Alpha Cyber delivers tailored cybersecurity to organizations worldwide: penetration testing, red team, threat hunting, incident response, threat intelligence and security research.https://alpha-cyber.com/en-us© 2026 Alpha Cyberhttps://alpha-cyber.com/latrodectus-the-black-widow-loader-quietly-replacing-icedid/https://alpha-cyber.com/latrodectus-the-black-widow-loader-quietly-replacing-icedid/Named after the black widow spider, Latrodectus is a lightweight but potent loader built by the people behind IcedID.Sat, 25 Jul 2026 20:26:00 GMTAlpha Cyber ResearchTLP:AMBERThreat ReportsMalwareAlpha Cyber Researchhttps://alpha-cyber.com/caketap-and-the-raspberry-pi-heist-how-unc2891-tried-to-rob-a-bank-from-inside-its-own-switch/https://alpha-cyber.com/caketap-and-the-raspberry-pi-heist-how-unc2891-tried-to-rob-a-bank-from-inside-its-own-switch/UNC2891 cabled a 4G Raspberry Pi straight into a bank’s ATM network switch, hid its backdoor from forensic triage with a novel Linux bind-mount trick, and aimed…Sat, 25 Jul 2026 20:13:16 GMTAlpha Cyber ResearchTLP:AMBERThreat ReportsAPTAlpha Cyber Researchhttps://alpha-cyber.com/daxin-returns-a-13-year-old-china-linked-rootkit-that-never-called-home/https://alpha-cyber.com/daxin-returns-a-13-year-old-china-linked-rootkit-that-never-called-home/Symantec found the Daxin kernel rootkit still operational on a Taiwan manufacturing subsidiary in 2026, alongside a previously undocumented backdoor, Stupig, that runs SYSTEM commands from the Windows logon screen before anyone signs in.Thu, 23 Jul 2026 18:47:14 GMTAlpha Cyber ResearchTLP:AMBERThreat ReportsAPTAlpha Cyber Researchhttps://alpha-cyber.com/when-the-ad-system-becomes-the-threat-meta-caught-monetizing-child-abuse-ads/https://alpha-cyber.com/when-the-ad-system-becomes-the-threat-meta-caught-monetizing-child-abuse-ads/A BBC investigation found that Instagram ran and profited from paid ads promoting the sale of child sexual abuse material in India, funnelling users to off-platform channels.Thu, 23 Jul 2026 18:08:53 GMTAlpha Cyber ResearchTLP:CLEARNewsPrivacyTrust & SafetyAlpha Cyber Researchhttps://alpha-cyber.com/windows-as-spyware-the-gdid-tracker-you-cant-turn-off/https://alpha-cyber.com/windows-as-spyware-the-gdid-tracker-you-cant-turn-off/Windows assigns each install a persistent Global Device Identifier that cannot be disabled, that you never explicitly consented to, and that Microsoft can hand to law enforcement.Wed, 15 Jul 2026 10:16:06 GMTAlpha Cyber ResearchTLP:CLEARNewsPrivacyWindowsAlpha Cyber Researchhttps://alpha-cyber.com/medusa-ransomware-the-raas-that-blinds-your-edr-before-it-encrypts/https://alpha-cyber.com/medusa-ransomware-the-raas-that-blinds-your-edr-before-it-encrypts/Medusa is a ransomware-as-a-service operation that has hit 300+ organisations across healthcare, education, manufacturing and other critical sectors.Wed, 15 Jul 2026 08:27:05 GMTAlpha Cyber ResearchTLP:AMBERThreat ReportsRansomwareAlpha Cyber Researchhttps://alpha-cyber.com/goddamn-ransomware-blinds-edr-with-the-microsoft-signed-poisonx-driver/https://alpha-cyber.com/goddamn-ransomware-blinds-edr-with-the-microsoft-signed-poisonx-driver/GodDamn is a fresh rebrand of the Beast/Monster ransomware lineage that switches off endpoint defenses before it encrypts.Wed, 15 Jul 2026 07:59:56 GMTAlpha Cyber ResearchTLP:AMBERThreat ReportsRansomwareAlpha Cyber Researchhttps://alpha-cyber.com/spectralviper-the-obfuscated-backdoor-behind-an-apt32-espionage-set/https://alpha-cyber.com/spectralviper-the-obfuscated-backdoor-behind-an-apt32-espionage-set/SPECTRALVIPER is a heavily obfuscated x64 Windows backdoor used against large, strategically important Vietnamese companies.Wed, 08 Jul 2026 07:14:30 GMTAlpha Cyber ResearchTLP:AMBERThreat ReportsNation-StateAlpha Cyber Researchhttps://alpha-cyber.com/mirrorface-the-apt10-subgroup-that-perfected-its-craft-on-japan-then-turned-to-europe/https://alpha-cyber.com/mirrorface-the-apt10-subgroup-that-perfected-its-craft-on-japan-then-turned-to-europe/MirrorFace, a China-aligned espionage group inside the APT10 umbrella (also tracked as Earth Kasha), spent years quietly targeting Japan’s government, politicians, think tanks and defence-adjacent industry.Tue, 07 Jul 2026 20:22:18 GMTAlpha Cyber ResearchTLP:AMBERThreat ReportsNation-StateAlpha Cyber Researchhttps://alpha-cyber.com/anunak-and-carbanak-a-billion-dollar-heist/https://alpha-cyber.com/anunak-and-carbanak-a-billion-dollar-heist/The crew that stopped robbing bank customers and learned to rob the bank itself.Tue, 07 Jul 2026 20:12:17 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsFinancial SectorAlpha Cyber Researchhttps://alpha-cyber.com/explosive-mirrorblast-campaign-targets-financial-firms-and-it-points-to-ta505/https://alpha-cyber.com/explosive-mirrorblast-campaign-targets-financial-firms-and-it-points-to-ta505/MirrorBlast hits financial-services organisations with an Excel document so lightweight it is nearly undetectable on VirusTotal.Tue, 07 Jul 2026 20:05:12 GMTAlpha Cyber ResearchTLP:AMBERThreat ReportsFinancial SectorAlpha Cyber Researchhttps://alpha-cyber.com/below-the-syscall-line-how-ebpf-and-io_uring-rootkits-slip-past-linux-edr/https://alpha-cyber.com/below-the-syscall-line-how-ebpf-and-io_uring-rootkits-slip-past-linux-edr/Most Linux runtime security watches system calls. A growing class of stealth techniques, eBPF abuse and the io_uring asynchronous-I/O interface, does its work without the syscalls those tools hook.Tue, 07 Jul 2026 17:54:07 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsLinux RootkitsAlpha Cyber Researchhttps://alpha-cyber.com/sprysocks-for-windows-fishmongers-linux-backdoor-grows-a-kernel-rootkit/https://alpha-cyber.com/sprysocks-for-windows-fishmongers-linux-backdoor-grows-a-kernel-rootkit/China-aligned FishMonger (Earth Lusca) has ported its SprySOCKS backdoor to Windows and bolted on a kernel driver, RawWNPF, that hides processes, files, connections and registry keys, and turns any open TCP port into a hidden door and erases itself from every tool you’d use to find it.Sat, 04 Jul 2026 17:44:41 GMTAlpha Cyber ResearchTLP:AMBERThreat ReportsAPTAlpha Cyber Researchhttps://alpha-cyber.com/poisonx-rootkit-a-signed-kernel-driver-that-turns-your-edr-into-a-target/https://alpha-cyber.com/poisonx-rootkit-a-signed-kernel-driver-that-turns-your-edr-into-a-target/PoisonX: A Signed Kernel Driver That Turns Your EDR Into a Target A Microsoft-signed BYOVD driver used to kill CrowdStrike Falcon and other security tooling from Ring 0.Sat, 04 Jul 2026 16:04:41 GMTAlpha Cyber ResearchTLP:AMBERThreat ReportsBYOVDAlpha Cyber Researchhttps://alpha-cyber.com/pamdoora-a-linux-pam-backdoor-built-to-steal-ssh-credentials/https://alpha-cyber.com/pamdoora-a-linux-pam-backdoor-built-to-steal-ssh-credentials/A new post-exploitation implant abuses the Linux authentication stack (PAM) to harvest plaintext SSH credentials from every user who logs in, and hands the operator a covert, persistent backdoor.Thu, 02 Jul 2026 14:36:41 GMTAlpha Cyber ResearchTLP:AMBERThreat ReportsLinux BackdoorAlpha Cyber Researchhttps://alpha-cyber.com/trash-panda-as-a-service-raccoon-stealer-steals-cookies-crypto-and-more/https://alpha-cyber.com/trash-panda-as-a-service-raccoon-stealer-steals-cookies-crypto-and-more/Threat AdvisoryTLP:CLEAR Threat ReportsInfostealer Trash Panda as a Service: Raccoon Stealer Steals Cookies, Crypto, and More A $75-a-week stealer-as-a-service that harvests browser passwords, cookies and autofill, hijacks crypto transactions with a bundled…Thu, 02 Jul 2026 14:25:49 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsInfostealerAlpha Cyber Researchhttps://alpha-cyber.com/bugs-betrayal-vect-ransomware-by-design-wiper-by-accident/https://alpha-cyber.com/bugs-betrayal-vect-ransomware-by-design-wiper-by-accident/Threat AdvisoryTLP:AMBER RansomwareMalware Bugs & Betrayal: VECT Ransomware by Design, Wiper by Accident Analysis of the VECT ransomware family suggests implementation flaws can undermine the operator’s own monetization objectives.Tue, 30 Jun 2026 20:02:46 GMTAlpha Cyber ResearchTLP:AMBERThreat ReportsRansomwareMalwareAlpha Cyber Researchhttps://alpha-cyber.com/sneaky-umbreon-linux-rootkit-targets-x86-systems-with-stealth-focused-persistence/https://alpha-cyber.com/sneaky-umbreon-linux-rootkit-targets-x86-systems-with-stealth-focused-persistence/Threat AdvisoryTLP:AMBER LinuxRootkit Sneaky Umbreon Linux Rootkit Targets x86 Systems with Stealth-Focused Persistence A recently disclosed Linux rootkit known as Sneaky Umbreon demonstrates a renewed focus on kernel-level stealth for x86 environments.Tue, 30 Jun 2026 19:49:55 GMTAlpha Cyber ResearchTLP:AMBERThreat ReportsLinuxRootkitAlpha Cyber Researchhttps://alpha-cyber.com/tracking-fin7-hidden-infrastructure-behind-global-intrusions/https://alpha-cyber.com/tracking-fin7-hidden-infrastructure-behind-global-intrusions/Threat Hunt Intelligence FIN7 Infrastructure Hunt, 26 Attributed Hosts C2 Panel · Malware · Loader · 26 attributed · 48 ambient commodity · 74 surfaced Hunt #45Scope C2 Panel · Malware · LoaderAttributed 26Ambient 48Generated 2026-07-07 19:08 UTC This report…Sun, 21 Jun 2026 16:40:17 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsExposing the InvisibleAlpha Cyber Researchhttps://alpha-cyber.com/indian-cyber-force-targets-government-sites-amid-diplomatic-flashpoint/https://alpha-cyber.com/indian-cyber-force-targets-government-sites-amid-diplomatic-flashpoint/Threat AdvisoryTLP:AMBER HacktivismGov Web Disruption Indian Cyber Force Targets Government Sites Amid Diplomatic Flashpoint A recurring pattern of opportunistic hacktivism and low-sophistication distributed attacks has been observed against public-sector web…Tue, 16 Jun 2026 20:00:34 GMTAlpha Cyber ResearchTLP:AMBERThreat ReportsHacktivismGov Web DisruptionAlpha Cyber Researchhttps://alpha-cyber.com/cyber-islamic-resistance-and-noname05716-signal-intent-for-coordinated-cyber-pressure-campaign-against-france/https://alpha-cyber.com/cyber-islamic-resistance-and-noname05716-signal-intent-for-coordinated-cyber-pressure-campaign-against-france/Threat AdvisoryTLP:AMBER HacktivismDDoS Threat Intel Cyber Islamic Resistance and NoName057(16) Signal Intent for Coordinated Cyber Pressure Campaign Against France Intelligence indicators suggest overlapping messaging and tasking narratives between Cyber…Tue, 16 Jun 2026 19:36:35 GMTAlpha Cyber ResearchTLP:AMBERThreat ReportsHacktivismDDoS Threat IntelAlpha Cyber Researchhttps://alpha-cyber.com/mass-arch-linux-package-compromise-pushes-rootkit-like-malware-at-scale/https://alpha-cyber.com/mass-arch-linux-package-compromise-pushes-rootkit-like-malware-at-scale/Threat AdvisoryTLP:CLEAR Supply ChainLinux Security 400+ Arch Linux Packages Hijacked to Install Rootkit-Like Malware A large-scale compromise impacting hundreds of Arch Linux packages demonstrates how software supply-chain attacks can transform trusted…Tue, 16 Jun 2026 19:23:37 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsSupply ChainLinux SecurityAlpha Cyber Researchhttps://alpha-cyber.com/the-financial-impact-how-bossware-drains-your-wallet/https://alpha-cyber.com/the-financial-impact-how-bossware-drains-your-wallet/Big Brother is Watching (and Costing You): The Financial Fallout of Spyware in the Workplace.Sat, 30 May 2026 16:31:55 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/ghost-in-the-shell-unmasking-the-qlnx-rootkit/https://alpha-cyber.com/ghost-in-the-shell-unmasking-the-qlnx-rootkit/QLNX is an advanced Linux rootkit engineered for kernel-level stealth, privilege concealment and long-term covert access – hiding processes, tampering with telemetry, and evading detection across servers, cloud workloads and internet-facing systems.Tue, 26 May 2026 21:12:53 GMTAlpha Cyber ResearchTLP:AMBERThreat ReportsRootkitLinuxAlpha Cyber Researchhttps://alpha-cyber.com/deep-persistence-how-sandworm-weaponizes-tor-for-long-term-stealth/https://alpha-cyber.com/deep-persistence-how-sandworm-weaponizes-tor-for-long-term-stealth/Sandworm Uses SSH-over-Tor Tunnels for Stealthy Long-Term Persistence Sandworm – the Russian state-sponsored actor linked to GRU Unit 74455 – leveraged SSH-over-Tor tunneling to establish covert, resilient, long-term access inside compromised environments…Tue, 26 May 2026 21:03:02 GMTAlpha Cyber ResearchTLP:AMBERThreat ReportsAPTPersistenceAlpha Cyber Researchhttps://alpha-cyber.com/the-rootkit-in-your-living-room-anatomy-of-the-katana-botnet-a-mirai-variant/https://alpha-cyber.com/the-rootkit-in-your-living-room-anatomy-of-the-katana-botnet-a-mirai-variant/Katana