🏆 VB2025 Péter Szőr Award — Finalists Announced! We're excited to reveal the three shortlisted finalists for this year’s Péter Szőr Award, selected by committee vote The winner will be announced at the Gala Dinner this evening, Thursday 25 September, at VB2025 in Berlin.

I'm excited to speak at #VB2025 later this week! I'll be diving into TAG-124, a group whose services are leveraged by a wide range of actors, from cybercriminals to state-sponsored groups. Hit me up if you are in town! www.virusbulletin.com/conference/v...

Two exciting panels featuring #ESETresearch’s Righard Zwienenberg at #VB2025 in Berlin @virusbtn - from stories of the past to debates about the future of vulnerability handling. Here's what to expect 👇1/3

I'm on my way to #VB2025, the Virus Bulletin conference, representing @silentpush.bsky.social. Come and say hello if that's your thing.

Good morning VB2025! Our talk will be at 15:00 in the Green Room today!

Silent Push threat analysts are tracking CountLoader, a new loader spreading via phishing and delivering Cobalt Strike and AdaptixC2, with evidence pointing to its use by an IAB or a ransomware affiliate linked to LockBit, BlackBasta and Qilin. www.silentpush.com/blog/countlo...

Hunt.io Threat Research uncovers attackers abusing ConnectWise ScreenConnect installers and open directories as staging points to deliver AsyncRAT and a custom PowerShell RAT. hunt.io/blog/asyncra...

GitLab Threat Intelligence details BeaverTail & InvisibleFerret, distributed via malicious repositories & ClickFix by North Korean threat actors. Previously targeting developers, the focus has shifted towards marketing & trader roles in crypto & retail. gitlab-com.gitlab.io/gl-security/...

Zscaler ThreatLabz reports two malicious PyPI packages, sisaws and secmeasure, that deliver SilentSync, a Python-based RAT designed to execute remote commands, exfiltrate files, capture screens and steal browser data from Chrome, Brave, Edge and Firefox. www.zscaler.com/blogs/securi...

Bitdefender Threat Research analyses a cyber attack on a Philippine military company, revealing EggStreme - a new fileless multi-stage framework built for persistent espionage and designed to establish a resilient foothold on compromised systems. businessinsights.bitdefender.com/eggstreme-fi...

Human Security's Satori Threat Intelligence & Research Team uncovered and disrupted SlopAds, an ad-and-click fraud scheme that uses steganography to load fraud modules and hidden WebViews to navigate to cashout sites across 224 apps. www.humansecurity.com/learn/blog/s...

EclecticIQ analysts observe the 'shinysp1d3r' RaaS in development, with features to encrypt VMware ESXi. They assess it will expand its victim base and broaden its extortion capabilities. blog.eclecticiq.com/shinyhunters...

Recorded Future's Insikt Group reports CopyCop, also tracked as Storm 1516, expanding in 2025, adding at least 200 new fictional media websites targeting the United States, France and Canada and using self-hosted LLMs. www.recordedfuture.com/research/cop...

Sophos Counter Threat Unit researchers track the victimology and online activity of GOLD SALEM, also called Warlock Group, active since March 2025 and deploying Warlock ransomware. The group has about 60 published victims by mid September 2025. news.sophos.com/en-us/2025/0...

Atlantic Council Cyber Statecraft Initiative introduces the 2025 Mythical Beasts update on the global spyware market to uncover historical entities not previously identified and to identify new entities entering the market in 2024. www.atlanticcouncil.org/in-depth-res...

🌍 One week to go: VB2025 kicks off next Wednesday in Berlin. ✅3 days of expert talks 🎤90+ speakers 🌐300+ security pros from around the world This is your last chance to connect, learn, and be part of the VB community this year in Berlin! 👉 tinyurl.com/3jvvmkxd

Proofpoint Threat Research reports TA415 ran spear-phishing campaigns in July & August 2025 against US government think tanks and academia using US-China economic lures, and using Google Sheets, Google Calendar and VS Code Remote Tunnels for C2. www.proofpoint.com/us/blog/thre...

