Cybersecurity News: Silver Fox targets Indian users, Mustang Panda deploys ToneShell, will prompt injection ever be solved?

By
Sarah Lane
-

In today’s cybersecurity news…

Silver Fox targets Indian users

China-linked cybercrime group Silver Fox is targeting Indian users with phishing emails posing as India’s Income Tax Department to deliver ValleyRAT, a modular remote access trojan, according to research from CloudSEK. The campaign uses DLL sideloading, anti-analysis checks, and registry-based persistence to enable credential theft and surveillance. Separate analysis from NCC Group found Silver Fox also running SEO poisoning campaigns and fake download sites impersonating apps like Microsoft Teams and Telegram, while ReliaQuest linked some activity to false-flag tactics intended to complicate attribution. (The Hacker News)

Mustang Panda deploys ToneShell

China-linked advanced persistent threat (APT) group Mustang Panda deployed a signed kernel-mode rootkit driver to load shellcode and install a new variant of its ToneShell backdoor, according to Kaspersky research. The campaign targeted government entities in Southeast and East Asia and used a stolen digital certificate, kernel-level protections, and Microsoft Defender tampering to evade detection while allowing full remote access. The malware communicated over TCP port 443 using fake TLS headers, marking the first observed use of a kernel-mode loader to deliver ToneShell. (Security Affairs)

Will prompt injection ever be ‘solved’?  

OpenAI says prompt injection attacks against browser-based AI agents like ChatGPT Atlas may never be fully eliminated, after internal red-teaming uncovered a new class of attacks that can hijack agents during routine web workflows. The company shipped an update with a newly adversarially trained model and stronger safeguards, but warned that agents with access to email, documents, and web services are inherently higher-value targets. (CyberScoop)

US cybersecurity experts plead guilty to BlackCat ransomware

Two former cybersecurity incident response professionals pleaded guilty to BlackCat ransomware attacks against U.S. companies in 2023. Ryan Goldberg, a former Sygnia incident response manager, and Kevin Martin, a former DigitalMint ransomware negotiator, admitted to extortion conspiracy after breaching multiple organizations and demanding ransoms ranging from $300,000 to $10 million, with at least $1.27 million paid by one victim. Prosecutors say the pair used insider knowledge to join BlackCat as affiliates, and now face up to 20 years in prison. (BleepingComputer)

Huge thanks to our sponsor, ThreatLocker

Want real Zero Trust training? Zero Trust World 2026 delivers hands-on labs and workshops that show CISOs exactly how to implement and maintain Zero Trust in real environments. Join us March 4–6 in Orlando, plus a live CISO Series episode on March 6. Get $200 off with ZTWCISO26 at ztw.com.

8 2025 cybersecurity acquisitions surpass $1 billion

SecurityWeek reports that in 2025, cybersecurity saw a wave of consolidation, with eight deals surpassing $1 billion and a total of more than 420 M&A transactions valued at over $84 billion. This includes Google’s $32 billion acquisition of Wiz, Palo Alto Networks’ $25 billion deal for CyberArk, ServiceNow’s pending $7.75 billion acquisition of Armis and $1 billion for Veza, and Francisco Partners’ $2.2 billion buyout of Jamf. (SecurityWeek)

CSA issues alert on critical SmarterMail bug

The Cyber Security Agency of Singapore (CSA) warned of a critical remote code execution vulnerability in SmarterTools SmarterMail. The flaw allows unauthenticated attackers to upload arbitrary files, potentially executing malicious code on affected mail servers. It impacts SmarterMail versions Build 9406 and earlier, and has been fixed in Build 9413, with Build 9483 released in December recommended for full protection. (The Hacker News)

KMSAuto malware suspect arrested

A 29-year-old Lithuanian was arrested for spreading KMSAuto malware that infected about 2.8 million Windows and Office systems worldwide. The malware, disguised as an illegal Windows activation tool, contained a clipper that monitored victims’ clipboards for cryptocurrency addresses and replaced them with attacker-controlled wallets. Investigators traced 3,100 compromised wallets used in 8,400 transactions totaling roughly ₩1.7 billion, with eight South Korean victims losing ₩16 million. The suspect was extradited from Georgia to South Korea under Interpol coordination. (Security Affairs)

ESA confirms “external servers” breach

The European Space Agency (ESA) confirmed a breach of external servers hosting unclassified collaborative engineering data. Threat actors claimed access to ESA’s JIRA and Bitbucket servers for a week, allegedly exfiltrating over 200GB of data including source code, CI/CD pipelines, API tokens, configuration files, and credentials. ESA said only a small number of external servers were impacted and has started a forensic investigation while notifying stakeholders. (BleepingComputer)