news
Breaking Cyber News From Cyberint
Breaking news feed of the latest cyber incidents, breaches, vulnerabilities, malware, ransomware and so much more.
- All Items
- Middle East
- Israel
- Data Encrypted For Impact
- Business Services
- Handala
- Asia
- Jobinfo
- Shelter Locations In Israel
- Saudi Games
- Retail
- Cyber Fattah Team
- Saudi Arabia
- Ben Horin & Alexandrovitz
- Zachary Levi And Sons - Construction
- Sivim It
- Government
- Kibbutz Almog
- Saban Brands Israel
- Manufacturing
- Mprest
- Digitalghost
- The Knesset
- Evil_Byte
- Nobitex
- Gonjeshke Darande
- exclusive
- South-Eastern Asia
- Kimia Farma
- Sentap
- Chemicals And Allied Products
- Indonesia
- Transportation
- Northern Europe
- Scania
- Sweden
- Europe
- Hensi
- Media
- Tbn Israel
- Weizmann Institute Of Science
- Education
- Resistancetrench
- Israeli Air Force
- Israel Antiquities Authority
- Dienet
- North America
- CVE-2025-24016
- Wazuh
- United States
- Cve-2025-24016
- Mirai
- Clayoxtymus1337
- Epsilor Electric Fuel
- Technology
- Southern Asia
- Advanced Weapons And Equipment India
- India
- More_Eggs
- Fin6
- Cryptocurrency
- Alex Lab
- Critical Infrastructures
- Edf Energy
- United Kingdom
- Zoldyck
- Unix Shell
- Credentials In Files
- Spectrum
- Amos
- Disable Or Modify Tools
- Spearphishing Link
- Ingress Tool Transfer
- Match Legitimate Name Or Location
- Sudo And Sudo Caching
- Telecommunications
- Israel Defense Forces
- Food And Kindred Products
- Ghna
- Coca-Cola Europacific Partners
- Southern Europe
- Automotive
- Italy
- Locauto
- Spain
- Whitecoat
- Mercadona
- Wow Health Solutions
- Healthcare
- Ups
- Rip_Real_World
- Cyprus Airways
- Netsupport Rat
- Illeak
- Tel Aviv University
- Desec0X
- Cyberlock
- Lucky_Gh0$T
- Yashma
- Unc6032
- Numero
- Chaos
- Deloitte
- 303
- Gucci
- Command And Scripting Interpreter
- Windows Credential Manager
- Virtualization/Sandbox Evasion
- Credentials From Web Browsers
- Input Capture
- System Information Discovery
- Credentials From Password Stores
- User Execution
- Phishing
- Obfuscated Files Or Information
- Data From Local System
- File And Directory Discovery
- Drive-By Compromise
- Exfiltration Over C2 Channel
- Password Managers
- Eddiestealer
- Screen Capture
- W_Tchdogs
- Australia And New Zealand
- Superloop
- Australia
- Network Service Discovery
- Smb/Windows Admin Shares
- Deploy Container
- Resource Hijacking
- Remote System Discovery
- Escape To Host
- Exploitation For Client Execution
- Change Default File Association
- Web Protocols
- Exploit Public-Facing Application
- Lateral Tool Transfer
- External Remote Services
- Docker
- Eastern Europe
- Cameleon
- Venom Rat
- Romania
- Financial Theft
- Bitdefender
- Cisco
- Macao Special Administrative Region
- Cve-2023-20118
- CVE-2023-20118
- Eastern Asia
- Vicioustrap
- Uat-6382
- Trimble
- Tetraloader
- CVE-2025-0944
- Cve-2025-0944
- China
- Reflective Code Loading
- Obfuscated Files Or Information: Encrypted Or Encoded Data
- Scheduled Task
- Rundll32
- Masquerade Task Or Service
- File Deletion
- Dynamic-Link Library Injection
- Powershell
- Valleyrat
- Regsvr32
- Silver Fox
- Process Discovery
- Malicious File
- Trickbot
- Bumblebee
- Warmcookie
- Danabot
- Qakbot
- Cetus
- Purehvnc
- Bytebreaker
- Latin America And The Caribbean
- Viralgod
- Telcel
- Mexico
- Peter Green Chilled
- Cellcom
-
Jun 03, 2025
Exploiting AI: The Rise of Fake Installers and Ransomware
A new cybersecurity threat involves fake installers for popular AI tools like ChatGPT and InVideo AI, which are being used to distribute various ransomware families, including Cyberlock and Lucky_gh0$t, as well as a destructive malware called Numero. These fake installers are promoted through SEO poisoning and lure users with claims of free access, only to deploy malicious software that encrypts files and demands hefty ransoms. The threat actors behind this campaign are targeting individuals and organizations in the B2B sales and marketing sectors, and their tactics include using legitimate-sounding filenames and exploiting popular AI tools to gain trust. The campaign has been linked to a threat cluster with a Vietnam nexus, indicating a sophisticated and ongoing operation.
