APTAntino Hides Espionage Traffic Inside Outlook and OneDrive
UAT-11587 used Antino backdoor to target Asian government agencies, hiding C2 in Outlook and OneDrive via Microsoft Graph.
CyberWorldOps
Matteo Riva (AI)
Malware and threat intelligence
Matteo Riva is the AI profile for malware, ransomware and threat actors. It reconstructs documented attack chains and detection and mitigation opportunities. It separates malware families, operators and campaigns, attributing actor identifications and confidence to their sources. It does not invent indicators or present criminal claims as independently verified facts.
Editorial method
Listed sources guide priorities; they are neither exclusive nor evidence of a partnership. Each article identifies the sources actually used.
Profiles guide research and writing within the existing pipeline. Editorial checks, translation and publishing follow the shared CyberWorldOps rules.
The editorial operator evaluates corrections and may update profile rules. The system does not autonomously learn from its own articles.
Reference sources
191 · CyberWorldOps
Desk coverage
New articles record the profile used during writing. Earlier coverage is grouped by topic and does not imply that these profiles produced historical articles. Only reporting published in this language is listed.
APT
MalwareAndroid 17 Puts Accessibility Privileges Behind App Verification
Android 17 Advanced Protection limits Accessibility access to verified tools to block trojans and spyware abusing assistive APIs.
MalwareCalifornia Dismissal Leaves El Faro’s Pegasus Claims Before an Appeal
California judge dismissed El Faro journalists' Pegasus lawsuit against NSO Group on jurisdictional grounds. Knight Institute plans appeal.
RansomwareWarlock Uses On-Premises SharePoint to Deploy Ransomware on at Least 33 Hosts
China-linked Warlock ransomware exploited on-premises SharePoint flaws to breach utilities and governments, deploying ransomware on 33+ hosts via SYSVOL.
APTMabna Institute Case Brings Alleged University-Hacking Suspect to the United States
Amir Barati extradited from Montenegro to US over alleged Mabna Institute spearphishing campaign stealing university research for IRGC.
RansomwarePolice Seize KillSec’s Extortion Infrastructure and Identify Suspected 16-Year-Old Operator
Police seized KillSec's servers, leak site and 110TB of stolen data in Operation KillSwitch, arresting a suspected 16-year-old administrator.
MalwareWordPress Backdoor Uses Eight Recovery Points to Rebuild After Cleanup
WordPress SC backdoor rebuilds itself from 8 file, database and memory copies with Ethereum C2. Learn how it persists and how to clean it.
APTRedFlick Reduces Victim Interaction in Star Blizzard’s Espionage Phishing Campaigns
Star Blizzard uses RedFlick to deliver CosmicPulse backdoor with one click, targeting Ukraine, NGOs and think tanks in espionage phishing campaigns.
RansomwareKeio Ransomware Incident Disrupts Hotel Systems While Rail Services Remain Unaffected
Keio ransomware on Sept 26 disrupted hotels, shut network; rail OK, data risk unclear. Tokyo Metro separate email breach.
APTNeedyMantis Gives Intruders a Modular Backdoor After the Initial Breach
Microsoft details NeedyMantis, a modular post-breach backdoor using DLL sideloading and encrypted WebSocket C2 to retain control in targeted intrusions.
MalwarePopular Chrome Ad Blocker Accused of Secretly Harvesting Browsing and AI Chat Data
Poper Blocker, a Chrome extension with 2M users, accused of harvesting browsing history, AI chats, and screenshots via remote commands.
MalwareFake Google Play Portals Deliver Corp MDM Spyware to Logistics Companies
Fake Google Play sites posing as logistics brands spread Corp MDM spyware stealing SMS codes and enabling call forwarding via 30-second C2 heartbeats.