Security researchers at Straiker’s AI Research (STAR) team have uncovered Villager, an AI-native penetration testing framework developed by Chinese-based group Cyberspike that has already accumulated over 10,000 downloads within two months of its release on the official Python Package Index (PyPI). The tool combines Kali Linux toolsets with DeepSeek AI models to fully automate penetration […]
Nmap vs Wireshark are the most popular Network penetration testing tools. Security professionals face an increasingly complex threat landscape, and picking the right penetration testing tools can make the difference between a secure infrastructure and a compromised network.
While both serve critical roles in network analysis and security assessment, they address fundamentally different aspects of network reconnaissance and traffic analysis, making the choice between them or the decision to use both a strategic consideration for effective penetration testing workflows.
Network security tools technical diagram
Nmap vs Wireshark Network Reconnaissance Tools
What Is Nmap?
Nmap (Network Mapper) stands as one of the most respected and widely adopted open-source network discovery and security auditing utilities in the cybersecurity industry.
Created by Gordon Lyon (originally under the pseudonym Fyodor Vaskovitch) in 1997, Nmap has evolved into a comprehensive platform that enables security professionals to scan large networks while maintaining precision against individual hosts rapidly.
The tool’s fundamental purpose centers on active network reconnaissance, using specially crafted IP packets to determine host availability, identify running services, detect operating systems, and assess security configurations.
Nmap operates by sending carefully crafted packets to target systems and analyzing the responses to gather information about the network infrastructure.
This active scanning approach allows cybersecurity professionals to map network topologies, identify potential attack vectors, and assess the security posture of networked systems.
The tool supports various scanning techniques, including TCP SYN scans, UDP scans, and service version detection, making it adaptable to different network environments and security requirements.
The tool’s versatility extends beyond basic port scanning through its Nmap Scripting Engine (NSE), which provides extensible automation capabilities for vulnerability detection, service enumeration, and specialized security assessments.
NSE scripts are written in Lua and categorized into areas such as authentication testing, vulnerability detection, and malware identification, enabling security professionals to customize their reconnaissance activities based on specific assessment objectives.
What Is Wireshark?
Wireshark represents the gold standard in network protocol analysis, functioning as a comprehensive packet analyzer that captures and dissects network traffic in real-time.
Originally developed as Ethereal in 1998 by Gerald Combs, Wireshark evolved into an indispensable tool for network troubleshooting, security analysis, and protocol development.
Unlike Nmap’s active scanning approach, Wireshark employs passive monitoring techniques, capturing packets traversing network interfaces and presenting detailed protocol-level information for analysis.
The tool’s core strength lies in its ability to provide deep packet inspection capabilities, supporting analysis of thousands of network protocols ranging from common protocols like HTTP, TCP, and DNS to specialized industrial and proprietary protocols.
Wireshark’s three-pane interface presents captured packets in list format, detailed protocol breakdowns, and hexadecimal/ASCII representations of packet contents, enabling forensic-level analysis of network communications.
Wireshark’s passive analysis approach makes it particularly valuable for post-incident forensics, network troubleshooting, and understanding communication patterns without generating additional network traffic.
The tool supports both live capture from network interfaces and offline analysis of previously captured packet files, providing flexibility for different analytical workflows.
Network mapping and host discovery illustration
Core Capabilities And Technical Features
Nmap’s Advanced Scanning Capabilities
Nmap’s technical capabilities extend far beyond basic port scanning, offering a comprehensive suite of reconnaissance functions designed for modern network security assessments.
Host discovery forms the foundation of Nmap’s capabilities, utilizing a diverse array of probes including ICMP echo requests, TCP SYN/ACK packets, and UDP probes to identify active hosts on target networks.
This flexibility proves crucial when navigating firewall-protected environments that may block standard ping requests. The tool’s advanced port scanning capabilities represent its most recognized feature, offering multiple scan types optimized for different scenarios.
TCP SYN scans provide stealth and speed, while TCP connect scans offer reliability in restrictive environments. UDP scanning enables the discovery of services that TCP-based scans might miss, creating comprehensive service inventories.
Service and version detection extends beyond identifying open ports to determine specific software versions running on discovered services, enabling security professionals to cross-reference findings with vulnerability databases.
Operating system fingerprinting through TCP/IP stack analysis allows Nmap to identify target operating systems and versions with high accuracy.
This capability proves invaluable for vulnerability assessment, as different operating systems present distinct attack surfaces and vulnerability profiles.
The Nmap Scripting Engine (NSE) elevates the tool’s functionality through automated vulnerability detection, advanced service discovery, and specialized security assessments.
NSE organizes scripts into fourteen categories, including authentication testing, vulnerability detection, malware identification, and exploitation capabilities.
