Google Classroom, a popular educational platform, has been exploited by threat actors to launch a major phishing campaign in a complex operation discovered by Check Point researchers. Over a single week from August 6 to August 12, 2025, attackers disseminated more than 115,000 malicious emails across five coordinated waves, targeting approximately 13,500 organizations globally. These […]
Readiness starts at “the foundry”—the U.S. Navy’s shipyards, training centers, shore facilities, weapons production lines, and logistics networks—the incoming chief of naval operations said Monday at the Washington Navy Yard.
“For too long, we’ve treated this interconnected network of force generation as background noise. No longer,” said Adm. Daryl Caudle as he assumed command as the 34th chief of naval operations Monday morning. “From reducing maintenance delays to ensuring spare parts and ordnance flow on time, the foundry will become the engine of naval dominance.”
Caudle most recently led the Navy’s Fleet Forces Command, where the term has been in use for some time. He was not referring, a spokesman confirmed, to the Navy team that is developing the future Integrated Combat System, a new architecture for warship software and systems, inside the Program Executive Office for Integrated Warfare Systems.
At the ceremony, Caudle reiterated themes from his confirmation hearing: he stressed shipbuilding and denounced delays with new ships and scheduled repairs on older ones.
“By the time my tenure ends, I want to be judged by the results we achieve together, plain and simple: platforms delivered and repaired on time; fully manned and combat-ready ships; ordnance production meeting contracted demand; backlogs in repair parts eliminated; sailors trained to the highest levels of mastery,” he said.
Caudle also repeated a Trump administration slogan that is itself a throwback to the Reagan administration.
“With battle-ready sailors at the helm, our platforms and systems are brought to life, empowering our fleet to project power and deter conflict through extraordinary mobility, persistent presence, and global reach—causing our adversaries to think twice. Peace through strength works,” he said.
Caudle’s comments come after the White House ordered the deployment of several warships to Venezuela, including Navy missile destroyers, at least one attack submarine, and about 4,000 marines as part of an Amphibious Ready Group to the region, as part of a push to deter drug cartels in Latin America and the Caribbean.
In introductory remarks, Navy Secretary John Phelan praised Caudle’s leadership, while emphasizing the duo’s mission for change.
The Navy must act urgently and “move away” from “traditions that stifle innovation,” Phelan said. “Together, Adm. Caudle and I clearly see the challenges before us: decaying shipyards, inadequate maintenance, enormous cost overruns, delayed delivery and repair base and a requirements process that has become undisciplined and detached from the acquisitions process.”
But to implement real changes, Phelan continued, the Navy must challenge traditions.
“For an institution to change, it needs to separate mission from tradition. Mission should never be tinkered with. Tradition needs to be constantly interrogated. It is far more likely an unpredictable event is the most predictable thing one can say about the future. How the Department of the Navy prepares for that in terms of capabilities and structures, is the greatest challenge we face,” Phelan said.
The audience at the Navy Yard included several former CNOs, including Adm. Lisa Franchetti, who was fired without explanation in February along with several other senior military leaders. Franchetti, the first woman to serve as CNO, served just 15 months in the role.
FortiGuard Labs has uncovered a sophisticated malware campaign targeting critical infrastructure devices from multiple vendors, with the “Gayfemboy” malware strain demonstrating advanced evasion techniques and multi-platform capabilities. The campaign affects organizations globally, exploiting vulnerabilities in DrayTek, TP-Link, Raisecom, and Cisco systems to establish persistent botnet infrastructure with backdoor access and distributed denial-of-service (DDoS) attack capabilities. […]
Scammers are using Google Ads to pose as Tesla in an elaborate cybercrime campaign that aims to obtain illicit preorders for the company’s unreleased Optimus humanoid robot and other items. These deceptive sponsored listings appear prominently in search results for terms like “Optimus Tesla preorder,” directing users to counterfeit websites that mimic Tesla’s official domain. […]
A China-nexus threat actor known as UNC6384 has been attributed to a set of attacks targeting diplomats in Southeast Asia and other entities across the globe to advance Beijing’s strategic interests.
“This multi-stage attack chain leverages advanced social engineering including valid code signing certificates, an adversary-in-the-middle (AitM) attack, and indirect execution techniques to evade
Docker has released fixes to address a critical security flaw affecting the Docker Desktop app for Windows and macOS that could potentially allow an attacker to break out of the confines of a container.
The vulnerability, tracked as CVE-2025-9074, carries a CVSS score of 9.3 out of 10.0. It has been addressed in version 4.44.3.
“A malicious container running on Docker Desktop could access the
The National Iranian Tanker Company (NITC) and Islamic Republic of Iran Shipping Lines (IRISL), two sanctioned companies, are the operators of 64 boats, 39 tankers, and 25 cargo ships that were compromised in a targeted attack on Iran’s maritime infrastructure by the hacking collective Lab-Dookhtegan. Rather than attempting direct breaches of individual ships, which are […]
A sophisticated campaign of cyber sabotage unfolded against Iran’s maritime communications infrastructure in late August 2025, cutting off dozens of vessels from vital satellite links and navigation aids.
Rather than targeting each ship individually—a logistical nightmare across international waters—the attackers infiltrated Fanava Group, the IT provider responsible for satellite communications to Iran’s sanctioned tanker fleets.
