🚀 O CloudSEK aumentou Rodada da Série B1 de $19 milhões — Potencializando o futuro da cibersegurança preditiva
CATEGORIES

Inteligência do adversário

Articles in Blog Posts

Weaponizing LSPosed: Remote SMS Injection and Identity Spoofing in Modern Payment Ecosystems

CloudSEK’s latest report highlights a major shift in mobile financial fraud, where threat actors use the LSPosed framework to manipulate Android at runtime and bypass UPI SIM-binding security without altering legitimate payment apps. The technique enables remote SMS injection, identity spoofing, OTP interception, and real-time account takeover at scale. The report urges banks to adopt stronger device integrity checks and carrier-side validation to counter this evolving threat.

Written by

Shobhit Mishra

March 6, 2026

AI, the Iran-US Conflict, and the Threat to US Critical Infrastructure

More than 60 Iranian-aligned cyber groups mobilized within hours of the February 28, 2026 Iran-US escalation, as AI tools sharply lowered the barrier to targeting America’s internet-exposed critical infrastructure. The report shows how exposed ICS systems, default credentials, and AI-assisted reconnaissance are converging into a fast-growing national security risk.

Written by

Ibrahim Saify

March 5, 2026

A Threat Actor Landscape Assessment of ICS/OT Targeting in the 2026 Iran-US Conflict AND THE SCALE OF THE RISK

The 28 February 2026 strikes accelerated an existing cyber threat to U.S. critical infrastructure, rather than creating it. This report examines who is targeting industrial control systems (ICS), how attacks are carried out, and the scale of the exposed attack surface. Critical infrastructure is a prime retaliation target due to high civilian impact, a large number of internet-exposed ICS devices, and long-standing underinvestment in OT cybersecurity.

Written by

Ibrahim Saify

March 3, 2026

Campanha do Trojan RedAlert: falso aplicativo de alerta de emergência espalhado por SMS falsificando o Comando da Frente Interna de Israel

O CloudSEK descobriu uma campanha maliciosa de falsificação de SMS espalhando uma versão falsa do aplicativo de emergência “Red Alert” de Israel em meio ao conflito em andamento. Disfarçado como uma plataforma de alerta confiável, o aplicativo Android trojanizado pode roubar SMS, contatos e dados de localização enquanto parece legítimo. O relatório destaca como os cibercriminosos estão usando o medo do público durante crises para implantar spyware móvel com sérias implicações de segurança e no mundo real.

Written by

Shobhit Mishra

March 2, 2026

Relatório de situação: Escalada no Oriente Médio (27 de fevereiro a 1º de março de 2026)

O relatório examina a forte escalada após os ataques conjuntos de Israel e EUA ao Irã em 28 de fevereiro de 2026, desencadeando um conflito híbrido que mistura ataques cinéticos com operações cibernéticas sem precedentes. O Irã enfrentou uma interrupção quase total da Internet, enquanto mísseis retaliatórios e atividades cibernéticas se espalharam por Israel, pelo Golfo e além. Mais de 150 incidentes hacktivistas foram registrados, com riscos globais de repercussão nos setores de energia, finanças, TI e infraestrutura crítica

Written by

CloudSEK Threat Intelligence

February 11, 2026

Por dentro do Gunra RaaS: do recrutamento de afiliados na Dark Web à dissecação técnica completa de seu armário

Os pesquisadores do CloudSek se infiltraram no recém-lançado programa de afiliados RaaS da Gunra, obtendo acesso ao seu painel ao vivo e ao armário de ransomware. Nossa análise revela um mecanismo de criptografia híbrida ChaCha20+ RSA-4096 altamente otimizado, execução multitarefa, segmentação de arquivos cirúrgicos e recursos de furtividade offline.

Written by

Articles in Threat Intelligence

May 29, 2023

Anonymous Sudan Claims Successful Takedown of First Abu Dhabi Bank Website & Application Via DDoS Attacks

CloudSEK’s contextual AI digital risk platform XVigil discovered the threat actor group Anonymous Sudan claiming responsibility for disrupting the services of the First Abu Dhabi Bank website and application.

September 4, 2023

3,20,000+ Patient Records From Ayush Jharkhand Gov. In Shared On Dark Web Hacking Forums

A hacker known as Tanaka has exposed over 320,000 patient records from ayush.jharkhand.gov.in, detailing personal and medical information. The 7.3 MB database leak includes sensitive data from the AYUSH ministry's site

November 3, 2022

Sensitive Documents Leaked from an Indonesian Telecom Firm & Its Subsidiaries

Category: Adversary Intelligence Industry: Telecommunications Motivation: Financial Region: Indonesia Source*: F4 Executive Summary THREAT IMPACT MITIGATION Data breach affecting an Indonesian telecom firm, PT Telekomunikasi Indonesia, and its subsidiaries. Tax cards, financial statements, and sensitive government documents exposed. Leaked documents could reveal business practices and IP. Compromised financial records can be used for social engineering […]

June 12, 2023

Cowin data leak claim and CloudSEK analysis

CloudSEK team has identified a malicious actor promoting a Telegram bot that provided access to the personal information of Indian individuals who had reportedly registered for vaccines through the Cowin Portal. The bot claimed to offer personally identifiable information (PII) data.

March 5, 2021

Kobalos Malware Threat Intel Advisory

CloudSEK threat intelligence advisory on Kobalos malware with a small yet complex codebase, targeting multiple operating systems.

November 6, 2023

CVE-2023-4197 Vulnerability in Dolibarr ERP CRM 18.0.1 Allows PHP Code Injection

CVE-2023-4197 Improper input validation in Dolibarr ERP CRM v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker to inject and evaluate arbitrary PHP code

Junte-se a mais de 10.000 assinantes

Acompanhe as últimas notícias sobre tipos de malware, iscas de phishing,
Indicadores de comprometimento e vazamentos de dados.