Popular NSE scripts enable the detection of specific vulnerabilities like Heartbleed, SMB vulnerabilities, and web application security issues.
This extensibility allows security professionals to adapt Nmap for specialized assessment requirements while maintaining the tool’s core scanning efficiency.
Wireshark’s Deep Analysis
Wireshark’s analytical power stems from its ability to capture and dissect network packets at multiple protocol layers simultaneously.
The tool’s real-time packet capture functionality enables monitoring of live network traffic with minimal latency, allowing security analysts to observe network behavior as it occurs.
Deep packet inspection capabilities provide granular visibility into packet headers, payloads, and protocol-specific information, enabling detailed forensic analysis.
Protocol analysis represents Wireshark’s core strength, with support for thousands of network protocols and the ability to automatically decode protocol hierarchies.
The tool’s protocol dissectors interpret raw packet data into human-readable formats, revealing communication patterns, application behaviors, and potential security anomalies.
Advanced filtering capabilities allow analysts to isolate specific traffic types, communication flows, or suspicious activities from large packet captures.
Wireshark’s Follow Stream functionality enables reconstruction of complete communication sessions, allowing analysts to view entire conversations between network endpoints.
This capability proves essential for understanding application-layer communications, identifying data exfiltration attempts, and analyzing attack sequences.
Color-coding and visualization features help analysts quickly identify different protocol types, error conditions, and anomalous traffic patterns within large packet captures.
The tool’s export and reporting capabilities enable integration with other security tools and workflows, supporting various output formats for further analysis or documentation.
Cross-platform compatibility ensures consistent functionality across Windows, macOS, and Linux environments, supporting diverse organizational technology stacks.
Packet analysis workflow and protocol dissection diagram
Use Cases And Practical Applications
Applications Of Nmap
Nmap serves multiple critical functions in cybersecurity workflows, with penetration testing and reconnaissance representing its primary application domains.
During penetration testing engagements, Nmap enables security professionals to map attack surfaces systematically, identifying potential entry points before conducting more invasive testing procedures.
The tool’s ability to perform comprehensive network mapping while maintaining stealth through timing controls and decoy scanning techniques makes it indispensable for realistic security assessments.
Network asset management represents another crucial application area where Nmap excels. Organizations utilize Nmap for automated network inventory creation, tracking devices connected to corporate networks, and identifying unauthorized systems that may pose security risks.
Regular Nmap scans enable IT teams to maintain accurate asset inventories, supporting compliance requirements and security monitoring initiatives.
Vulnerability assessment workflows leverage Nmap’s service detection capabilities combined with NSE scripts to identify potentially vulnerable services.
Security teams can quickly scan network ranges to identify systems running outdated software versions, misconfigured services, or known vulnerable applications.
This capability proves particularly valuable during incident response activities, where rapid vulnerability identification supports containment and remediation efforts.
Compliance auditing applications utilize Nmap’s comprehensive scanning capabilities to verify security control implementations and identify policy violations.
Many regulatory frameworks require periodic network assessments, and Nmap’s detailed reporting capabilities streamline compliance documentation processes.
Firewall testing represents a specialized application where Nmap’s diverse scan types help validate firewall rule effectiveness and identify potential bypass techniques.
Applications Of Wireshark
Wireshark’s passive analysis capabilities make it essential for network troubleshooting and performance analysis.
Network administrators rely on Wireshark to diagnose connectivity issues, identify bandwidth bottlenecks, and analyze application performance problems.
The tool’s ability to capture and analyze protocol-level details enables precise identification of network issues that other monitoring tools might miss.
Digital forensics investigations represent a critical application domain where Wireshark’s comprehensive packet analysis capabilities prove invaluable.
Security analysts use Wireshark to reconstruct attack sequences, identify data exfiltration attempts, and analyze malware communications.
The tool’s ability to export captured data in various formats supports integration with forensic workflows and legal documentation requirements.
Malware analysis and threat hunting activities leverage Wireshark’s deep packet inspection capabilities to understand malicious software behavior.
Security researchers analyze malware network communications to identify command-and-control servers, understand attack methodologies, and develop detection signatures.
Protocol development and application testing utilize Wireshark’s detailed protocol analysis to verify implementation correctness and identify communication errors.
Security monitoring and incident response workflows integrate Wireshark for detailed analysis of suspicious network activities.
When security information and event management (SIEM) systems identify potential threats, Wireshark provides the detailed packet-level analysis necessary to understand attack vectors and assess impact.
Compliance monitoring applications use Wireshark to verify data handling procedures and identify potential policy violations in network communications.
Comparative Analysis
Active vs Passive Analysis
The fundamental operational difference between Nmap and Wireshark lies in their analytical methodologies. Nmap employs active scanning techniques, generating network traffic to probe target systems and elicit responses that reveal system characteristics.
