https://blog.dansec.red/actors/doppelpaymer/Recent content in DoppelPaymer on DanSec DailyHugoen-gbTue, 13 May 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-05-13-cybersecurity-news/Tue, 13 May 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-05-13-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li> <p><strong>Output Messenger Zero-Day Exploited in Espionage</strong></p> <ul> <li>A Türkiye-backed threat actor exploited a zero-day vulnerability in Output Messenger, an Indian enterprise communication platform, to deploy Golang-based backdoors on Kurdish servers. The campaign, ongoing since April 2025, targeted Kurdish military operations in Iraq as part of a cyber espionage effort.</li> </ul> </li> <li> <p><strong>Airline Confirms Cyberattack</strong></p> <ul> <li>An airline involved in deportation flights for the US government disclosed a cybersecurity incident to the SEC, confirming reports of a cyberattack.</li> </ul> </li> <li> <p><strong>DoppelPaymer Ransomware Arrest</strong></p> <ul> <li>Moldovan authorities arrested a suspect linked to DoppelPaymer ransomware attacks against Dutch organisations in 2021.</li> </ul> </li> <li> <p><strong>Global Botnet Operation Disrupted</strong></p> <ul> <li>Four hackers were arrested for operating a global botnet that infected outdated wireless routers with Anyproxy and 5socks malware, allowing covert reconfiguration and use for malicious activities.</li> </ul> </li> </ul>