Category Archives: News

Article, Knowledge, News, Uncategorized

Another European Region Ditches Microsoft: Linux Adoption Accelerates

🇩🇪 Another European Region Ditches Microsoft: Linux Adoption Accelerates

Following Denmark’s recent move to transition its digital infrastructure to Linux and LibreOffice, a German federal state has now announced a similar plan — dropping Microsoft Windows and Office in favor of open-source alternatives. The shift is gaining momentum, and it’s starting to look like a growing European movement.

But what does this trend mean for the future of government IT, digital sovereignty, and cybersecurity?

A Growing Pattern Across Europe

First Denmark, now a German state — and this might just be the beginning. In the article published by PC för Alla, the German state has declared its intention to gradually move public institutions away from Microsoft products. The reasons are similar across the board:

  • Reducing dependence on foreign tech giants
  • Saving public money
  • Gaining control over software ecosystems
  • Ensuring long-term access and compatibility through open standards

Europe has long been debating digital sovereignty, especially as tensions rise globally over data protection and geopolitical control of tech infrastructure. Open-source software offers an escape from this vendor lock-in.

The Positive Outcomes

  • Economic Savings: No more massive license renewals for operating systems and productivity suites.
  • Customizability: Open-source allows tailoring to local needs — something large commercial vendors rarely provide.
  • Transparency: Anyone can audit the code, which is especially important for public institutions handling sensitive data.
  • Standardization Across Borders: If multiple EU countries use similar open-source stacks, it could lead to better interoperability and shared resources.

But Not Without Risk

Despite its advantages, the shift comes with challenges:

  • Learning Curve: Staff accustomed to Windows and Microsoft Office will need training and time to adapt.
  • Compatibility: Not all workflows or legacy systems migrate smoothly — especially in bureaucracy-heavy sectors.
  • Support Infrastructure: While Microsoft offers commercial support, governments must now rely on internal expertise or third-party support companies.
  • Security Target Shift: As mentioned in our earlier coverage of Denmark’s move — the more popular Linux becomes, the more attractive it becomes to attackers.

“Security through obscurity” is no longer an option. If Linux-based systems become the new standard in public administration, they must be secured with the same (or higher) rigor traditionally applied to Windows-based environments.

What the Future Might Hold

If this trend continues, we could see:

  • A cascade effect, with other regions and countries following suit
  • The development of new government-funded open-source distributions or tools
  • A more resilient, independent European digital landscape
  • But also, a potential rise in Linux-targeted malware, phishing campaigns, and zero-day exploits

Governments must prepare for both the benefits and the responsibilities that come with running an open-source infrastructure.

Final Thoughts

This isn’t just about software — it’s about sovereignty, transparency, and the future of public digital services. If properly managed, the move to Linux can empower governments and protect citizen data. But poor implementation or lack of preparation could lead to service disruptions, user frustration, and even new cyberattack vectors.

Europe is changing. The question is: will the rest of the world follow?

Article, Knowledge, News, Uncategorized

Anubis Ransomware

What is Anubis Ransomware?

Discovered in mid-2025, Anubis is a ransomware variant that takes its name from the Egyptian god of the dead—and for good reason. Instead of merely holding files hostage, it executes them. After encrypting a victim’s files, the malware demands a ransom (usually in cryptocurrency), promising a decryption key upon payment. However, analysis has revealed that the malware has no functional decryption routine—once the files are encrypted, they are irreversibly overwritten or deleted.

Security researchers believe this behavior is intentional, likely designed to cause maximum disruption and psychological damage rather than financial gain.

Who Are the Targets?

Anubis doesn’t discriminate by industry, but critical infrastructure and healthcare institutions appear to be prime targets. Several reported attacks have involved:

  • Hospitals and clinics, resulting in data loss and halted medical operations.
  • Municipal networks, affecting emergency response and civic services.
  • Educational institutions, erasing research and administrative records.
  • SMBs (small and medium-sized businesses) lacking proper backups.