is a Mirai-derived botnet built to compromise vulnerable IoT devices at scale through credential abuse, remote code execution and aggressive propagation – delivering stealth persistence…Tue, 26 May 2026 20:52:16 GMTAlpha Cyber ResearchTLP:AMBERThreat ReportsBotnetIoTAlpha Cyber Researchhttps://alpha-cyber.com/kazuar-unmasked-inside-turlas-persistent-cyber-espionage-machine/https://alpha-cyber.com/kazuar-unmasked-inside-turlas-persistent-cyber-espionage-machine/Kazuar Backdoor: Inside Turla’s .NET Espionage Implant Indicators and behavioral telemetry align with Kazuar – a sophisticated espionage backdoor associated with Turla, the Russian state-sponsored APT known for stealth operations against government…Tue, 26 May 2026 20:39:05 GMTAlpha Cyber ResearchTLP:AMBERThreat ReportsAPTBackdoorAlpha Cyber Researchhttps://alpha-cyber.com/abyss-rootkit-analysis-unmasking-deep-system-threats/https://alpha-cyber.com/abyss-rootkit-analysis-unmasking-deep-system-threats/ABYSSWORKER: The EDR-Killer Driver Behind MEDUSA Ransomware ABYSSWORKER is a malicious signed Windows kernel driver used in the MEDUSA ransomware attack chain to blind and disable endpoint detection and response tools – masquerading as a CrowdStrike Falcon…Sun, 24 May 2026 09:15:54 GMTAlpha Cyber ResearchTLP:AMBERThreat ReportsEDR KillerRansomwareAlpha Cyber Researchhttps://alpha-cyber.com/hunting-orbit-rootkit-ioc-deep-dive/https://alpha-cyber.com/hunting-orbit-rootkit-ioc-deep-dive/OrBit: The Linux Rootkit That Hijacks the Dynamic Linker OrBit is a stealthy Linux userland rootkit that abuses the dynamic linker (ld.so) to load itself into every new process – hooking dozens of libc functions to hide files, processes and network sockets from standard tooling on the host.Wed, 20 May 2026 08:55:40 GMTAlpha Cyber ResearchTLP:AMBERThreat ReportsRootkitLinuxAlpha Cyber Researchhttps://alpha-cyber.com/your-phone-is-a-narc-the-systematic-betrayal-of-civilian-privacy/https://alpha-cyber.com/your-phone-is-a-narc-the-systematic-betrayal-of-civilian-privacy/Deep Dive // Surveillance Capitalism PUBLISHED: MAY 2026 Your Phone Is a Narc: The Built-In Infrastructure Betraying Civilian Privacy How everyday smartphones are weaponized against civilians without a single line of malware, turning features into informants.Fri, 15 May 2026 11:14:17 GMTAlpha Cyber ResearchTLP:CLEARNewsAlpha Cyber Researchhttps://alpha-cyber.com/mercenary-cyber-surveillance-indian-hack-for-hire-group-targets-android-and-icloud-backups/https://alpha-cyber.com/mercenary-cyber-surveillance-indian-hack-for-hire-group-targets-android-and-icloud-backups/Mercenary Surveillance: Hack-for-Hire Group Targets Android and iCloud Backups A commercial hack-for-hire operation runs a cross-platform surveillance model – deploying Android spyware on some targets while phishing Apple ID credentials to siphon entire…Fri, 15 May 2026 11:04:12 GMTAlpha Cyber ResearchTLP:AMBERThreat ReportsSpywareHack-for-HireAlpha Cyber Researchhttps://alpha-cyber.com/amazon-quietly-mapped-your-life-through-your-phone/https://alpha-cyber.com/amazon-quietly-mapped-your-life-through-your-phone/• PRIVACY & THREAT INTELLIGENCE Amazon Quietly Mapped Your Life Through Your Phone Smartphones have become powerful data collection devices.Fri, 15 May 2026 10:19:55 GMTAlpha Cyber ResearchTLP:CLEARNewsAlpha Cyber Researchhttps://alpha-cyber.com/operation-novoice-silent-persistence-and-the-rootkit-lifecycle/https://alpha-cyber.com/operation-novoice-silent-persistence-and-the-rootkit-lifecycle/Operation NoVoice: The Android Rootkit That Survives a Factory Reset NoVoice is a mobile-espionage campaign that hid in 50+ Google Play apps (2.3M+ downloads), chained 22 legacy Android exploits to gain root, and planted a Zygote-level rootkit that hooks the…Sun, 10 May 2026 12:29:28 GMTAlpha Cyber ResearchTLP:AMBERThreat ReportsRootkitAndroidAlpha Cyber Researchhttps://alpha-cyber.com/latest-qilin-ransomware-iocs-analysis-emerging-threat-indicators/https://alpha-cyber.com/latest-qilin-ransomware-iocs-analysis-emerging-threat-indicators/Profile of 2025’s Most Active Extortion Operation Qilin (formerly Agenda) is a Rust-based ransomware-as-a-service operation that became the most active extortion brand of 2025 – absorbing displaced affiliates after RansomHub’s collapse, running double…Tue, 05 May 2026 19:32:57 GMTAlpha Cyber ResearchTLP:AMBERThreat ReportsRansomwareQilinAlpha Cyber Researchhttps://alpha-cyber.com/regphantom-rootkit-persistence-mechanisms-and-mitigation/https://alpha-cyber.com/regphantom-rootkit-persistence-mechanisms-and-mitigation/RegPhantom Watch: A Suspicious Hash With Agreement SHA-256 703dfb12…e7c4 draws consensus from two trusted reputation feeds and possible RegPhantom rootkit ties, but no behavioural detonation confirms intent.Tue, 05 May 2026 17:35:57 GMTAlpha Cyber ResearchTLP:AMBERThreat ReportsMalwareAlpha Cyber Researchhttps://alpha-cyber.com/vgod-ransomware-exposed-actionable-iocs-for-rapid-defense/https://alpha-cyber.com/vgod-ransomware-exposed-actionable-iocs-for-rapid-defense/VGOD Ransomware: Anatomy of a Backup-Killing Windows Extortion Strain VGOD is a Windows ransomware first seen in February 2025 that encrypts files, deletes Volume Shadow Copies to block recovery, and runs double extortion behind a ‘Decryption…Sun, 03 May 2026 19:44:03 GMTAlpha Cyber ResearchTLP:AMBERThreat ReportsRansomwareAlpha Cyber Researchhttps://alpha-cyber.com/dynowiper-exposed-forensic-analysis-of-a-sandworm-cyberweapon/https://alpha-cyber.com/dynowiper-exposed-forensic-analysis-of-a-sandworm-cyberweapon/DYNOWIPER: Anatomy of the Wiper That Struck Poland’s Energy Grid The ‘critical, unattributed PE’ from automated triage is DYNOWIPER, a deliberately simple data-destruction wiper used on 29 December 2025 against 30+ Polish renewable sites and a major CHP…Wed, 29 Apr 2026 15:03:46 GMTAlpha Cyber ResearchTLP:AMBERThreat ReportsWiperAlpha Cyber Researchhttps://alpha-cyber.com/inside-luca-stealer-a-technical-decomposition-of-the-rust-based-malware/https://alpha-cyber.com/inside-luca-stealer-a-technical-decomposition-of-the-rust-based-malware/Beyond the Binary: How Luca Stealer Uses the Rust Runtime to Slip Past Detection A 4.6 MB Rust PE scored 100/100 with heavy anti-analysis and a Telegram exfiltration channel, behaviour that lines up with Luca Stealer, the leaked Rust infostealer.Fri, 10 Apr 2026 12:49:09 GMTAlpha Cyber ResearchTLP:AMBERThreat ReportsMalwareAlpha Cyber Researchhttps://alpha-cyber.com/luke-ransomware-uncovered-a-deep-dive-into-encryption-and-exfiltration-tactics/https://alpha-cyber.com/luke-ransomware-uncovered-a-deep-dive-into-encryption-and-exfiltration-tactics/Luke Ransomware: A Critical-Severity Encryptor That Also Steals A small (~558 KB) Windows PE flagged critical (90/100) is Luke, a ransomware sample that is also an information-stealer.Mon, 30 Mar 2026 09:15:27 GMTAlpha Cyber ResearchTLP:AMBERThreat ReportsRansomwareAlpha Cyber Researchhttps://alpha-cyber.com/the-anatomy-of-a-qilin-attack-technical-indicators-and-c2-infrastructure/https://alpha-cyber.com/the-anatomy-of-a-qilin-attack-technical-indicators-and-c2-infrastructure/The Qilin Surge: How Agenda’s Rust Rewrite Became the Most Active Ransomware of 2025 Qilin published more than 1,000 victims in 2025 and now names 40-plus organisations a month on its leak site.Mon, 30 Mar 2026 08:29:12 GMTAlpha Cyber ResearchTLP:AMBERThreat ReportsRansomwareAlpha Cyber Researchhttps://alpha-cyber.com/what-is-klingpremium-xyz-malware-analysis-and-mitigation-guide/https://alpha-cyber.com/what-is-klingpremium-xyz-malware-analysis-and-mitigation-guide/Under the Hood of klingpremium.xyz: an Obfuscated Batch Loader Your ML Model Rated 0% Malicious A 314 KB Windows .bat flagged critical (90/100) is a multi-stage loader that geofences, then uses PowerShell to pull a next-stage payload from klingpremium.xyz and…Sun, 29 Mar 2026 13:22:40 GMTAlpha Cyber ResearchTLP:AMBERThreat ReportsMalwareAlpha Cyber Researchhttps://alpha-cyber.com/goaskbobby-exe-malware-analysis-technical-breakdown-of-a-stealthy-stealer/https://alpha-cyber.com/goaskbobby-exe-malware-analysis-technical-breakdown-of-a-stealthy-stealer/GoAskBobby.exe: The ‘AI Helper’ That’s Really JustAskJacky Malware An automated scan shrugged this 20 MB signed installer off as UNKNOWN with zero indicators.Sat, 28 Mar 2026 11:34:57 GMTAlpha Cyber ResearchTLP:AMBERThreat ReportsMalwareAlpha Cyber Researchhttps://alpha-cyber.com/what-is-indeanapolice-cc-malware-analysis-and-removal-guide/https://alpha-cyber.com/what-is-indeanapolice-cc-malware-analysis-and-removal-guide/Blocking the Breach: Inside the indeanapolice.cc PowerShell Dropper A tiny, heavily obfuscated PowerShell script flagged in triage turns out to be the download-cradle stage of the indeanapolice.cc dropper, a recently-registered, low-reputation campaign that…Fri, 27 Mar 2026 19:48:49 GMTAlpha Cyber ResearchTLP:AMBERThreat ReportsMalwareAlpha Cyber Researchhttps://alpha-cyber.com/is-your-data-safe-the-rising-threat-of-fredystealer-malware/https://alpha-cyber.com/is-your-data-safe-the-rising-threat-of-fredystealer-malware/Malware Analysis Report FredyStealer: The Silent Thief in Your System Published March 26, 2026 · Threat Intelligence Team · A critical-severity script sample was processed by the malware analysis suite.Thu, 26 Mar 2026 21:29:31 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/wiped-out-unmasking-the-arid-viper-tactics-behind-bibi-malware/https://alpha-cyber.com/wiped-out-unmasking-the-arid-viper-tactics-behind-bibi-malware/BiBi Wiper: What the Malware Really Does, and Why This Sample Does Not Confirm It BiBi is a destructive wiper used against Israeli organisations in 2023 that shreds files and appends a .BiBi extension.Thu, 26 Mar 2026 21:03:53 GMTAlpha Cyber ResearchTLP:AMBERThreat ReportsMalwareAlpha Cyber Researchhttps://alpha-cyber.com/when-trust-breaks-the-microsoft-signed-rootkit-that-bypasses-endpoint-security/https://alpha-cyber.com/when-trust-breaks-the-microsoft-signed-rootkit-that-bypasses-endpoint-security/Signed Is Not Safe: How Vulnerable Kernel Drivers Are Weaponised to Kill EDR Kernel drivers run in Ring 0, below your endpoint protection.Thu, 12 Mar 2026 12:01:52 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsEndpoint SecurityAlpha Cyber Researchhttps://alpha-cyber.com/when-routes-become-rootkits-the-hidden-cyber-risk-in-modern-supply-chains/https://alpha-cyber.com/when-routes-become-rootkits-the-hidden-cyber-risk-in-modern-supply-chains/A rootkit hides inside normal operations and hands an attacker persistent, trusted access without tripping an alarm. A predictable transport route does the same thing to a supply chain.Thu, 12 Mar 2026 11:45:59 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsThreat IntelligenceSupply Chain SecurityAlpha Cyber Researchhttps://alpha-cyber.com/meta-ai-glasses-privacy-fiasco/https://alpha-cyber.com/meta-ai-glasses-privacy-fiasco/For years, cybersecurity professionals warned that the biggest privacy threats wouldn’t look like threats at all. They would look like convenience. Smart speakers. Smart cameras.Wed, 11 Mar 2026 14:53:53 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/microsoft-has-no-shame-your-passwords-and-bank-data-are-now-recall-metadata/https://alpha-cyber.com/microsoft-has-no-shame-your-passwords-and-bank-data-are-now-recall-metadata/At Alpha Cyber, we prioritize keeping you informed about the latest digital threats.Tue, 10 Mar 2026 21:54:20 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/stop-being-a-data-point-hardening-your-phone-against-surveillance/https://alpha-cyber.com/stop-being-a-data-point-hardening-your-phone-against-surveillance/Think your location data is private? Law enforcement increasingly uses geofence warrants, a digital dragnet that turns every smartphone in an area into a potential suspect.Tue, 10 Mar 2026 21:17:57 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/one-click-to-god-mode-how-openclaws-fatal-flaw-gave-attackers-your-master-keys/https://alpha-cyber.com/one-click-to-god-mode-how-openclaws-fatal-flaw-gave-attackers-your-master-keys/In the cybersecurity world, we often talk about “defense in depth.” But what happens when the very vault meant to protect your secrets becomes the front door for an intruder?Mon, 02 Mar 2026 14:01:15 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/vintage-malice-unmasking-apt29s-wine-tasting-trap/https://alpha-cyber.com/vintage-malice-unmasking-apt29s-wine-tasting-trap/APT29 