NewApp Digest
search bot

file encryption

NetScaler vulnerability exploited, AdaptHealth suffers breach, new Android malware
AppWizard
September 11, 2026

NetScaler vulnerability exploited, AdaptHealth suffers breach, new Android malware

The Cybersecurity and Infrastructure Security Agency (CISA) warned of a critical vulnerability in NetScaler, identified as CVE-2026-19490, with a CVSS score of 9.3, which has been exploited and affects all NetScaler ADC and Gateway appliances. Citrix has patched this vulnerability as of August 19. AdaptHealth reported a data breach affecting over 4.1 million individuals, compromising personal, health, and insurance information, but not Social Security numbers or financial data. A new strain of Android malware, MantaxOtax, attributed to Indonesian threat actors, combines ransomware and spyware, stealing sensitive information and affecting older Android versions. The Gigabud banking trojan has evolved to evade detection by installing a secondary app that hides the malicious application. CISA acting director Nick Andersen emphasized the need for swift adaptation to cybersecurity threats and highlighted staffing improvements within CISA. Russian e-commerce giant Wildberries experienced disruptions from a DDoS attack affecting payments to sellers, following claims of a cyber operation by Ukraine's military intelligence. McKesson faced a cyberattack exposing sensitive data of 6.4 million individuals, with the ShinyHunters group releasing this data after a failed extortion attempt. IDScan confirmed a data breach affecting 150 million individuals, resulting in the theft of personally identifiable information and government-issued documents.
Get antivirus, a VPN, and password manager for $30
Tech Optimizer
July 16, 2026

Get antivirus, a VPN, and password manager for $30

Panda Dome Complete is a comprehensive Windows security suite that offers protection against various digital threats, including ransomware, phishing scams, and data breaches. A one-year subscription is currently available for .99, reduced from its regular price of .99. Key features include real-time antivirus protection, anti-phishing tools, a dark web scanner, a built-in firewall, Wi-Fi protection, 150MB of daily VPN access, a password manager, PC cleanup tools, file encryption, secure file deletion, gaming and multimedia modes, and parental controls. The product is recognized by industry leaders and has over 23,000 reviews on Trustpilot.
GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware
Tech Optimizer
July 10, 2026

GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware

Microsoft Threat Intelligence has identified the GigaWiper malware, which has been detected in compromised environments since October 2025. This malware has destructive capabilities and comes in two forms: standalone wiper binaries and larger binaries with backdoor functionalities, both developed in Golang. The standalone wiper operates at the physical disk level, overwriting disk content and removing partition references. The backdoor variant includes the same wiper functionality and adds persistence through a registry key and scheduled tasks, along with command and control communication via RabbitMQ and Redis. GigaWiper can execute various commands, including wiping drives, triggering a Blue Screen of Death (BSOD), file encryption that mimics ransomware behavior, and managing system elements. The malware integrates components from multiple malware families, including wipers and ransomware mechanisms, and has been linked to a previous malware known as FlockWiper. To defend against GigaWiper, organizations are advised to implement security measures such as tamper protection, blocking access to known C2 infrastructure, and utilizing endpoint detection and response solutions. Microsoft Defender provides detections for GigaWiper and related malware, and threat intelligence reports are available for customers to stay informed about threats. Indicators of compromise include specific SHA-256 hashes and IP addresses associated with GigaWiper.
This antivirus doesn’t slow your PC down — it quietly keeps it safe for $19.99
Tech Optimizer
July 9, 2026

This antivirus doesn’t slow your PC down — it quietly keeps it safe for $19.99

ESET NOD32 Antivirus for Windows is available for .99 for a one-year subscription. It operates in the background, providing protection against malware, phishing, and ransomware without causing noticeable slowdowns. Key features include a Ransomware Shield, Anti-phishing Protection, Gamer Mode, and AI-assisted Threat Detection. It is designed for users who multitask, stream, or game, allowing for uninterrupted productivity.
Malware Has Gotten Smarter. Here's How Your Antivirus Has, Too
Tech Optimizer
June 21, 2026

Malware Has Gotten Smarter. Here’s How Your Antivirus Has, Too

Antivirus software is evolving from relying on static databases of known malware signatures to employing behavioral monitoring and machine learning for threat detection. Traditional antivirus solutions focused on recognizing known threats through unique signatures, but this approach has become inadequate due to the rapid evolution of malware, including polymorphic and metamorphic types. Modern antivirus systems now monitor program behavior, looking for suspicious activities such as unexpected file encryption or unusual network communication. Machine learning models analyze large datasets to identify patterns associated with malware, allowing for the classification of files as safe, potentially unwanted, or malicious. Techniques like sandboxing and dynamic analysis are used to preemptively neutralize threats. However, advancements in AI also present challenges, as cybercriminals can exploit these technologies to create sophisticated malware that evades detection. Despite improvements in antivirus effectiveness, modern cyberattacks increasingly target individuals through methods like phishing and social engineering, necessitating a combination of robust antivirus solutions and good cybersecurity practices.
Researchers Use Windows Minifilter Drivers to Detect Ransomware in Real Time
Tech Optimizer
February 10, 2026

