San Mateo, CA, February 24, 2025 — Stories, events, and developments that impacted the cybersecurity landscape last week, including emerging threats, policy changes, and industry responses.
Impact of Salt Typhoon telecom breach may last forever
Speaking at a conference hosted by CyberScoop, Cynthia Kaiser, deputy assistant director in the FBI’s cyber division, had some troubling statements about the impact and implications of Salt Typhoon’s hack on major telecoms. “What we found particularly remarkable in our investigation is the gigantic and seemingly indiscriminate collection of call records and data about American people, like your friends, your family, people in your community,” she said. She went on to describe the breach as “a different level of insidiousness” that highlights China’s “ambition and reckless aggression in cyberspace.” With regard to the indiscriminate targeting of public servants, private citizens, adults, and children alike, Kaiser asked the audience “can any of you imagine a world in which China would have been stealing information about you as a 13-year-old? That’s precisely what American children are facing in this new era of big data, cyber espionage, and that’s going to follow them no matter which careers or risks they choose in the future.” Read more.
Malware-laced game removed from Steam marketplace
Valve has removed a game from its Steam marketplace after it was revealed that it contained malware. The game, ironically titled PirateFi, was specifically designed to infect players with the Vidar info-stealer. SECUINFRA Falcon Team researcher Marius Genheimer and colleagues discovered that “PirateFi was built by modifying an existing game template called Easy Survival RPG, which bills itself as a game-making app that ‘gives you everything you need to develop your own singleplayer or multiplayer’ game. The game maker costs between $399 and $1,099 to license.” The Vidar info-stealer “is capable of stealing and exfiltrating several types of data from the computers it infects, including: passwords from the web browser autofill feature, session cookies that can be used to log in as someone without needing their password, web browser history, cryptocurrency wallet details, screenshots, and two-factor codes from certain token generators, as well as other files on the person’s computer.” Read more.
Italian media files criminal complaint over WhatsApp spyware
A group of Italian media groups have filed a criminal complaint with the Rome Public Prosecutor’s Office in an effort to discover who installed the zero-click Paragon-built spyware on their devices via WhatsApp. The complaint alleges that the party responsible for the incident violated Italy’s “illicit installation” ban and that the spyware continues to expose the nearly 100 journalists targeted to “enormous and still persistent risks for their individual safety.” The far-right Italian government, which has a long-standing contract with Paragon, has denied any involvement in the attacks. After the attack became public, Paragon suspended an agreement with the Italian government. However, it has been confirmed that a second contract between the two entities is still in place. Read more.
New Darcula PhaaS version auto-generates phishing kits
A third major version of the Darcula phishing-as-a-service platform is on the way. This one can create DIY phishing kits targeting any brand simply by inserting a URL. The new release, Darcula Suite, “also lifts technical skills requirements, a new user-friendly admin dashboard, IP and bot filtering, campaign performance measurement, and automated credit card theft/digital wallet loading.” Tests done by Netcraft confirm that the platform’s build delivers as advertised. While the version is still in beta, Netcraft warns that its features are already attracting cybercriminals. “Because the container images used to run the admin panel are publicly available at registry[.]magic-cat[.]world, Netcraft was able to get a rough estimate of the number of individuals already exploring this test suite,” reads their report. “The pull count of the API image has increased by more than 100% and the web image by more than 50% from February 5 to February 10.” Read more.
DeepSeek downloads suspended in South Korea
Downloads of Chinese AI chatbot DeepSeek have been suspended in South Korea over non-compliance with the country’s data protection laws. South Korea’s Personal Information Protection Commission (PIPC) has determined that DeepSeek’s communication and data processing policies fell short of legal standards, its third-party data handling raised privacy concerns, and unencrypted data transmission was detected in mobile apps. Other countries are also voicing concerns about the chatbot. Its use has been banned on government devices in Australia, Taiwan, and Italy, and US lawmakers are moving to restrict DeepSeek due to surveillance risks. DeepSeek is noteworthy for operating at a fraction of the cost of US AI models. Read more.