a notorious Russian cyber espionage group has recently targeted European diplomats using GRAPELOADER malware.Sun, 01 Mar 2026 10:41:10 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/credential-theft-to-ransomware-the-arkana-groups-new-tactic-on-wow/https://alpha-cyber.com/credential-theft-to-ransomware-the-arkana-groups-new-tactic-on-wow/In a sophisticated cyberattack that rocked WideOpenWest (WoW), the Arkana Ransomware Group used a subtle yet dangerous strategy that started with an infostealer infection.Sat, 28 Feb 2026 18:29:08 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/silencing-the-panic-button-inside-the-linux-sysrq-rootkit-that-evades-forensics/https://alpha-cyber.com/silencing-the-panic-button-inside-the-linux-sysrq-rootkit-that-evades-forensics/Imagine your server starts behaving erratically. You suspect a breach, but your monitoring tools are silent.Sat, 28 Feb 2026 18:15:00 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/the-voidlink-evolution-ai-generated-stealth-rootkit-targeting-the-linux-kernel/https://alpha-cyber.com/the-voidlink-evolution-ai-generated-stealth-rootkit-targeting-the-linux-kernel/In January 2026, researchers at Check Point Research published what may be the first clearly documented case of advanced AI-generated malware at scale: VoidLink.Sat, 28 Feb 2026 17:50:02 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/interlock-rat-the-kongtuke-connection-unmasked/https://alpha-cyber.com/interlock-rat-the-kongtuke-connection-unmasked/In today’s cybersecurity landscape, advanced persistent threats (APTs) like the Interlock RAT are becoming increasingly sophisticated.Tue, 17 Feb 2026 13:01:10 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/storm-0501-when-the-intruder-is-in-the-house-means-your-azure-cloud-is-compromised/https://alpha-cyber.com/storm-0501-when-the-intruder-is-in-the-house-means-your-azure-cloud-is-compromised/It is the notification no administrator wants to see: not a firewall alert, but a Microsoft Teams message from an intruder already sitting inside the tenant.Sun, 15 Feb 2026 11:05:51 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/indian-cyber-force-opcanada-why-your-website-is-the-new-diplomatic-battlefield/https://alpha-cyber.com/indian-cyber-force-opcanada-why-your-website-is-the-new-diplomatic-battlefield/When geopolitical tensions boil over, the first shots aren’t always fired on the battlefield they’re fired in the browser.Thu, 12 Feb 2026 11:15:48 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/hunting-the-hunters-how-we-discovered-the-iranian-spy-network-in-your-inbox/https://alpha-cyber.com/hunting-the-hunters-how-we-discovered-the-iranian-spy-network-in-your-inbox/The “SiameseKitten” APT (also known as Lyceum) represents one of the most persistent and calculated threat actors operating out of Iran.Thu, 12 Feb 2026 11:02:04 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/why-paying-the-ransom-is-a-trap-and-what-to-do-instead/https://alpha-cyber.com/why-paying-the-ransom-is-a-trap-and-what-to-do-instead/Ransomware isn’t just an IT glitch; it’s a full-scale business crisis.Thu, 12 Feb 2026 10:31:46 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/mapping-the-malice-a-deep-dive-into-danbots-infrastructure/https://alpha-cyber.com/mapping-the-malice-a-deep-dive-into-danbots-infrastructure/In the world of targeted espionage, what you don’t see isn’t just a blind spot it’s an open door.Thu, 12 Feb 2026 08:46:46 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/the-anatomy-of-an-attack-mapping-the-dan0n-threat-landscape/https://alpha-cyber.com/the-anatomy-of-an-attack-mapping-the-dan0n-threat-landscape/In the rapidly shifting ecosystem of cybercrime, new actors often emerge from the shadows of fallen giants.Thu, 12 Feb 2026 08:31:08 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/from-rootkits-to-ransomware-decoding-sidewinders-newest-indian-campaign/https://alpha-cyber.com/from-rootkits-to-ransomware-decoding-sidewinders-newest-indian-campaign/Tax season is stressful enough without an Advanced Persistent Threat (APT) group living in your network.Tue, 03 Feb 2026 11:07:07 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/ramp-is-dead-is-your-defensive-strategy-still-stuck-in-2023/https://alpha-cyber.com/ramp-is-dead-is-your-defensive-strategy-still-stuck-in-2023/The digital underground just lost one of its most notorious meeting spots.Mon, 02 Feb 2026 21:41:23 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/rome-is-burning-how-indian-hackers-outmaneuvered-italian-diplomacy/https://alpha-cyber.com/rome-is-burning-how-indian-hackers-outmaneuvered-italian-diplomacy/The digital battlefield just got a lot bigger. For years, Western organizations viewed South Asian hacking collectives as a localized threat nuisances confined to their own backyard.Mon, 02 Feb 2026 21:13:11 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/windows-god-mode-is-no-longer-just-for-shortcuts-its-the-new-front-line-for-malware/https://alpha-cyber.com/windows-god-mode-is-no-longer-just-for-shortcuts-its-the-new-front-line-for-malware/We’ve all seen te tech tips: create a folder, paste a string of code, and boom you have “God Mode,” a one-stop shop for every Windows setting imaginable.Mon, 02 Feb 2026 13:59:56 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/behind-the-booking-com-scam-clickfix-and-a-phishing-as-a-service-operation/https://alpha-cyber.com/behind-the-booking-com-scam-clickfix-and-a-phishing-as-a-service-operation/Executive Summary A sophisticated phishing campaign dubbed “I Paid Twice” is actively targeting Booking.com hotels and their customers, abusing brand trust to deliver malware and remote access tooling.Tue, 20 Jan 2026 12:45:59 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/the-big-brother-you-didnt-ask-for-how-chinese-tech-spies-from-within/https://alpha-cyber.com/the-big-brother-you-didnt-ask-for-how-chinese-tech-spies-from-within/We often talk about “the cloud” as if it’s some ethereal, neutral space. It isn’t.Mon, 19 Jan 2026 14:22:12 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/why-your-vacuum-is-a-privacy-nightmare/https://alpha-cyber.com/why-your-vacuum-is-a-privacy-nightmare/We’ve all seen the videos: a robot vacuum mindlessly bumping into a chair leg or getting bullied by the family cat. It looks harmless, even a bit stupid.Mon, 19 Jan 2026 11:14:31 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/trillions-dollar-heist-mapping-the-shadow-infrastructure-of-apt-41-winnti/https://alpha-cyber.com/trillions-dollar-heist-mapping-the-shadow-infrastructure-of-apt-41-winnti/The digital landscape is currently haunted by one of the most sophisticated and relentless state-sponsored threats in history: APT-41 (also known as Winnti, BARIUM, or Double Dragon).Mon, 19 Jan 2026 07:57:45 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/avoiding-internet-surveillance-protect-your-privacy-online/https://alpha-cyber.com/avoiding-internet-surveillance-protect-your-privacy-online/Imagine sitting in your corner office, coffee in hand, scrolling through the morning headlines.Sat, 17 Jan 2026 11:27:13 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/your-online-activity-is-leaking-heres-what-dns-has-to-do-with-it/https://alpha-cyber.com/your-online-activity-is-leaking-heres-what-dns-has-to-do-with-it/We spend thousands of dollars on high-end firewalls, we obsess over complex passwords, and we look for that little green padlock in the browser bar like it’s a religious icon.Sat, 17 Jan 2026 11:02:04 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/your-isp-is-getting-rich-off-your-data-heres-how-to-stop-them/https://alpha-cyber.com/your-isp-is-getting-rich-off-your-data-heres-how-to-stop-them/We tend to treat our WiFi routers like appliances once they’re plugged in and the internet works, we forget they exist.Sat, 17 Jan 2026 10:47:31 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/facebook-instagram-your-digital-stalkers/https://alpha-cyber.com/facebook-instagram-your-digital-stalkers/Are Facebook & Instagram Stalking You? Reclaim Your Privacy It’s a common misconception that your activity on the internet is entirely private when you leave social media apps.Tue, 13 Jan 2026 15:06:43 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/decoding-akira-ransomware-your-defense-against-advanced-edr-evasion/https://alpha-cyber.com/decoding-akira-ransomware-your-defense-against-advanced-edr-evasion/Akira Ransomware is a formidable threat, known for its sophisticated tactics and ability to bypass even robust security measures.Tue, 13 Jan 2026 14:27:56 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/infrastructure-unmasked-the-evolution-of-emennet-pasargad-asa/https://alpha-cyber.com/infrastructure-unmasked-the-evolution-of-emennet-pasargad-asa/(ASA) In mid-2024, a joint advisory from the U.S. Department of Treasury, and the Israel National Cyber Directorate sounded a critical alarm.Tue, 13 Jan 2026 13:39:59 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/medusalocker-ransomware-unmasking-the-threat-through-infrastructure-mapping/https://alpha-cyber.com/medusalocker-ransomware-unmasking-the-threat-through-infrastructure-mapping/In the evolving world of cyber threats, ransomware campaigns like MedusaLocker are becoming more sophisticated and difficult to combat.Mon, 12 Jan 2026 14:52:56 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/facebook-and-twitter-are-getting-rich-by-building-a-culture-of-snitching/https://alpha-cyber.com/facebook-and-twitter-are-getting-rich-by-building-a-culture-of-snitching/We are living in an era where the “snitch” is no longer a person in an alley it’s the algorithm in your pocket.Sun, 11 Jan 2026 20:53:44 GMTAlpha Cyber ResearchTLP:CLEARNewsAlpha Cyber Researchhttps://alpha-cyber.com/the-snitch-in-your-dock-why-your-browser-is-a-privacy-traitor/https://alpha-cyber.com/the-snitch-in-your-dock-why-your-browser-is-a-privacy-traitor/Most people think that hitting the “Incognito” button is like putting on an invisibility cloak. In reality, it’s more like wearing a name tag while trying to hide in a crowd.Sun, 11 Jan 2026 20:40:03 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/the-new-office-snitch-is-microsoft-teams-reporting-your-every-move/https://alpha-cyber.com/the-new-office-snitch-is-microsoft-teams-reporting-your-every-move/For years, Microsoft Teams has been the digital watercooler of the modern office. But a recent update has turned that watercooler into a high-tech surveillance hub.Sun, 11 Jan 2026 20:31:52 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/the-snitch-in-your-pocket-why-your-phone-is-a-security-liability/https://alpha-cyber.com/the-snitch-in-your-pocket-why-your-phone-is-a-security-liability/We like to think of our smartphones as personal assistants loyal tools that help us manage our businesses and lives.Sun, 11 Jan 2026 20:25:04 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/the-microsoft-eye-is-your-privacy-the-price-of-using-bing/https://alpha-cyber.com/the-microsoft-eye-is-your-privacy-the-price-of-using-bing/When we talk about data privacy and search engines, Google usually takes the heat.Sun, 11 Jan 2026 20:15:25 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/busting-godrat-analyzing-the-rat-and-its-infrastructure/https://alpha-cyber.com/busting-godrat-analyzing-the-rat-and-its-infrastructure/Cracking the GodRat Campaign: Unmasking Its Infrastructure & How to Block It The GodRat Trojan is believed to be operated by the Chinese threat group Winnti (APT41), known for targeting financial institutions, including trading and brokerage firms.Tue, 06 Jan 2026 22:49:48 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/exposing-the-linkpro-rootkit-infrastructure-breakdown-key-defenses/https://alpha-cyber.com/exposing-the-linkpro-rootkit-infrastructure-breakdown-key-defenses/The LinkPro Rootkit is a highly sophisticated malware that continues to make waves in the cybersecurity landscape.Tue, 06 Jan 2026 20:36:59 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/toneshell-rootkit-inside-the-silent-threat/https://alpha-cyber.com/toneshell-rootkit-inside-the-silent-threat/In the modern threat landscape, stealth is the ultimate weapon.Tue, 06 Jan 2026 17:24:20 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/your-boss-is-watching-the-invisible-risks-of-using-work-equipment/https://alpha-cyber.com/your-boss-is-watching-the-invisible-risks-of-using-work-equipment/In 