Acronis Threat Research Unit reports a sophisticated FileFix in the wild beyond the original POC with a multi-lingual phishing site, anti-analysis tricks and JPG steganography that hides a second-stage PowerShell script and encrypted executables. www.acronis.com/en/tru/posts...

Check Point Research analyses a ClickFix job lure campaign that resulted in an eight-day intrusion with deployment of a Rust loader, PureHVNC RAT & Sliver. The team provides detailed analyses of PureHVNC including its complete set of commands and plugins. research.checkpoint.com/2025/under-t...

The Sekoia.io Threat Detection and Response team links two early 2025 APT28 samples to the CERT UA BeardShell and Covenant publication on 21 June 2025 and reports additional weaponized Office documents and previously undocumented techniques. blog.sekoia.io/apt28-operat...

The Point Wild Lat61 Threat Intelligence Team shares a technical evaluation of Raven Stealer, covering its functional capabilities and distribution mechanisms, correlating observed behaviour, and detailing Telegram-based exfiltration. www.pointwild.com/threat-intel...

Zscaler's ThreatLabz tracks SmokeLoader’s return with new “2025-alpha” and “2025” builds after the May 2024 Operation Endgame takedown. The builds fix performance-impacting bugs and update artifacts to evade static and behaviour-based detection. www.zscaler.com/blogs/securi...

Qianxin XLab observes the AISURU botnet behind multiple 2025 high impact DDoS events with peak bandwidth now 11.5 Tbps. blog.xlab.qianxin.com/super-large-...

Genians reports on the Kimsuky APT group using ChatGPT to generate deepfake South Korean military ID cards for phishing. The campaign used batch files and AutoIt scripts to evade anti-virus defences. www.genians.co.kr/en/blog/thre...

StrikeReady notes SideWinder repackaging its playbook around Nepal protests to target users tracking the unrest. The operation mixes mobile malware, Windows malware, and credential phishing via spoofed emergency notifications. strikeready.com/blog/sidewin...

CyberProof reports a spike in DarkCloud Stealer attacks against financial firms in August 2025 via phishing. Samples steal credentials from email and FTP clients and browsers, inject into MSBuild.exe, and use a JPG-embedded loader. www.cyberproof.com/blog/darkclo...

Seqrite reports a surge in HijackLoader distributed via fake installers, SEO-poisoned sites, malvertising, and piracy portals. Since June 2025, ClickFix lures have pushed .msi installers that execute HijackLoader, with DeerStealer observed as the final payload. www.seqrite.com/blog/deconst...

Check Point Research profiles Yurei, a new ransomware group first seen on September 5 that listed a Sri Lankan food manufacturer as its first victim. Derived from open-source Prince-Ransomware in Go, it uses double extortion and leaves Shadow Copies intact. research.checkpoint.com/2025/yurei-t...

FortiGuard Labs highlights an SEO-poisoning campaign that targets Chinese-speaking users. Attackers manipulate search rankings with SEO plugins and lookalike domains, delivering malware families such as Hiddengh0st and Winos. www.fortinet.com/blog/threat-...

ESET Research introduces HybridPetya, a Petya/NotPetya copycat discovered on VirusTotal in Feb 2025. It encrypts the NTFS MFT and can compromise UEFI systems, weaponizing CVE-2024-7344 to bypass Secure Boot on outdated machines. www.welivesecurity.com/en/eset-rese...

Expel reports that the AppSuite-PDF/PDF Editor developers behind BaoLoader used at least 26 code-signing certificates over seven years to appear legitimate. The analysis focuses on code-signing certificate abuse. expel.com/blog/the-his...

Hunt.io maps a phishing wave that clones the websites of Chevron, ConocoPhillips, PBF Energy, and Phillips 66. Tactics include HTTrack-based site copying, exposed directories, and investment-scam templates. hunt.io/blog/us-ener...

ASEC documents BlackNevas ransomware activity affecting firms in various industries and countries, including South Korea. The article details behaviour and encryption methods, and explains why victims cannot decrypt files. asec.ahnlab.com/en/90080/

IBM X-Force has published new research on China-aligned Mustang Panda. Researchers observed an updated Toneshell and SnakeDisk, a USB worm that triggers only on Thailand-based IPs to deliver Yokai backdoor. www.ibm.com/think/x-forc...

