X_Hunt3r

Microsoft says hackers are exploiting critical zero-day bugs to target Windows and Office users | TechCrunch Critical security flaws targeting Windows and Office users allow hackers to take complete control of a victim's computer by clicking a malicious link or opening a file. Patch now.

By me: Microsoft has fixed three zero-day bugs in Windows and Office that are being actively abused by hackers to break into people's computers. Microsoft said three of the exploits are now public.

Google, which helped find the bugs, said one of them is under “widespread, active exploitation."

Outstanding work 👏

Report cover showing a dark blue patch with crossed sword, arrow and scroll emblem, titled "Unveiling GRU's Information Operations Troops (VIO)"

🔴 𝗡𝗘𝗪 𝗥𝗘𝗣𝗢𝗥𝗧
Last year, we've been able to unearth the infrastructure of the FSB's 16th Centre, combining #OSINT techniques and photos of old medals. We replicated this method to explore the Information Operations Troops (#VIO) of #Russia’s military intelligence service (#GRU).

Overall, this activity underscores the GRU’s continued reliance on credential harvesting as a low-cost, high-yield intelligence collection method, enabled by the persistent abuse of legitimate internet services and disposable infrastructure. (5/5)

Victimology indicates targeted activity rather than broad spraying. Observed targets included researchers linked to a Turkish energy research agency, a European think tank, and organizations in North Macedonia and Uzbekistan, which align with Russian intelligence priorities. (4/5)

The credential-harvesting pages captured usernames and passwords and then redirected victims to legitimate portals to reduce suspicion. BlueDelta refined its JavaScript to automate URL handling, victim tracking, and data exfiltration, lowering operational overhead and complicating detection. (3/5)

BlueDelta impersonated MS OWA, Google, and Sophos VPN login pages, often using multi-stage redirection chains hosted on free services such as Webhook[.]site, InfinityFree, Byet Internet Services, and ngrok. Several campaigns began with legitimate PDF lures to increase credibility. (2/5)

GRU-Linked BlueDelta Evolves Credential Harvesting Insikt Group reveals how GRU-linked BlueDelta evolved credential-harvesting campaigns targeting government, energy, and research organizations across Europe and Eurasia.

Today, we released new @RecordedFuture research detailing BlueDelta’s expanded credential-harvesting activity observed between February and September 2025. #BlueDelta #APT28 #FANCYBEAR #ForestBlizzard #FROZENLAKE #ITG05 #PawnStorm #Sednit #Sofacy #TA422 (1/5) www.recordedfuture.com/research/gru...

Notably, the infrastructure shows rapid adaptation following previous takedown actions. BlueDelta continues to rely on free, disposable hosting and tunneling services, enabling resilient, low-cost credential theft operations targeting Ukrainian users. (5/5)

While the campaign does not reveal specific victim industries, this activity aligns with BlueDelta’s longstanding objective: collecting credentials to support GRU intelligence requirements amid Russia’s ongoing war in Ukraine. (4/5)

These pages harvested usernames, passwords, MFA codes, and CAPTCHA responses. BlueDelta refined its JavaScript to automate URL handling and exfiltration, reducing operational overhead and complicating detection efforts. (3/5)

BlueDelta impersonated UKR.NET login pages using multi-stage redirection chains hosted on free services such as Mocky, DNS EXIT, and later ngrok and Serveo. The group also deployed PDF lures to bypass automated email filtering and increase user trust. (2/5)

BlueDelta’s Persistent Campaign Against UKR.NET Discover how Russia’s BlueDelta targets UKR.NET users with advanced credential-harvesting campaigns, evolving tradecraft, and multi-stage phishing techniques.

Today, we released new @RecordedFuture research detailing BlueDelta’s sustained credential-harvesting campaign targeting UKR.NET users between June 2024 and April 2025. www.recordedfuture.com/research/blu...
#BlueDelta #APT28 #FANCYBEAR #ForestBlizzard #FROZENLAKE #PawnStorm #Sednit #Sofacy (1/5)

APT28 Operation Phantom Net Voxel APT28 Operation Phantom Net Voxel: weaponized Office lures, COM-hijack DLL, PNG stego to Covenant Grunt via Koofr, BeardShell on icedrive.

Great work by Sekoia uncovering new #BlueDelta #APT28 #Sofacy #FancyBear #ForestBlizzard #TAG110 malware samples. Linked to CERT-UA’s BeardShell & Covenant frameworks + revealed fresh weaponized docs & subtle TTPs. Activity ties to Russia-nexus ops incl. Double-Tap. blog.sekoia.io/apt28-operat...

Ukraine claims cyberattacks on Russian election systems; Moscow confirms disruptions Ukraine said it was responsible for disrupting websites related to Russian election infrastructure as voters went to the polls in occupied territories.

Ukraine claims cyberattacks on Russian election systems; Moscow confirms disruptions
therecord.media/ukraine-clai...

Russian Influence Assets Converge on Moldovan Elections Ahead of Moldova’s 2025 elections, Russia-linked influence operations seek to undermine EU integration, discredit President Sandu, and destabilize democratic processes through coordinated disinformati...