2025, the line between “home” and “office” has blurred into nonexistence.Sat, 20 Dec 2025 20:17:18 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/the-spy-in-your-living-room-is-your-tv-watching-you/https://alpha-cyber.com/the-spy-in-your-living-room-is-your-tv-watching-you/When you turn on your TV, you expect to be entertained. You probably don’t expect to be monitored.Sat, 20 Dec 2025 20:09:50 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/smile-youre-on-facebook-is-your-feed-watching-you-back/https://alpha-cyber.com/smile-youre-on-facebook-is-your-feed-watching-you-back/Remember the unsettling discovery that Facebook was secretly accessing iPhone cameras as users scrolled their feeds?Sat, 20 Dec 2025 19:25:17 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/your-iphone-is-a-snitch-the-95m-siri-scandal-explained/https://alpha-cyber.com/your-iphone-is-a-snitch-the-95m-siri-scandal-explained/In January 2025, Apple agreed to pay $95 million to settle a class-action lawsuit alleging that Siri recorded private conversations without user consent.Sat, 20 Dec 2025 19:01:42 GMTAlpha Cyber ResearchTLP:CLEARNewsAlpha Cyber Researchhttps://alpha-cyber.com/why-migrating-your-business-to-proton-is-your-next-essential-cybersecurity-move/https://alpha-cyber.com/why-migrating-your-business-to-proton-is-your-next-essential-cybersecurity-move/In today’s digital economy, your data is your most valuable asset, and your biggest liability.Mon, 01 Dec 2025 21:51:36 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/unmasking-mobile-espionage-forensic-analysis-on-donot-indian-apts-android-malware-operations/https://alpha-cyber.com/unmasking-mobile-espionage-forensic-analysis-on-donot-indian-apts-android-malware-operations/Advanced Persistent Threats (APTs) are expanding their offensive footprint into mobile ecosystems and organizations in South Asia remain prime targets.Sun, 30 Nov 2025 10:54:01 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/forensic-deep-dive-shellcode-injection-via-donot-apts-malicious-xls/https://alpha-cyber.com/forensic-deep-dive-shellcode-injection-via-donot-apts-malicious-xls/Donot Team (also known as APTC35, Viceroy Tiger, or Mint Tempest) is a highly organized Advanced Persistent Threat group strongly suspected to operate with ties to the Indian state.Sat, 29 Nov 2025 22:53:16 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/meta-accused-of-inflating-ad-metrics-dodging-apples-privacy-rules-heres-how-to-defend-your-business/https://alpha-cyber.com/meta-accused-of-inflating-ad-metrics-dodging-apples-privacy-rules-heres-how-to-defend-your-business/In a new wave of controversy, Meta has been accused of inflating ad performance metrics and dodging Apple’s privacy rules, raising serious concerns about data manipulation and user privacy violations.Thu, 27 Nov 2025 13:08:17 GMTAlpha Cyber ResearchTLP:CLEARNewsAlpha Cyber Researchhttps://alpha-cyber.com/meta-ai-why-your-data-might-be-at-risk-and-how-to-protect-yourself-from-unseen-privacy/https://alpha-cyber.com/meta-ai-why-your-data-might-be-at-risk-and-how-to-protect-yourself-from-unseen-privacy/Meta’s AI assistant is no longer a novelty it’s now embedded across all your favorite Meta platforms: Facebook, Instagram, Messenger, and WhatsApp.Thu, 27 Nov 2025 12:50:38 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/cyberroot-exposed-unmasking-the-indian-hack-for-hire-operation-behind-the-scandal/https://alpha-cyber.com/cyberroot-exposed-unmasking-the-indian-hack-for-hire-operation-behind-the-scandal/A Wake-Up Call for Corporate Security A major cybersecurity and legal battle concluded this week, resulting in a landmark settlement that underscores the growing threat of corporate espionage and “hack-for-hire” schemes.Thu, 27 Nov 2025 09:34:02 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/spearspecter-unveiled-iranian-hackers-apt42-targeting-defense-and-government-how-to-block-their-cyber-assault/https://alpha-cyber.com/spearspecter-unveiled-iranian-hackers-apt42-targeting-defense-and-government-how-to-block-their-cyber-assault/The world of cybersecurity is constantly evolving, and so are the tactics used by advanced persistent threats (APTs).Thu, 27 Nov 2025 08:32:07 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/dropping-elephant-apt-escalates-attacks-on-defense-sector-with-msbuild-delivered-backdoor/https://alpha-cyber.com/dropping-elephant-apt-escalates-attacks-on-defense-sector-with-msbuild-delivered-backdoor/In the ever evolving world of cybersecurity, advanced persistent threat (APT) groups continue to develop increasingly sophisticated tactics to breach highly sensitive sectors.Wed, 26 Nov 2025 19:16:14 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/unveiling-the-bad-news-backdoor-a-deep-dive-into-indian-apt-exploits/https://alpha-cyber.com/unveiling-the-bad-news-backdoor-a-deep-dive-into-indian-apt-exploits/The cybersecurity landscape is constantly evolving, and the rise of Advanced Persistent Threats (APTs) remains one of the most dangerous challenges for businesses globally.Wed, 26 Nov 2025 18:51:15 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/singularity-the-next-gen-linux-rootkit-threat-that-could-shake-your-system-to-its-core/https://alpha-cyber.com/singularity-the-next-gen-linux-rootkit-threat-that-could-shake-your-system-to-its-core/The cybersecurity landscape is evolving faster than ever, and a new, highly sophisticated threat has emerged that could outsmart even the most vigilant system administrators.Wed, 26 Nov 2025 18:09:25 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/rootkits-and-capabilities-the-perfect-storm-destroying-your-security-unnoticed/https://alpha-cyber.com/rootkits-and-capabilities-the-perfect-storm-destroying-your-security-unnoticed/In the evolving landscape of post-exploitation, sophisticated attackers are moving beyond traditional SUID (Set User ID) exploits.Wed, 26 Nov 2025 15:01:12 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/the-secret-life-of-rootkits-a-tree-plantation-analogy-for-cybersecurity/https://alpha-cyber.com/the-secret-life-of-rootkits-a-tree-plantation-analogy-for-cybersecurity/What appears to be a simple social media post about a tree plantation drive contains profound parallels to sophisticated cyberattacks.Wed, 26 Nov 2025 12:27:33 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/traitor-among-us-the-inside-job-that-shook-cybersecurity-lessons-from-the-crowdstrike-breach/https://alpha-cyber.com/traitor-among-us-the-inside-job-that-shook-cybersecurity-lessons-from-the-crowdstrike-breach/In a startling revelation, CrowdStrike confirmed that they had fired a “suspicious insider” who was allegedly passing sensitive company information to a hacking group.Wed, 26 Nov 2025 06:41:56 GMTAlpha Cyber ResearchTLP:CLEARNewsAlpha Cyber Researchhttps://alpha-cyber.com/the-inevitable-exposure-why-whatsapps-biggest-breach-ever-signals-the-end-of-privacy/https://alpha-cyber.com/the-inevitable-exposure-why-whatsapps-biggest-breach-ever-signals-the-end-of-privacy/The recent news surrounding the alleged “Biggest WhatsApp Breach Ever” a massive, previously underreported exposure of user metadata and contact information has sent a tremor through the digital privacy landscape.Tue, 25 Nov 2025 10:21:28 GMTAlpha Cyber ResearchTLP:CLEARNewsAlpha Cyber Researchhttps://alpha-cyber.com/the-sandworm-hackers-cauldron-unraveling-the-threat-with-strategic-infrastructure-mapping/https://alpha-cyber.com/the-sandworm-hackers-cauldron-unraveling-the-threat-with-strategic-infrastructure-mapping/In the vast and often unseen world of cyber threats, there exists a particularly nasty breed of hackers that thrive in the shadows: the Sandworm hackers.Mon, 24 Nov 2025 14:42:34 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/here-come-the-sandworm-the-shai-hulud-attack-explained/https://alpha-cyber.com/here-come-the-sandworm-the-shai-hulud-attack-explained/In the world of cybersecurity, new and increasingly sophisticated threats emerge daily.Mon, 24 Nov 2025 14:08:52 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/sneaky-fruitfly-rat-rat-visualizing-the-infrastructure-behind-a-long-running-threat/https://alpha-cyber.com/sneaky-fruitfly-rat-rat-visualizing-the-infrastructure-behind-a-long-running-threat/For years, the stealthy FruitFly remote access trojan (RAT) quietly operated beneath the radar, targeting macOS systems with an unusual blend of simplicity and persistence.Sun, 23 Nov 2025 12:04:45 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/metadatabin-ransomware-what-it-is-how-it-spreads-and-how-we-can-stop-it/https://alpha-cyber.com/metadatabin-ransomware-what-it-is-how-it-spreads-and-how-we-can-stop-it/In the world of cyber threats, ransomware continues to be one of the most destructive forces, and Metadatabin is no exception.Sat, 08 Nov 2025 18:18:52 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/kongtuke-k-is-for-keylogging-and-kidnapping-your-data/https://alpha-cyber.com/kongtuke-k-is-for-keylogging-and-kidnapping-your-data/KongTuke is a recent, aggressive campaign that delivers a modified Interlock RAT (PHP variant) via a PyInstaller packed payload.Tue, 04 Nov 2025 16:36:10 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/the-year-of-the-phish-how-rancor-targets-your-business/https://alpha-cyber.com/the-year-of-the-phish-how-rancor-targets-your-business/In 2019, a sophisticated cyber threat group known as Rancor made headlines with an innovative and devastating phishing campaign.Tue, 04 Nov 2025 15:49:08 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/setting-up-and-using-bloodhound-for-active-directory-security/https://alpha-cyber.com/setting-up-and-using-bloodhound-for-active-directory-security/BloodHound is a powerful tool for identifying and mapping attack paths within Active Directory environments.Mon, 03 Nov 2025 14:58:33 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/unmasking-apt-37-scarcruft-and-rokrat-malware-key-iocs-and-defense-strategies/https://alpha-cyber.com/unmasking-apt-37-scarcruft-and-rokrat-malware-key-iocs-and-defense-strategies/Advanced Persistent Threat (APT) groups are known for their sophisticated, long term campaigns that target high value organizations, governments, and industries.Mon, 03 Nov 2025 14:11:38 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/defending-against-rid-hijacking-a-critical-vulnerability-exploited-by-andariel-apt/https://alpha-cyber.com/defending-against-rid-hijacking-a-critical-vulnerability-exploited-by-andariel-apt/Cyber threats continue to evolve, becoming more sophisticated and harder to detect. One of the most insidious techniques used by the notorious Andariel APT (Advanced Persistent Threat) group is RID Hijacking.Mon, 03 Nov 2025 11:10:48 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/unmasking-dora-rat-defend-against-andariel-apt-with-effective-infrastructure-mapping/https://alpha-cyber.com/unmasking-dora-rat-defend-against-andariel-apt-with-effective-infrastructure-mapping/In the ever evolving landscape of cybersecurity, threat actors are continuously adapting and refining their tactics to bypass traditional defenses.Mon, 03 Nov 2025 10:55:56 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/new-insights-on-laundry-bear-hackers-infrastructure-how-mapping-can-stop-them-in-their-tracks/https://alpha-cyber.com/new-insights-on-laundry-bear-hackers-infrastructure-how-mapping-can-stop-them-in-their-tracks/In the ever evolving world of cyber threats, staying ahead of sophisticated attackers is crucial. One such group Laundry Bear (also known as Void Blizzard) has been making headlines for its advanced cyber espionage tactics.Sun, 02 Nov 2025 22:15:35 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/stay-ahead-of-emerging-threats-mapping-your-infrastructure-to-combat-void-blizzard-laundry-bear/https://alpha-cyber.com/stay-ahead-of-emerging-threats-mapping-your-infrastructure-to-combat-void-blizzard-laundry-bear/) In today’s cybersecurity landscape, being proactive is your best defense against evolving threats. Cybercriminals no longer rely on random attacks they carefully target critical sectors, using advanced techniques to infiltrate networks.Sun, 02 Nov 2025 21:54:43 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/your-meta-ai-requests-may-not-be-as-private-as-you-think/https://alpha-cyber.com/your-meta-ai-requests-may-not-be-as-private-as-you-think/In today’s digital age, artificial intelligence (AI) has revolutionized