NewApp Digest
search bot

hacking group

Windows and Linux users: The deadline to update Secure Boot keys is near
Winsage
June 17, 2026

Windows and Linux users: The deadline to update Secure Boot keys is near

In 2012, a novel bootkit targeting Mac OS X systems emerged, infiltrating the EFI firmware. A basic bootkit for Windows 8 also appeared, compromising the UEFI bootkit. By 2013, a more sophisticated UEFI bootkit named Dreamboat was introduced for Windows. The first documented real-world UEFI attack occurred in 2018 with the malware LoJax, linked to a Kremlin-backed hacking group. In 2020, the second known UEFI malware, MosaicRegressor, was discovered, which verified the presence of a malicious file upon each reboot. New UEFI bootkits like ESpecter, FinSpy, and MoonBounce have since emerged. In response to the threat of UEFI bootkits, Microsoft collaborated with manufacturers to implement Secure Boot, a protocol that uses cryptographic signatures to ensure the integrity of firmware during startup.
China-Linked SprySOCKS Backdoor Expands to Windows with Driver-Based Stealth
Winsage
June 16, 2026

China-Linked SprySOCKS Backdoor Expands to Windows with Driver-Based Stealth

Cybersecurity researchers have identified two new Windows variants of the SprySOCKS backdoor, named WINDRV and WINPLUS, which were previously thought to be exclusive to Linux systems. Both variants feature hard-coded command-and-control configurations and can communicate via TCP, UDP, and WebSocket protocols. They support over 30 commands for operations such as system information collection and file management. WINDRV employs kernel drivers for stealth, obscuring network connections and allowing TCP traffic diversion. SprySOCKS was first documented by Trend Micro in September 2023, linked to the Chinese state-sponsored threat actor Earth Lusca, also known as FishMonger. The Windows variants belong to version 1.8 of SprySOCKS and utilize a kernel driver named RawWNPF for enhanced stealth. The attack chain begins with an initial access method that drops a batch script, leading to the installation of the backdoor. Evidence suggests these variants may have been used in attacks against government organizations in Honduras, Taiwan, Thailand, and Pakistan between 2023 and 2024. The WINPLUS variant was first detected in July 2024 in Pakistan. There are indications of a potential UEFI bootkit involvement exploiting CVE-2023-24932, a vulnerability in the Windows Boot Manager.
ScarCruft Hacks Gaming Platform to Deploy BirdCall Malware on Android and Windows
BetaBeacon
May 5, 2026

ScarCruft Hacks Gaming Platform to Deploy BirdCall Malware on Android and Windows

ScarCruft compromised a video game platform in a supply chain attack, trojanizing its components with a backdoor called BirdCall to target ethnic Koreans residing in China. The attack enabled the threat actors to target both Windows and Android devices, turning it into a multi-platform threat. The campaign targeted sqgame[.]net, a gaming platform used by ethnic Koreans in China, known as a transit point for North Korean defectors. BirdCall has features like screenshot capture, keystroke logging, and data gathering, and relies on legitimate cloud services for command-and-control. The Android variant collects various data and has seen active development.
North Koreans Spy on Defectors Via Android Game Apps
AppWizard
May 5, 2026

North Koreans Spy on Defectors Via Android Game Apps

A North Korean hacking group has targeted a digital gaming platform popular among the Korean ethnic enclave in China, using a sophisticated strategy to infiltrate Android applications. Researchers from Eset discovered that an app on the platform contained a backdoor known as BirdCall, linked to North Korea. The official website for the gaming platform hosted the same suspicious APK file. A second Android file associated with another game on the same site was also found to contain the BirdCall backdoor. This supply-chain attack was attributed to the threat actor ScarCruft (APT37), active in Asia and extending into Europe and the Middle East since late 2024. The hackers likely compromised the web server to recompile original APKs with the backdoor, which can collect sensitive information such as contacts, SMS messages, call logs, documents, media files, and private keys, and can take screenshots and record audio. The malware disguises its command and control traffic among regular internet traffic, primarily using Zoho WorkDrive for operations.
Microsoft: New Remote Desktop warnings may display incorrectly
Winsage
April 28, 2026

Microsoft: New Remote Desktop warnings may display incorrectly

Microsoft has identified an issue affecting the display of security warnings when users open Remote Desktop (.rdp) files across all supported versions of Windows, including Windows 11, Windows 10, and Windows Server. The security warning may not render correctly, making the text difficult to read and buttons misaligned, especially when multiple monitors with different display scaling settings are used. This issue often results in overlapping text or obscured buttons in the warning window. The problem is part of Microsoft's security enhancements introduced with the April 2026 cumulative updates, which aim to mitigate risks associated with malicious RDP connection files. Users receive a one-time educational prompt upon opening an RDP file for the first time, followed by a security dialog that provides information about the file's publisher and resource redirections. RDP files are commonly used in enterprise environments, but their exploitation in phishing campaigns has raised security concerns, particularly by groups like the Russian state-sponsored APT29.
Девочка-андроид не нужна: хакеры сами справились со взломом Pragmata за двое суток до релиза игры
TrendTechie
April 16, 2026

Девочка-андроид не нужна: хакеры сами справились со взломом Pragmata за двое суток до релиза игры

Capcom's game Pragmata was hacked by the group DenuvOwO, which dismantled the Denuvo protection system just two days before its scheduled launch on April 17. A pirated version of the game is now circulating online. This incident follows a significant data leak from Capcom's servers and poses challenges for the gaming community regarding piracy and its impact on sales and future development. Pragmata is Capcom's first original franchise in many years.
Hackers demand ransom from GTA6 studio Rockstar, threaten to leak stolen data
AppWizard
April 11, 2026

Hackers demand ransom from GTA6 studio Rockstar, threaten to leak stolen data

Rockstar Games is facing a security breach involving the hacking group ShinyHunters, which has issued a ransom demand for sensitive data. A Rockstar spokesperson confirmed that a limited amount of non-material company information was accessed due to a third-party data breach, stating it has no impact on the organization or its players. This incident follows a similar breach in 2022 when a 17-year-old hacker infiltrated Rockstar's systems. ShinyHunters has targeted various high-profile companies in the past, including Microsoft and AT&T. The breach highlights that many security incidents can result from simple human errors rather than sophisticated hacking techniques.
Max Messenger: A fake data breach with genuine consequences?
AppWizard
February 15, 2026

Max Messenger: A fake data breach with genuine consequences?

A user claimed to have breached Max but later clarified that no large-scale breach or critical vulnerabilities were found. False claims about data breaches can cause significant reputational damage, as demonstrated by a Russian hacking group that falsely claimed to have accessed Epic Games' data, which was later admitted to be a ruse. Similarly, EuroCar reported that fake breach reports may have been generated by ChatGPT, misleading customers. Russian users are distrustful of the Max app, perceived as buggy and insecure. The Russian Federal Security Service blocked its integration with government services due to encryption concerns. Although the government pressures citizens to adopt Max, many may install it without using it regularly. There is skepticism among Russian citizens regarding the app's security, making them susceptible to damaging rumors. Future claims about Max Messenger data breaches are anticipated. Recommendations for organizations to protect against misinformation include maintaining a good reputation, being transparent if a breach occurs, and investing in digital forensics to counter false claims.
Search