🚨 New Threat Report Released: UNC2891 — ATM Threats Never Die

A financially motivated threat actor infiltrated banking networks using a Raspberry Pi connected to an ATM switch, deployed custom malware like CAKETAP and SLAPSTICK, and maintained undetected access for years.

From DNS tunneling to money mule recruitment via Telegram see how modern attackers operate.

🔗 Get the full breakdown of UNC2891’s TTPs, malware analysis, and incident response insights.

#CyberSecurity #ThreatIntelligence #ATMThreats #FinancialSecurity

🚨Bloody Wolf Expands Across Central Asia 🚨

Since June 2025, Group-IB analysts have been tracking a rapidly evolving campaign by Bloody Wolf, an APT group weaponizing trusted government identities to deliver lightweight but highly effective JAR-based loaders.

By impersonating Ministries of Justice and abusing legitimate remote-access software like NetSupport Manager, the group has quietly scaled its operations from Kyrgyzstan to Uzbekistan supported by geo-fenced infrastructure, tailored lures, and a custom JAR generator designed for stealth and persistence.

Key highlights:
🔹 Their spear-phishing techniques and localized PDF lures
🔹 How custom JAR loaders deploy NetSupport RAT
🔹 Infrastructure masquerading as government portals
🔹 Multi-layered persistence and evasion methods
🔹 IOCs, MITRE mapping, & defensive recommendations

Bloody Wolf shows how low-cost tools & precise social engineering can evolve into regionally impactful cyber operations. Read the full analysis.

#CyberSecurity #BloodyWolf

🚨 New launch: Fraud moves fast. Now defense does too.

Announcing the Cyber Fraud Intelligence Platform: real-time, privacy-preserving fraud intelligence sharing for banks, payment providers, e-commerce, gaming, and telecoms.
🔹Share risk signals on suspicious activity, not just confirmed fraud. 
🔹Stop APP fraud & mule networks before funds are lost. 
🔹GDPR-compliant, Bureau Veritas verified. 
🔹Personal data never leaves your organization.

Collective problem. Collective defense.

📄 Read the press release here.
🔗 Learn more.

#CFIP #Cybersecurity #GDPR #AppFraud

Group-IB’s latest threat report exposes the full scale of GoldFactory’s mobile fraud operation, one of the most technically advanced campaigns currently targeting APAC.

Key insights:
🔹A surge of 300+ modified banking apps, patched with injected modules to bypass security and retain full legitimate functionality
🔹Over 11,000 device infections traced through Group-IB Fraud Protection telemetry
🔹A unified ecosystem of loaders (Gigabud, Remo, MMRat) delivering secondary payloads such as SkyHook
🔹New Gigaflower variant features experimental OCR and QR code scanning to auto-extract ID card data.
🔹Infrastructure overlaps linking open directories and shared S3 buckets hosting malicious binaries

This report reveals how GoldFactory has industrialized mobile fraud by weaponizing legitimate apps and what defenders need to know now. Read the full analysis.

#MobileBanking #CyberSecurity #APACThreats #BankingMalware #GoldFactory

As digital lending accelerates in Uzbekistan, cybercriminals are exploiting verification gaps, low financial awareness, and social engineering to weaponize online credit services at scale turning personal identity into a profitable attack surface.

Key Highlights:
🔹 Online credit fraud cases surged 42% in 2024 compared to 2023
🔹 34% of incidents involved fraudsters posing as bank or government officials
🔹 Microcredits are approved using stolen passport, FaceID, and OTP data
🔹 Scammers deploy Telegram bots and SMS-stealers to bypass authentication
🔹 New regulations now allow victims to be exempt from repaying fraudulent loans

Our latest analysis breaks down the evolving fraud ecosystem, the social engineering tactics behind it, and the controls financial institutions must implement to stay ahead.

Read the full report here.

#FraudIntelligence #ThreatIntel #DigitalFraud #SocialEngineering #CyberSecurity

Group-IB’s Red Team has identified two previously unknown zero-day vulnerabilities in widely used enterprise platforms: Cisco UCCX and IBM Sterling.

Following responsible disclosure, both vendors validated the findings and released security updates to protect their customers.

This discovery highlights the strength of Group-IB’s approach to rigorous, dependable, and attributable analysis. By leveraging deep empirical threat intelligence to replicate highly advanced attacks, our teams reveal critical risks that many other security assessments overlook.

Full technical details are available in our press release.

#CyberSecurity #ZeroDay #VulnerabilityAssessment #ThreatIntelligence #EnterpriseSecurity #SecurityUpdates #FightAgainstCybercrime

🚨Android-based financial fraud in Uzbekistan has entered a new stage of operational maturity, with threat actors shifting from simple SMS stealers to sophisticated, multi-stage infection chains built around stealthy droppers, advanced obfuscation, and automated infrastructure.

Key Highlights:
🔹Over $2M stolen by a single tracked group since January 2025
🔹Two primary dropper families, MidnightDat and RoundRift, were identified using native decryption and encrypted asset storage.
🔹Wonderland, a new SMS stealer with bidirectional WebSocket C₂, enables real-time command execution, SMS sending, and USSD control.
🔹Telegram remains the central distribution channel, fueled by stolen sessions sold on dark web markets.
🔹Thousands of unique samples generated through automated build pipelines to evade signature-based detection

🔗 Read the full analysis here.

#ThreatIntelligence #AndroidMalware

💸 “Easy money. Simple tasks. Work from your phone.”

Our latest analysis exposes a coordinated wave of fake online job ads sweeping across the Middle-East and Africa region. These aren't isolated scams, they are a large-scale, organized operation exploiting the demand for remote work to steal personal data and funds.

Key insights from our investigation:
🔹 Over 1,500 fraudulent job ads identified in 2025, impersonating trusted e-commerce platforms, banks, and even government ministries.
🔹 Ads are highly localized, using Arabic dialects and regional currencies to appear authentic.
🔹 Victims are funneled from social media into private Telegram and WhatsApp groups, where sensitive information and upfront “deposits” are collected.
🔹The scam infrastructure includes fake registration portals, cloned branding, and repeat behavioral patterns among attackers.

Read More.

#CyberSecurity #OnlineScams #MENA #Phishing #DigitalRisk #FraudPrevention #ThreatIntelligence

🚨 Tap-to-pay fraud has evolved into a remote, industrialized threat. Chinese cybercrime groups are now selling NFC relay malware on Telegram, enabling real-time payment fraud from anywhere in the world.

Our latest research breaks down the full ecosystem from malware vendors and illicit POS terminals to mule networks and provides technical analysis of key families like TX-NFC and NFU.

Learn how this threat works and how to defend against it. 🔗 Read the full report.

#CyberSecurity #MalwareAnalysis #NFCFraud #AndroidSecurity #FraudPrevention #ThreatIntelligence #FightAgainstCybercrime

Most organizations are stuck in survival mode. Real resilience is achieved when we move beyond reaction to planning ahead with real-world threat intelligence.

Gartner report highlights:
🔹 90% of attacks will exploit known vulnerabilities by 2028
🔹 Most can be prevented with strategic Threat Intelligence
🔹 Threat intelligence reduces MTTD & MTTR and strengthens overall readiness.

Download the report.

#ThreatIntelligence #CyberSecurity #IncidentResponse #CyberAwareness #GartnerReport