Cybersecurity News - Page 72

Edward Coristine ran a company named DiamondCDN, which allegedly provided vital infrastructure services to cybercrime group EGodly.

CVE-2025-2783 works in conjunction with a remote code execution exploit, which has yet to be identified.

According to DTI's findings, the infrastructure involves a set of mail servers, each operating a network of spoofed domains.

The malware’s attack chains have evolved to include various distribution methods.

The attack, named ‘MSC EvilTwin,’ leverages .msc files and MUIPath to download and execute malicious payload.

The primary goal of this operation was to sway public and political views to the detriment of Ukraine and in favor of Russia.

The group employed a combination of web shells and tunneling methods to facilitate long-term persistence within the network.

The driver is designed to masquerade as a legitimate CrowdStrike Falcon driver.

Each malicious ad in the campaign is tied to a unique domain name.

The breach, which affected hundreds of repositories, was carried out through a compromised GitHub Action.