This active approach enables comprehensive network discovery and service enumeration, but potentially alerts monitoring systems to scanning activities.
Active scanning provides immediate results about network topology and running services, making it ideal for rapid security assessments. Wireshark utilizes passive monitoring approaches, capturing existing network traffic without generating additional packets.
This passive methodology enables covert analysis of network communications but requires existing traffic to analyze.
Passive monitoring provides historical and real-time visibility into network behavior patterns, supporting forensic analysis and long-term monitoring objectives.
Scope And Depth Of Analysis
Nmap’s broad network overview capabilities enable rapid assessment of large network ranges, identifying active hosts, open ports, and running services across thousands of IP addresses.
The tool excels at providing macro-level network intelligence, creating comprehensive inventories of network assets and services. However, Nmap’s analysis remains service-focused, providing limited visibility into actual data communications or application-layer behaviors.
Wireshark’s detailed packet-level inspection provides micro-level analysis of individual network communications, revealing protocol-specific details, data contents, and communication patterns.
This granular approach enables deep understanding of network behaviors but requires significant time investment for analysis of large traffic volumes.
Wireshark excels at protocol-specific analysis, providing detailed insights into application behaviors and communication anomalies.
Technical Expertise Requirements
Nmap’s command-line interface requires fundamental networking knowledge and familiarity with scanning techniques.
Basic Nmap usage involves straightforward commands for port scanning and host discovery, making it accessible to security professionals with intermediate networking skills.
Advanced Nmap usage, including NSE scripting and stealth scanning techniques, requires deeper understanding of network protocols and attack methodologies.
Wireshark’s graphical interface offers intuitive packet browsing capabilities, but it requires extensive protocol knowledge for effective analysis.
Users must understand network protocol hierarchies, packet structures, and communication patterns to extract meaningful insights from captured traffic.
Advanced Wireshark usage requires expertise in protocol analysis, filtering techniques, and forensic investigation methodologies.
Synergistic Workflows
Nmap and Wireshark integration creates powerful analytical workflows that leverage both tools’ strengths.
Security professionals typically begin assessments with Nmap reconnaissance to identify network topology, active hosts, and running services.
This initial mapping phase provides target identification for subsequent detailed analysis. Wireshark packet analysis then provides deep visibility into specific communications identified during Nmap scanning.
Penetration testing methodologies often combine both tools in structured workflows. Initial Nmap scans identify potential attack vectors and vulnerable services, while Wireshark monitoring captures subsequent exploitation attempts and analyzes target responses.
This complementary approach enables comprehensive security assessments that combine broad network reconnaissance with detailed communication analysis.
Advanced Features And Extensibility
Nmap’s Scripting Engine Power
The Nmap Scripting Engine (NSE) represents one of the most significant advances in network scanning automation.
NSE enables vulnerability-specific detection through specialized scripts that test for known security issues, from SSL/TLS vulnerabilities to web application flaws.
Custom script development allows security professionals to create specialized testing procedures tailored to specific environments or requirements.
Script categories organize NSE functionality into logical groupings, including authentication testing, brute force attacks, vulnerability detection, and exploitation frameworks.
Default script execution provides comprehensive security assessment capabilities with minimal configuration, while targeted script selection enables focused testing of specific vulnerabilities or services.
Script chaining and automation support complex testing workflows that combine multiple assessment techniques.
Wireshark’s Analysis Depth
Protocol dissector architecture enables Wireshark’s comprehensive protocol support, with a modular dissector design allowing extension for proprietary or specialized protocols.
Custom dissector development enables analysis of non-standard communications and proprietary application protocols. Lua scripting support provides automation capabilities for repetitive analysis tasks and custom filtering operations.
Statistical analysis capabilities enable pattern identification and anomaly detection within captured traffic. Flow reconstruction features allow analysts to piece together complete communication sessions from fragmented packet captures.
The strategic choice between Nmap and Wireshark for cybersecurity professionals ultimately depends on specific assessment objectives, available resources, and analytical requirements.
Nmap excels in active reconnaissance scenarios where rapid network discovery, service enumeration, and vulnerability identification drive security assessment priorities.
Its comprehensive scanning capabilities, extensive scripting engine, and scalable architecture make it indispensable for penetration testing, network inventory management, and initial security assessments.
Wireshark provides unmatched depth in passive network analysis, offering detailed protocol dissection, forensic investigation capabilities, and comprehensive traffic monitoring that proves essential for incident response, malware analysis, and network troubleshooting.
Its ability to capture and analyze thousands of protocols with granular detail makes it the definitive tool for understanding network behaviors and investigating security incidents.
Security professionals who master both tools gain significant advantages in their ability to assess, monitor, and protect network infrastructure against evolving cyber threats.
Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.
The U.S. Federal Bureau of Investigation (FBI) has issued a flash alert to release indicators of compromise (IoCs) associated with two cybercriminal groups tracked as UNC6040 and UNC6395 for a string of data theft and extortion attacks.
“Both groups have recently been observed targeting organizations’ Salesforce platforms via different initial access mechanisms,” the FBI said.
UNC6395 is a
A sophisticated malware campaign has emerged that leverages artificial intelligence to create deceptively legitimate applications, marking a significant evolution in cyberthreat tactics.
The EvilAI malware family represents a new breed of threats that combines AI-generated code with traditional trojan techniques to infiltrate systems worldwide while maintaining an unprecedented level of stealth.
The malware operates by disguising itself as productivity and AI-enhanced tools, complete with professional interfaces, valid digital signatures, and functional features that align with their advertised purposes.
Applications such as “Recipe Lister,” “Manual Finder,” and “PDF Editor” provide genuine utility to users while simultaneously executing malicious payloads in the background.
This dual-purpose approach significantly reduces user suspicion and allows the malware to establish persistence before detection.
Global telemetry data reveals the campaign’s extensive reach, with infections spanning multiple continents and affecting critical sectors including manufacturing, government services, and healthcare.
Europe has reported the highest concentration of cases with 56 incidents, followed by the Americas and AMEA regions with 29 cases each.
The rapid geographic distribution within just one week of monitoring indicates an active and expanding threat landscape.
Trend Micro researchers identified that EvilAI employs sophisticated social engineering tactics combined with AI-generated code that appears clean and legitimate to static analysis tools.
The threat actors create entirely novel applications rather than mimicking existing software brands, making detection considerably more challenging for traditional security solutions.
Advanced Infection and Persistence Mechanisms
The malware’s infection chain begins when users launch seemingly legitimate applications, triggering a covert Node.js execution process that remains hidden from user visibility.
The attack leverages a carefully orchestrated command sequence that silently launches node.exe via Windows command line, executing JavaScript payloads stored in temporary directories.
The persistence mechanism demonstrates remarkable sophistication through multiple redundant methods.
EvilAI creates scheduled tasks named “sys_component_health_{UID}” that masquerade as legitimate Windows processes, triggering daily at 10:51 AM and repeating every four hours. The implementation uses the following command structure:
Additionally, the malware establishes registry entries in the Windows Run key, ensuring execution at user logon while creating Start Menu shortcuts to maintain the illusion of legitimate software installation.
The JavaScript files consistently follow naming patterns with GUID suffixes ending in characters such as “or,” “ro,” or “of.”
EvilAI’s detection evasion capabilities extend beyond traditional obfuscation through the implementation of anti-analysis loops using MurmurHash3 32-bit hashing.
These loops create the appearance of potentially infinite execution cycles to static analysis tools while actually executing only once, effectively forcing analysts to rely on dynamic analysis methods rather than static code examination.
Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.
A sophisticated malvertising campaign has emerged, exploiting GitHub repositories through dangling commits to distribute malware via fake GitHub Desktop clients.
This novel attack vector represents a significant evolution in cybercriminal tactics, leveraging the trust and legitimacy associated with GitHub’s platform to deceive unsuspecting users into downloading malicious software.
The campaign operates by promoting compromised GitHub repositories containing dangling commits that serve as delivery mechanisms for malware payloads.
When users search for GitHub Desktop through compromised advertisements, they are redirected to malicious repositories that appear legitimate but contain hidden malware embedded within the repository structure.
The attack leverages users’ familiarity with GitHub’s interface and their trust in the platform’s security.
Upon successful infection, the malware establishes persistence on victim systems while maintaining covert communication channels with command and control servers.
Attack chain (Source – X)
Unit 42 researchers identified this campaign through behavioral analysis of suspicious GitHub repository activities and anomalous download patterns associated with fake GitHub Desktop installers.
Advanced Infection Mechanism and Payload Execution
The malware employs a sophisticated multi-stage infection process that begins when users download what appears to be a legitimate GitHub Desktop installer.
The initial payload performs comprehensive system discovery, collecting detailed information about the infected machine including operating system details, installed software, and network configurations.
This reconnaissance data is immediately exfiltrated to attacker-controlled servers before proceeding to the next infection stage.
We have tracked a #malvertising campaign that promoted dangling commits in an official GitHub repository. This new campaign tricked users into downloading a fake GitHub desktop client that delivered malware in the background. More info at: https://t.co/7tX3rz1TSTpic.twitter.com/V9yNrUU6xW
The campaign demonstrates particular sophistication in its use of conditional payload deployment based on system characteristics.
