NewApp Digest
search bot

espionage

What Prevents Zero-Day Exploits? A Practical Guide to Stopping Unknown Threats
Tech Optimizer
July 27, 2026

What Prevents Zero-Day Exploits? A Practical Guide to Stopping Unknown Threats

Zero-day exploits are attacks that take advantage of previously unknown software vulnerabilities before a vendor can issue a patch. These exploits pose significant challenges because organizations cannot address vulnerabilities they are unaware of, and traditional security measures may not effectively identify them. Zero-day vulnerabilities are distinct from zero-day exploits; the former refers to the software flaw itself, while the latter is the method used by attackers to exploit that flaw. Zero-day exploits are particularly dangerous because they give attackers a temporary advantage, allowing them to compromise systems before defenders can respond. These exploits are commonly used in advanced attacks, including ransomware campaigns and espionage. The lifecycle of a zero-day exploit typically involves discovering a vulnerability, weaponizing it, delivering the exploit, executing malicious code, and achieving the attacker's objectives. Traditional antivirus solutions may not consistently prevent zero-day exploits, as they primarily focus on known threats. Endpoint Detection and Response (EDR) platforms provide visibility and detection but do not inherently prevent exploitation. Effective prevention strategies emphasize stopping the exploitation techniques themselves, rather than solely relying on detection. Memory-based attack prevention is a key approach, as all exploits must execute within memory. This method disrupts exploitation techniques and can protect against unknown vulnerabilities. Best practices for preventing zero-day exploits include reducing the attack surface, enforcing least privilege, maintaining aggressive patch management, strengthening identity security, deploying prevention-based endpoint protection, and maintaining a layered security strategy.
I'm very into this Papers, Please-esque puzzle game about identifying traitors to the socialist motherland
AppWizard
July 22, 2026

I’m very into this Papers, Please-esque puzzle game about identifying traitors to the socialist motherland

Players assume the role of Aleksey Lutomski, a recruit at the security service of a fictional 20th-century communist state, in the game What Awaits, Aleksey?. Set in 1970, the game involves examining evidence such as coded letters, covert photographs, and wiretapped conversations to identify members of an underground dissident cell called the KNOT network. The gameplay emphasizes a balance between challenge and engagement, with players needing to present findings to superiors who critique their work. The game features a 1970s setting with mechanical tools like calculators and tape recorders that enhance the investigative experience. Players must navigate misleading clues and make critical decisions that affect their allegiance, potentially choosing between siding with conspirators or remaining loyal to the state. The game explores themes of loyalty, identity, and moral dilemmas within a historical context.
007: First Light was originally going to be less about James Bond and more of 'an ensemble piece', with 'all the 00s working together, as they do in Slovakia'
AppWizard
July 20, 2026

007: First Light was originally going to be less about James Bond and more of ‘an ensemble piece’, with ‘all the 00s working together, as they do in Slovakia’

In 007: First Light, characters Cressida Bright and Lennox Monroe are introduced alongside James Bond, presenting a unique narrative twist where Bond has flatmates. Initially, the game appears to be an ensemble piece featuring camaraderie among 00 agents during training sequences. However, after a failed operation in Slovakia, most of Bond's fellow trainees die, leaving him aligned primarily with his mentor, Greenway. This shift from an ensemble dynamic to focusing on Bond's individual journey is a deliberate narrative choice made by lead writer Michael Vogt, emphasizing Bond's character evolution and the harsh realities of his profession. The initial intention to include Cressida and Monroe as integral companions was significant in early development, and their absence enhances the emotional depth of Bond's story.
2 months after releasing Zero Parades, Studio ZA/UM is laying off employees: 'Its commercial performance has not enabled us to sustain a studio of our current size'
AppWizard
July 18, 2026

2 months after releasing Zero Parades, Studio ZA/UM is laying off employees: ‘Its commercial performance has not enabled us to sustain a studio of our current size’