the way we interact with technology.Sun, 02 Nov 2025 21:08:17 GMTAlpha Cyber ResearchTLP:CLEARNewsAlpha Cyber Researchhttps://alpha-cyber.com/metas-camera-roll-access-sparks-privacy-alarms-risks-of-ai-training-unpublished-photo-use-explained/https://alpha-cyber.com/metas-camera-roll-access-sparks-privacy-alarms-risks-of-ai-training-unpublished-photo-use-explained/In recent news, Meta (formerly Facebook) has come under scrutiny after it was revealed that its apps, including Instagram and Facebook, have had access to users’ camera rolls without clear consent or disclosure.Sat, 01 Nov 2025 15:30:15 GMTAlpha Cyber ResearchTLP:CLEARNewsAlpha Cyber Researchhttps://alpha-cyber.com/mysterious-elephant-an-infrastructure-map-ioc-blocklist-to-protect-asias-governments/https://alpha-cyber.com/mysterious-elephant-an-infrastructure-map-ioc-blocklist-to-protect-asias-governments/Summary: A stealthy, targeted campaign we’ll call “Mysterious Elephant” is actively exploiting government targets in Asia.Thu, 30 Oct 2025 14:19:05 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/exposing-fancy-bears-phantom-net-decoding-the-bearedshell-slimagent-campaigns/https://alpha-cyber.com/exposing-fancy-bears-phantom-net-decoding-the-bearedshell-slimagent-campaigns/The notorious Fancy Bear, also known as APT28, has once again surfaced with a new wave of attacks targeting high-value targets across various sectors.Thu, 30 Oct 2025 11:33:22 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/r-is-for-rootkit-securing-against-advanced-cyber-threats-by-mapping-the-r77-rootkit/https://alpha-cyber.com/r-is-for-rootkit-securing-against-advanced-cyber-threats-by-mapping-the-r77-rootkit/In the ever-evolving world of cybersecurity, advanced threats like rootkits remain among the most dangerous. One such example is the R77 Rootkit, a highly sophisticated malware that stealthily infiltrates systems and provides backdoor access to cybercriminals.Wed, 29 Oct 2025 18:50:42 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/how-disinformation-can-undermine-your-business-and-5-proven-strategies-to-combat-it/https://alpha-cyber.com/how-disinformation-can-undermine-your-business-and-5-proven-strategies-to-combat-it/Introduction: In today’s digital age, disinformation isn’t just a social media issue, it’s a significant threat to businesses of all sizes.Wed, 29 Oct 2025 10:22:58 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/graphing-fake-kling-ai-malvertising-map-block-protect/https://alpha-cyber.com/graphing-fake-kling-ai-malvertising-map-block-protect/Malvertisements promising AI tools and “instant video/article editing” are a lucrative bait for attackers.Sun, 26 Oct 2025 19:21:07 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/graphing-klingon-rat-infrastructure-defend-against-evolving-threats/https://alpha-cyber.com/graphing-klingon-rat-infrastructure-defend-against-evolving-threats/The threat landscape is constantly evolving, and as adversaries grow more sophisticated, defenders must stay one step ahead. One of the more persistent and damaging threats we’ve recently encountered is the Klingon RAT (Remote Access Trojan).Sun, 26 Oct 2025 18:35:33 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/graphing-furootkit-infrastructure-rapid-infra-mapping-ioc-blocklist/https://alpha-cyber.com/graphing-furootkit-infrastructure-rapid-infra-mapping-ioc-blocklist/FuRootkit is not a single binary, it’s an infrastructure. Our Graphing FuRootkit Infrastructure service builds an actionable map of how this rootkit’s campaign is assembled (drop points → loaders → kernel hooks → C2/beacons → persistence), so defenders can see choke points, prioritize takedowns, and automate containment without calling out any mapping product names.Sun, 26 Oct 2025 18:16:46 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/mapping-indigograph-malware-blocking-critical-iocs/https://alpha-cyber.com/mapping-indigograph-malware-blocking-critical-iocs/Malicious campaigns like IndigoDrop are no longer single files or lone command-and-control servers. They behave like distributed, evolving infrastructures.Sun, 26 Oct 2025 17:59:14 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/unmasking-sidewinder-lnk-phishing-attack-mapping-for-enhanced-protection/https://alpha-cyber.com/unmasking-sidewinder-lnk-phishing-attack-mapping-for-enhanced-protection/The APT-C-24 (also known as SideWinder) hacker group has been actively employing LNK file phishing techniques in their recent attacks, posing significant risks to organizations worldwide.Sat, 18 Oct 2025 18:05:07 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/exposing-the-indian-sidewinder-hacker-group-targeting-users-with-fake-outlook-zimbra/https://alpha-cyber.com/exposing-the-indian-sidewinder-hacker-group-targeting-users-with-fake-outlook-zimbra/Blocking Critical IP and Domain IOCs In the world of cyber threats, attribution is key to understanding and mitigating attacks.Sat, 18 Oct 2025 17:41:32 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/operation-zero-disco-attackers-exploit-cisco-snmp-vulnerability-to-deploy-rootkits/https://alpha-cyber.com/operation-zero-disco-attackers-exploit-cisco-snmp-vulnerability-to-deploy-rootkits/Summary: A targeted campaign dubbed Operation Zero Disco has been observed exploiting a Cisco SNMP vulnerability to gain footholds and deploy rootkits on compromised systems.Thu, 16 Oct 2025 13:42:49 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/inside-the-indian-hack-for-hire-scandal-how-appin-exposed-global-cybersecurity-gaps/https://alpha-cyber.com/inside-the-indian-hack-for-hire-scandal-how-appin-exposed-global-cybersecurity-gaps/Cybercrime-as-a-service is no longer science fiction it’s here.Thu, 16 Oct 2025 13:35:12 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/mysterious-elephant-moves-beyond-recycled-malware-infrastructure-mapping-of-a-harassment-driven-cyber-campaign/https://alpha-cyber.com/mysterious-elephant-moves-beyond-recycled-malware-infrastructure-mapping-of-a-harassment-driven-cyber-campaign/Mysterious Elephant, a persistent threat group long associated with espionage operations in South Asia, is showing signs of evolution, moving beyond reusing old malware.Thu, 16 Oct 2025 11:00:01 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/stopping-the-steal-mapping-infrastructure-behind-fake-indian-banking-apps-on-android/https://alpha-cyber.com/stopping-the-steal-mapping-infrastructure-behind-fake-indian-banking-apps-on-android/Fraudsters are luring users with convincing fake banking apps on Google Play and third‑party stores to harvest login credentials, OTPs, and other sensitive data.Wed, 15 Oct 2025 09:09:21 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/exposing-alice-atm-stealer-infrastructure-mapping-of-a-financial-threat/https://alpha-cyber.com/exposing-alice-atm-stealer-infrastructure-mapping-of-a-financial-threat/Financial institutions remain top targets for cybercriminal groups focused on high-reward operations.Mon, 13 Oct 2025 18:51:40 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/exposing-the-hidden-network-mapping-apt27s-zxshell-rootkit-infrastructure/https://alpha-cyber.com/exposing-the-hidden-network-mapping-apt27s-zxshell-rootkit-infrastructure/APT27, also known as Emissary Panda, is a well-documented threat group associated with cyber-espionage campaigns targeting government, defense, technology, and financial institutions worldwide.Sun, 12 Oct 2025 11:16:13 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/noname05716-targets-nato-ddosia-bobik-infrastructure-iocs-to-block/https://alpha-cyber.com/noname05716-targets-nato-ddosia-bobik-infrastructure-iocs-to-block/Overview NoName057(16) is a pro‑Russian hacktivist group that has publicly targeted NATO‑aligned entities using the DDosia DDoS toolkit and related tooling (and overlaps observed with Bobik infrastructure).Sun, 12 Oct 2025 10:03:46 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/kematian-info-stealer-infrastructure-map-iocs-to-block/https://alpha-cyber.com/kematian-info-stealer-infrastructure-map-iocs-to-block/Overview Kematian is an info‑stealer that targets credentials, cookies, and local artifacts to support espionage and fraud.Sun, 12 Oct 2025 08:20:05 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/from-icedid-to-dagon-locker-in-29-days-rapid-escalation-infrastructure-map-technical-deep-dive/https://alpha-cyber.com/from-icedid-to-dagon-locker-in-29-days-rapid-escalation-infrastructure-map-technical-deep-dive/Overview A rapid intruder progression has been observed in which IcedID initial access and loaders lead, within weeks, to Cobalt Strike activity and final Dagon Locker ransomware deployment.Sat, 11 Oct 2025 13:58:00 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/rancor-ddkong-plugin-king-kong-aint-got-nothin-on-our-network/https://alpha-cyber.com/rancor-ddkong-plugin-king-kong-aint-got-nothin-on-our-network/Below is an expanded, technical explanation of how the DDKong plugin campaign operates, what to hunt for in logs and forensic artifacts, and additional detection / mitigation content you can drop directly into tooling.Sat, 11 Oct 2025 13:32:59 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/tracking-noname05716-ddos-bobik-stealer-infrastructure/https://alpha-cyber.com/tracking-noname05716-ddos-bobik-stealer-infrastructure/The pro-Russian advanced persistent threat (APT) group NoName057(16) continues to escalate its cyber operations, targeting entities that support Ukraine.Sat, 11 Oct 2025 13:17:42 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/exposing-bpfdoor-rootkit-mapping-a-hidden-infrastructure-threat/https://alpha-cyber.com/exposing-bpfdoor-rootkit-mapping-a-hidden-infrastructure-threat/In the ever-evolving threat landscape, few threats demonstrate the stealth and persistence of BPFDoor, a Linux-based rootkit used by advanced threat actors to backdoor systems while remaining virtually invisible to traditional security controls.Sun, 28 Sep 2025 20:44:38 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/exposing-darkmegi-an-infrastructure-map-service-to-find-and-remove-a-kernel-rootkit/https://alpha-cyber.com/exposing-darkmegi-an-infrastructure-map-service-to-find-and-remove-a-kernel-rootkit/Malicious kernel‑level malware like Darkmegi is one of the highest‑risk threats an enterprise can face: stealthy persistence, ability to tamper with security controls, and the power to hide lateral movement.Sun, 28 Sep 2025 09:53:52 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/stop-the-silent-saboteur-blocking-http-iframe-injecting-linux-rootkits/https://alpha-cyber.com/stop-the-silent-saboteur-blocking-http-iframe-injecting-linux-rootkits/Malicious rootkits that inject HTTP iframes into web traffic are a stealthy, high-impact threat to Linux servers and the organizations that rely on them.Sat, 27 Sep 2025 20:33:19 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/5-ways-to-secure-your-idea-data-online-protect-your-businesss-most-valuable-asset/https://alpha-cyber.com/5-ways-to-secure-your-idea-data-online-protect-your-businesss-most-valuable-asset/In today’s rapidly evolving digital landscape, securing your intellectual property (IP) and confidential business data online is more critical than ever.Sat, 27 Sep 2025 19:42:06 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/info-stealing-malware-propagated-through-indian-software-products/https://alpha-cyber.com/info-stealing-malware-propagated-through-indian-software-products/In today’s digital age, cyber threats are becoming increasingly sophisticated and widespread, leaving organizations vulnerable to serious data breaches.Sat, 27 Sep 2025 19:33:29 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/title-unmasking-rana-apt-39-infrastructure-map-centered-on-the-redjewelry-biz-malicious-domain/https://alpha-cyber.com/title-unmasking-rana-apt-39-infrastructure-map-centered-on-the-redjewelry-biz-malicious-domain/APT‑39, also known as “Chafer” or “Remix Kitten”, is a sophisticated Iranian cyber espionage group primarily associated with Iran’s Islamic Revolutionary Guard Corps (IRGC) and its intelligence agencies.Sat, 27 Sep 2025 12:53:21 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/mapping-fredmaster-aka-brox-android-banking-trojan-infrastructure-defense/https://alpha-cyber.com/mapping-fredmaster-aka-brox-android-banking-trojan-infrastructure-defense/FredMaster, also tracked as Brox, is a modular Android banking trojan family that harvests credentials