Finding Minhook in a sideloading attack – and Sweden too
Multifaceted changes in TTPs illustrate what researchers see when they start digging
Similar Posts
The Hidden Security Risks of Shadow AI in Enterprises
Bys sAs AI tools become more accessible, employees are adopting them without formal approval from IT and security teams. While these tools may boost productivity, automate tasks, or fill gaps in existing workflows, they also operate outside the visibility of security teams, bypassing controls and creating new blind spots in what is known as shadow AI. While similar to…
Sophos Firewall v22: Your top-requested features
Bys sGet involved in the Sophos Firewall v22 Early Access Program today!
Bill raising the bar for class-action suits in data breach incidents advances
Bys sRural Radio reports: A measure that would raise the bar for filing class-action lawsuits in state courts against private entities that suffer a cybersecurity breach has received first round approval in the Nebraska Legislature. Lawmakers spent a considerable amount of floor debate Tuesday and today discussing LB 241, which would require willful, wanton, or gross…
EdgeStepper Implant Reroutes DNS Queries to Deploy Malware via Hijacked Software Updates
Bys sThe threat actor known as PlushDaemon has been observed using a previously undocumented Go-based network backdoor codenamed EdgeStepper to facilitate adversary-in-the-middle (AitM) attacks. EdgeStepper “redirects all DNS queries to an external, malicious hijacking node, effectively rerouting the traffic from legitimate infrastructure used for software updates to attacker-controlled infrastructure
New Coyote Malware Variant Exploits Windows UI Automation to Steal Banking Credentials
Bys sThe Windows banking trojan known as Coyote has become the first known malware strain to exploit the Windows accessibility framework called UI Automation (UIA) to harvest sensitive information. “The new Coyote variant is targeting Brazilian users, and uses UIA to extract credentials linked to 75 banking institutes’ web addresses and cryptocurrency exchanges,” Akamai security researcher…
Veeam and IBM Release Patches for High-Risk Flaws in Backup and AIX Systems
Bys sVeeam has released security updates to address a critical security flaw impacting its Backup & Replication software that could lead to remote code execution. The vulnerability, tracked as CVE-2025-23120, carries a CVSS score of 9.9 out of 10.0. It affects 12.3.0.310 and all earlier version 12 builds. “A vulnerability allowing remote code execution (RCE) by…