Studio ZA/UM announced layoffs two months after the launch of their game, Zero Parades: For Dead Spies, due to sales not meeting expectations. The studio issued redundancy notices affecting up to 32 employees, despite the game receiving critical acclaim. The game did not achieve the same level of success as its predecessor, Disco Elysium, with mixed reviews highlighting its shortcomings. Key figures from Disco Elysium had left the studio prior to the game's release, contributing to a challenging environment. Critics noted that the cultural context surrounding the game has impacted its reception, turning it into a symbol of industry practices rather than a standalone experience.
EU Imposes Sanctions on Tech Giant VK and State-Backed MAX Messaging App
AppWizard
July 13, 2026

EU Imposes Sanctions on Tech Giant VK and State-Backed MAX Messaging App

The European Union has sanctioned VK, the Russian technology firm behind VKontakte and its subsidiary MAX, due to their involvement in cyber activities and providing personal data to Russian authorities against dissenters. These sanctions were formalized on July 13 and align with a broader effort involving the UK, targeting individuals and entities linked to Russia's cyber operations. The MAX application is developed under the oversight of Russia's Federal Security Service (FSB). Additionally, Apple's removal of VK applications from its App Store has prompted a response from the Kremlin, with government spokesperson Dmitry Peskov indicating a need for clarification from Apple on this decision.
Windows SprySOCKS Malware: Advanced Kernel-Level Rootkit Targets Government Organizations via Supply Chain Vulnerabilities
Winsage
June 17, 2026

Windows SprySOCKS Malware: Advanced Kernel-Level Rootkit Targets Government Organizations via Supply Chain Vulnerabilities

The Windows variant of SprySOCKS malware, developed by the Chinese threat group Earth Lusca, targets government entities globally and features advanced capabilities such as rootkit-level stealth and extensive command-and-control (C2) functionalities. It operates on Windows systems, utilizing two main variants: WINDRV, which includes kernel drivers for stealth operations, and WINPLUS, a streamlined backdoor. The malware can communicate over TCP, UDP, and WebSocket, offering over 30 C2 commands for various operations, including system information gathering and keystroke logging. WINDRV loads a driver named ‘RawWNPF’ into memory using another signed kernel driver, allowing it to conceal processes and achieve persistence. The malware's design incorporates open-source elements and exploits vulnerabilities in the software supply chain, notably using a leaked certificate for driver signing. To combat SprySOCKS, organizations are advised to implement advanced endpoint detection and response (EDR) solutions, maintain regular patching, and manage supply chain risks vigilantly. The malware's adaptability and reliance on legitimate certificates complicate detection efforts, necessitating continuous refinement of security practices.
China-Linked SprySOCKS Backdoor Expands to Windows with Driver-Based Stealth
Winsage
June 16, 2026

China-Linked SprySOCKS Backdoor Expands to Windows with Driver-Based Stealth

Cybersecurity researchers have identified two new Windows variants of the SprySOCKS backdoor, named WINDRV and WINPLUS, which were previously thought to be exclusive to Linux systems. Both variants feature hard-coded command-and-control configurations and can communicate via TCP, UDP, and WebSocket protocols. They support over 30 commands for operations such as system information collection and file management. WINDRV employs kernel drivers for stealth, obscuring network connections and allowing TCP traffic diversion. SprySOCKS was first documented by Trend Micro in September 2023, linked to the Chinese state-sponsored threat actor Earth Lusca, also known as FishMonger. The Windows variants belong to version 1.8 of SprySOCKS and utilize a kernel driver named RawWNPF for enhanced stealth. The attack chain begins with an initial access method that drops a batch script, leading to the installation of the backdoor. Evidence suggests these variants may have been used in attacks against government organizations in Honduras, Taiwan, Thailand, and Pakistan between 2023 and 2024. The WINPLUS variant was first detected in July 2024 in Pakistan. There are indications of a potential UEFI bootkit involvement exploiting CVE-2023-24932, a vulnerability in the Windows Boot Manager.
Search