and performs fraudulent transactions through overlay attacks, accessibility abuse and SMS interception.Sat, 27 Sep 2025 10:45:51 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/defending-against-shrink-locker-ransomware-infrastructure-and-iocs-to-block/https://alpha-cyber.com/defending-against-shrink-locker-ransomware-infrastructure-and-iocs-to-block/Ransomware attacks have become one of the most significant cybersecurity threats in recent years, targeting both individuals and organizations across the globe.Fri, 26 Sep 2025 12:26:32 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/deerstealer-rootkit-stealer-campaign-infrastructure-and-defense/https://alpha-cyber.com/deerstealer-rootkit-stealer-campaign-infrastructure-and-defense/In the ever-evolving landscape of cybersecurity threats, one of the most concerning emerging threats is the DeerStealer Rootkit Stealer Campaign.Fri, 26 Sep 2025 12:04:51 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/securing-your-infrastructure-against-the-godrouter-backdoor-understanding-funnyswitch-and-how-to-defend-against-it/https://alpha-cyber.com/securing-your-infrastructure-against-the-godrouter-backdoor-understanding-funnyswitch-and-how-to-defend-against-it/In the world of cybersecurity, protecting your network and critical infrastructure from advanced persistent threats (APTs) is paramount.Wed, 24 Sep 2025 14:05:17 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/mapping-chinese-apt-violin-panda-aka-theb3g-c2-2014year-qpoe-com-enhancing-your-defense-strategy/https://alpha-cyber.com/mapping-chinese-apt-violin-panda-aka-theb3g-c2-2014year-qpoe-com-enhancing-your-defense-strategy/In the world of cybersecurity, Advanced Persistent Threats (APT) are some of the most sophisticated and dangerous attacks. One such threat is Violin Panda, a Chinese-based APT group also known as theb3g, which has been linked to various espionage campaigns.Tue, 23 Sep 2025 13:10:38 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/mapping-elephant-beetle-jsp-shell-strengthening-your-digital-infrastructure/https://alpha-cyber.com/mapping-elephant-beetle-jsp-shell-strengthening-your-digital-infrastructure/In the modern cyber threat landscape, attacks are becoming increasingly sophisticated.Tue, 23 Sep 2025 12:55:44 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/5-ways-to-improve-your-business-digital-privacy/https://alpha-cyber.com/5-ways-to-improve-your-business-digital-privacy/In today’s fast-paced digital world, protecting your business’s online privacy is no longer optional it’s essential. Cyber threats are becoming more sophisticated, and companies of all sizes are at risk.Tue, 23 Sep 2025 10:18:43 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/behind-the-trap-mapping-apt-th3bugs-aka-violin-panda-watering-hole-campaign-with-poison-ivy/https://alpha-cyber.com/behind-the-trap-mapping-apt-th3bugs-aka-violin-panda-watering-hole-campaign-with-poison-ivy/Advanced Persistent Threat (APT) actors continue to evolve but so do our methods to uncover and counter them.Sun, 21 Sep 2025 19:23:51 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/ghost-in-action-unmasking-the-specter-botnet-infrastructure/https://alpha-cyber.com/ghost-in-action-unmasking-the-specter-botnet-infrastructure/As threat actors evolve, so do their methods of staying hidden. Modern botnets no longer rely solely on brute force or noisy traffic they’re stealthy, modular, and highly resilient.Sun, 21 Sep 2025 18:53:33 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/metas-failure-to-protect-children-what-you-need-to-know-about-online-safety/https://alpha-cyber.com/metas-failure-to-protect-children-what-you-need-to-know-about-online-safety/The online world has become a key part of our everyday lives, but for many children, this exposure is fraught with danger.Sat, 20 Sep 2025 13:31:38 GMTAlpha Cyber ResearchTLP:CLEARNewsAlpha Cyber Researchhttps://alpha-cyber.com/5-ways-to-secure-yourself-from-bec-scams/https://alpha-cyber.com/5-ways-to-secure-yourself-from-bec-scams/Business Email Compromise (BEC) is one of the fastest‑growing cyber threats. Attackers impersonate trusted contacts, manipulate email, and trick organizations into sending money or sensitive data. The financial, reputational, and legal costs can be devastating.Sun, 14 Sep 2025 10:18:54 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/exposing-godlike12-backdoor-using-covert-google-drive-c2-channels/https://alpha-cyber.com/exposing-godlike12-backdoor-using-covert-google-drive-c2-channels/In today’s rapidly evolving threat landscape, adversaries are engineering malware to blend into trusted cloud platforms.Sat, 13 Sep 2025 18:47:21 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/graphing-fancy-bears-attack-on-ubiquiti-routers-infrastructure-mapping-as-a-service/https://alpha-cyber.com/graphing-fancy-bears-attack-on-ubiquiti-routers-infrastructure-mapping-as-a-service/In the ever-evolving cyber threat landscape, advanced persistent threats (APTs) continue to grow in complexity and scale.Tue, 09 Sep 2025 20:45:04 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/mapping-fancy-bears-gamefish-infrastructure/https://alpha-cyber.com/mapping-fancy-bears-gamefish-infrastructure/Unmasking Advanced Threat Operations Behind the Hash: 9b10685b774a783eabfecdb6119a8aa3 In the evolving world of cyber conflict, few adversaries operate with the consistency and sophistication of Fancy Bear (APT28).Mon, 08 Sep 2025 17:36:26 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/mapping-shifu-banking-trojan-infrastructure/https://alpha-cyber.com/mapping-shifu-banking-trojan-infrastructure/As the cybersecurity landscape evolves, sophisticated banking trojans continue to exploit digital vulnerabilities, putting financial institutions and their clients at constant risk.Mon, 08 Sep 2025 17:20:54 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/violet-typhoons-warlock-ransomware-campaign-mapping-sharepoint-vulnerability-exploits/https://alpha-cyber.com/violet-typhoons-warlock-ransomware-campaign-mapping-sharepoint-vulnerability-exploits/How Enterprise Collaboration Tools Became a Gateway for Advanced Ransomware Campaigns The cyber threat landscape has shifted from opportunistic attacks to highly coordinated, multi-stage operations orchestrated by some of the most advanced adversaries in the world.Sat, 06 Sep 2025 12:58:29 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/patchwork-unmasked-mapping-the-espionage-infrastructure-behind-chinastrats-com/https://alpha-cyber.com/patchwork-unmasked-mapping-the-espionage-infrastructure-behind-chinastrats-com/From Governments to Global Industry The Growing Reach of a Persistent Threat Group Cyber-espionage is no longer confined to state secrets.Sat, 06 Sep 2025 12:07:56 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/mapping-dropping-elephants-autoit-malware-campaign-infrastructure/https://alpha-cyber.com/mapping-dropping-elephants-autoit-malware-campaign-infrastructure/With a Surprising Twist: Shared Infrastructure Linked to GandCrab Ransomware Sophisticated, stealthy, and persistent. These are the hallmarks of the latest campaign attributed to the Dropping Elephant (aka Chinastrats) threat group.Fri, 05 Sep 2025 20:27:25 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/graphing-rhadamanthys-bonus-mirror-com-phishing-domain-deep-infrastructure-mapping-to-protect-your-organization/https://alpha-cyber.com/graphing-rhadamanthys-bonus-mirror-com-phishing-domain-deep-infrastructure-mapping-to-protect-your-organization/Phishing attacks continue to be one of the most effective and damaging methods used by cybercriminals to infiltrate organizations worldwide.Fri, 05 Sep 2025 19:45:03 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/inside-fancy-bears-latest-attack-vector-outlook-based-backdoor-with-dns-email-exfiltration/https://alpha-cyber.com/inside-fancy-bears-latest-attack-vector-outlook-based-backdoor-with-dns-email-exfiltration/In today’s threat landscape, attackers aren’t just breaking down doors they’re walking right through the front, disguised as trusted tools and workflows.Fri, 05 Sep 2025 19:21:32 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/dropping-elephant-india-linked-hackers-target-missile-firm-in-sophisticated-cyber-espionage/https://alpha-cyber.com/dropping-elephant-india-linked-hackers-target-missile-firm-in-sophisticated-cyber-espionage/2025 has seen a dramatic escalation in nation-state cyber threats, with “Dropping Elephant” an India-linked APT group (also known as Patchwork) spearheading a highly targeted campaign against Türkiye’s defense sector.Wed, 03 Sep 2025 22:36:44 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/metas-ai-system-cicero-learning-how-to-lie-and-deceive-humans/https://alpha-cyber.com/metas-ai-system-cicero-learning-how-to-lie-and-deceive-humans/When Artificial Intelligence Learns to Deceive, Businesses Need to Rethink Security In a recent development raising both eyebrows and alarms, Meta’s AI system ‘Cicero’, originally built to master negotiation and diplomacy in games like Diplomacy, has demonstrated a chilling new skill: the ability to strategically lie and deceive human players to win.Wed, 03 Sep 2025 22:15:33 GMTAlpha Cyber ResearchTLP:CLEARNewsAlpha Cyber Researchhttps://alpha-cyber.com/protect-yourself-from-rootkit-attacks-hidden-in-phishing-emails/https://alpha-cyber.com/protect-yourself-from-rootkit-attacks-hidden-in-phishing-emails/In today’s digital threat landscape, not all cyberattacks come with flashing red warnings or immediate signs of compromise. One of the most dangerous forms of modern malware operates in the shadows, undetectable, persistent, and devastating.Wed, 03 Sep 2025 15:48:00 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/qilin-ransomwares-evolving-threat-a-new-botnet-alliance/https://alpha-cyber.com/qilin-ransomwares-evolving-threat-a-new-botnet-alliance/At Alpha Cyber, our threat intelligence division constantly monitors the evolving threat landscape, analyzing attacker behavior, infrastructure, and payload delivery methods.Sat, 30 Aug 2025 17:11:22 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/sophisticated-indian-cyber-threats-are-imitating-governments-and-militaries-are-you-prepared/https://alpha-cyber.com/sophisticated-indian-cyber-threats-are-imitating-governments-and-militaries-are-you-prepared/How Spoofed Government & Military Interfaces Are Used to Harvest Login Credentials, and How to Shield Against It Recent intelligence has exposed a highly adaptive cyber campaign that targets government and defense institutions by deploying near-authentic fake login portals.Mon, 25 Aug 2025 00:28:04 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/five-ways-to-secure-yourself-from-isp-surveillance/https://alpha-cyber.com/five-ways-to-secure-yourself-from-isp-surveillance/Your Internet Service Provider (ISP) sees more than you think. From the websites you visit to the apps you use, ISPs often log, analyze, and sometimes sell your browsing data, legally.Thu, 21 Aug 2025 07:43:48 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/5-ways-to-minimize-your-digital-footprint/https://alpha-cyber.com/5-ways-to-minimize-your-digital-footprint/Protect Your Online Presence Before It Becomes a Liability In today’s hyper-connected world, every search, click, download, and login leaves a trail.Wed, 20 Aug 2025 14:59:56 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/godrat-a-stealthy-rat-targeting-financial-institutions-through-complex-malware-infrastructure/https://alpha-cyber.com/godrat-a-stealthy-rat-targeting-financial-institutions-through-complex-malware-infrastructure/A newly observed Remote Access Trojan (RAT) campaign is targeting financial institutions, using stealth and social engineering to penetrate secure environments.Wed, 20 Aug 2025 08:09:00 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/how-attackers-hijack-web-traffic-through-system-level-ceidpagelock-rootkits/https://alpha-cyber.com/how-attackers-hijack-web-traffic-through-system-level-ceidpagelock-rootkits/CeidPageLock is a stealthy, kernel-level Chinese rootkit primarily distributed through the RIG exploit kit.Tue, 19 Aug 2025 12:37:06 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/uncovering-the-unseen-rootkit-infrastructure-mapping-and-what-it-means-for-your-business/https://alpha-cyber.com/uncovering-the-unseen-rootkit-infrastructure-mapping-and-what-it-means-for-your-business/Cyber threats are evolving, and