The choice of targets seems tactical—disrupting organizations where downtime equals danger.

Technical Behavior

While the full technical breakdown is still ongoing, researchers have observed the following behavior:

  • Payload Delivery: Via phishing emails, malicious attachments, or vulnerable exposed services (e.g. RDP, VPN).
  • Encryption: Files are encrypted with strong algorithms, but without saving decryption metadata.
  • Destruction: Files are deleted or corrupted even if ransom is paid.
  • Anti-Recovery: It wipes shadow copies, disables backups, and often attempts to overwrite files with garbage data before deletion.

Anubis also prevents boot in some cases, corrupting system partitions or disabling key services to paralyze the system further.

How to Protect Yourself

Given Anubis’ non-negotiable nature, prevention is the only real defense. Here are critical steps to minimize your risk:

1. Backups Are King

  • Maintain regular, offline, and offsite backups.
  • Test recovery procedures monthly.
  • Avoid mapping backup storage directly to production systems.

2. Patch and Harden

  • Keep systems, especially public-facing services, fully patched.
  • Disable unnecessary ports (like RDP) and use firewalls or VPNs to restrict remote access.
  • Harden configurations using CIS Benchmarks or similar guidelines.

3. Educate Your Team

  • Conduct regular phishing training.
  • Simulate attacks to build awareness.

4. Use EDR and Network Monitoring

  • Employ Endpoint Detection and Response (EDR) tools with behavioral detection.
  • Monitor traffic for unusual activity (e.g., outbound traffic spikes, command & control connections).

5. Zero Trust Principles

  • Limit permissions.
  • Segment networks.
  • Authenticate everything—especially internal access.

Should You Ever Pay?

No. Not with Anubis. This is not a ransomware that unlocks your files post-payment—it destroys them. Paying only funds further destruction and emboldens attackers.

Instead, report the attack to national cybersecurity authorities (like CERT-SE in Sweden or CISA in the U.S.), preserve any evidence, and isolate infected systems immediately.

Final Thoughts

Anubis is not just another ransomware strain—it represents a shift in cybercriminal mindset from extortion to pure sabotage. It also underlines the critical importance of preparedness over reaction.

“Hope is not a strategy. Backups, segmentation, and proactive defense are.”

Organizations—especially those in healthcare and critical infrastructure—must now treat ransomware not just as a financial threat, but as a destructive force. With no key, no mercy, and no trust, Anubis lives up to its mythological namesake—ushering victims straight to the digital underwo

Article, News

Hijacked Discord Invites

Hijacked Discord Invites: The New Lure in Phishing Campaigns

Introduction

In a concerning development for the security of social platforms and their users, attackers are now exploiting Discord invite links as a novel vector for phishing and malware distribution. This tactic represents a dangerous blend of social engineering and technical exploitation that can deceive even experienced users. The attack surfaced in a report by The Hacker News on June 17, 2025, highlighting how these malicious campaigns hijack trust by misusing Discord’s legitimate infrastructure.

How the Attack Works

At the core of this campaign is Discord’s invite system. Normally, these links (discord.gg/xyz) are generated by server admins to onboard new users. However, attackers have discovered a method to hijack these links, pointing them to fake landing pages that mimic legitimate Discord content but are instead controlled by the attacker.

1. Spoofed Landing Pages

The fake invite links redirect victims to phishing sites that visually replicate Discord’s invite screen. Users are prompted to “Join Server,” but in reality, these sites serve malware-laced payloads or harvest credentials.

2. SEO Poisoning

To increase visibility and trust, attackers use SEO techniques to make these hijacked links appear in Google Search results for specific Discord communities or NFT/gaming groups. This ensures organic reach, drawing in users who are actively searching for the real servers.

