Internal company materials illustrate an AI-powered effort to make pilfered foreign government documents digestible for police; targets include Russia, Pakistan.

U.S. agencies accuse six China-based AI firms of industrial-scale distillation to extract proprietary capabilities from frontier AI models.

Attackers are actively exploiting CVE-2026-20079, a critical authentication bypass vulnerability in Cisco Secure Firewall Management Center.

QUIRSO’s Incident Response team recently investigated a VMware vCenter compromise that uncovered a coordinated, global exploitation…

Researchers linked the latest malicious activity to a Chinese company, after one of the spyware's operators placed an order with KFC using their real name and office address.

Microsoft says Storm-1175 is deploying new StormEncryptor ransomware, likely after exploiting N-able N-central CVE-2026-18577 for access.

The U.S. has at most six to 12 months before Beijing can compete with this new wave of hyper-advanced AI models.

Introduction to ShadowPad Malware ShadowPad, a sophisticated modular malware, has emerged as a significant cybersecurity threat. Attributed initially to Chinese state-sponsored threat actors (APT41), ...

Operation Dragon Weave delivers AdaptixC2 via phishing; Azure-based AZUREVEIL enables covert control, impacting Czech and Taiwan targets.

Exclusive: Just in time for the Trump-Xi summit

GopherWhisper infected 12 Mongolian government systems in January 2025, abusing Slack and Discord for C2, exposing wider espionage risks.

Storm-1175 exploits 16+ CVEs since 2023, including zero-days, enabling rapid Medusa ransomware attacks within 24 hours.

North Korean hackers exploit VS Code tasks.json auto-run since Dec 2025 to deploy StoatWaffle malware, stealing data and enabling remote control.

Reports allege a March 12, 2026 data breach at Crunchyroll that exposed nearly 100GB of user data—including email addresses, IPs, passwords, and some credit card information—after an attacker gained access via a third‑party vendor. Crunchyroll has not confirmed the full scope, but the incident underscores risks from outsourced ticketing and support...

AI-powered CyberStrikeAI linked to 600 FortiGate breaches in 55 countries, with 21 IPs tied to China-based infrastructure.

The cybersecurity community recently witnessed the emergence of targeted malware campaigns linked to the Silver Fox threat group. This operation focuses heavily on Asia, targeting local organizations with carefully localized lures. By disguising attacks as routine business communications, actors successfully distributed the Winos 4.0 malware, known as ValleyRat, into corporate networks. To compromise victim systems, attackers leverage deceptive phishing emails containing malicious attachments or embedded links. These messages closely impersonate official government correspondence, such as tax audit notifications, software installers, and electronic invoice downloads. Tax-themed phishing (Source – Fortinet) When a user interacts with these files, they trigger a complex infection chain that operates quietly, minimizing the chances of immediate user suspicion. The final impact of a successful infection is severe, leading to widespread file encryption and extensive data theft that can fuel further cyberattacks. Attacker’s domain (Source – Fortinet) Fortinet researchers identified the malware and its infrastructure as highly volatile, utilizing a rotating network of cloud domains to host their payloads. This rapid shifting of resources makes traditional static domain blocking mostly ineffective as a primary defense measure against the ongoing Winos 4.0 operations. Advanced Detection Evasion Techniques Once inside a network, the Silver Fox group employs advanced detection evasion strategies to maintain access and control. The attackers deliver an archive containing a legitimate application that secretly sideloads a malicious dynamic link library into memory. The execution file and the malicious DLL file (Source – Fortinet) This stage sets the foundation for a “Bring Your Own Vulnerable Driver” attack. The malware loads a validity-signed Windows kernel-mode driver, named wsftprm.sys, to silently acquire elevated system privileges without alerting administrators. Archive contents with LNK and social-engineering decoys (Source – Fortinet) After securing kernel-level access, the malicious driver enters a continuous monitoring loop to identify and terminate active security processes. By targeting a vast array of popular antivirus and endpoint protection tools , the malware creates a completely blind environment. This allows Winos 4.0 to operate, escalate its privileges, and maintain remote communication with its command server unimpeded. To effectively defend against these highly sophisticated techniques, organizations must treat all unexpected documents and external links with extreme caution. Security teams should implement behavioral monitoring tools, continuously update endpoint protection signatures, and deploy strong email filtering solutions to proactively detect evasive phishing attempts before they occur. Follow us on  Google News ,  LinkedIn , and  X  to Get More Instant Updates ,  Set CSN as a Preferred Source in  Google . The post Silver Fox APT Uses DLL Sideloading and BYOVD Techniques in Sophisticated Malware Attacks appeared first on Cyber Security News .

Cybersecurity researchers have disclosed details of a new mobile spyware platform dubbed ZeroDayRAT that's being advertised on Telegram as a way to grab sensitive data and facilitate real-time surveillance on Android and iOS devices. "The developer runs dedicated channels for sales, customer support, and regular updates, giving buyers a single point of access to a fully operational spyware

: Meanwhile, IP-stealing 'distillation attacks' on the rise

Campaign combines stolen Telegram accounts, fake Zoom calls and ClickFix attacks to deploy infostealer malware