Lauro Perez

Hunters International — a Russian-linked ransomware group that acquired the Hive ransomware after its operators were shut down by law enforcement — is deploying SharpRHino, a RAT disguised as the legitimate Angry IP Scanner network admin tool. The attack targets IT professionals specifically, betting that administrators install software with elevated privileges and are more likely to have access to high-value systems worth ransoming.

Stories Covered

SharpRHino RAT: Hunters International Tricks IT Admins with Fake Network Scanner

Hunters International emerged after international law enforcement took down the original Hive ransomware operation. The group acquired Hive’s codebase and rapidly scaled — claiming 134 attacks in the first seven months of 2024 and reaching the top 10 most active ransomware groups. SharpRHino is their initial access tool: a RAT built to look like Angry IP Scanner, an open-source network administration utility commonly used by IT professionals. Distribution is via typosquatting domains that closely mimic the legitimate Angry IP Scanner download site. Because Angry IP Scanner is open source, attackers can sign their malicious installer with a “valid” certificate (attributed to “J. Golden’s Drive Trading Co. Ltd.”) paired with a domain name close enough to the real one that a hurried admin won’t notice. The downloaded executable is an NSIS-packed installer that bypasses suspicion by appearing to be standard installation software.

Once executed, SharpRHino establishes persistence by modifying the Windows registry Run key and creating two directories under C:\ProgramData\Microsoft\ — named “Windows Updater 24” and “Log Update Windows” — to blend into existing Microsoft infrastructure and maintain multiple fallback channels to the Hunters International C2 server. The persistence mechanism is designed to survive removal attempts: even if security tools delete one component, registry keys and scripts can rebuild the necessary foothold. Quorum Cyber researchers who analyzed the campaign note that complete remediation may require a full system reimaging rather than targeted file deletion. Once SharpRHino is established, the group follows a standard double-extortion ransomware playbook: exfiltrate data first, then encrypt files with the .locked extension and direct victims to a Tor payment portal. The encryption layer is implemented in Rust — a language increasingly favored by cybercriminal developers for its resistance to reverse engineering and memory safety properties that reduce detectable vulnerabilities in the malware itself.

The IT professional targeting is strategically sound. Standard phishing targets general users who may or may not have access to sensitive systems. IT admins routinely install software, often under elevated or administrative accounts, and their access frequently spans the network — giving a successful infection broad lateral movement potential from the first moment of compromise. The typosquatting + code signing combination lowers the bar for a technically informed target: the download looks like the right domain, the installer is signed, and the tool performs its advertised function. Quorum Cyber has published MITRE ATT&CK mappings for the campaign covering defense evasion, discovery, privilege escalation, execution, persistence, and C2 stages — useful reference material for defenders building detection rules.

Listen to the Episode

Pakistani state-sponsored hackers (Transparent Tribe / APT36) are targeting TikTokers and gamers with CapraRAT spyware hidden in four fake Android apps. Meanwhile, researchers at Drexel University developed MISLNet — an AI deepfake detector that identifies AI-generated video with 98.3% accuracy, outperforming every other tool currently available.

Stories Covered

CapraRAT Android Spyware: Pakistani APT36 Targets TikTokers and Gamers with Fake Apps

Sentinel Labs researchers identified four malicious Android apps distributing CapraRAT — an Android Remote Access Trojan attributed to Transparent Tribe (also tracked as APT36 and Operation C Major), a Pakistani state-linked threat actor active since 2016 with a history of targeting Indian victims. The four apps — a fake CrazyGames clone (com.maeps.crygms.tktols), a “Sexy Videos” app, a TikTok-branded downloader, and a clone of the “Forgotten Weapons” YouTube channel — were designed to attract downloads through recognizable brand names or exploitative content. Once installed, the apps request an extensive permission set: SMS access, contact lists, GPS location, storage read/write, camera, audio recording, screen recording, call history, call-making, and network state management. A video-viewing or gaming app has no legitimate use case for the majority of these permissions, but the social engineering vector (a game, a video app) reduces user scrutiny.

The updated campaign incorporates a WebView feature — an in-app browser component — to load legitimate-looking content and reduce immediate suspicion. For the TikTok clone, the app likely loads YouTube content in a WebView to simulate a functional experience while the spyware payload runs in the background harvesting the permitted data. CapraRAT has been in use by Transparent Tribe since at least 2021 in various forms; the 2024 variant reflects an ongoing evolution of the malware rather than a new actor. The defense against sideloaded or Play Store-mimicking spyware is consistent: only install apps from official stores (Google Play), scrutinize permission requests against what the app actually needs to function, and treat any app requesting call-making or SMS-access permissions that isn’t a communication tool as a red flag.