3. Redirection to Malware

Upon clicking the spoofed invite, users are often redirected to:

  • .exe downloads posing as Discord installers
  • Fake giveaways or NFT drops
  • Credential harvesting forms asking for Discord login or email credentials

Real-World Example

The article highlights a particular case where users searching for a popular gaming Discord server landed on a hijacked link. Instead of joining the server, they were redirected to a page that prompted them to download a malicious file disguised as a “Discord verification” tool. The file deployed information-stealing malware on execution, targeting browser cookies, Discord tokens, and saved passwords.

Technical Breakdown

  • Domain Spoofing: Attackers registered domains resembling legitimate Discord or community URLs (e.g., discords-giveaway.com, discord.gg.login-secure.com).
  • Link Cloaking: Shortened URLs (e.g., bit.ly, tinyurl) hide the true destination.
  • Payload Delivery: Malware such as RedLine Stealer, RATs, and browser hijackers were commonly delivered.
  • Token Grabbers: JavaScript was used in some cases to harvest Discord tokens directly from localStorage or the leveldb directory.

Why It Works

This method is particularly effective because:

  • Users trust the Discord brand
  • Invite links look legitimate
  • No immediate signs of compromise appear
  • Users are often distracted by the lure (NFT drop, giveaway, invite-only access)

Mitigation & Protection

For Users:

  • Double-check links: Always verify the full URL before clicking. Look out for extra domains or misspellings.
  • Avoid third-party sites: Only join Discord servers via official websites or known communities.
  • Use browser isolation or sandboxes when interacting with unknown links.
  • Enable 2FA on Discord to protect your account even if credentials are stolen.

For Server Admins:

  • Monitor for clones: Search for lookalike domains mimicking your community.
  • Report phishing sites: Use services like Google Safe Browsing or Discord’s abuse portal.
  • Educate your users: Share awareness guides on your server.

For Security Teams:

  • Add Discord invite domains to watchlists
  • Use DNS filtering and threat intel tools to detect malicious redirects
  • Monitor employee devices for suspicious Discord token activity

Implications for the Future

This campaign is a wake-up call for platform security. It shows how trust can be weaponized through very subtle infrastructure manipulation. Discord, known for its developer-friendly APIs and widespread use among gamers and professionals alike, is now part of a broader attack surface. If attackers can continue to abuse invite-based ecosystems, other platforms like Slack, Telegram, and Microsoft Teams may also see similar exploitation.

Final Thoughts

As phishing tactics evolve, attackers are moving beyond fake login pages and into ecosystem manipulation. The hijacking of Discord invites marks a shift in adversarial strategy—where the infrastructure of trust becomes the attack vector itself. Users, communities, and security teams must respond by raising awareness, monitoring DNS and SEO vectors, and enforcing zero-trust link policies.


Source: https://thehackernews.com/2025/06/discord-invite-link-hijacking-delivers.html

News

Danish Government Shifts to Linux

🇩🇰 Danish Government Shifts to Linux – A Smart Move with Hidden Risks?

In a bold and future-oriented decision, Denmark’s Agency for Digital Government has announced a plan to transition from Microsoft Windows and Office to Linux and LibreOffice. The shift is part of a larger effort to reduce dependency on proprietary software and embrace open standards and open-source alternatives.

But while this is a progressive and cost-effective step, it also comes with both challenges and unforeseen cybersecurity implications.

The Benefits of Going Open Source

There are many advantages to this decision:

  • Cost Efficiency: Eliminating costly Microsoft licenses can save millions of Danish kroner over time.
  • Sovereignty and Control: By using open-source software, the government avoids vendor lock-in and gains greater control over its digital infrastructure.
  • Transparency and Security: Open-source code can be audited by anyone, potentially increasing trust and reducing hidden backdoors or telemetry.
  • Flexibility: Linux systems are highly customizable and often more efficient on older hardware.

This move mirrors similar actions taken by other governments and institutions over the years — like Munich’s initial Linux migration or France’s adoption of open-source in the military sector.