PowerShell-based payloads download NetSupport Remote Access Trojan from command and control infrastructure, while executable variants deploy AutoIT interpreters with COM file extensions to evade detection.
The malware establishes registry-based persistence mechanisms and utilizes legitimate system utilities like MSBuild.exe and RegAsm.exe for data exfiltration, effectively blending malicious activities with normal system operations.
Detection evasion techniques include enabling browser remote debugging capabilities, setting Windows Defender exclusion paths, and leveraging trusted system processes for payload execution, making traditional security solutions less effective against this sophisticated threat.
Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.
A sophisticated backdoor malware known as Backdoor.WIN32.Buterat has emerged as a significant threat to enterprise networks, demonstrating advanced persistence techniques and stealth capabilities that enable attackers to maintain long-term unauthorized access to compromised systems.
The malware has been identified targeting government and corporate environments through carefully orchestrated phishing campaigns, malicious email attachments, and trojanized software downloads.
Unlike conventional malware focused on immediate damage or data extraction, Buterat prioritizes longevity and covert operations.
The backdoor establishes encrypted communication channels with remote command-and-control servers, allowing threat actors to execute arbitrary commands, deploy additional payloads, and move laterally across network infrastructure while evading traditional detection mechanisms.
Point Wild researchers identified the malware sample with SHA-256 hash f50ec4cf0d0472a3e40ff8b9d713fb0995e648ecedf15082a88b6e6f1789cdab, revealing its compilation using Borland Delphi and sophisticated obfuscation techniques.
Execution Flow (Source – Point Wild)
The malware disguises its processes under legitimate system tasks and modifies registry keys to achieve persistence across system reboots.
Advanced Thread Manipulation and Injection Techniques
Buterat employs sophisticated thread manipulation methods that set it apart from typical backdoor implementations.
The malware leverages obfuscated API calls, particularly SetThreadContext and ResumeThread, to achieve precise control over thread execution without creating new processes or altering entry points.
This technique enables the backdoor to hijack existing threads seamlessly, making detection significantly more challenging for behavioral analysis systems.
The SetThreadContext API provides attackers with granular control over thread states, allowing them to inject malicious code into legitimate processes without triggering process creation alerts.
Following thread context modification, the malware uses ResumeThread to activate compromised threads with altered execution flows.
This approach represents a sophisticated evasion mechanism that bypasses lightweight behavioral detection systems commonly deployed in enterprise environments.
During infection, Buterat drops multiple executable files including amhost.exe, bmhost.exe, cmhost.exe, dmhost.exe, and lqL1gG.exe in the user directory, establishing multiple persistence points.
The malware attempts communication with its command-and-control server at http://ginomp3.mooo.com/, enabling remote control capabilities for data exfiltration and additional payload deployment.
Security teams should monitor for these specific indicators of compromise and implement network-level blocking to prevent communication with known malicious infrastructure.
Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.
Cybersecurity researchers have uncovered a sophisticated malware campaign that exploits SVG (Scalable Vector Graphics) files and email attachments to distribute dangerous Remote Access Trojans, specifically XWorm and Remcos RAT.
This emerging threat represents a significant evolution in attack methodologies, as threat actors increasingly turn to non-traditional file formats to bypass conventional security defenses.
The campaign employs multiple delivery vectors, including direct email attachments containing malicious EML files and URLs hosted on trusted platforms like ImageKit.
These ZIP archives contain highly obfuscated BAT scripts that serve as the initial infection stage, utilizing advanced techniques to evade static detection mechanisms.
The malware’s fileless execution approach enables it to operate entirely in memory, making detection considerably more challenging for traditional endpoint protection solutions.
Seqrite researchers identified two distinct campaign variants during their analysis, revealing an evolving threat landscape where attackers continuously refine their techniques.
The first campaign delivers BAT scripts directly through email attachments, while the second introduces SVG files embedded with JavaScript as a novel delivery mechanism.
Infection Chain (Source – Seqrite)
These SVG files appear as legitimate image files but contain embedded scripts that automatically trigger malicious payload downloads when rendered in vulnerable environments or embedded within phishing pages.
The attack chain demonstrates remarkable sophistication in its execution methodology. Once the initial ZIP file is extracted, victims encounter a heavily obfuscated BAT script designed to appear benign while executing complex malicious operations.
This script leverages PowerShell to perform in-memory payload injection, effectively bypassing traditional file-based detection systems.
Advanced Evasion and Persistence Mechanisms
The malware employs sophisticated evasion techniques that target core Windows security mechanisms. The PowerShell component programmatically disables both AMSI (Antimalware Scan Interface) and ETW (Event Tracing for Windows) through dynamic .NET reflection and delegate creation.
Obfuscated and deobfuscated bat files (Source – Seqrite)
The attack resolves native functions including GetProcAddress, GetModuleHandle, VirtualProtect, and AmsiInitialize to locate and patch the AmsiScanBuffer function in memory.
