Cyberespionage group TA402, known for targeting government entities in the Middle East and North Africa, has altered its infection chain tactics three times recently, despite no observed change in its targeting. Its recent campaigns use spear-phishing emails sent from compromised email accounts of legitimate entities, delivering custom malware implant, IronWind. The group’s activities overlap with those attributed to Molerats, Gaza Cybergang, Frankenstein, and WIRTE, suggesting these could all be aliases.
Rogue VPN servers used to spread malware via malicious updates
AmberWolf researchers identified two vulnerabilities, dubbed “NachoVPN,” in popular VPN products SonicWall NetExtender and Palo Alto Networks GlobalProtect, which can be exploited by cyber-attackers to