The Migration Challenge

However, the human aspect of this change shouldn’t be underestimated. Many public employees are deeply familiar with Windows and Microsoft Office. Transitioning to Linux desktops and tools like LibreOffice will require:

  • Training programs
  • Documentation and support
  • Patience during the adaptation period

This learning curve could lead to temporary productivity loss — a factor that must be managed carefully through strong onboarding strategies.

🛡️ Linux as a New Target?

A crucial and often overlooked consequence of such transitions is the shifting threat landscape.

“If more governments and major institutions adopt Linux, attackers will follow.”

Historically, Linux desktops have enjoyed a degree of “security through obscurity” — not because they are invulnerable, but because attackers focused primarily on Windows, which dominates the desktop market.

However, this shift means:

  • More Linux systems in high-value environments (like government agencies)
  • Increased attacker interest in Linux vulnerabilities, malware, and privilege escalation techniques
  • More Linux-targeted phishing campaigns and social engineering

🔐 The Security Paradox

Linux is often seen as more secure by design. Features like strict user privilege models, package repositories with signature verification, and SELinux/AppArmor profiles can offer enhanced protection. But more usage equals more risk:

  • Unpatched third-party software becomes a bigger problem
  • Threat actors may begin crafting more Linux-specific rootkits and ransomware
  • Public institutions may lack deep Linux security expertise at scale

A Shift Worth Watching

Denmark’s move may signal the beginning of a larger trend. If successful, other EU countries and institutions may follow suit, especially in the context of digital sovereignty and tightening IT budgets.

But with great power comes great responsibility. As Linux gains adoption, defenders must be proactive in adapting their cybersecurity strategies to cover this new threat surface.

What do you think? Will Linux dominate the public sector in the next decade, or will it remain a niche choice? And are we prepared for the security consequences of such a shift?

News

Cyberattacks against Sweden: What’s happening – and how can we ALL prepare?

Cyberattacks against Sweden: What is happening – and how can we ALL prepare?
Published: June 12, 2025

In recent weeks, cyberattacks against Sweden’s critical societal functions have completely exploded. Public services, authorities and banks have all been hit by various types of attacks – from overload attacks to targeted intrusions. Most of the evidence points to a foreign power – probably Russia – being behind it. But why is this happening right now, and what does it mean for you and me? Can we do something, or are we just spectators while the great powers fight?

Why is this happening right now?

The attacks do not come out of nowhere. Here are some explanations:

  1. NATO and geopolitics
    Sweden’s rapprochement with NATO and our changed security policy have provoked Russia. Historically, they respond with hybrid attacks: cyberattacks, influence operations and disinformation.
  2. Election year and societal impact
    Ahead of the 2026 election, attackers want to sow division, create unrest and test how robust our digital society really is.
  3. Vulnerabilities in the systems
    Many systems are vulnerable and not sufficiently protected. This applies to both authorities, companies and private individuals.

Is this the beginning of something bigger?

It is very possible. Overload attacks, intrusion attempts and influence against the media are classic steps in major campaigns – especially from state actors. The next step could very well be:

Destructive attacks on infrastructure (electricity, water, communication)

Targeted extortion attempts against companies or authorities

Massive disinformation spread on social media and via news sites

What can YOU do as a private individual?

It can feel overwhelming when the “cyber war of the great powers” ​​seems to be beyond your control. But the fact is that the digital resilience of private individuals plays a major role – not just for yourself but for the entire society. Here are some simple but powerful tips:

  1. Review your passwords
    Use unique, strong passwords for each service.

Enable two-factor authentication (2FA) where possible – especially on email, social media and important apps.

Use a password manager (e.g. Bitwarden, 1Password, KeePassXC).

  1. Update your devices and applications
    Make sure your phone, computer and tablet have the latest updates.

Also update your apps and browsers regularly.

  1. Be vigilant about scams and disinformation
    Don’t click on links in strange emails or SMS – even if they appear to come from “your bank” or “the Swedish Tax Agency”.

Don’t blindly trust sensational news on social media. Always check the sender and source.

