Group
Seven things we learned from WhatsApp vs. NSO Group spyware lawsuit | TechCrunch
On Tuesday, WhatsApp scored a major victory against NSO Group when a jury ordered the infamous spyware maker to pay more than $167 million in damages to the Meta-owned company. The ruling concluded a legal battle spanning more than five years, which started in October 2019 when WhatsApp accused NSO Group of hacking more than…
TheWizards APT group uses SLAAC spoofing to perform adversary-in-the-middle attacks
In this blogpost, ESET researchers provide an analysis of Spellbinder, a lateral movement tool for performing adversary-in-the-middle attacks, used by the China-aligned threat actor that we have named TheWizards. Spellbinder enables adversary-in-the-middle (AitM) attacks, through IPv6 stateless address autoconfiguration (SLAAC) spoofing, to move laterally in the compromised network, intercepting packets and redirecting the traffic of…
The Anatomy of a Skype Group Chat Scam: How Bots Manipulate Victims into Crypto Fraud • AI Blog
Shouldn’t Microsoft then at least be held legally and financially liable for damages caused by such scams on their platform? Should Microsoft Be Held Legally and Financially Liable for Scams on Skype? Legally, holding Microsoft accountable for scams on Skype is a complex issue because of existing laws that protect online platforms from liability for…
Investigators Link $1.4B Bybit Hack to North Korea’s Lazarus Group
Bybit, the world’s second-largest cryptocurrency exchange, suffered a devastating $1.4 billion Ethereum (ETH) hack from a cold wallet breach on February 21, 2025. In the days following the attack, independent blockchain investigator ZachXBT traced the stolen funds directly to North Korea’s Lazarus Group, a notorious state-backed hacking organization. His findings were confirmed by Arkham Intelligence,…
Lazarus Group Spotted Targeting Nuclear Engineers with CookiePlus Malware
The Lazarus Group, an infamous threat actor linked to the Democratic People’s Republic of Korea (DPRK), has been observed leveraging a “complex infection chain” targeting at least two employees belonging to an unnamed nuclear-related organization within the span of one month in January 2024. The attacks, which culminated in the deployment of a new modular…