MISLNet: AI Deepfake Detector Hits 98.3% Accuracy by Analyzing Sub-Pixel Video Patterns

Researchers at Drexel University published results from MISLNet, a constrained neural network trained to detect AI-generated video by analyzing patterns at the sub-pixel level. Prior deepfake detection tools were trained on the artifacts left by video editing software — inconsistencies in pixel relationships between frames that arise from tools like Premiere or After Effects manipulating existing camera footage. AI-generated video (from tools like Sora or Luma) doesn’t pass through a camera or video editor, so it doesn’t carry those artifacts. MISLNet was trained to detect the different telltale signatures that generative AI leaves behind in how it constructs pixel relationships across frames. The result: 98.3% accuracy on AI-generated video, outperforming the next-best competing tool by approximately 5.3 percentage points. At scale — millions of videos on social platforms — a 5-point accuracy gap translates to tens of thousands of correctly classified videos that other tools miss. Overfitting was a concern during development; the 98.3% figure represents real-world test data, not training data performance.

Listen to the Episode

Two stories define this episode: the US sanctioned Russian hacktivists who breached water facility SCADA systems in Texas, and threat actors wasted no time exploiting the CrowdStrike outage chaos — using fake hotfix emails to drop Remcos RAT and a data wiper against Israeli companies while businesses scrambled to recover from the mass blue screen event.

Stories Covered

US Sanctions Russian Hacktivists Who Breached Texas Water Facility SCADA Systems

The US government sanctioned two members of the Cyber Army of Russia Reborn (CARR) following the group’s January 2024 claims of compromising SCADA (Supervisory Control and Data Acquisition) systems at a US energy firm and manipulating a water storage unit in Texas — with video proof posted publicly. SCADA systems are the industrial control infrastructure behind water treatment, power generation, and manufacturing — they manage sensors, motors, and actuators that control physical processes. Successful manipulation of water treatment SCADA could allow an attacker to alter chemical levels (fluoride, chlorine) or disable safety shutoffs. CARR did not cause major damage in these incidents, but demonstrated access sufficient to warrant Treasury action. Sanctions block US-based property and assets of the designated individuals and prohibit US persons from transacting with them — meaningful pressure even without extradition agreements, as they isolate sanctioned hackers from the US financial system and create legal risk for any international entities that work with them.

CrowdStrike Chaos: Threat Actors Drop Remcos RAT and Data Wiper Using Fake Fix Emails

When CrowdStrike’s July 19, 2024 sensor update triggered a logic error that caused blue screens across millions of Windows hosts worldwide — grounding flights, disrupting hospitals, and taking down banking systems — threat actors immediately launched phishing campaigns masquerading as official remediation. Two distinct campaigns were identified. The first impersonated BBVA bank’s intranet portal, distributing a fake CrowdStrike hotfix that delivered the HijackLoader, which then dropped the Remcos Remote Access Trojan onto affected systems. The second campaign was attributed to the pro-Iranian hacktivist group Handala: emails sent from crowdstrike.com.vc targeted Israeli companies with a PDF claiming to contain a recovery tool, which instead delivered a data wiper that destroyed files and reported activity over Telegram.

The pattern is consistent with how opportunistic threat actors operate during high-profile incidents — chaos reduces vigilance, urgency drives clicks, and the fake fix is exactly what affected users are desperately looking for. CrowdStrike and the UK National Cyber Security Centre both issued warnings during the incident urging victims to verify any communications through official channels only. The actual cause of the outage was a defective update to a CrowdStrike sensor file that modified a Windows host configuration and triggered a crash — a software bug, not a Microsoft vulnerability. The core lesson holds regardless: never run an executable obtained through an unsolicited email or unfamiliar download link, even when the situation feels urgent. Verified remediation instructions were available through CrowdStrike’s official channels throughout the event.

Listen to the Episode

Two stories this episode: London police arrested suspects running a fake cell tower to blast phishing SMS past carrier protections, and a deep look into Southeast Asian cyber scam slave camps — forced labor operations that have siphoned more than $64 billion in three years using trafficked workers running pig butchering and romance scams from guarded compounds.

