infrastructure Archives

Winsage

September 2, 2026

Fake Software Installers Disable Windows Update and Weaken Microsoft Defender

An active malware campaign is using counterfeit software-download websites to distribute malicious installers, primarily targeting users seeking popular software. This campaign has significantly affected China-based operations of multinational corporations and Chinese-speaking users. The malware, once executed, can establish persistence, undermine security measures, and communicate with attacker-controlled infrastructure. Victims span various sectors, including healthcare, manufacturing, gaming, technology, logistics, government, and education. Microsoft associates this campaign with a Chinese threat cluster called Silver Fox, known for using spoofed vendor download pages to spread Gh0st RAT and ValleyRAT. The malicious websites are hosted on .com.cn and .hl.cn domains, featuring Chinese-language content. The downloaded files are dynamically generated, and upon execution, they deploy a wrapper installer that initiates the malware payload. The malware achieves persistence through scheduled tasks and interferes with Windows Update services. The campaign establishes command-and-control communication over non-standard ports, with two identified domains linked to the activity. Microsoft Defender has detected the threat and initiated containment procedures. Kaspersky reported a related malicious installer exploiting a legitimate adware application to execute a backdoor, which captures keystrokes and clipboard contents. ValleyRAT, a sophisticated implant, can collect system information, reboot the computer, capture screenshots, and transmit logs. The attackers are motivated by cyber espionage and financial gain, targeting organizations globally. A subgroup within GoldenEyeDog, known as CuboidalCanine, has also been linked to the use of ValleyRAT, particularly in the gambling industry. In June 2026, Chinese authorities addressed cybercrime cases involving a new variant of the Silver Fox trojan.

Winsage

September 2, 2026

Fake Microsoft Edge, Kaspersky and Razer Installers Used to Compromise Windows Systems

An ongoing malware campaign is targeting Windows devices through counterfeit download pages for well-known software brands like Microsoft Edge, Kaspersky, and Razer. The campaign affects various sectors, including healthcare, manufacturing, gaming, technology, logistics, government, and education. It utilizes high-fidelity fraudulent websites that closely mimic legitimate vendors, with observed lure domains such as app-microsoft-edge[.]com[.]cn and kaspersky-lab[.]hl[.]cn. Attackers employ evasion tactics like server-side payload regeneration and create multiple copies of the same archive in quick succession. Victims are lured into downloading ZIP files that contain a bundled wrapper installer, which activates a stage-one executable in randomized directories. The malware often masquerades as legitimate software, with some payloads impersonating known applications. Persistence is achieved through scheduled tasks with unusual names, and the malware employs various evasion techniques, including deleting shadow copies and altering file permissions. Microsoft Defender has identified activity across multiple stages of the attack, including delivery, execution, and command-and-control communications. To mitigate risks, organizations are advised to block downloads from unofficial sources, enforce Tamper Protection, and implement Attack Surface Reduction rules. Indicators of compromise (IOCs) include specific lure domains and URLs associated with the campaign.

AppWizard

September 2, 2026

Fully Playable Scream Game Found in Steam Leak [2026]

A horror game based on the Scream film franchise was discovered in the Steam data leak that occurred from August 29 to 31, 2026. The game, an unfinished multiplayer prototype created by Fatshark, was found by a Twitter user named Roly Poly Reaper, who managed to run it on their computer and enable online multiplayer. The prototype included several unfinished builds, with one featuring operational networking code that allowed players to take on the roles of survivors evading a player-controlled Ghostface. The project appears to have been a pitch build, never fully greenlit for production, and was stored in Valve’s old Steam2 backend for approximately 15 years before the leak. Roly Poly Reaper used the Goldberg Steam emulator and Radmin VPN to run the game, circumventing the need for a live connection to Valve’s servers. Fatshark, known for cooperative shooters, had reportedly built the Scream prototype around 2011, coinciding with the release of Scream 4. The prototype's existence predates the popularization of the asymmetric horror genre by several years. The Steam2 leak itself involved approximately 12 to 13 terabytes of data, including various internal builds and beta versions from Valve and third-party developers. Valve has not publicly commented on the leak.

Winsage

September 1, 2026

Why governments worldwide are abandoning Windows for homegrown Linux alternatives

Windows is the most widely used desktop operating system, but Linux is gaining popularity among government entities globally, driven by a desire for independence from Western software due to geopolitical tensions. France plans to transition government workstations from Windows to Linux as part of a broader European movement for digital sovereignty, with the national police force having migrated 97% of its computers to a customized version of Ubuntu called GendBuntu. Germany is also adopting Linux, with Munich creating a customized distribution called LiMuX and other states like Mecklenburg-Vorpommern shifting to open-source platforms like Nextcloud. In Russia, the government is deploying Astra Linux to reduce reliance on Microsoft products following the Ukraine conflict. China is promoting Kylin OS, a Linux-based system, to achieve software self-sufficiency after the end of support for Windows 10. Governments are increasingly turning to Linux to diminish dependence on American technology and foster digital autonomy.

AppWizard

September 1, 2026

Empulse and Splitgate: Arena Reloaded are officially over as 1047 Games says it’s probably done making arena shooters

1047 Games has announced it will cease development on the PvP arena shooter Empulse and its predecessor Splitgate: Arena Reloaded due to insufficient revenue to cover operational expenses. The studio will continue to exist but will shift its strategic focus to future projects. The original Splitgate: Arena Warfare launched in 2019 and gained significant popularity, but the follow-up titles did not achieve similar success, resulting in layoffs shortly after Empulse's launch. Despite discontinuing dedicated servers, the studio will support both Empulse and Splitgate: Arena Reloaded through peer-to-peer matchmaking, allowing players to host matches indefinitely. Empulse will receive a final new map and a price reduction. 1047 Games expressed gratitude to its team members and players for their contributions and support.