By compromising the company’s outdated iDirect Falcon terminals, they gained root access to Linux systems running kernel 2.6.35 and mapped the entire constellation of vessels through a centralized MySQL database.
The initial breach vector appears to have exploited unpatched vulnerabilities in legacy Falcon management consoles, allowing the threat actors to execute privileged commands and exfiltrate network mappings.
Once inside, they harvested modem serial numbers, network IDs, and IP phone system configurations in plain text, including credentials such as “1402@Argo” and “1406@Diamond.”
These details were then weaponized to orchestrate a synchronized blackout: email and FBB SIM communications failed, automated weather updates ceased, and port coordination signals vanished almost instantaneously.
Nariman Gharib researchers identified that the campaign, dubbed Lab-Dookhtegan, was not a one-off disruption.
Email logs dating back to May revealed persistent access and periodic “Node Down” tests, confirming that the attackers maintained control over the networks for months before launching a destructive finale.
On August 18, they executed a “scorched earth” sequence, overwriting multiple storage partitions on satellite modems with zeroed data, rendering remote recovery impossible.
FANAVA (Source – Nariman Gharib)
By crippling Iran’s sanctioned fleets—NITC and IRISL—at a time when covert oil transfers to China intensify, the attackers dealt a blow to the country’s sanctions-evasion capabilities.
Without communication links, tankers risk drifting off-course or becoming easy targets for boarding and seizure. The operation’s precision underscores a deep reconnaissance phase, allowing the threat actors to deliver maximally disruptive payloads at the worst strategic moment.
Infection Mechanism
The malware’s infection mechanism relied on a multi-stage approach: initial access through unprotected management ports, lateral movement via SSH keys harvested from MySQL dumps, and deployment of destructive scripts.
After gaining root on a compromised Falcon console, the attackers executed commands akin to:-
These commands systematically wiped primary storage partitions and recovery slices, ensuring the terminal’s firmware and configurations were irrecoverable without physical intervention.
IP addresses and passwords in plain text (Source – Nariman Gharib)
Simultaneously, SQL queries extracted the fleet blueprint:-
SELECT serial_number, vessel_name, network_id
FROM modems;
Armed with this data, the attackers automated credential injection and shutdown sequences across 64 vessels with a single orchestration script.
PoCs (Source – Nariman Gharib)
By embedding malicious cron entries, they achieved both persistence and timed execution, triggering the blackout at a moment calculated to maximize operational chaos.
This infection chain highlights the importance of isolating management interfaces and enforcing strict patch regimes on critical satellite communication systems.
Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.
Cybersecurity researchers at AhnLab Security Intelligence Center (ASEC) have uncovered a persistent campaign where attackers distribute proxyware malware through fake YouTube video download pages. This operation, which mimics legitimate video downloading services, tricks users into installing malicious executables disguised as benign tools like WinMemoryCleaner. The attackers leverage GitHub for malware hosting, a tactic consistent with […]
Cybersecurity researchers have observed a surge in deceptive sites masquerading as YouTube video download services to deliver Proxyware malware in recent weeks.
Victims seeking to grab videos in MP4 format are redirected through ad pages that sporadically present a download link for a seemingly legitimate utility called “WinMemoryCleaner.”
Behind this innocuous facade, however, lies a multi-stage installer that ultimately deploys Proxyware and covertly enslaves the system’s network bandwidth.
The initial download executable, Setup.exe, unpacks WinMemoryCleaner.exe into the Program Files directory before triggering an update script via WinMemoryCleanerUpdate.bat.
Once executed, WinMemoryCleaner.exe performs environment checks to evade virtual machines or sandbox analysis, then invokes a PowerShell payload that installs Node.js and fetches a malicious JavaScript component from a remote server.
Attack Flow (Source – ASEC)
ASEC analysts identified this technique as a refined evolution of previous Proxyware campaigns, noting the attacker’s reliance on GitHub for hosting intermediary tools.
Subsequent stages involve the registration of two scheduled tasks—“Schedule Update” and “WindowsDeviceUpdates”—that ensure the JavaScript runs periodically under Node.js.
This script communicates basic system information to a command-and-control server and awaits directives, which can include fetching additional scripts or initiating the final Proxyware installation.
Information Sent to C&C Server (Source – ASEC)
ASEC researchers noted that the actor has pivoted from distributing only DigitalPulse and HoneyGain Proxyware to integrating Infatica’s agent, enhancing bandwidth theft capabilities.
The impact of this campaign is twofold: affected systems experience degraded network performance, and the attacker monetizes the stolen bandwidth through affiliate programs.
YouTube Downloader Page and Malware Download Link (Source – ASEC)
Proxyware programs typically share idle network throughput, promising remuneration to end users, but com promise victims unwittingly supply bandwidth without compensation.
In regions with high adoption of streaming services, such as South Korea, the campaign’s reach has grown significantly, prompting warnings from major AV vendors.
Infection Mechanism
A deeper examination of the infection mechanism reveals the pivotal role of the PowerShell script delivered by WinMemoryCleaner.exe.
The script begins with a stealthy installation of Node.js:-
Continuous execution of the JavaScript component under Node.js enables dynamic updates and final payload deployment, making eradication challenging without specialized tools.
Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.
.webp)
.webp)
.webp)
.webp)
.webp)
.webp)