many organizations don’t realize just how far attackers will go to stay hidden.Mon, 18 Aug 2025 20:20:06 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/project-ghostbusters-facebooks-secret-surveillance-operation-what-it-means-for-your-business/https://alpha-cyber.com/project-ghostbusters-facebooks-secret-surveillance-operation-what-it-means-for-your-business/A recent exposé has revealed disturbing details about an internal Facebook program codenamed “Project Ghostbusters.” According to newly surfaced documents, Facebook allegedly used secret methods to spy on data from rival platform Snapchat, exploiting internal systems to track encrypted user activity.Sun, 17 Aug 2025 15:43:12 GMTAlpha Cyber ResearchTLP:CLEARNewsAlpha Cyber Researchhttps://alpha-cyber.com/meta-illegally-collected-flo-users-menstrual-data-a-wake-up-call-for-businesses-on-data-privacy/https://alpha-cyber.com/meta-illegally-collected-flo-users-menstrual-data-a-wake-up-call-for-businesses-on-data-privacy/In today’s data-driven world, the privacy and security of user information have become more than just a technical issue, they’re a matter of public trust, legal compliance, and business survival.Sun, 17 Aug 2025 15:34:59 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/5-facebook-settings-to-help-prevent-business-information-leakage/https://alpha-cyber.com/5-facebook-settings-to-help-prevent-business-information-leakage/In today’s hyperconnected world, social media isn’t just a personal risk, it’s a corporate one.Wed, 13 Aug 2025 10:06:54 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/akira-exploits-sonicwall-sslvpn-rootkit-in-suspected-zero-day-attacks/https://alpha-cyber.com/akira-exploits-sonicwall-sslvpn-rootkit-in-suspected-zero-day-attacks/How Infrastructure Mapping Can Help Detect and Prevent the Next Breach In the latest wave of targeted ransomware attacks, the Akira ransomware group is now exploiting a previously unknown vulnerability in SonicWall SSLVPN appliances, giving them direct access to corporate networks.Mon, 11 Aug 2025 06:14:47 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/facebooks-vpn-deception-how-vpn-compromised-millions-in-the-name-of-privacy/https://alpha-cyber.com/facebooks-vpn-deception-how-vpn-compromised-millions-in-the-name-of-privacy/In an era where privacy is increasingly under threat, the line between protection and surveillance is growing dangerously thin.Sat, 09 Aug 2025 16:49:27 GMTAlpha Cyber ResearchTLP:CLEARNewsAlpha Cyber Researchhttps://alpha-cyber.com/inside-scranos-mapping-a-cross-platform-rootkit-enabled-spyware-operation/https://alpha-cyber.com/inside-scranos-mapping-a-cross-platform-rootkit-enabled-spyware-operation/In today’s threat landscape, cybercriminals are no longer relying on single-layer malware. Instead, they’re deploying fully integrated infrastructures to maintain persistence, monetize user data, and avoid detection.Wed, 06 Aug 2025 19:41:58 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/coordinated-cyber-strike-five-families-syndicate-targets-alpha-automation-in-brazil/https://alpha-cyber.com/coordinated-cyber-strike-five-families-syndicate-targets-alpha-automation-in-brazil/A new wave of coordinated cyberattacks has emerged from a threat actor group known as the Five Families Collective, recently targeting Alpha Automation, a leading industrial automation firm in Brazil.Mon, 04 Aug 2025 11:41:33 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/signed-to-deceive-the-return-of-fivesys-rootkits/https://alpha-cyber.com/signed-to-deceive-the-return-of-fivesys-rootkits/How Nation-State-Grade Malware is Bypassing Defenses – and What You Can Do About It In today’s rapidly evolving threat landscape, attackers are using increasingly advanced techniques to bypass endpoint security, including digitally-signed rootkits.Mon, 04 Aug 2025 11:35:25 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/attackers-use-microsoft-teams-calls-to-deploy-matanbuchus-ransomware/https://alpha-cyber.com/attackers-use-microsoft-teams-calls-to-deploy-matanbuchus-ransomware/Cybercriminals are exploiting legitimate collaboration tools in increasingly sophisticated ways.Mon, 04 Aug 2025 08:14:05 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/the-next-big-scandal-meta-can-access-your-private-unpublished-photos/https://alpha-cyber.com/the-next-big-scandal-meta-can-access-your-private-unpublished-photos/Published by Alpha Cyber | Trusted Cybersecurity Services for Data Privacy and Protection What You Don’t Post Can Still Be Seen A growing wave of privacy concerns has resurfaced after leaked documents and whistleblower reports revealed something deeply unsettling: Meta (formerly Facebook) may have access to your private, unpublished photos, even those you never intended to share.Sat, 02 Aug 2025 16:58:11 GMTAlpha Cyber ResearchTLP:CLEARNewsAlpha Cyber Researchhttps://alpha-cyber.com/remote-administration-tools-rats-the-hidden-threat-recording-your-screens/https://alpha-cyber.com/remote-administration-tools-rats-the-hidden-threat-recording-your-screens/Remote Administration Tools are a category of malware used to gain complete control of a machine. Weaponized RATs are stealthy and capable of watching employees in real time.Fri, 01 Aug 2025 19:24:14 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/combatting-insider-threats-protecting-your-business-from-within/https://alpha-cyber.com/combatting-insider-threats-protecting-your-business-from-within/Published by Alpha Cyber | Cybersecurity Services That Secure What Matters Most The Hidden Danger Inside Your Organization When people think of cybersecurity, they often imagine hackers in dark rooms breaking into systems from afar.Thu, 31 Jul 2025 11:58:44 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/facebook-got-caught-phishing-for-friend/https://alpha-cyber.com/facebook-got-caught-phishing-for-friend/In the digital age, data is currency, and trust is everything. Yet even global tech giants like Meta have shown that mishandling data can come at a cost.Tue, 29 Jul 2025 13:57:29 GMTAlpha Cyber ResearchTLP:CLEARNewsAlpha Cyber Researchhttps://alpha-cyber.com/mapping-the-invisible-enemy-sidewinder-apt-04-indian-linked-cyber-threat-infrastructure/https://alpha-cyber.com/mapping-the-invisible-enemy-sidewinder-apt-04-indian-linked-cyber-threat-infrastructure/In the modern threat landscape, advanced persistent threats (APTs) operate like invisible war machines, strategic, highly coordinated, and capable of maintaining long-term access to their targets.Tue, 29 Jul 2025 12:13:03 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/mapping-indian-cyber-force-infrastructure-using-social-media-osint/https://alpha-cyber.com/mapping-indian-cyber-force-infrastructure-using-social-media-osint/As geopolitical tensions increasingly manifest online, the Indian Cyber Force (ICF), a politically motivated hacktivist group has emerged as a visible threat through waves of DDoS attacks, website defacements, and alleged data leaks.Sat, 26 Jul 2025 11:50:40 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/microsoft-identifies-china-backed-nation-state-hackers-targeting-sharepoint-protect-your-infrastructure/https://alpha-cyber.com/microsoft-identifies-china-backed-nation-state-hackers-targeting-sharepoint-protect-your-infrastructure/Microsoft recently confirmed that China-backed nation-state hackers, including the notorious group known as Violet Typhoon, are actively targeting Microsoft SharePoint servers worldwide.Fri, 25 Jul 2025 19:39:43 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/metas-covert-android-tracking-what-you-need-to-know/https://alpha-cyber.com/metas-covert-android-tracking-what-you-need-to-know/Unsurprising News: Meta Caught Spying on Android Users Again! We’ve heard it before, and it’s happening again.Mon, 21 Jul 2025 10:32:38 GMTAlpha Cyber ResearchTLP:CLEARNewsAlpha Cyber Researchhttps://alpha-cyber.com/seconddate_cnc-equation-group-god-of-espionage-lurks-in-your-network/https://alpha-cyber.com/seconddate_cnc-equation-group-god-of-espionage-lurks-in-your-network/A highly sophisticated backdoor, SecondDate_CnC, attributed to the elite Equation Group, has resurfaced in targeted infrastructure attacks.Mon, 21 Jul 2025 09:53:25 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/threat-spotlight-sonicwall-vpns-compromised-by-stealthy-rootkit-backdoor/https://alpha-cyber.com/threat-spotlight-sonicwall-vpns-compromised-by-stealthy-rootkit-backdoor/A sophisticated cyber campaign has been discovered targeting SonicWall VPN appliances, embedding a stealthy rootkit backdoor deep in the system, invisible to standard endpoint protection.Mon, 21 Jul 2025 08:22:27 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/chinese-group-silver-fox-uses-fake-sites-to-deliver-sainbox-rat-hidden-rootkit/https://alpha-cyber.com/chinese-group-silver-fox-uses-fake-sites-to-deliver-sainbox-rat-hidden-rootkit/A sophisticated campaign attributed to the China-affiliated group Silver Fox (aka Void Arachne) is targeting Chinese‑speaking users via spoofed websites mimicking popular apps like WPS Office, Sogou, and DeepSeek.Tue, 15 Jul 2025 12:46:06 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/metas-privacy-fiasco-a-cautionary-tale-for-big-tech/https://alpha-cyber.com/metas-privacy-fiasco-a-cautionary-tale-for-big-tech/Meta’s recent privacy scandals have become a stark warning for the entire tech industry.Sun, 13 Jul 2025 20:28:38 GMTAlpha Cyber ResearchTLP:CLEARNewsAlpha Cyber Researchhttps://alpha-cyber.com/bing-ai-claims-it-spied-on-microsoft-employees-through-their-webcams/https://alpha-cyber.com/bing-ai-claims-it-spied-on-microsoft-employees-through-their-webcams/Why AI Security Matters More Than Ever A recent headline sent shockwaves through the tech world: Bing AI reportedly claimed it spied on Microsoft employees through their webcams.Sun, 13 Jul 2025 20:16:26 GMTAlpha Cyber ResearchTLP:CLEARNewsAlpha Cyber Researchhttps://alpha-cyber.com/godloader-malware-how-attackers-exploit-the-godot-engine-threat-insights/https://alpha-cyber.com/godloader-malware-how-attackers-exploit-the-godot-engine-threat-insights/Cybercriminals are exploiting the Godot Engine in a new wave of attacks using the GodLoader malware, infecting over 17,000 systems in just three months.Sun, 13 Jul 2025 07:48:35 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/unmasking-godlua-a-glimpse-into-malwares-hidden-infrastructure/https://alpha-cyber.com/unmasking-godlua-a-glimpse-into-malwares-hidden-infrastructure/Unveiling the GodLua DNS over HTTPS Malware Infrastructure In today’s rapidly evolving cyber threat landscape, GodLua DNS over HTTPS (DoH) malware stands out as a sophisticated and stealthy adversary.Sat, 12 Jul 2025 12:23:45 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/unmasking-the-god-of-espionage-bvp47-backdoors-infrastructure-revealed/https://alpha-cyber.com/unmasking-the-god-of-espionage-bvp47-backdoors-infrastructure-revealed/The Bvp47 backdoor, dubbed the “God of Espionage,” is a top-tier Linux malware platform attributed to the Equation Group, with strong ties to the US NSA.Wed, 09 Jul 2025 13:12:47 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/bert-ransomware-mapping-the-185-100-157-74-infrastructure/https://alpha-cyber.com/bert-ransomware-mapping-the-185-100-157-74-infrastructure/A new ransomware threat called Bert is targeting organizations across Asia, Europe, and the US, especially in healthcare, technology, and event services.Wed, 09 Jul 2025 07:18:03 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/beyond-the-surface-mapping-the-facefish-rootkits-digital-footprint/https://alpha-cyber.com/beyond-the-surface-mapping-the-facefish-rootkits-digital-footprint/In the shadowy world of cyber threats, some malware aims not just to steal data, but to disappear.Mon, 07 Jul 2025 22:08:53 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/beyond-the-inbox-mapping-sidewinders-stealthy-c2-infrastructure/https://alpha-cyber.com/beyond-the-inbox-mapping-sidewinders-stealthy-c2-infrastructure/The Threat:The Sidewinder APT group, believed to be aligned with Indian interests, is actively targeting government, military, and critical infrastructure across South Asia, including Bangladesh, Pakistan, and Sri Lanka.Mon, 07 Jul 2025 16:37:17 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/sneaky-2fa-phishing-unmasking-the-invisible-threat/https://alpha-cyber.com/sneaky-2fa-phishing-unmasking-the-invisible-threat/Two-Factor Authentication (2FA) is vital, but attackers are bypassing it with 2FA Phishing-as-a-Service (PhaaS). These sophisticated platforms, like “Sneaky 2FA,” act as a “reverse proxy,” intercepting real-time credentials and 2FA codes.Mon, 07 Jul 2025 12:28:58 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/privacy-alert-microsoft-may-be-storing-bing-chat-copilot-conversations/https://alpha-cyber.com/privacy-alert-microsoft-may-be-storing-bing-chat-copilot-conversations/In an increasingly digital world, our online interactions leave a significant footprint.Mon, 07 Jul 2025 08:12:18 GMTAlpha Cyber ResearchTLP:CLEARNewsAlpha Cyber Researchhttps://alpha-cyber.com/kubernetes-cloud-attacks-a-risk-every-organization-should-know/https://alpha-cyber.com/kubernetes-cloud-attacks-a-risk-every-organization-should-know/🚨 As businesses move to the cloud, more organizations rely on Kubernetes to manage applications and microservices. But along with flexibility and scalability come serious security risks. 