LATEST NEWS

Threat actors are exploiting bulletproof hosting service Proton66 for malicious activities, including campaigns from SuperBlack ransomware operators, Android malware distribution via hacked WordPress, targeted attacks using XWorm and Strela Stealer, and potential connections to Chang Way Technologies. Cybersecurity experts at Trustwave's SpiderLabs have discovered an increase in malicious online activities originating from a Russian "bulletproof" hosting provider known as Proton66. These services, often favoured by cybercriminals due to their relaxed policies, have been linked to a wave of attacks targeting organizations worldwide since January 8, 2025. Researchers have detailed their findings in a two-part series. The first part highlights a major increase in "mass scanning, credential brute-forcing, and exploitation attempts" coming from Proton66's network (ASN 198953). This means attackers were actively probing for weaknesses in systems and trying to guess login details on a large scale. SpiderLabs has also noticed an increase in scanning and exploiting traffic from Proton66's network from January 8, 2025, with a sharp decline in February. The attacks targeted specific network blocks, the most active being 45.135.232.0/24 and 45.140.17.0/24, while some had been inactive for a significant period, with the last reported malicious activity dating back to July and November 2021. Traffic Volume Analysis (Source: SpiderLabs) Notably, the address 193.143.1.65, was observed connected to the operators of a new ransomware strain called SuperBlack, and its operators were distributing "some of the latest critical priority exploits,” researchers noted in the blog post. The second part discusses malware campaigns linked to Proton66, including compromised WordPress websites redirecting Android users to fake Google Play Store pages likely to steal their information or install malicious apps. The domain naming conventions used suggest targets speaking English ("us-playmarket.com"), French ("playstors-france.com"), Spanish ("updatestore-spain.com"), and Greek ("playstors-gr.com"). SpiderLabs also discovered operators deploying Strela Stealer, an information-stealing tool that extracts email login credentials from targeted systems, between January and February 2025. Another campaign involved XWorm malware targeting users of Korean-speaking chat rooms. Additionally, connections to WeaXor ransomware, a modified version of Mallox that encrypts files and demands a ransom for recovery, were detected. At the time of the report, the WeaXor group was asking for "$2,000, transferred in BTC or USDT." Sample Ransom Note (Source: SpiderLabs) Interestingly, SpiderLabs' investigation reveals a potential rebranding or connection between Proton66 and Hong Kong-based company, Chang Way Technologies Co. Limited. In November 2024, security firm Intrinsec linked Proton66 and PROSPERO to bulletproof hosting services advertised on underground forums as UNDERGROUND and BEARHOST. SpiderLabs’s investigation revealed that while the Russian control panel for UNDERGROUND/BEARHOST customers remained at my.31337.ru, the my.31337.hk page was updated with a "CHANGWAY / HOSTWAY" theme. Still, technical connections between the infrastructures remained, suggesting an underlying link. Technology and financial organizations are the prime targets of this campaign. However, the SuperBlack ransomware group preferred targeting non-profit, engineering, and financial sectors. Research by Forescout linked this IP address to the Mora_001 threat actor who exploited vulnerabilities in Fortinet FortiOS devices, leading to the deployment of the SuperBlack ransomware. It is worth noting that hackers have exploited vulnerabilities in Palo Alto Networks' PAN-OS software (CVE-2025-0108), Mitel MiCollab (CVE-2024-41713), and D-Link NAS devices (CVE-2024-10914). D-Link has announced that the affected devices have reached their end-of-life, therefore, no security updates will be provided. Nevertheless, researchers strongly recommend that organizations block all the internet address ranges associated with both Proton66 and Chang Way Technologies to protect themselves from potential compromise. Trey Ford, Chief Information Security Officer at Bugcrowd, a San Francisco, Calif.-based leader in crowdsourced cybersecurity, commented on the development, stating that while IPs aren’t reliable indicators of threat actors, since changing scan sources is cheap, patterns like consistent brute-force attempts still matter. “It’s a reminder to monitor login velocity, harden exposed services, and make attacks costly for low-effort actors,” he said.