Stories Covered

Fake Cell Tower Used to Blast Phishing SMS: London Makes First-of-Its-Kind Arrests

London Metropolitan Police arrested two individuals in connection with what law enforcement described as a first-of-its-kind crime: standing up a homemade cell phone tower to send thousands of malicious SMS messages impersonating banks and official organizations. Mobile carriers implement anti-phishing protections at the network infrastructure level — on their own towers and backend systems — but not on end-user devices themselves. A rogue tower broadcasting a stronger signal than the nearest legitimate cell tower will attract nearby phones, which automatically connect to the strongest available signal. Once phones are communicating with the fake tower instead of a legitimate one, the network-level protections the carrier implemented are bypassed entirely. The rogue tower can then deliver SMS messages that appear to come from trusted sources — banks, government agencies, any organization — with no way for the phone to verify the tower’s authenticity. Fake cell towers (sometimes called IMSI catchers or stingrays) are not a new concept, but their deployment for mass SMS phishing campaigns is an escalation of the attack surface beyond standard internet-based smishing.

Cyber Scam Slave Camps: $64B Operation Running on Trafficked Forced Labor in Southeast Asia

A Dark Reading investigation documented the scale of cyber scam operations running from compounds in Cambodia, Laos, and Myanmar — where Chinese criminal syndicates shifted from illicit gambling houses (closed by COVID border controls in 2020) to online fraud at massive scale. The estimated annual revenue from scam centers across Cambodia, Laos, Myanmar, Thailand, and Vietnam is approximately $44 billion — representing roughly 40% of the combined GDP of Cambodia, Laos, and Myanmar. Over three years, these operations siphoned an estimated $64+ billion globally through romance scams and pig butchering schemes targeting victims worldwide. The operations have a second category of victims: job seekers from China, India, the Philippines, and neighboring countries, lured with promises of legitimate employment and then held in compounds against their will to conduct the scams. China’s law enforcement agencies have conducted operations rescuing 45,000 trapped workers. Singapore police, working with six banks, prevented over 3,000 scam cases and blocked approximately $74 million USD in a two-month operation.

University of Texas researchers traced $75 billion in cryptocurrency flows connected to these operations, with approximately $39 billion landing in Binance accounts, $14 billion in Huobi, and $6 billion in OKEx — suggesting major cryptocurrency exchanges are knowingly or unknowingly serving as laundering infrastructure for the syndicate. The broader structural problem is that corrupt local officials and militias in coup-disrupted Myanmar provide protection to the compounds in exchange for a share of profits — a corruption dynamic that neutralizes local law enforcement. The city of Sihanoukville in Cambodia reportedly converted shuttered casinos into guarded scam facilities. The episode makes a point worth holding: many of the individuals conducting these scams are themselves victims of human trafficking with no free will to stop — a distinction that complicates any simple moral framing of online scammers.

Listen to the Episode

Two stories this episode: scammers used AI to clone a BBC presenter’s voice and defraud an ad company out of £20,000, and threat actor TA547 deployed AI-generated PowerShell scripts to deliver the Rhadamanthus information stealer against dozens of German organizations.

Stories Covered

AI Voice Clone Used to Defraud Ad Company Out of £20,000 Impersonating BBC Presenter

Scammers used AI-generated audio to impersonate BBC science presenter Liz Bonìn, convincing the CEO of UK company Incognito that she had agreed to endorse their insect repellent product. The attackers contacted Howard Carter, Incognito’s chief executive, via WhatsApp and email — explicitly steering negotiations away from official channels to avoid professional representation that would have caught the fraud. They supplied a fake contract they claimed Bonìn had electronically signed and provided fabricated contact details for someone impersonating her management at the Wildlife Trust, where Bonìn serves as president. Carter transferred £20,000 to a digital bank account linked to the scammers and received images for the campaign shortly after. The ad ran on Monday. Hours later, Bonìn posted on X that she had never agreed to any endorsement with the company.