Criminals and state-sponsored threat actors team up
Google is urging the world’s lawmakers to take more decisive action against the links between state-sponsored and criminal cyber activity, which they say are increasing. The company has revealed a list of recommendations to help defend against malicious cyber actors from the “Big Four” adversarial states: China, Russia, Iran, and North Korea. Google says that state entities are leaning more frequently on criminals to further their agendas, both as a cost-saving measure and to make it harder to attribute the origin of malicious cyber activity. “The vast cybercriminal ecosystem has acted as an accelerant for state-sponsored hacking, providing malware, vulnerabilities, and in some cases full-spectrum operations to states,” said Ben Read, senior manager at Google Threat Intelligence Group. Google believes that state-sponsored cyber activity and attacks originating from criminals should not be treated as two distinct threats but as a national security issue. Read more.
MacOS users targeted by fake browser updates
A new Apple macOS malware called FrigidStealer has been uncovered via a campaign that infects victims by presenting them with fake browser updates. The activity has been attributed to a new threat actor tracked as TA2727. “It’s one of the newly identified threat activity clusters alongside TA2726, which is assessed to be a malicious traffic distribution system (TDS) operator that facilitates traffic distribution for other threat actors to deliver malware. The financially motivated threat actor is believed to be active since at least September 2022.” FrigidStealer requires macOS users to bypass Gatekeeper protections. “Actors are using web compromises to deliver malware targeting enterprise and consumer users,” the company said. “It is reasonable that such web injects will deliver malware customized to the recipient, including Mac users, which are still less common in enterprise environments than Windows,” said the Proofpoint Threat Research Team that discovered the activity. Read more.
BlackLock could be 2025’s most prolific ransomware group
Data from intelligence vendor ReliaQuest indicates that BlackLock, a ransomware-as-a-service group active since March 2024, is on track to be 2025’s most active and dangerous ransomware actor. According to ReliaQuest, BlackLock has increased its number of data leak posts by a whopping 1,425% quarter-on-quarter in Q4 of 2024. BlackLock has specific characteristics that differentiate it from other groups in the sphere, such as custom-built malware, data leak site features that prevent victims from assessing the scope of breaches, and closer collaboration with affiliates. BlackLock also maintains greater control over early-stage attack tasks as opposed to delegating them to their affiliates. “BlackLock actively recruits key players, known as traffers, to support the early stages of ransomware attacks. These individuals drive malicious traffic, steer victims to harmful content, and help establish initial access for campaigns. Recruitment posts for traffers explicitly outline requirements, signaling BlackLock’s urgency to bring on candidates quickly – often prioritizing speed over operational security,” reads ReliaQuest’s report. Read more.
Over 1,000 people rescued from cyber scam camps
Thailand’s military government has announced that one thousand thirty foreign nationals have been rescued from scam centers located near Myanmar. According to Bloomberg, the government’s information ministry said the victims are primarily from Asian countries, including China and India. Reportedly, 61 people have been returned to their home countries, with the rest in line to be sent back once their identities can be verified. Thailand has stepped up its efforts to curb scam camps after Chinese actor Wang Xing was kidnapped, having been lured to the country with a promised acting job. The Thai-Myanmar border is a hot spot for criminal scam operations, generating billions of dollars annually. Read more.
New Android feature protects against TOAD tactics
Google has introduced a security enhancement in Android 16 Beta 2 to combat telephone-oriented attack delivery (TOAD) tactics where scammers manipulate users during calls to allow them to install malicious software. This feature restricts users from enabling app installations from unknown sources and denies specific accessibility permissions while on a call. Attempts to modify sensitive settings during a call prompt a warning: “Scammers often request this type of action during phone call conversations, so it’s blocked to protect you.” This measure aims to disrupt fraudsters’ strategies that combine urgent SMS messages with phone calls to deceive users into offering them access to their devices. Previously, Google expanded restricted settings to prevent sideloaded apps from accessing sensitive data and initiated automatic blocking of potentially unsafe app sideloading in regions like Brazil, India, and Singapore. Read more.
More cybersecurity news
- Last week’s news
- More cybersecurity news
- All articles sponsored by NetworkTigers