New report published today from our team at Recorded Future: “Russian Influence Assets Converge on Moldovan Elections”

www.recordedfuture.com/research/rus...

This report on Stark Industries is a fantastic case study in the cat-and-mouse game between hosting providers and law enforcement. The new "Threat Activity Enabler" (TAE) terminology is spot-on and highlights the critical role these providers play in the cybercrime ecosystem.

Finnish police wiretap reveals Russian ‘shadow fleet’ captain instructed to destroy evidence The captain of a Russia-linked oil tanker that damaged five subsea cables in the Baltic Sea was reportedly instructed to destroy evidence after the ship was seized by authorities.

Scandi noir meets The Wire...

🇫🇮🚢

The captain of a Russia-linked oil tanker that damaged five subsea cables in the Baltic Sea on Christmas Day was instructed by his shipping company to destroy evidence after the ship was seized by Finnish authorities, according to a wiretap transcript.

Russian state-sponsored espionage group Static Tundra compromises unpatched end-of-life network devices A Russian state-sponsored group, Static Tundra, is exploiting an old Cisco IOS vulnerability to compromise unpatched network devices worldwide, targeting key sectors for intelligence gathering.

Is it really 2025?! Cisco Smart Install and SNMP brute attacks... We are giving the FSB an easy ride. Great report by the Talos team! blog.talosintelligence.com/static-tundra/

Fantastic new report by @julianferdinand.bsky.social and @aejleslie.bsky.social exposing Lumma’s vast info-stealing ecosystem—where affiliates juggle scams, MaaS platforms, and evasion tools to stay ahead of defenders💪 Great work team 🔥

Saher's first blog on the scourge that is ClickFix usage in the espionage space!!

Had to sneak in the UNK_RemoteRogue RDP shenanigans as well - a thus far unattributed group we assess to be Russia-aligned, using a pretty fun set of email tactics

Attention!

Check your Compromised Website Report for critical events tagged “fortinet-compromised” and follow Fortinet's mitigation advice on compromised devices:

fortinet.com/blog/psirt-b...

Data available from 2025-04-11+

shadowserver.org/what-we-do/n...

Snoop, a Romanian investigative journalism outlet, has linked an online advertising company named AdNow to intelligence officials from Russia's FSB and SVR services

snoop.ro/pe-urmele-ba...

🪡 Our 2024 Malicious Infrastructure Report showcases the results of our detections across hundreds of malware families and threat actors, revealing victims in 200+ countries and highlighting the global scale of cyber threats.
Blog: www.recordedfuture.com/research/202... (1/10)

Multiple Russian Threat Actors Targeting Microsoft Device Code Authentication Starting in mid-January 2025, Volexity identified several social-engineering and spear-phishing campaigns by Russian threat actors aimed at compromising Microsoft 365 (M365) accounts. These attack cam...

@volexity.com recently identified multiple Russian threat actors targeting users via #socialengineering + #spearphishing campaigns with Microsoft 365 Device Code authentication (a well-known technique) with alarming success: www.volexity.com/blog/2025/02...

#dfir #threatintel #m365security

New Insikt Report just landed: RedMike AKA Salt Typhoon targeting of Global Telcos.
www.recordedfuture.com/research/red...

100 Days of Yara, Yara Rule Tips and The Current State of Email borne Threats with Greg Lesnewich Yara is one of the most versatile tools in cyber security. Come learn about creating effective and efficient rules with the creator of the 100 Days of Yara, ...

🔥 Live streams resume this week! Greg Lesnewich joins us to talk about 100 Days of Yara, some Yara rule tips and the current state of email borne threats!

https://buff.ly/4gukMSN

🗓️ Thursday at 2pm CST

Ukrainian military considering creation of new cyber army branch Ukrainian military, lawmakers, and experts discussed the creation of a separate branch of Ukraine's Armed Forces dedicated to cyberspace operations, the General Staff said on Oct. 24.

Ukrainian military officials, lawmakers, and experts are discussing the creation of a separate branch of Ukraine's Armed Forces dedicated to cyberspace operations, according to the General Staff of Ukraine.
kyivindependent.com/ukraine-cons...

"Crazy Evil" Cryptoscam Gang: Unmasking a Global Threat in 2024 Explore how the "Crazy Evil" cryptoscam gang operates, infecting thousands worldwide with infostealer malware. Learn how its tactics pose a threat to the Web3 ecosystem and digital asset security.

New report! Check it out.

This research examines the operations of Crazy Evil — a Russian-speaking “traffer team” and cryptoscam gang — which has victimized thousands of people with infostealer malware.

Blog: www.recordedfuture.com/research/cra...

PDF: go.recordedfuture.com/hubfs/report...

Tracking Adversaries: Ghostwriter APT Infrastructure CTI, threat intelligence, OSINT, malware, APT, threat hunting, threat analysis, CTF, cybersecurity, security

New Blog! Tracking Adversaries: Ghostwriter APT Infrastructure 🇧🇾

blog.bushidotoken.net/2025/01/trac...