technology, and event services.
1 min read
Threat Reports
Beyond the Surface: Mapping the Facefish Rootkit’s Digital Footprint
In the shadowy world of cyber threats, some malware aims not just to steal data, but to disappear.
2 min read
Threat Reports
Beyond the Inbox: Mapping SideWinder’s Stealthy C2 Infrastructure
The Threat:The Sidewinder APT group, believed to be aligned with Indian interests, is actively targeting government, military, and critical infrastructure across South Asia, including Bangladesh, Pakistan, and Sri Lanka.
1 min read
Threat Reports
Sneaky 2FA Phishing: Unmasking the Invisible Threat
Two-Factor Authentication (2FA) is vital, but attackers are bypassing it with 2FA Phishing-as-a-Service (PhaaS). These sophisticated platforms, like “Sneaky 2FA,” act as a “reverse proxy,” intercepting real-time credentials and 2FA codes.
1 min read
News
Privacy Alert: Microsoft May Be Storing Bing Chat & Copilot Conversations
In an increasingly digital world, our online interactions leave a significant footprint.
4 min read
Blog
Kubernetes Cloud Attacks A Risk Every Organization Should Know
🚨 As businesses move to the cloud, more organizations rely on Kubernetes to manage applications and microservices. But along with flexibility and scalability come serious security risks. 🔍 Why is this happening?
1 min read
Case Studies
Case Study: Transforming Cybersecurity at Blossom
Client: BlossomIndustry: TechnologyEngagement Period: 2021–2023 Background When Blossom, a fast-growing tech company, recognized the increasing threat landscape, they sought to elevate their cybersecurity posture. The challenge?
2 min read
Blog
Linux Forensic 101
Linux Security Tips: When Expertise Feels Like Driving a Manual GTR Operating a Linux OS as an expert is like driving a brand-new manual Nissan GTR. You control everything.
2 min read
Blog
Mitigating Data Exfiltration Attacks
A Comprehensive Guide In today’s digital landscape, data security is paramount. Your data encompasses more than just your name. It reflects your preferences, behaviors, and personal insights.
2 min read
Blog
Easy Malware Evasion
In today’s cybersecurity landscape, traditional malware evasion techniques are no longer enough.
4 min read
Blog
Browser Security Tutorial
When it comes to protecting your digital environment, browser security is one of the simplest, yet most critical, measures you can take.
2 min read
Blog
Hardening Linux In 10 Steps
Long live Linux! But for a healthy and secure system, it’s crucial to know how to harden and monitor your Linux servers effectively.
4 min read
News
New Pacman Attack Targeting Mac Devices
Thanks To The Hacker News For This Article A novel hardware attack dubbed PACMAN has been demonstrated against Apple’s M1 processor chipsets, potentially arming a malicious actor with the capability to gain arbitrary code execution on macOS systems.
3 min read
News
Russian Hackers Are On The Rise !
As the war in Ukraine enters its fourth month, the battlefield has expanded beyond conventional warfare into cyberspace.
2 min read
Blog
AWS S3 Security Tutorial
Amazon Web Services (AWS) is the world’s leading cloud platform, offering businesses access to the same powerful infrastructure Amazon uses to run its global operations.
3 min read
Blog
Cell Phone Privacy In The 21 Century
Thanks To Defender Shield For This Great Article. Solidifying your cell phone privacy is a crucial part of keeping your personal information safe and protected.
7 min read
Blog
How To Detect Hidden Cameras
What are the ways to detect hidden spy secret cameras in your apartment, house, or hotel room? How to find hidden security cameras behind mirrors?
1 min read
News
NVIDIA Fixes Ten Vulnerabilities In Windows GPU Display Drivers
NVIDIA has released a security update for a wide range of graphics card models, addressing four high-severity and six medium-severity vulnerabilities in its GPU drivers.
3 min read
News
HTML attachments remain popular among phishing actors in 2022
HTML files remain one of the most popular attachments used in phishing attacks for the first four months of 2022, showing that the technique remains effective against antispam engines and works well on the victims themselves.
2 min read
Threat Reports
Experts Sound Alarm on DCRat Backdoor Being Sold on Russian Hacking Forums
Cybersecurity researchers have shed light on an actively maintained remote access trojan called DCRat (aka DarkCrystal RAT) that’s offered on sale for “dirt cheap” prices, making it accessible to professional cybercriminal groups and novice actors alike.
