Malicious code in guras-asia-ba (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5294e2dc00136de019b5cf2715baec3828307c4d8dc114c3070df97a2bce188a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in guras-asia-vietna (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5dabe0b3bda2c010422810f9a12829c5bca0a0cb1f1bd4f1c3caa22e1623b45 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in guras-asia-vei (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b33f77f6d1e46688f45224139239dce5a5d72aca47a834a58305e06b1f300bc3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in guras-asia-bangkok (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68fa9cc2ab0575044acebe1897f19982f4dcec43859e98aa6e5c4b47ca3f829d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in guras-asia-thai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60190b628dcfcf72fd62afbcafa8ffd4cf81aabfbb1791fd3bdcc2626d700fb5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-155368 Malicious code in guras-asia-bangkok (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68fa9cc2ab0575044acebe1897f19982f4dcec43859e98aa6e5c4b47ca3f829d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-155375 Malicious code in guras-asia-nguyen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40e0917fe059a90efe2a3ebd69fb74fcc91d64c59bb9a8476043167d78a60e9e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

SideWinder Adopts New ClickOnce-Based Attack Chain Targeting South Asian Diplomats

A European embassy located in the Indian capital of New Delhi, as well as multiple organizations in Sri Lanka, Pakistan, and Bangladesh, have emerged as the target of a new campaign orchestrated by a threat actor known as SideWinder in September 2025. The activity "reveals a notable evolution in...

Researchers Identify PassiveNeuron APT Using Neursite and NeuralExecutor Malware

Government, financial, and industrial organizations located in Asia, Africa, and Latin America are the target of a new campaign dubbed PassiveNeuron , according to findings from Kaspersky. The cyber espionage activity was first flagged by the Russian cybersecurity vendor in November 2024, when it...

Mysterious Elephant: a growing threat

Introduction Mysterious Elephant is a highly active advanced persistent threat APT group that we at Kaspersky GReAT discovered in 2023. It has been consistently evolving and adapting its tactics, techniques, and procedures TTPs to stay under the radar. With a primary focus on targeting government...

Cyber Slavery Infrastructures: A Socio-Technical Study of Forced Criminality in Transnational Cybercrime

The rise of "cyber slavery," a technologically facilitated variant of forced criminality, signifies a concerning convergence of human trafficking and digital exploitation. In Southeast Asia, trafficked individuals are increasingly coerced into engaging in cybercrimes, including online fraud and...

EUVD-2006-1881

Malware in sbrugna...

EUVD-2025-11628

Malicious code in bioql PyPI...

How RainyDay, Turian and a new PlugX variant abuse DLL search order hijacking

Cisco Talos discovered a new campaign active since 2022, targeting the telecommunications and manufacturing sectors in Central and South Asian countries, delivering a new variant of PlugX. Talos discovered that the new variant's features overlap with both the RainyDay and Turian backdoors,...

PT-2025-38696

ParsedReport ChatGPT Translated Autotext: TI Report Analyser + ChatGPT + Auto Translate ------ Группа компаний Belsen, действующая с января 2025 года, допустила утечку 1,6 ГБ данных с более чем 15 000 уязвимых устройств Fortinet из-за CVE-2022-406841, что указывает на постоянный доступ до взлома...

SUSE SLES12 Security Update : regionServiceClientConfigAzure (SUSE-SU-2025:03169-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:03169-1 advisory. - Update to version 3.0.0. bsc1246995 - SLE 16 python-requests requires SSL v3 certificates. Update 2 region server certs to support SLE 16...

Security update for regionServiceClientConfigAzure

This update for regionServiceClientConfigAzure contains the following fixes: Update to version 3.0.0. bsc1246995 SLE 16 python-requests requires SSL v3 certificates. Update 2 region server certs to support SLE 16 when it gets released. Update dependency name for metadata package, name change in S...

Chinese APT Hits Philippine Military Firm with New EggStreme Fileless Malware

Bitdefender uncovers EggStreme, a fileless malware by a China-based APT targeting the Philippine military and APAC organisations. Cybersecurity…...

Abandoned Sogou Zhuyin Update Server Hijacked, Weaponized in Taiwan Espionage Campaign

An abandoned update server associated with input method editor IME software Sogou Zhuyin was leveraged by threat actors as part of an espionage campaign to deliver several malware families, including C6DOOR and GTELAM, in attacks primarily targeting users across Eastern Asia. "Attackers employed...

ShadowSilk Hits 35 Organizations in Central Asia and APAC Using Telegram Bots

A threat activity cluster known as ShadowSilk has been attributed to a fresh set of attacks targeting government entities within Central Asia and Asia-Pacific APAC. According to Group-IB, nearly three dozen victims have been identified, with the intrusions mainly geared towards data exfiltration...