Researchers Use Windows Minifilter Drivers to Detect Ransomware in Real Time

A security researcher has developed a proof-of-concept tool called Sanctum, available on GitHub, aimed at combating ransomware within the Windows operating system. Sanctum utilizes a Windows feature known as a "filter driver" to monitor file operations at a strategic chokepoint between applications and the hard drive. It employs two primary callbacks: IRPMJCREATE, which detects rapid file write or delete requests indicative of ransomware activity, and IRPMJSET_INFORMATION, which identifies changes in file metadata, such as renaming with malicious extensions. Upon detecting suspicious activity, Sanctum blocks the action and identifies the source of the threat, logging events for security teams. Future enhancements may include real-time encryption detection and the ability to freeze malicious threads. This kernel-level approach offers greater visibility and speed compared to traditional antivirus solutions.
VolkLocker Emerges as a Cross-Platform Ransomware Threat Targeting Linux and Windows
Winsage
December 15, 2025

VolkLocker Emerges as a Cross-Platform Ransomware Threat Targeting Linux and Windows

A pro-Russian hacktivist group, CyberVolk, has re-emerged in 2025 with a new ransomware-as-a-service (RaaS) operation called VolkLocker, which targets both Windows and Linux systems using Golang. The group utilizes Telegram bots for command-and-control operations, allowing affiliates to manage ransomware interactions. Despite its advancements, coding errors in the ransomware enable victims to recover encrypted files without paying a ransom. VolkLocker employs AES-256 encryption but has a critical flaw where the master encryption key is hard-coded and saved in plaintext, allowing easy decryption. The ransomware also ensures persistence by replicating itself and disabling essential system tools. CyberVolk offers additional RAT and keylogger add-ons for sale, with complete RaaS packages priced between [openai_gpt model="gpt-4o-mini" prompt="Summarize the content and extract only the fact described in the text bellow. The summary shall NOT include a title, introduction and conclusion. Text: A newly rebooted pro-Russian hacktivist group, CyberVolk, has made a notable comeback in 2025, unveiling a new ransomware-as-a-service (RaaS) operation dubbed VolkLocker, as detailed in recent research by SentinelOne. After a prolonged period of dormancy following extensive bans on Telegram, this group has re-emerged with a Golang-based ransomware solution that targets both Windows and Linux systems. This latest initiative signifies CyberVolk's commitment to revitalizing its operations, showcasing what analysts refer to as the “CyberVolk 2.x” generation of tools. Despite the group's advancements, their integration of sophisticated Telegram-based automation has inadvertently led to coding errors that allow victims to recover their encrypted files without the need to pay a ransom. Telegram-Fueled Automation and Functionality VolkLocker is heavily reliant on Telegram bots for its command-and-control operations, which form the core of its new RaaS model. All interactions between operators and the ransomware's ecosystem, from onboarding new customers to managing victims, are facilitated through a Telegram bot known as CyberVolk_Kbot. This bot provides various commands such as /decrypt, /list, and /status, enabling affiliates to monitor infections and communicate with compromised systems in real time. Operators tasked with creating new ransomware payloads must input several configuration details, including a Bitcoin address, Telegram bot token ID, chat ID, encryption deadline, and file extension. Decryption triggered via backed-up key file This design approach aligns with CyberVolk’s goal of simplifying deployment for affiliates with limited technical skills. The Golang-based payloads, compiled for both Linux and Windows platforms, utilize the “ms-settings” UAC bypass technique (MITRE ATT&CK T1548.002) for privilege escalation. Once operational, VolkLocker performs system reconnaissance, checks for virtual machine environments by matching MAC address prefixes, and strategically excludes key system paths from encryption. Encryption Flaws and System Destruction Features VolkLocker employs AES-256 in Galois/Counter Mode (GCM) for file encryption; however, its encryption design reveals a significant oversight. The master encryption key is hard-coded within the binary and is also saved in a plaintext file named system_backup.key located in the %TEMP% directory. This easily accessible key allows victims to decrypt their files without paying the ransom, highlighting a critical flaw in CyberVolk’s development process. In addition to its encryption capabilities, VolkLocker ensures persistence by replicating itself across multiple directories and disabling essential tools such as Task Manager, Windows Defender, and Command Prompt through registry modifications. It also deletes Volume Shadow Copies and can trigger a Blue Screen of Death (BSOD) using the Windows NtRaiseHardError() function when the countdown timer expires or when incorrect decryption keys are repeatedly entered. Despite these coding missteps, CyberVolk is expanding its offerings, providing RAT and keylogger add-ons for 0 each, along with complete RaaS packages ranging from 0 to ,200. SentinelOne researchers caution that this resurgence underscores how politically motivated groups are increasingly leveraging Telegram infrastructure to commercialize their ransomware operations. Indicators of Compromise: Windows Sample: dcd859e5b14657b733dfb0c22272b82623466321 Linux Sample: 0948e75c94046f0893844e3b891556ea48188608 Bitcoin Wallet: bc1qujgdzl0v82gh9pvmg3ftgnknl336ku26nnp0vy Telegram Bot: 8368663132:AAHBfe3xYPtg1IMynKhQy1BRzuF5UZRZspw Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates" max_tokens="3500" temperature="0.3" top_p="1.0" best_of="1" presence_penalty="0.1" frequency_penalty="frequency_penalty"] and ,200. Indicators of compromise include specific Windows and Linux sample hashes, a Bitcoin wallet address, and a Telegram bot ID.
Search