In today’s cybersecurity news…
Nimbus Manticore learning new tricks
This Iranian-backed APT with ties to the Islamic Revolutionary Guard Corps, also known as Smoke Sandstorm and Bohrium, has been active since at least 2022. Its known for targeting sophisticated actors in the aerospace, aviation, and defense sectors across the Middle East and Europe. Researchers at Check Point recently found that the group is changing tactics and expanding targets to the US. This has seen them switch from tried and true DLL sideloading to AppDomain hijacking, using trojanized installers for legitimate apps like Zoom and OnlyOffice to install an updated version of its MiniJunk backdoor. Check Point notes the group shows the ability to rapidly adapt to new approaches, use new tooling, and maintain infrastructure for persistence.
Phishing moves to real-time credential harvesting
Researchers at Google’s Threat Intelligence Group warned that its seen increasing sophistication from phishing-as-a-service operators. Within the broader Asian criminal ecosystem, there has been a shift from static password harvesting to real-time interception. These operations target the general public with phishing lures that spoof non-Chinese entities. These use encrypted RCS and iMessage channels to deliver phishing messages, making it harder for infrastructure-layer blocks to be effective. Operators then seek to capture one-time passcodes in real-time to bypass MFA and ultimately get victims’ payment cards linked to an attacker’s virtual wallet. It’s believed many of these efforts are aided by AI automation, as many providers show a lack of usual operational security and cyber hygiene when advertising these schemes.
India wants 12-hour patches
This comes from new guidance from the Indian Computer Emergency Response Team (CERT-In), which urged organizations to meet this timeline for actively exploited internet-facing vulnerabilities. The guidance lays out a further triage timeline for less severe vulnerabilities, ranging from one to five days. This guidance was developed in response to AI-enhanced exploitation, and also includes a framework for zero-trust architecture, encourages the use of AI bill of materials, and other best practices. India has had a requirement to report cyber incidents to CERT-In within 6 hours of detection since 2022.
Iran says it will reopen internet access
According to state media reports, Iran’s President Masoud Pezeshkian issued an order to restore internet access nationwide. According to NetBlocks, Iran cut off international internet access 87 days ago after initial strikes were made by US and Israeli forces on February 28th. This followed another multi-week internet blackout that started on January 8th, following massive anti-government protests. It’s unclear how and when Iran will restore access, or if the country will change its existing censorship policies.
(Reuters)
Huge thanks to our sponsor, Guardsquare
KnowledgeDeliver delivers backdoors
Researchers at Mandiant discovered a campaign impacting Digital Knowledge’s KnowledgeDeliver e-learning platform, which is particularly popular in Japan. This exploited a zero-day that was able exploit known hardcoded values in the platforms web.config file, allowing for deserialization attacks against other deployments. The attackers used Godzilla web shells to pull down further payloads to the machine, ultimately infecting with a Cobalt Strike backdoor. All KnowledgeDeliver deployments prior to February 24, 2026 are vulnerable.
No-Code comes to malware
ESET researchers published details on an Android remote access trojan called BTMOB, which ships with commercial-style packaging, and includes an APK builder to let buyers generate new payloads and reconfigure phishing lures without any coding. Ultimately BTMOB is capable of full device takeover by abusing Android’s accessibility services. This malware-as-a-service operation is sold through Telegram channels, as well as X and Instagram accounts, offering a $5,000 lifetime license, plus additional monthly support fees. Researchers saw this operating mostly in Brazil and Argentina, with operators posing as streaming services, major brands, or tax authorities.
Microsoft testing automated endpoint isolation
Microsoft released a preview for Defender for Endpoint that can automatically isolate compromised endpoints. This is designed to limit lateral movement across the network by attackers. While cut off from the network, endpoints will retain connectivity to the Microsoft Defender for Endpoint service for monitoring. Admins will be able to release devices from this automated isolation at any time. Microsoft introduce manual endpoint isolation for Defender back in June 2022.
Netherlands blocks sale of authentication tech to US
In November, the US firm Kyndryl announced it would acquire the Dutch company Solvinity, which operates the DigiD app platform that citizens use to authenticate identities with public authorities. In a letter to the national parliament, the Dutch government said the national authority that screens investments had advised the government to block the acquisition as it posed “a possible risk to the public interest.” This announcement comes a week before the European Commission releases a tech sovereignty policy proposal to reduce EU reliance on foreign technology, particularly in the cloud and AI. A statement from Kyndryl said it was “extremely disappointed” about the “politicization of this process.”
(Politico)