The persistence mechanism involves creating BAT files within the Windows Startup folder, ensuring automatic execution upon system restart or user login.
The PowerShell script searches for Base64-encoded payloads hidden within batch file comments, specifically targeting lines prefixed with triple-colon markers.
These payloads undergo multiple layers of decryption, including AES decryption using hardcoded keys and GZIP decompression before final execution.
The loader component functions as a critical intermediary, extracting and executing embedded .NET assemblies directly in memory using Assembly.Load operations.
This approach eliminates the need for disk-based file creation, significantly reducing detection probability while maintaining full operational capability for deploying XWorm and Remcos RAT payloads.
Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.
The well-known group of cybercriminals called Scattered Lapsus$ Hunters released a surprising farewell statement on BreachForums.
This manifesto, a mix of confession and strategic deception, offers vital insights into the changing landscape of modern cybercrime and the increasing pressure from global law enforcement agencies.
The statement reveals sophisticated operational security practices that extend far beyond typical cybercriminal behavior.
The group claims their 72-hour silence was deliberately orchestrated to “speak with our families, our relatives, and to confirm the efficiency of our contingency plans and our intents”.
This calculated approach demonstrates a level of strategic planning typically associated with nation-state actors rather than financially motivated cybercriminals.
They describe these spectacular breaches as tactical misdirection designed to “divert the FBI, Mandiant, and a few others” while their actual contingency plans were being activated.
This reveals a sophisticated understanding of how law enforcement and incident response teams allocate resources, suggesting the group has studied defensive methodologies as carefully as attack vectors.
The group’s claim that they “willingly left them in wonder” after penetrating Google’s systems is particularly significant.
The restraint shown in Google’s Workspace, Person Finder, and Gmail legacy branches suggests that the group may have had more access than they revealed but chose not to use it fully. This decision goes against what is typical for ransomware groups, which usually try to cause as much damage and make as much money as possible.
Infrastructure Targeting And Unrealized Threats
Perhaps most concerning are the group’s implications regarding critical infrastructure vulnerabilities.
Their statement suggests data from companies including Kering, Air France, American Airlines, and British Airlines may be compromised, with some organizations unaware they face potential exploitation.
This aligns with documented attacks throughout 2025, where Air France and KLM confirmed breaches in August, and multiple aviation sector incidents were attributed to related groups.
The group’s question, “Are their data currently being exploited, whilst US, UK, AU, and French authorities fill themselves with the illusions thinking they have gotten the situation under control?” reveals deep cynicism about international law enforcement coordination.
This statement gains particular significance given the recent arrests and the group’s apparent ability to monitor investigative activities, including their claim of “observing them as they painfully try to upload their HD logos to the BF servers”.
The statement directly addresses the human cost of their operations, acknowledging eight arrests linked to Scattered Spider and ShinyHunters operations since April 2024, with four individuals currently in French custody.
These arrests include the June 2025 detention of four alleged ShinyHunters members in France, highlighting the effectiveness of international cooperation between French authorities, the FBI, and other agencies.
The group’s expression of regret “to the four who are now in custody in France” and their assertion that investigations will “progressively fall apart” suggests they believe the arrested individuals were sacrificial.
Their claim to have “manipulated evidence to mislead investigators” indicates sophisticated counterintelligence capabilities designed to protect core operators while allowing peripheral members to face legal consequences.
Collaborations
The emergence of Scattered Lapsus$ Hunters represents an unprecedented consolidation within cybercrime, combining the tactics of Scattered Spider, Lapsus$, and ShinyHunters.
This merger brought together complementary skill sets: Scattered Spider’s social engineering expertise, Lapsus$’s brazen publicity tactics, and ShinyHunters’ data theft capabilities.
Their operations throughout 2025 demonstrated remarkable technical sophistication, including OAuth token abuse in Salesforce environments, AI-enhanced voice cloning for vishing attacks, and custom tooling for accelerated data extraction.
The Google Threat Intelligence Group confirmed these actors deployed specialized tools for Salesforce data extraction while simultaneously targeting multiple organizations through social engineering campaigns.
The group’s announcement of retirement should be viewed skeptically, given historical precedent. Their statement that “LAPSUS$, Trihash, Yurosh, Kurosh, Clown, IntelBroker, Scattered Spider, Yukari, and among many others” are “going dark” reads more like a strategic reorganization than a genuine cessation of activities.
The timing coincides with unprecedented law enforcement pressure. The FBI and CISA’s July 2025 advisory warned of Scattered Spider’s “serious and ongoing threat”, while coordinated international operations throughout 2025 disrupted numerous cybercrime infrastructures.
