https://blog.dansec.red/vendors/flipper-devices/Recent content in Flipper Devices on DanSec DailyHugoen-gbMon, 07 Jul 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-07-07-cybersecurity-news/Mon, 07 Jul 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-07-07-cybersecurity-news/<h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>TAG-140, a threat group linked to Pakistan, has been observed targeting Indian government, defence, and rail sectors using a modified version of the DRAT remote access trojan (DRAT V2). The campaign involves spear-phishing and the deployment of the new RAT variant for persistent access and data exfiltration.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>The Caracal rootkit, written in Rust and leveraging eBPF, has been released for stealthy post-exploitation. Caracal enables the hiding of BPF programs, maps, and processes on compromised systems, enhancing evasion capabilities for attackers and red teamers.</li> <li>Analysis of SSH and Telnet honeypot data has revealed attackers experimenting with new and varied usernames in brute-force attempts, indicating ongoing evolution in credential-stuffing tactics.</li> <li>The Flipper Zero device continues to demonstrate a wide range of offensive security capabilities, including RFID/NFC cloning, signal replay attacks, and wireless protocol analysis, maintaining its popularity among both security professionals and hobbyists.</li> </ul>https://blog.dansec.red/posts/2025-07-06-cybersecurity-news/Sun, 06 Jul 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-07-06-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>Ingram Micro, a major IT distributor, is experiencing an ongoing outage attributed to a SafePay ransomware attack. Internal systems have been shut down as a result of the incident.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>Exposed Java Debug Wire Protocol (JDWP) interfaces are being actively exploited by threat actors to gain remote code execution and deploy cryptocurrency miners on compromised systems.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>Attackers are leveraging exposed JDWP interfaces for illicit crypto mining operations.</li> <li>Hpingbot malware is targeting SSH services to facilitate Distributed Denial of Service (DDoS) attacks.</li> <li>Iran-linked hackers have threatened to release emails related to the Trump campaign.</li> <li>Chinese state-linked threat actors reportedly maintain persistent access within US telecommunications networks.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>SSH and Telnet honeypot data has revealed the use of new and notable usernames by attackers, indicating ongoing credential stuffing and brute-force attempts.</li> <li>The Flipper Zero multi-tool continues to gain attention for its versatile capabilities, which include radio protocol manipulation and device access, underscoring its popularity among security researchers and potential misuse by threat actors.</li> <li>AI research tools such as ChatGPT Deep Research are expanding integration options, with new connectors including Slack, potentially broadening the attack surface if misconfigured or abused.</li> </ul> <h2 id="regulatory-or-policy-developments-affecting-the-security-industry">Regulatory or Policy Developments Affecting the Security Industry</h2> <ul> <li>Taiwan’s National Security Bureau (NSB) has issued a public warning regarding the security risks posed by Chinese-developed applications, specifically RedNote (Xiaohongshu), Weibo, TikTok, WeChat, and Baidu Cloud, citing concerns over excessive data collection and potential foreign influence.</li> <li>Android is reportedly developing a feature to warn users about fake cell towers (IMSI catchers), aimed at improving user privacy and security against mobile interception threats.</li> </ul>