Trend Micro details EvilAI, which disguises itself as productivity/AI apps and is signed to appear legitimate. Infections span Europe, the Americas and AMEA, hitting manufacturing, government and healthcare sectors. www.trendmicro.com/en_us/resear...

Intezer analyses a new ToneShell backdoor variant linked to Mustang Panda. It’s delivered via DLL sideloading with signed EXEs and cloud-hosted lures in ongoing operations against Myanmar. intezer.com/blog/franken...

Just two weeks to go until VB2025, and the final programme is now live! We’ve added several last-minute presentations, selected through our late CFP to reflect the most timely, real-world developments in the field. Secure your spot now 👉 tinyurl.com/37p9dajp

S2W TALON reports Kimsuky abusing GitHub repositories in an ongoing campaign. A malicious LNK downloads a PowerShell script with a hard-coded GitHub private token that collects system metadata and uploads the logs to the adversary’s repository. s2w.inc/en/resource/...

Jamf Threat Labs presents a deep dive into ChillyHell, a modular macOS backdoor active since 2021. The latest sample was developer-signed, Apple-notarized, and remained undetected. www.jamf.com/blog/chillyh...

Sysdig’s Threat Research Team identifies ZynorRAT, a new Go-based RAT supporting Linux and Windows. First seen on 8 July 2025, it shows little similarity to known families, uses Telegram for C2, and is likely Turkish in origin. www.sysdig.com/blog/zynorra...

Zscaler ThreatLabz identifies a campaign active since early May 2025 targeting Chinese-speaking users that delivers ValleyRAT, FatalRAT, & the newly named kkRAT. The blog post details the attack chain and kkRAT’s features, network protocol, commands, & plugins. www.zscaler.com/blogs/securi...

Unit 42 reports AdaptixC2 being used in campaigns in May 2025. The open-source, customizable post-exploitation framework enables command execution, file movement, and exfiltration, with little public documentation of real-world use. unit42.paloaltonetworks.com/adaptixc2-po...

Bitdefender details a sophisticated, targeted attack on a Philippine military company that led to the discovery of EggStreme, a newly identified APT framework. businessinsights.bitdefender.com/eggstreme-fi...

Kroll researchers analyse GONEPOSTAL, used by KTA007 (Fancy Bear/APT28) in an espionage campaign. A dropper DLL deploys a password-protected Outlook macro (VbaProject.OTM), enabling backdoor access to Microsoft Outlook. Context links the actor to GRU Unit 26165. www.kroll.com/en/publicati...

ASEC analyses the CyberVolk ransomware, first seen in May 2024, which continues to hit government agencies and critical infrastructure in multiple countries. The analysis provides a technical breakdown of its architecture and encryption scheme. asec.ahnlab.com/ko/90033/

Trend Micro details the Gentlemen ransomware group, showing advanced tooling to bypass enterprise endpoint protections. TTPs include driver abuse, GPO manipulation, custom anti-AV utilities, privileged account compromise, and exfiltration. www.trendmicro.com/en_us/resear...

Cybereason Security Services reports a Chrome extension targeting Meta advertisers. Using fake “Madgicx Plus” branding, the malicious add-ons pose as optimizers but exfiltrate credentials, harvest session tokens, and enable account takeover. www.cybereason.com/blog/chrome-...

Whilst tracking NFSkate, ThreatFabric uncovered RatOn, an Android banking trojan that targets crypto wallets, supports device/account takeover, & can perform automated money transfers abusing a specific bank application, and ransoms via overlays & device locks. www.threatfabric.com/blogs/the-ri...

Got something to share? Pitch it as a poster at #VB2025. Informal, low-pressure, perfect for open-source projects, early research, or just a good question. We print it. You bring the charm. 😉 📧 [email protected] 👉 tinyurl.com/3w2cenkb

Kimsuky uses Korea’s National Tax Service-themed emails to target Naver accounts, per a Korean blog analysis. The campaign uses Mail[.]ru infrastructure, and links are obfuscated and personalized with the recipient’s email. wezard4u.tistory.com/429590