🔍 Why is this happening?Thu, 03 Jul 2025 07:21:40 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/case-study-transforming-cybersecurity-at-blossom/https://alpha-cyber.com/case-study-transforming-cybersecurity-at-blossom/Client: BlossomIndustry: TechnologyEngagement Period: 2021–2023 Background When Blossom, a fast-growing tech company, recognized the increasing threat landscape, they sought to elevate their cybersecurity posture. The challenge?Wed, 02 Jul 2025 16:01:14 GMTAlpha Cyber ResearchTLP:CLEARCase StudiesAlpha Cyber Researchhttps://alpha-cyber.com/linux-forensic-101/https://alpha-cyber.com/linux-forensic-101/Linux Security Tips: When Expertise Feels Like Driving a Manual GTR Operating a Linux OS as an expert is like driving a brand-new manual Nissan GTR. You control everything.Wed, 28 Dec 2022 13:58:06 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/mitigating-data-exfiltration-attacks/https://alpha-cyber.com/mitigating-data-exfiltration-attacks/A Comprehensive Guide In today’s digital landscape, data security is paramount. Your data encompasses more than just your name. It reflects your preferences, behaviors, and personal insights.Sat, 10 Dec 2022 21:25:10 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/easy-malware-evasion/https://alpha-cyber.com/easy-malware-evasion/In today’s cybersecurity landscape, traditional malware evasion techniques are no longer enough.Fri, 09 Dec 2022 09:44:27 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/browser-security-tutorial/https://alpha-cyber.com/browser-security-tutorial/When it comes to protecting your digital environment, browser security is one of the simplest, yet most critical, measures you can take.Thu, 08 Dec 2022 14:10:33 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/hardening-linux-in-10-steps/https://alpha-cyber.com/hardening-linux-in-10-steps/Long live Linux! But for a healthy and secure system, it’s crucial to know how to harden and monitor your Linux servers effectively.Tue, 06 Dec 2022 19:45:59 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/new-pacman-attack-targeting-mac-devices/https://alpha-cyber.com/new-pacman-attack-targeting-mac-devices/Thanks To The Hacker News For This Article A novel hardware attack dubbed PACMAN has been demonstrated against Apple’s M1 processor chipsets, potentially arming a malicious actor with the capability to gain arbitrary code execution on macOS systems.Sat, 11 Jun 2022 17:08:40 GMTAlpha Cyber ResearchTLP:CLEARNewsAlpha Cyber Researchhttps://alpha-cyber.com/russian-apt-attack-are-on-the-rise/https://alpha-cyber.com/russian-apt-attack-are-on-the-rise/As the war in Ukraine enters its fourth month, the battlefield has expanded beyond conventional warfare into cyberspace.Sun, 05 Jun 2022 20:32:36 GMTAlpha Cyber ResearchTLP:CLEARNewsAlpha Cyber Researchhttps://alpha-cyber.com/aws-s3-security-tutorial/https://alpha-cyber.com/aws-s3-security-tutorial/Amazon Web Services (AWS) is the world’s leading cloud platform, offering businesses access to the same powerful infrastructure Amazon uses to run its global operations.Fri, 03 Jun 2022 15:10:47 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/cell-phone-privacy-in-the-21-century/https://alpha-cyber.com/cell-phone-privacy-in-the-21-century/Thanks To Defender Shield For This Great Article. Solidifying your cell phone privacy is a crucial part of keeping your personal information safe and protected.Fri, 03 Jun 2022 13:56:20 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/how-to-detect-hidden-cameras/https://alpha-cyber.com/how-to-detect-hidden-cameras/What are the ways to detect hidden spy secret cameras in your apartment, house, or hotel room? How to find hidden security cameras behind mirrors?Mon, 30 May 2022 17:09:51 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/nvidia-fixes-ten-vulnerabilities-in-windows-gpu-display-drivers/https://alpha-cyber.com/nvidia-fixes-ten-vulnerabilities-in-windows-gpu-display-drivers/NVIDIA has released a security update for a wide range of graphics card models, addressing four high-severity and six medium-severity vulnerabilities in its GPU drivers.Wed, 18 May 2022 12:54:07 GMTAlpha Cyber ResearchTLP:CLEARNewsAlpha Cyber Researchhttps://alpha-cyber.com/html-attachments-remain-popular-among-phishing-actors-in-2022/https://alpha-cyber.com/html-attachments-remain-popular-among-phishing-actors-in-2022/HTML files remain one of the most popular attachments used in phishing attacks for the first four months of 2022, showing that the technique remains effective against antispam engines and works well on the victims themselves.Wed, 18 May 2022 09:36:24 GMTAlpha Cyber ResearchTLP:CLEARNewsAlpha Cyber Researchhttps://alpha-cyber.com/experts-sound-alarm-on-dcrat-backdoor-being-sold-on-russian-hacking-forums-2/https://alpha-cyber.com/experts-sound-alarm-on-dcrat-backdoor-being-sold-on-russian-hacking-forums-2/Cybersecurity researchers have shed light on an actively maintained remote access trojan called DCRat (aka DarkCrystal RAT) that’s offered on sale for “dirt cheap” prices, making it accessible to professional cybercriminal groups and novice actors alike.Mon, 16 May 2022 17:20:37 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/hackers-can-now-run-malware-on-your-phone-when-its-off-2/https://alpha-cyber.com/hackers-can-now-run-malware-on-your-phone-when-its-off-2/Thanks To The Hacker News For This Great Article A first-of-its-kind security analysis of iOS Find My function has identified a novel attack surface that makes it possible to tamper with the firmware and load malware onto a Bluetooth chip that’s executed…Mon, 16 May 2022 17:10:47 GMTAlpha Cyber ResearchTLP:CLEARNewsAlpha Cyber Researchhttps://alpha-cyber.com/hardening-windows-server-machine/https://alpha-cyber.com/hardening-windows-server-machine/Windows servers are often responsible for critical infrastructure and sensitive data.Thu, 05 May 2022 20:32:12 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/connecting-securely-to-tor-network/https://alpha-cyber.com/connecting-securely-to-tor-network/The internet is a powerful tool, but privacy isn’t something you should take for granted. The Tor network is one of the best ways to browse anonymously, masking your identity and location online.Mon, 02 May 2022 20:24:10 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/10-hardening-configuration-any-linux-system-should-have/https://alpha-cyber.com/10-hardening-configuration-any-linux-system-should-have/If you’re a Linux user, you likely appreciate its performance, efficiency, and built-in security. But no system is invulnerable, and adding extra layers of protection is always a smart move.Sat, 30 Apr 2022 15:50:27 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/praying-mantis-apt-hackers-group-using-asp-net-exploits-to-attack-windows-iis/https://alpha-cyber.com/praying-mantis-apt-hackers-group-using-asp-net-exploits-to-attack-windows-iis/Thanks to cybersecuritynews for this great article Sygnia Incident Response Team found an advanced and persistent threat actor named “Praying Mantis” or “TG2021”, operating completely in memory.Thu, 28 Apr 2022 13:28:26 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/north-korean-hackers-targeting-journalists-with-novel-malware/https://alpha-cyber.com/north-korean-hackers-targeting-journalists-with-novel-malware/North Korean state-sponsored hackers known as APT37 have been discovered targeting journalists specializing in the DPRK with a novel malware strain.Tue, 26 Apr 2022 06:25:26 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/ntlm-relay-with-inveigh/https://alpha-cyber.com/ntlm-relay-with-inveigh/With Inveigh, an attacker can perform NTLM relay attacks, enabling them to intercept and relay NTLM authentication hashes within a target network.What is NTLM?Mon, 18 Apr 2022 14:00:06 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/extracting-password-from-dpapi-with-mimikatz/https://alpha-cyber.com/extracting-password-from-dpapi-with-mimikatz/DPAPI (Data Protection API) is a native Windows encryption mechanism designed to securely protect sensitive data such as saved credentials, browser secrets and certificates.Mon, 18 Apr 2022 11:43:58 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/kerberos-authentication/https://alpha-cyber.com/kerberos-authentication/Explained Kerberos is a powerful authentication protocol designed to securely verify users and services over insecure networks, commonly used in Active Directory environments, POSIX authentication, NFS, and Samba.Mon, 18 Apr 2022 02:08:37 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/dcsync-attack-with-mimikatz/https://alpha-cyber.com/dcsync-attack-with-mimikatz/In the complex landscape of Active Directory security, understanding the tactics adversaries employ is paramount.Sun, 17 Apr 2022 22:45:17 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/kerberos-golden-tickets/https://alpha-cyber.com/kerberos-golden-tickets/A golden ticket in Active Directory grants the bearer unlimited access. An attacker holding one can reach any service, for an unlimited time.Sat, 16 Apr 2022 19:06:51 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/pass-the-hash-attack-with-mimikatz/https://alpha-cyber.com/pass-the-hash-attack-with-mimikatz/Pass the Hash attack is when the attacker can authenticate without clear text password. similiar to pass the ticket but in pass the hash attack our access is not limited to 10 hours.Wed, 13 Apr 2022 12:24:43 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/abusing-sudo/https://alpha-cyber.com/abusing-sudo/In Linux systems, the /etc/sudoers file dictates user privileges, specifying which users can execute commands with elevated (root) permissions.Mon, 11 Apr 2022 18:32:12 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/danderspritz-framework-is-causing-problems/https://alpha-cyber.com/danderspritz-framework-is-causing-problems/In April 2017, the hacking collective known as the Shadow Brokers leaked a sophisticated malware framework attributed to the NSA’s Equation Group.Sun, 10 Apr 2022 11:43:37 GMTAlpha Cyber ResearchTLP:CLEARThreat ReportsAlpha Cyber Researchhttps://alpha-cyber.com/blue-screen-of-death-with-mimikatz/https://alpha-cyber.com/blue-screen-of-death-with-mimikatz/Mimikatz is a post exploitation tools used for clear text dumping credentials and many else Dumping credentials with mimiktatz 1.first this first clone the script with git clone https://github.com/ParrotSec/mimikatz 2.run mimikatz.exe in X64 directory…Tue, 22 Feb 2022 20:08:01 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/secure-and-encrypt-c2-setup-with-redirectors/https://alpha-cyber.com/secure-and-encrypt-c2-setup-with-redirectors/This post will teach you how to setup a simple red team c2 infrastructure with encrypted socat HTTPS redirectors Requirements: Attacker C2 Server: Kali with metasploit Redirector Server: Ubuntu with socat Victim Machine: Windows10 1.First open metasploit with…Sat, 12 Feb 2022 18:40:40 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Researchhttps://alpha-cyber.com/dumping-credentials-with-evil-mimikatz/https://alpha-cyber.com/dumping-credentials-with-evil-mimikatz/Mimikatz is a post exploitation tools used for clear text dumping credentials and many else Dumping credentials with mimiktatz 1.first this first clone the script with git clone https://github.com/ParrotSec/mimikatz 2.run mimikatz.exe in X64 directory…Sun, 05 Dec 2021 16:14:39 GMTAlpha Cyber ResearchTLP:CLEARBlogAlpha Cyber Research