Two AI audio experts who assessed the voice recording confirmed it was likely artificially generated. The tells were characteristic: early in the clip the voice matched Bonìn’s Irish accent, then shifted to sound Australian, then British — losing coherent accent identity across the recording. Experts noted gaps in recitation speed, inconsistent cadence, and speech quality that was unusually clean despite apparent background noise, artifacts consistent with current AI voice synthesis limitations. When AI models generate speech, they tend toward unnatural evenness — a flattening of the subtle tonal variation, emphasis drift, and trailing letter sounds that characterize natural human speech. Those gaps are detectable now, but are narrowing as the technology improves. The fraud illustrates the risk vector clearly: AI voice cloning lowers the barrier to impersonating specific named individuals for targeted financial fraud, with the attack surface extending to any public figure with enough recorded audio to train on.

The scam worked because Carter was willing to conduct the entire deal off official channels. The warning pattern is well established: any negotiation that redirects away from a person’s professional representation, verified contact information, or established platform carries elevated fraud risk. If someone contacts you claiming to represent a known person or organization and asks to keep things unofficial — that is the signal to stop and verify through an independent, documented channel. The actual legitimate parties almost never ask to bypass their own management or legal structures. In this case the £20,000 was gone before the campaign even ran.

TA547 Uses AI-Generated PowerShell to Deploy Rhadamanthus Info-Stealer Against German Firms

Proofpoint researchers attributed a March 2024 email campaign targeting dozens of German organizations across multiple industries to TA547, a threat actor also tracked as Scully Spider and active since at least 2017. The campaign impersonated Metro Cash & Carry using invoice-themed lures. Messages carried a password-protected ZIP archive (password: MAR26) containing a malicious .lnk shortcut file. Executing the shortcut triggered a PowerShell script that decoded a Base64-encoded copy of the Rhadamanthus executable stored in a variable, loaded it into memory as an assembly, and executed it — never writing the payload to disk. The fileless execution technique is deliberate: a payload that never touches disk is harder to detect through traditional antivirus signature scanning, leaves less forensic evidence, and cannot be trivially pulled for reverse engineering the way a dropped binary can.

Rhadamanthus is an information stealer distributed since September 2022 under a malware-as-a-service model — sold to cybercrime groups who pay per install or by subscription, following the same commercial structure as legitimate SaaS products. Proofpoint flagged an unusual characteristic in the PowerShell script: it included a hash or pound sign followed by descriptive comments for nearly every component of the code. Professional developers and threat actors alike rarely comment every line of working code — comments appear to mark what is needed or to annotate unusual behavior, not to narrate routine operations. The dense, instructional commenting pattern — including markers like “Replace with your actual Base64 string” — is characteristic of code generated by large language models responding to simple prompts, which produce heavily annotated output by default. Bleeping Computer reproduced the experiment using ChatGPT-4 with a similar prompt and got structurally identical output, matching variable names, commenting style, and structure.

The implication is that TA547 used an AI assistant to write or rewrite portions of the attack toolchain — not to develop novel malware, but to accelerate script production and potentially evade signature-based detection by generating code that does not match known human-authored samples. In mid-February 2024, OpenAI announced it had blocked accounts linked to state-sponsored groups including Charcoal Typhoon and Salmon Typhoon (China), Crimson Sandstorm (Iran), Emerald Sleet (North Korea), and Forest Blizzard (Russia) for misuse of ChatGPT. The practical uses: LLMs serve as a fast reconnaissance tool, a code assistant for writing attack scripts, and a way to produce polished phishing content at scale. The convergence of AI tooling and offensive security operations is accelerating — the same tools developers use to write faster are available to the people attacking them.

Listen to the Episode

Two Chinese APT groups coordinated cyberattacks against ASEAN-affiliated entities to coincide with the ASEAN-Australia Special Summit in March 2024, while leaked documents from Chinese contractor iSoon revealed that the Tianfu Cup hacking contest feeds zero-day exploits directly to China’s Ministry of Public Security.

Stories Covered

Mustang Panda and Earth Krahang Target ASEAN Nations with DLL-Sideloading Malware Packages