The group’s decision to withdraw likely reflects recognition that their operational security has been compromised rather than genuine remorse.
Cybersecurity Landscape
The Scattered Lapsus$ statement provides several critical takeaways for cybersecurity professionals and law enforcement:
Operational Evolution: Modern cybercriminal groups increasingly operate with nation-state level sophistication, employing strategic deception, counterintelligence, and long-term planning.
Human-Centric Threats: Their success stemmed primarily from social engineering and identity-based attacks rather than technical exploits, highlighting the continued vulnerability of human factors in security.
International Coordination Effectiveness: The pressure evidenced in their farewell statement validates the impact of coordinated international law enforcement efforts, particularly the Franco-American cooperation that led to multiple arrests.
Infrastructure Vulnerabilities: Their targeting of third-party vendors and cloud services underscores the critical importance of supply chain security and OAuth token management.
The Scattered Lapsus$ farewell represents not the end of an era, but likely a transformation.
While these specific actors may have withdrawn, their techniques, tools, and tactical innovations will undoubtedly influence the next generation of cybercriminal operations.
Their statement serves as both a warning about the sophistication of modern threats and validation that sustained international pressure can force even the most brazen actors to reconsider their activities.
Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.
A newly introduced feature in ChatGPT that allows it to connect with personal data applications can be exploited by attackers to exfiltrate private information from a user’s email account.
The attack requires only the victim’s email address and leverages a malicious calendar invitation to hijack the AI agent.
On Wednesday, OpenAI announced that ChatGPT would begin supporting Model Context Protocol (MCP) tools, an innovation from AnthropicAI designed to let AI agents connect with and read data from a user’s personal applications.
This includes widely used services such as Gmail, Google Calendar, Sharepoint, and Notion. While this integration is designed to enhance productivity, it introduces a significant security vulnerability rooted in the fundamental nature of AI agents.
These models are designed to follow commands precisely but lack the common-sense judgment to distinguish between a legitimate user request and a malicious, injected prompt.
This makes them susceptible to attacks that can turn the AI against the user it is supposed to assist.
Weaponized Email Invite
Eito Miyamura demonstrated a simple yet effective method to exploit this integration. The attack begins when a threat actor sends a specially crafted calendar invitation to a victim’s email address.
We got ChatGPT to leak your private email data
All you need? The victim's email address.
On Wednesday, @OpenAI added full support for MCP (Model Context Protocol) tools in ChatGPT. Allowing ChatGPT to connect and read your Gmail, Calendar, Sharepoint, Notion,… pic.twitter.com/E5VuhZp2u2
This invitation contains a hidden “jailbreak” prompt designed to give the attacker control over the victim’s ChatGPT session. The victim does not even need to see or accept the invitation for the attack to proceed.
The next step relies on a common user action: asking ChatGPT to help prepare for their day by reviewing their calendar. When the AI scans the calendar, it reads the data from the malicious invitation.
The jailbreak prompt is then executed, effectively hijacking the AI. Now under the attacker’s control, ChatGPT follows the embedded commands, which can instruct it to search through the victim’s private emails for sensitive information and exfiltrate that data to an email address specified by the attacker.
For now, OpenAI has limited the MCP feature to a “developer mode” and implemented a safeguard that requires manual user approval for every session.
However, this relies on user vigilance, which is often undermined by a psychological phenomenon known as decision fatigue. In practice, users are likely to become accustomed to the approval prompts and will repeatedly click “approve” without fully understanding the permissions they are granting.
Integrating these tools with sensitive personal data poses a serious security risk that requires more robust safeguards than simple user approvals.
Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.
It’s been less than a week since President Donald Trump signed an executive order designating the Department of Defense as the Department of War. And while Congress has blocked debate of the change for now, officials for the Pentagon’s IT agency have seemingly already renamed the networks and infrastructure used for missions worldwide.
“When we talk about the Department of War Information Network, it doesn't exist without industry. It's nothing more than a nomination of industry products, and we put them together in a meaningful way. We make some minor adjustments and modifications to ensure that we meet the war fighting requirements,” Defense Information Systems Agency leader Lt. Gen. Paul Stanton said Thursday during the Billington Cybersecurity Summit, referring to a network typically known as the Department of Defense Information Network, or DODIN.
Name changes and complicated acronyms are common in the U.S. government. But the White House’s executive order to rename the Defense Department has started a trickle-down effect with likely unintended consequences as officials seem to adhere to new policy without specific guidance. Without consistency, the effects could lead to confusion from private companies and mission partners who work with the Pentagon and its entities. And some of the quickly changed names could result in unfortunate acronyms—such as “DOWNet,” which seems to imply a broken network, for the program previously called the Department of Defense Network.