Winsage

September 1, 2026

Windows bug incorrectly tells users that Microsoft Defender Antivirus is turned off

Microsoft Defender's reliability is under scrutiny due to a recent security alert that affects a wide range of Windows versions, including both Windows 11 26H1 and Windows Server 2012. Insurers will require more than verbal assurances about software performance in six months, necessitating the archiving of telemetry data, including sensor check-ins and Defender versions, by Chief Information Security Officers (CISOs). The alert's impact is significant, as a single flaw in Defender can affect various systems categorized into different patch rings, highlighting the need for vigilant monitoring and proactive management of security protocols.

AppWizard

August 31, 2026

Fake dating apps are being used to target Android users: How the new cyber scam works

India's cybercrime authorities have warned about the misuse of dating and adult-themed advertisements on social media platforms like Instagram and Facebook, which are being exploited by criminals to distribute malicious Android applications. These ads redirect users to external websites where they are prompted to download APK files, bypassing security measures of trusted app stores. The Indian Cybercrime Coordination Centre (I4C) has identified several malicious applications, including Night Play, Reloop, Kyss, Vimo, Rivo, Nexo, and Vixa, and cautions against installing unfamiliar applications promoted through unsolicited ads. These apps may request sensitive permissions, such as access to SMS messages, contacts, photos, device storage, and Accessibility Services, which can allow fraudsters to access valuable information. Compromised devices can lead to financial fraud by intercepting OTPs and other verification details. The I4C recommends using trusted app stores, keeping Google Play Protect active, reviewing app permissions, and being cautious with social media ads. If a suspicious app is installed, users should restart their phone in Safe Mode to uninstall it, disable its permissions if necessary, and consider a factory reset if removal fails. Users who suspect fraud are encouraged to report incidents promptly.

Winsage

August 30, 2026

In a rare move, Google is bringing native Windows 11 and WSL support to its new AI tools

The Windows Subsystem for Linux (WSL) is gaining popularity among developers, with GitHub introducing experimental support for WSL in its Copilot desktop application, allowing Linux environments to be used directly within Windows. Google is also integrating WSL support into its Antigravity development platform, marking a shift in its approach to Windows support. Rody Davis from Google confirmed that both WSL and native Windows support are being developed for Antigravity, which will enable file operations and shell commands in a Linux environment. GitHub Copilot now allows users to create sessions inside WSL, enhancing the development experience by enabling real-time interaction with projects in a WSL environment. Additionally, Microsoft is focusing on improving Windows for developers, with initiatives like Coreutils for Windows and the open-sourcing of WinUI, while Ubuntu is reportedly gaining traction on Windows 11.

Winsage

August 29, 2026

Why does Windows constantly need to update?

Windows updates are released frequently to enhance performance, improve compatibility, fix bugs, and distribute critical security patches. Microsoft issues security updates every second Tuesday of the month, known as Patch Tuesday, which are cumulative, meaning the latest updates include all previous fixes. The Cybersecurity and Infrastructure Security Agency (CISA) issues warnings about vulnerabilities, and Microsoft maintains a security portal for documentation of these issues. Users on unsupported versions, like Windows 10 without Extended Security Updates (ESU), are at increased risk. In addition to security updates, Windows receives an annual feature update and occasional optional non-security updates that introduce new features and enhancements. An example is the Windows 11 February 2026 preview update, which added new features and improvements.

Tech Optimizer

August 29, 2026

Overcoming the Barriers of Commercial DBs with Open Source and AI… EDB Hosts ‘PostgreSQL AI Summit’

A company's approach to artificial intelligence (AI) begins with determining the optimal structure for data storage and management, often facing challenges such as high costs of commercial databases and reliance on specific enterprise technologies. To effectively utilize AI, companies need to establish new infrastructures, including vector search capabilities, Search Augmentation Generative (RAG) systems, and data lakehouses. EDB is notable for connecting companies and technology partners that have transitioned to open-source databases. On September 3, EDB will host the 'EDB Postgres AI Summit Seoul 2026' at the Sofitel Ambassador Seoul, starting at 10:00 AM. This event is the largest PostgreSQL conference in Korea, themed 'Change the Game,' focusing on the shift from commercial databases to open-source and AI-driven frameworks, featuring real-world case studies. Approximately 300 C-level executives and IT decision-makers from various sectors are expected to attend, with participation by invitation only. The summit will include 15 sessions with customer case studies and technical presentations. Notable discussions will include IBK Industrial Bank of Korea's migration of 15 core systems to PostgreSQL, a semiconductor company's diversification of MPP databases on a DBaaS platform, and Kyobo Book Centre's database modernization strategy. Shopcast will present its development of an 'Agentic Lakehouse' integrating AI technology with a data lakehouse framework. The keynote address will be given by Kim Deok-joong, discussing organizational management strategies for integrating AI agents. The technical sessions will cover the architecture of the 'EDB Postgres AI' platform, which supports AI vector search and RAG, with live demonstrations of the analytics engine ClickHouse and LakeHouse technology for analyzing petabyte-scale data. EDB's domestic distributors and international partners will participate as sponsors. The summit aims to showcase technologies and case studies from the domestic ecosystem, addressing PostgreSQL adoption, system migration, operations, data analysis, and AI implementation. EDB manages transaction, analytics, and AI workloads using Postgres in cloud environments, serving over 1,500 global customers. Herve Timsit, EDB's Chief Revenue Officer, emphasized the event's focus on sharing tangible results and addressing the challenges of commercial databases while investing in AI infrastructure.