cybersecurity

Tech Optimizer
April 5, 2026
z3soft is developing the Agentic Security Platform (ASP), which integrates large language models, antivirus solutions, and comprehensive file security to shift from passive to proactive cybersecurity measures. CEO Park Ju-seon highlights the need for a broader market strategy to address challenges in the domestic security market, which is dominated by a few players. The ASP aims to combine legacy security systems with AI technology for enhanced security management. z3soft is focusing on creating a 'cyber immunity' solution for AI environments, integrating Zero Trust principles for data protection. The company plans to foster an integrated security ecosystem through partnerships with smaller firms and aims to make advanced security solutions accessible to small and medium-sized enterprises (SMEs) via a subscription model. z3soft intends to validate its business model in Japan and the U.S. before introducing it to South Korea, with goals set for market entry by 2027 and the launch of zero-trust firewalls in Japan and an integrated security platform in the U.S. Park anticipates that significant changes in the domestic market may take five to ten years.
AppWizard
April 3, 2026
Google has imposed strict restrictions on sideloading applications on Android devices due to concerns about risks from external sources. A new malware named NoVoice has been discovered on Google Play, embedded in over 50 applications with at least 2.3 million downloads, potentially compromising that many devices. The malware seeks root access by exploiting vulnerabilities in older Android versions and can steal sensitive data and install/remove apps without consent. It is difficult to remove, as it installs recovery scripts that survive factory resets. However, Google has stated that devices updated since May 2021 are protected against this threat, and Google Play Protect removes these apps and blocks new installs. Users with devices updated after May 2021 are considered safe, while those with infected apps should consider their devices compromised.
AppWizard
April 3, 2026
Researchers at McAfee Labs discovered that 50 Android applications on the Google Play Store contain malware known as NoVoice, which can grant full remote access to infected smartphones. These apps have over 2.3 million downloads. The malware can communicate with remote servers, profile devices, and download tailored root exploits, potentially compromising specific hardware and software configurations. However, devices with an Android security patch level of May 2021 or later are not vulnerable to these exploits, as the vulnerabilities were patched by Android between 2016 and 2021. Google Play Protect removes these apps and blocks new installs, and users are advised to keep their devices updated with the latest security patches.
AppWizard
April 3, 2026
Fraudsters are exploiting in-game chats in Minecraft to deceive young players, particularly in Russia. They initiate contact with children in the game, then move the conversation to Telegram, posing as "cybersecurity officers" and claiming that the children have shared sensitive information. They threaten detention to coerce minors into stealing money from their parents to give to couriers. Authorities have issued warnings to raise awareness among children and parents about these deceptive tactics.
Tech Optimizer
April 1, 2026
Ransomware attackers are increasingly using legitimate IT tools, referred to as the “dual-use dilemma,” to infiltrate systems instead of relying solely on traditional malware. Tools like Process Hacker and IOBit Unlocker, originally designed for troubleshooting, are now being weaponized to disable antivirus software. IOBit Unlocker has been linked to cyber campaigns by LockBit Black 3.0 and Dharma, while Process Hacker is used by Phobos and Makop ransomware operators. These tools have trusted digital signatures, allowing hackers to operate undetected. Ransomware attacks typically follow a kill chain, starting with phishing emails or compromised credentials. Attackers gain SYSTEM-level control using tools like PowerRun or YDArk. The attack unfolds in two phases: first, they use “process killers” to terminate antivirus monitoring, and then they employ tools like Mimikatz to extract passwords and erase logs, complicating tracking efforts. The evolution of ransomware tactics includes the use of Ransomware-as-a-Service (RaaS) kits, such as LockBit 3.0 and BlackCat, which are designed to disable antivirus protections. Future trends may involve AI-assisted methodologies that autonomously determine ways to circumvent security measures, indicating a shift in the security landscape.
Search