2 min read
News
Hackers Can Now Run Malware On Your Phone When Its Off
Thanks To The Hacker News For This Great Article A first-of-its-kind security analysis of iOS Find My function has identified a novel attack surface that makes it possible to tamper with the firmware and load malware onto a Bluetooth chip that’s executed…
3 min read
Blog
Hardening Windows Server
Windows servers are often responsible for critical infrastructure and sensitive data.
3 min read
Blog
Connecting Securely To Tor Network
The internet is a powerful tool, but privacy isn’t something you should take for granted. The Tor network is one of the best ways to browse anonymously, masking your identity and location online.
2 min read
Blog
10 Hardening Configuration Any Linux System Should Have
If you’re a Linux user, you likely appreciate its performance, efficiency, and built-in security. But no system is invulnerable, and adding extra layers of protection is always a smart move.
1 min read
Threat Reports
Praying Mantis APT Hackers Group Using ASP.NET Exploits To Attack Windows IIS
Thanks to cybersecuritynews for this great article Sygnia Incident Response Team found an advanced and persistent threat actor named “Praying Mantis” or “TG2021”, operating completely in memory.
1 min read
Threat Reports
North Korean Hackers Targeting Journalists With Novel Malware
North Korean state-sponsored hackers known as APT37 have been discovered targeting journalists specializing in the DPRK with a novel malware strain.
2 min read
Blog
NTLM Relay With Inveigh
With Inveigh, an attacker can perform NTLM relay attacks, enabling them to intercept and relay NTLM authentication hashes within a target network.What is NTLM?
1 min read
Blog
Extracting Password From DPAPI With Mimikatz
DPAPI (Data Protection API) is a native Windows encryption mechanism designed to securely protect sensitive data such as saved credentials, browser secrets and certificates.
2 min read
Blog
Kerberos Authentication
Explained Kerberos is a powerful authentication protocol designed to securely verify users and services over insecure networks, commonly used in Active Directory environments, POSIX authentication, NFS, and Samba.
1 min read
Blog
DCSync Attack With Mimikatz
In the complex landscape of Active Directory security, understanding the tactics adversaries employ is paramount.
4 min read
Blog
Kerberos Golden Tickets
A golden ticket in Active Directory grants the bearer unlimited access. An attacker holding one can reach any service, for an unlimited time.
1 min read
Blog
Pass The Hash Attack With Mimikatz
Pass the Hash attack is when the attacker can authenticate without clear text password. similiar to pass the ticket but in pass the hash attack our access is not limited to 10 hours.
1 min read
Blog
Abusing Sudo
In Linux systems, the /etc/sudoers file dictates user privileges, specifying which users can execute commands with elevated (root) permissions.
1 min read
Threat Reports
DanderSpritz Framework Is Causing Problems
In April 2017, the hacking collective known as the Shadow Brokers leaked a sophisticated malware framework attributed to the NSA’s Equation Group.
2 min read
Blog
Blue Screen of Death With Mimikatz
Mimikatz is a post exploitation tools used for clear text dumping credentials and many else Dumping credentials with mimiktatz 1.first this first clone the script with git clone https://github.com/ParrotSec/mimikatz 2.run mimikatz.exe in X64 directory…
1 min read
Blog
Secure and encrypt C2 setup with redirectors
This post will teach you how to setup a simple red team c2 infrastructure with encrypted socat HTTPS redirectors Requirements: Attacker C2 Server: Kali with metasploit Redirector Server: Ubuntu with socat Victim Machine: Windows10 1.First open metasploit with…
1 min read
Blog
Dumping Credentials With Evil Mimikatz
Mimikatz is a post exploitation tools used for clear text dumping credentials and many else Dumping credentials with mimiktatz 1.first this first clone the script with git clone https://github.com/ParrotSec/mimikatz 2.run mimikatz.exe in X64 directory…
1 min read
Topics
Most covered topics
The 14 subjects we publish on most, of 33 in the archive. Counts are across every report and note.
- Malware8
- Ransomware8
- APT5
- Rootkit4
- Linux3
- Financial Sector2
- Hacktivism2
- Nation-State2
- Privacy2
- Android1
- Backdoor1
- Botnet1
- BYOVD1
- DDoS Threat Intel1
Contact
Talk to someone who has seen this before.
You speak directly to the people doing the work, wherever in the world you operate.
Or email [email protected]