Palo Alto Networks Unit 42 documented coordinated campaigns by two China-linked APT groups against entities affiliated with the Association of Southeast Asian Nations (ASEAN). Mustang Panda — also tracked as Stately Taurus, Camaro Dragon, and Earth Preta — created two malware packages timed to the ASEAN-Australia Special Summit (March 4–6, 2024), targeting entities in Myanmar, the Philippines, Japan, and Singapore via phishing emails. The first package, TalkingPointsForChina.zip, contained a renamed legitimate executable: TalkingPointsForChina.exe was actually a signed copy of KeyScrambler.exe, an anti-keylogging tool developed by QFX Software. Threat actors exploit signed legitimate binaries for the trust factor — an executable signed by a known software company bypasses casual inspection and some endpoint defenses. Executing it sideloaded a malicious DLL (KeyScrambler.ie.dll), which decrypted shellcode assessed as PlugX malware and established persistence via an auto-run registry entry. The second package, note_pso.scr (a screensaver executable), targeted an entity in Myanmar — with “PSO” likely referencing Personal Staff Officer, a rank in the Myanmar military. This package downloaded a renamed copy of EA Core Server (signed by Electronic Arts) as WindowsUpdate.exe, paired with a malicious sideloaded eacore.dll that replaced the legitimate supporting library. Both packages exploit the same technique: a signed, trusted executable loads a malicious DLL through sideloading, which then pulls additional payloads into memory.

DLL sideloading works by placing a malicious DLL in the same directory as a legitimate executable that loads supporting libraries by name rather than by verified path. When the signed program launches, it loads the attacker’s DLL instead of the real one, executing the malicious code under the cover of a trusted process. This approach reduces detection friction: the parent process is signed, the file on disk looks legitimate at a glance, and the actual payload often runs only in memory. Phishing remains the preferred delivery mechanism because it eliminates the need to burn a zero-day against patched infrastructure — a single click from a targeted user provides the entry point. The timing of malware package creation (March 4–5) precisely overlapping the summit dates suggests deliberate operational planning around geopolitically significant events where ASEAN government personnel would be exchanging relevant documents.

A second unnamed Chinese APT cluster (attributed by infrastructure overlap to attacks originating in Cambodia) was also observed targeting ASEAN-affiliated entities. This group, tracked as Earth Krahang and active since early 2022, specializes in using compromised government infrastructure as an attack platform — proxying attack traffic through government servers, hosting malicious payloads, and sending spear-phishing emails from legitimately compromised government email accounts. Once inside a network, Earth Krahang builds VPN servers on compromised public-facing hosts to tunnel into private networks and conducts brute-force attacks on email credentials for exfiltration. Attribution to the same national-state actor was made via shared C2 infrastructure: when malware from two different campaigns reaches out to the same command-and-control servers, that overlap ties the operations together regardless of the targeting differences.

iSoon Leak Exposes China’s Cyber-Contractor Ecosystem and Tianfu Cup as Zero-Day Pipeline

Documents leaked on GitHub from Chinese contractor iSoon (also known as Anxun) provided rare public visibility into how China structures and outsources its state cyber operations. The documents showed that iSoon sells a portfolio of offensive tools — including the ShadowPad RAT and Winnti (also called Treadstone) — to multiple Chinese government entities. The model mirrors a commercial software supply chain: the government does not build or maintain these tools in-house but purchases capabilities from private firms that specialize in developing and maintaining them. The contractors operate like digital private military companies — some had been implicated in prior campaigns including the 2019 Poison Carp operation against Tibetan groups and a 2022 breach of Com 100. What the documents also revealed is that some of these firms conduct attacks independently without explicit government instruction, hoping that a successful operation will attract a paying government customer. This creates an uncontrolled layer in the offensive ecosystem: contractors acting on their own initiative may inadvertently burn ongoing government APT operations by triggering detections at targets already silently compromised by a different group.

The most structurally significant detail in the leaked documents concerns the Tianfu Cup, China’s state-run equivalent of Pwn2Own. Where Pwn2Own is a commercial hacking contest where researchers submit exploits to vendors who pay bounties and patch the vulnerabilities, the Tianfu Cup feeds in the opposite direction: when submissions include full exploit chains, China’s Ministry of Public Security receives the proof-of-concept code and disseminates it to private firms for further development and deployment. The contest functions as a pipeline that converts competitive hacking research into government-stockpiled zero-days rather than vendor patches. By contrast, Pwn2Own 2024 paid $200,000 for a Tesla hack, $130,000 for a VMware Workstation guest-to-host escape, and $60,000 each for Chrome and Safari exploits — all of which go to vendors for remediation. The structural difference is consequential: one system converts discovered vulnerabilities into patches; the other converts them into weapons. The iSoon leak makes clear that China’s offensive cyber capacity is not purely internal — it is an ecosystem of contractors, mercenaries, and competition-fed exploit pipelines operating in parallel with and sometimes independently from state APT groups.

Listen to the Episode