cyberespionage
Security Affairs newsletter Round 586 by Pierluigi Paganini – INTERNATIONAL EDITION
The latest Security Affairs newsletter covers a range of global cybersecurity incidents and trends. Key topics include ransomware extortion, significant cyberattacks on major companies like Odido and a Japanese taxi operator, and the compromise of the AsyncAPI npm organization. The newsletter also highlights new malware strains, exploitation campaigns targeting CMS, and state-sponsored cyber activities from Russia, China, and North Korea.
China-Linked APT Expands Proxy Network With New Malware
A China-linked advanced persistent threat group, identified as UAT-7810, is reportedly expanding its network of proxy servers. This expansion is being facilitated by the deployment of new malware, according to research from Cisco Talos.
Canadian spy agency reports hacking three criminal groups in 2025
Canada's Communications Security Establishment (CSE) conducted offensive cyber operations against three distinct criminal organizations in 2025. The targets included a ransomware-as-a-service operation, an extremist group with international ties, and drug trafficking networks.
Analysis of Ongoing Ousaban Attacks Targeting the Iberian Peninsula
Cybersecurity researchers have identified a new campaign by the banking Trojan Ousaban, primarily targeting users in Spain and Portugal. The malware, previously active in Brazil, is distributed via a sophisticated phishing PDF that leads victims to a malicious webpage. This page employs environmental and geo-fencing checks to ensure only intended targets download the payload, which includes a VBS script and the Ousaban executable. The Trojan then establishes persistence, decrypts banking-related strings using a custom algorithm, and communicates with command-and-control servers through dynamically generated hostnames.