3 minute read

Russian Host Proton66 Tied to SuperBlack and WeaXor Ransomware

Threat actors are exploiting bulletproof hosting service Proton66 for malicious activities, including campaigns from SuperBlack ransomware operators, Android…

byDeeba Ahmed

April 22, 2025

3 minute read

AI Ethics, Cybersecurity and Finance: Navigating the Intersection

Artificial intelligence is transforming industries, but its adoption also raises ethical and cybersecurity concerns, especially in the regulated…

byOwais Sultan

April 22, 2025

Entra ID Users Locked Out After MACE App Flags Legitimate Accounts

3 minute read

Microsoft Entra ID Lockouts After MACE App Flags Legit Users

Was your Microsoft Entra ID account locked? Find out about the recent widespread lockouts caused by the new…

byDeeba Ahmed

April 22, 2025

3 minute read

Booking.com Phishing Scam Uses Fake CAPTCHA to Install AsyncRAT

Fake Booking.com emails trick hotel staff into running AsyncRAT malware via fake CAPTCHA, targeting systems with remote access…

byWaqas

April 21, 2025

2 minute read

Native Language Phishing Spreads ResolverRAT to Healthcare

Morphisec discovers a new malware threat ResolverRAT, that combines advanced methods for running code directly in computer memory,…

byDeeba Ahmed

April 21, 2025

2 minute read

North Korea, Iran, Russia-Backed Hackers Deploy ClickFix in New Attacks

Government-backed hacking groups from North Korea (TA427), Iran (TA450), and Russia (UNK_RemoteRogue, TA422) are now using the ClickFix…

byDeeba Ahmed

April 21, 2025

3 minute read

Press Release

Industry First: StrikeReady AI Platform Moves Security Teams Beyond Basic, One-Dimensional AI-Driven Triage Solutions

Dallas, United States, TX, 21st April 2025, CyberNewsWire

byCyberNewswire

April 21, 2025

5 minute read

ORSNN VP of UX and Frontend Engineering on Why Security by Design Matters in 2025

As fintech platforms scale and AI-driven threats multiply, user trust has become the single point of failure or…

byRoman Fedytskyi

April 20, 2025

Chinese APT IronHusky Deploys New MysterySnail RAT on Russia

2 minute read

Chinese APT IronHusky Deploys Updated MysterySnail RAT on Russia

Kaspersky researchers report the reappearance of MysterySnail RAT, a malware linked to Chinese IronHusky APT, targeting Mongolia and…

byDeeba Ahmed

April 19, 2025

2 minute read

Cozy Bear’s Wine Lure Drops WineLoader Malware on EU Diplomats

Midnight Blizzard (APT29/Cozy Bear) targets European embassies and Ministries of Foreign Affairs with sophisticated phishing emails disguised as…

byDeeba Ahmed

April 19, 2025

The Latest

Understanding Trend Structure: Higher Highs and Lower Lows Explained

GitHub Breach: TeamPCP Steals 3,800 Repositories via VS Code Extension

Verizon DBIR: AI Helped Hackers Exploit Vulnerabilities in 31% of Recent Breaches

Fake Word Phishing Reveals Enterprise Blind Spot in Trusted Remote Access Tools

Latest News

Russian Host Proton66 Tied to SuperBlack and WeaXor Ransomware

AI Ethics, Cybersecurity and Finance: Navigating the Intersection

Microsoft Entra ID Lockouts After MACE App Flags Legit Users

Booking.com Phishing Scam Uses Fake CAPTCHA to Install AsyncRAT

Native Language Phishing Spreads ResolverRAT to Healthcare

North Korea, Iran, Russia-Backed Hackers Deploy ClickFix in New Attacks

Industry First: StrikeReady AI Platform Moves Security Teams Beyond Basic, One-Dimensional AI-Driven Triage Solutions

ORSNN VP of UX and Frontend Engineering on Why Security by Design Matters in 2025

Chinese APT IronHusky Deploys Updated MysterySnail RAT on Russia

Cozy Bear’s Wine Lure Drops WineLoader Malware on EU Diplomats

Criminal IP Returns to Infosecurity Europe 2026 with Advanced AI-Driven TI & ASM

Two-Thirds of Nonhuman Accounts Are Unseen and Unmanaged, According to Orchid Security’s Identity Gap Report

Lyrie.ai Joins First Batch of Anthropic’s Cyber Verification Program

LuxSci Launches Enterprise-Grade HIPAA-Compliant Email Security for Mid-Sized Healthcare Organizations

Criminal IP and Securonix ThreatQ Collaborate to Enhance Threat Intelligence Operations