Latest cybersecurity reporting from selected sources.

Also: IoTex Bridge Exploit Linked to Private Key BreachThis week, Step Finance shuts down, IoTeX bridge exploit, Russia-linked exchanges help evade sanctions, Australian charged in $3.5 million scam, a hacker returned $21 million in seized bitcoin to South Korean prosecutors and Malaysia arrested 12 police officers in an extortion case.

Russian Intel Hackers Flexible in Face of DetectionRussia-linked threat group COLDRIVER rapidly replaced its exposed malware with a stealthier PowerShell variant, using fake CAPTCHA prompts and cryptographic key-splitting to evade detection and escalate surveillance on NGOs, dissidents and policy experts, according to new research.

OpenAI on Tuesday said it disrupted three activity clusters for misusing its ChatGPT artificial intelligence (AI) tool to facilitate malware development

Cybersecurity researchers have shed light on a Russian-speaking cyber espionage group called Nebulous Mantis that has deployed a remote access trojan called RomCom RAT since mid-2022

The Russian threat actor known as Star Blizzard has been linked to a new spear-phishing campaign that targets victims' WhatsApp accounts, signaling a departure from its longstanding tradecraft in a likely attempt to evade detection

Rust-Based Ransomware Employs Aggressive Anti-Detection TacticsOperators of a Russian-speaking ransomware group launched a new encryptor with enhanced measures for defeating cyber defenders including wiping logs, disrupting backup systems and stopping decryption without insiders knowledge. The same group disrupted London hospitals in a July attack.

Also: Angel Drainer Resurfaces; Russia's Sanctions Evasion PloyThis week, Indodax was hacked, Angel Drainer resurfaced, Russia developed Infra crypto, GS Partners settled with U.S. states, Caroline Ellison to be sentenced Sept. 24, FCA prosecuted first unregistered crypto case, Nigeria set new crypto regulations, and India may approve offshore crypto firms.

Users in Russia have been the target of a previously undocumented Android post-compromise spyware called LianSpy since at least 2021

A previously undocumented Android malware named 'LightSpy' has been discovered targeting Russian users, posing on phones as an Alipay app or a system service to evade detection. [...]

The US Treasury has designated several Russian blockchain and virtual currency firms for sanctions evasion

The U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) sanctioned three cryptocurrency exchanges for offering services used to evade economic restrictions imposed on Russia following its invasion of Ukraine in early 2022

Russian APT28 military hackers are using compromised Ubiquiti EdgeRouters to evade detection, the FBI says in a joint advisory issued with the NSA, the U.S. Cyber Command, and international partners. [...]

You don't need us to craft phishing emails or write malware, super-lab sniffs OpenAI has shut down five accounts it asserts were used by government agents to generate phishing emails and malicious software scripts as well as research ways to evade malware detection.…

Experts Warn Tech Giant Faces Potential for Future Cyberattacks After Email HackingSecurity experts told ISMG they were concerned Microsoft could suffer future cyberattacks and threats to its customers after a Russian state hacking group managed to evade detection for several weeks while targeting accounts associated with the company’s top executives.

The threat actor known as COLDRIVER has continued to engage in credential theft activities against entities that are of strategic interests to Russia while simultaneously improving its detection evasion capabilities

Woman is accused of assisting Russian oligarchs and ransomware affiliates with schemes to evade sanctions.

The Russia-linked hacking crew known as Turla has been observed using an updated version of a known second-stage backdoor referred to as Kazuar

State-backed hackers part of Russia's Federation Foreign Intelligence Service (SVR) have switched, for the first time, to using legitimate cloud storage services such as Google Drive to evade detection. [...]

The Russian hacker group has shifted tactics and tools with an aim to continue profiting from its nefarious activity

The threat cluster dubbed UNC2165, which shares numerous overlaps with a Russia-based cybercrime group known as Evil Corp, has been linked to multiple LockBit ransomware intrusions in an attempt to get around sanctions imposed by the U.S. Treasury in December 2019