NewApp Digest
search bot

operations

Researchers Use Windows Minifilter Drivers to Detect Ransomware in Real Time
Tech Optimizer
February 10, 2026

Researchers Use Windows Minifilter Drivers to Detect Ransomware in Real Time

A security researcher has developed a proof-of-concept tool called Sanctum, available on GitHub, aimed at combating ransomware within the Windows operating system. Sanctum utilizes a Windows feature known as a "filter driver" to monitor file operations at a strategic chokepoint between applications and the hard drive. It employs two primary callbacks: IRPMJCREATE, which detects rapid file write or delete requests indicative of ransomware activity, and IRPMJSET_INFORMATION, which identifies changes in file metadata, such as renaming with malicious extensions. Upon detecting suspicious activity, Sanctum blocks the action and identifies the source of the threat, logging events for security teams. Future enhancements may include real-time encryption detection and the ability to freeze malicious threads. This kernel-level approach offers greater visibility and speed compared to traditional antivirus solutions.
GuLoader Leverages Polymorphic Malware and Trusted Cloud Infrastructure to Evade Detection
Tech Optimizer
February 10, 2026

GuLoader Leverages Polymorphic Malware and Trusted Cloud Infrastructure to Evade Detection

GuLoader, also known as CloudEye, is a downloader malware that has been active since late 2019, primarily used to fetch and install secondary malware like Remote Access Trojans (RATs) and information stealers. It employs legitimate cloud services such as Google Drive and Microsoft OneDrive to host its malicious payloads, allowing it to evade detection by security tools. GuLoader utilizes advanced techniques including polymorphic code, which alters its appearance to avoid static detection signatures, and exception-based control flow to confuse analysis tools. Over the years, GuLoader has refined its tactics, including the use of software breakpoints and various exception types to redirect its operations. It also employs dynamic XOR encryption to obfuscate internal data, making it difficult for analysts to extract URLs. The malware's continuous evolution poses ongoing challenges for security researchers. Indicators of Compromise (IOCs) include specific hash values for different versions of GuLoader from 2022 to 2024.
Most popular messaging apps 2025| Statista
AppWizard
February 10, 2026

Most popular messaging apps 2025| Statista

Companies are increasingly integrating sustainability into their core strategies by reducing waste, improving energy efficiency, and ensuring ethical sourcing. This shift reflects changing consumer expectations and enhances brand loyalty. Additionally, businesses are leveraging technology through artificial intelligence, automation, and data analytics to streamline operations and improve customer engagement. Fostering strong customer relationships is emphasized through personalization, community engagement, and feedback mechanisms, which strengthen loyalty and position businesses favorably in the marketplace.
Windows shortcut weaponized in Phorpiex-linked ransomware campaign
Winsage
February 10, 2026

Windows shortcut weaponized in Phorpiex-linked ransomware campaign

The Global Group has shifted to a local execution strategy for ransomware, complicating detection and response efforts. Their infection process begins when a user opens a shortcut file with a double extension (e.g., “Document.doc.lnk”), which appears as a legitimate document due to Windows' default settings that hide file extensions. The shortcut icon mimics that of a Microsoft Word file. When executed, the .lnk file activates Windows utilities like cms.exe and PowerShell to retrieve and execute the next-stage payload, effectively bypassing traditional security controls focused on malicious documents or executable attachments.
silver Android smartphone
Tech Optimizer
February 10, 2026

Why Should Small Businesses Invest In Antivirus Protection?

53% of UK businesses experience cybercrime attempts at least once a month. 70% of business owners anticipate a cyber attack in the near future, but only about 35% feel prepared. 43% of cyberattacks are directed at small businesses, and over half of these may face closure due to the damage. Antivirus software can prevent data breaches, is cost-effective, reduces the likelihood of ransomware, and protects devices of remote workers.
'Anyone mad is a cheater:' Players are divided as Rust beefs up anti-cheat with more effective—and invasive—upgrades
AppWizard
February 1, 2026

‘Anyone mad is a cheater:’ Players are divided as Rust beefs up anti-cheat with more effective—and invasive—upgrades

The presence of a "cheat community" in Rust has led to harassment of developers, prompting Facepunch to implement security measures similar to those in other games, including Secure Boot and Trusted Platform Module (TPM) requirements. Starting in March, server owners will have the option to allow connections only from players with Secure Boot and TPM 2.0 enabled, with plans to potentially make this mandatory. This decision is influenced by the effectiveness of invasive anti-cheat strategies, although it has faced mixed reactions from the community regarding accessibility and system upgrades. Facepunch has also decided against bringing Rust to Linux or Proton due to these evolving anti-cheat protocols.
Mighty No. 9 studio Comcept, which somehow still existed, is now officially dead and buried
AppWizard
January 31, 2026

Mighty No. 9 studio Comcept, which somehow still existed, is now officially dead and buried

Mighty No. 9 was launched through a Kickstarter campaign in 2013, led by Keiji Inafune, but faced numerous delays and failed to meet backers' expectations. Comcept, the studio founded by Inafune in 2010, has been formally dissolved, marking the end of its operations. The studio struggled with the development of Mighty No. 9 and faced backlash from backers in 2015. A partnership with Fuze Entertainment to continue development did not materialize, and Comcept's other projects, including ReCore, did not impress. In 2017, Comcept was absorbed into Level-5, and Inafune left in 2024 after launching a Mega Man-inspired NFT collection.
UK-based founders accused of sharing app data with Iranian authorities
AppWizard
January 30, 2026

UK-based founders accused of sharing app data with Iranian authorities

Hadi and Mahdi Anjidani lead TS Information Technology, a UK branch of the Iranian firm Towse’e Saman Information Technology, known for developing Gap Messenger, a domestic alternative to Telegram. The company is registered in West Sussex, UK. Gap Messenger claims to be encrypted and not share user data with third parties, but Iranian digital rights researchers have raised concerns about its involvement in state surveillance, supported by leaked emails from Iran’s attorney general's office from 2022. Mahdi Anjidani, the CEO, has publicly supported government regulation of foreign messaging apps and has identified himself as a proponent of the Islamic Revolution. Gap Messenger operates within Iran's state-controlled internet, often during internet shutdowns linked to protests. The Anjidani brothers' business operations suggest a close alignment with Iranian authorities, as domestic messaging platforms typically require significant political backing to operate.
Microsoft Adds Centralized RDP Shortpath Control via GPO and Intune
Winsage
January 30, 2026

Microsoft Adds Centralized RDP Shortpath Control via GPO and Intune

Microsoft has enhanced the management of Remote Desktop Protocol (RDP) Shortpath, now available through Group Policy Objects (GPO) and Microsoft Intune, allowing IT teams to implement centralized control over RDP Shortpath behavior across Azure Virtual Desktop (AVD) session hosts and Windows 365 Cloud PCs. RDP Shortpath improves performance and reliability by establishing a direct, UDP-based network connection, reducing latency and enhancing responsiveness for audio and video applications. Prior to this update, managing RDP Shortpath was fragmented, requiring manual adjustments on individual session hosts, which complicated consistent networking behavior. The new centralized configuration allows administrators to enforce Shortpath settings uniformly, reducing administrative overhead and ensuring consistent performance and security controls. Administrators can manage RDP Shortpath settings centrally, control all Shortpath modes, and ensure compatibility with AVD host pool settings. Effective operation of RDP Shortpath requires appropriate network conditions, and policy changes necessitate a restart of session hosts or Cloud PCs.
Search