FlagThis - Latest Cybersecurity News

APT28 has deployed "LameHug," a novel infostealer that integrates Large Language Models (LLMs) to generate malicious Windows commands dynamically. By shifting from hardcoded C2 scripts to AI-driven prompt sequences, LameHug adapts attack commands in real-time to the victim's environment, significantly bypassing signature-based EDR and antivirus detection. The malware utilizes dedicated exfiltration modules to steal credentials and sensitive data from NATO, EU, and US targets. This workflow represents a strategic pivot toward "AI-as-a-weapon," reducing the manual research time required for target-specific exploitation and increasing the scalability of state-sponsored espionage operations.

Luxembourg state workstations were targeted by a coordinated cyber-espionage campaign timed with the nation's National Day. Attackers utilized spear-phishing emails to deploy Socgholish (FakeUpdates) as an initial access broker, which subsequently loaded Amadey for persistence and StealC for credential exfiltration. The infection chain focused on harvesting administrative credentials and government metadata from public sector infrastructure. The campaign was neutralized through a global disruption operation led by Europol in collaboration with GovCERT.lu, CIRCL, and CERT-EU, resulting in the dismantling of the Amadey and StealC command-and-control (C2) infrastructure.

Operation Escaneo is a sophisticated hybrid threat campaign targeting critical infrastructure, government entities (notably in Mexico), and financial institutions across Latin America. The campaign utilizes a dual-purpose operational model where financially motivated cybercrime activities appear to subsidize strategic intelligence-gathering operations. Threat actors establish initial access through the exploitation of exposed edge devices and network tunnels, subsequently leveraging privileged service account abuse to facilitate lateral movement and persistent access. This shift from opportunistic attacks to structured intrusion chains represents a heightened risk to regional sovereignty and economic stability, necessitating urgent defensive hardening of perimeter assets.

Earth Alux (UAT-8302), a China-aligned threat group utilizing state-sponsored cyber contractors, is executing a global espionage campaign targeting government, telecommunications, and manufacturing sectors. The campaign leverages internet-facing vulnerabilities to establish initial access, followed by the deployment of specialized modular malware toolkits, specifically VARGEIT and COBEACON. These frameworks facilitate long-term persistence, stealthy lateral movement, and sophisticated command and control (C2) communications. The activity spans the Asia-Pacific, South America, and Europe, focusing on unauthorized intelligence collection and the exfiltration of high-value intellectual property through modular, extensible post-exploitation payloads.

The U.S. Department of Justice (DOJ) and FBI disabled 13 domains associated with a Chinese intelligence operation utilizing front companies, including Centrik Global and Rightinfo, to conduct social engineering attacks against U.S. government and military personnel. Since November 2023, threat actors leveraged AI-generated personas and professional freelance platforms to recruit targets for "consulting" roles. The campaign transitioned victims to Telegram and used cryptocurrency for payments to incentivize the exfiltration of sensitive national security data and classified research. Remediation involved the legal seizure of infrastructure and a wide-scale Army advisory distributed to over one million personnel.