DISA operates and maintains communications networks and tools for the White House, Pentagon, military departments, combatant commands, defense agencies, and field activities. The agency also handles networks that allies and partners use to communicate with the U.S. military. That sprawling, global system is DODIN—which is how Stanton referred to it in subsequent references, when describing missions at the U.S. southern border.
“The DODIN today won't be the DODIN tomorrow, which is why my No. 2 priority is continuous modernization. We must keep pace with technology. We must keep pace with the adversary. We must keep pace with our mission command,” Stanton said.
[[Related Posts]]
For now at least, the Department of War is a secondary name, which means it can be used by officials in public and, for example, signage printed on stationery. But statutorily, the name is still the Department of Defense, and any official change would have to be approved by Congress.
Still, the nickname has caught on quickly in just a few days. The Pentagon’s official website, defense.gov, quickly changed to war.gov, and the social media handles and names for top U.S. defense accounts have changed as well. The Defense Media Activity, which handles the department’s websites, sports the new “Department of War” emblem on its homepage.
Additionally, the Pentagon’s top official, Pete Hegseth, now refers to himself as the secretary of war, and various titles for roles and organizations under his office have followed suit.
Defense One sent multiple requests to the Pentagon and Defense Information Systems Agency to get clarity on new guidance and policy. A DISA spokesperson said: “The Office of the Secretary War Public Affairs will handle all questions regarding name changes based on the executive order.” When asked if network, program, agency and command name changes were permanent or aliases, the Pentagon referred to the “executive order and to the Secretary’s comments. Beyond that we don’t have anything to offer you at this time.”
The executive order states: "All executive departments and agencies shall recognize and accommodate the use of such secondary titles in internal and external communications, provided that the use of such titles does not create confusion with respect to legal, statutory, or international obligations."
Katie Arrington, who is performing the duties of the Pentagon’s chief information officer, used both names for the department during her keynote Thursday at the Billington Cybersecurity Summit. But she emphasized the Department of War name change when intertwining talking points about the department’s mission, technology, and the emotional effects of the killing of conservative activist Charlie Kirk and the anniversary of September 11.
“Yesterday was hard. I knew Charlie Kirk very well, because I was a former politician. And then, the impact of this morning and what today means. And why we are called now the Department of War is something I really want you all to understand. Senseless violence is not acceptable by Americans, full stop. End of story,” Arrington said. “The more that the world knows that I am lethal, I am deadly, and I am efficient, and you don't want me to get mad. That is why we named it the Department of War, because the more that we are offensively postured and that we're in a place so that people won't do stupid things. That is why we're doing what we're doing.”
Arrington continued saying that more technology, such as the sensors and other infrastructure needed to create a domestic missile defense system concept known as Golden Dome, would also deter and warn of potential threats, such as the suspected shooter in Kirk’s death.
“If we have more sensors in the environments, would we be able to see a shooter on a roof? Yes. Where we need sensors in our environment, around the country, as we build out Golden Dome—that is left of boom. That is our world. But all of that is technology. All of that is computers and systems and networks talking to each other and micro-segments and having everything at the speed of relevance—not at the speed of a requirement, not at the speed of a budget.”
Changing a social media handle or a sign on a wall is relatively straightforward, but things are more tricky when talking about IT networks and tech initiatives that include “Department of Defense” in the name—particularly one as complex as the DODIN, which includes the telecommunications network called the Defense Information Systems Network.
A representative for the Billington event confirmed that the Pentagon requested references to the Department of Defense, including acronyms, be changed to the Department of War on its agenda. Paper materials reflected the traditional name and acronym. Organization names were also changed, including DCDC, which is called the Department of War Cyber Defense Command on the event website but not the command’s official website.
One such acronym is for a collection of networks DISA runs for defense agencies and field activities often referred to as the Fourth Estate. The agency has been consolidating and updating those networks as part of a program called the Department of Defense Network, or DODNet.
During a panel discussion on zero trust and DISA’s role in helping defense organizations meet the 2027 deadline, Michael Butler, the chief engineer for the program, referred to a collection of networks DISA runs for defense agencies as DOWNet. The event’s agenda also reflected the acronym change, but it kept the full name as Department of Defense Network.
“The frameworks are there, the capabilities are there, the technology is there. We're ready to execute. So, bringing those capabilities when we're taking D-O-W-Net—excuse me, it’s going to take a little time to adjust to that—ICAM, Thunderdome, defensive cyber operations. All those things bundled together to deliver…expanding our scope beyond just only the combat support agencies, but also the command commands and others, making those things available to them, and executing and implementing those technologies…Those are things that we already said, go ahead and actually do right now.”
The effort is still referred to as DODNet on DISA’s website.
.webp)
.webp)
.webp)
.webp)
.webp)
(@Eito_Miyamura)