In today’s cybersecurity news…

Iran boosts cyberattacks

According to research from Check Point, Iran’s Ministry of Intelligence and Security is working with cybercriminal groups to strengthen and obscure its cyber operations. Iranian APTs such as Void Manticore have incorporated criminal tools like the Rhadamanthys infostealer and may participate in ransomware-as-a-service ecosystems, blending state and cybercrime activity. The approach is said to complicate attribution and allows Iranian actors to buy malware, infrastructure, or initial access from underground markets instead of developing their own tools. (Dark Reading)

VENON targets Brazilian banks

Brazilian cybersecurity firm ZenoX has disclosed VENON, a new Rust-based banking malware targeting 33 banks in Brazil. VENON infects Windows systems via DLL side-loading, social engineering campaigns like ClickFix, and nine evasion techniques. It monitors active windows and hijacks shortcuts to deliver fake overlays for credential theft, notably targeting Itaú’s banking app. The malware can also undo modifications to cover its tracks.. (The Hacker News)

England Hockey investigating breach

England Hockey is investigating a potential ransomware breach after the AiLock gang claimed to have stolen 129GB of data and threatened to publish it unless a ransom is paid. The organization, which oversees field hockey across 800+ clubs and 150,000 players, is working with internal teams, external experts, and law enforcement to assess the impact. AiLock has been active since April 2025 and uses double-extortion tactics and advanced encryption to lock files. Players are advised to watch for suspicious activity and phishing attempts. (BleepingComputer)

Storm-2561 uses SEO poisoning for fake VPN clients

Microsoft Threat Intelligence reports that the cybercriminal group Storm-2561 is running a credential theft campaign using SEO poisoning to distribute fake VPN clients. Users searching for legitimate VPN software are redirected to malicious sites hosting ZIP files with MSI installers that side-load DLLs, including the Hyrax infostealer, to capture VPN credentials. The malware is digitally signed to appear legitimate and maintains persistence via the Windows RunOnce key. Microsoft advises enabling Defender protections, multifactor authentication, and blocking untrusted executables. (Microsoft Security Blog)

Huge thanks to our sponsor, Dropzone AI

Hive0163 uses AI-assisted Slopoly malware

IBM X-Force researcher Golo Mühr said in a report shared with The Hacker News that Hive0163 is using AI-assisted malware called Slopoly to maintain persistent access during ransomware attacks. It’s deployed via PowerShell scripts and scheduled tasks and functions as a backdoor, beaconing system info and executing commands from a C2 server. AI helped generate readable, well-structured code, but the malware is relying on standard persistence and post-exploitation techniques. Hive0163 often uses ClickFix, malvertising, and access brokers to deliver malware like NodeSnake, Interlock RAT, and Interlock ransomware. (The Hacker News)

Operation Lightning takes down SocksEscort proxy network

Law enforcement from eight countries disrupted the SocksEscort residential proxy network in an operation called Operation Lightning, seizing 34 domains and 23 servers across seven countries and freezing about $3.5 million in cryptocurrency. The service infected routers with AVRecon malware and sold access to roughly 369,000 compromised IP addresses used for fraud, ransomware, account takeovers, and other cybercrime that caused tens of millions of dollars in losses. Authorities say the network had about 124,000 users. (The Register)

Veeam warns of flaws exposing backup servers to RCE attacks

Veeam patched multiple vulnerabilities in its Backup & Replication software, including four critical remote code execution flaws that could allow low-privileged users to run code on backup servers. The bugs could also enable privilege escalation and credential theft. The fixes are included in versions 12.3.2.4465 and 13.0.1.2067. Veeam warned attackers often reverse-engineer patches to target unpatched systems, noting backup servers are frequent ransomware targets. (BleepingComputer)

PixRevolution hijacks Brazil’s PIX transfers

Researchers at Zimperium uncovered PixRevolution, an Android banking trojan that hijacks Brazil’s PIX instant payment transfers by replacing the recipient’s payment key during a transaction and redirecting funds to attacker-controlled accounts. The malware abuses Android accessibility permissions to monitor screens, stream activity to a command server, and let a remote operator intervene in real time. It spreads through fake app pages mimicking the Google Play store and targets Brazil’s PIX network, used by more than 76% of Brazilians and handling more than three billion transactions monthly. (Infosecurity Magazine)