If you get “urgent” messages (“you need to log in NOW or your account will be closed”) – take a deep breath and check first.

  1. Back up what’s important
    Save important files and photos both in the cloud and on an external hard drive.

If something happens (e.g. ransomware), you can restore without paying a ransom.

  1. Talk about digital risks with family and friends
    Help those who are less digitally savvy – especially older relatives – to set up 2FA, choose good passwords and recognize scams.
  2. Have a plan B in case of major disruptions
    Think about what you will do if the internet or banking services are down for a few days. Have some cash at home, and think about how you will contact loved ones without the internet.

Community defense starts at home
Swedish cyber defense is stronger than it was just a few years ago – but every individual is also part of the defense. If we all raise our digital threshold, we make society less vulnerable, both to state actors and cybercriminals.

Conclusion
Sweden is currently under attack – and it is no coincidence. Geopolitics is shaking, and cybersecurity is the new front line. But we are not powerless: if companies, governments and individuals do their part, we will be much stronger when the next big wave comes.

Be critical, be prepared – and stay informed!

CVE, News

CVE-2025-33053 & Stealth Falcon’s Espionage Campaign: Everything You Need to Know

CVE-2025-33053 & Stealth Falcon’s Espionage Campaign: Everything You Need to Know

A critical zero-day vulnerability, CVE-2025-33053, has recently been exploited in the wild by the APT group known as Stealth Falcon (also identified as “FruityArmor”). This attack targets a flaw in Windows’ WebDAV implementation and employs sophisticated payloads—including a custom implant dubbed Horus Agent. Here’s a full breakdown and advice on how to safeguard your systems.

🕵️ Who is Stealth Falcon?
Stealth Falcon is an Advanced Persistent Threat (APT) group active since at least 2012, known for targeting government and defense organizations—primarily in the Middle East and Africa

Also referred to as “FruityArmor,” the group is believed to have backing ties to the UAE

Vulnerability Overview: CVE-2025-33053
Type: Remote Code Execution (RCE) in Windows’ WebDAV via manipulation of the working-directory during execution

CVSS Score: 8.8 (High severity)

Attack Vector: A phishing-based .url shortcut triggers a legitimate Windows tool (e.g., iediagcmd.exe) to run malicious executables hosted on attacker-controlled WebDAV servers

Microsoft released a patch for this flaw on June 10, 2025, even extending updates to legacy systems like Windows 8 and Server 2012

.

Attack Kill Chain
Phishing delivery: A .url file disguised as a PDF (e.g., TLM.005_…pdf.url) tricks recipients into clicking a malicious link

Remote executable hijack: Using Windows’ working-directory resolution, iediagcmd.exe launches a malicious route.exe hosted on WebDAV

Loader deployment: route.exe, the Horus Loader, uses code virtualization to evade detection, displays decoy docs, and drops the payload

Implant installation: The final payload, Horus Agent, a custom C++ implant built on the Mythic C2 framework, enables system fingerprinting, shellcode injection, backdoor communication, keylogging, and credential theft

Who’s at Risk?
High-value targets: Defense and government entities in the Middle East (e.g., Turkey, Qatar, Egypt, Yemen)

Broader threat: Now that the patch is public, cybercriminals may begin exploiting the vulnerability more widely—including ransomware actors

🛡️ How to Protect Yourself
1. Patch Immediately
Apply Microsoft’s June 10, 2025 update for CVE‑2025‑33053—available even for legacy Windows versions
darkreading.com

2. Limit .url/.lnk Exposure
Block execution of .url, .lnk, .cpl files from email/download folders using Group Policy, AppLocker, or WDAC
ampcuscyber.com
.

Train users to recognize suspicious shortcuts disguised as attachments.

3. Restrict WebDAV Access
Monitor or block connections to unknown WebDAV servers on port 443.

Detect when trusted Windows tools spawn from non-standard working directories
kaspersky.com

4. Deploy Defense-in-Depth
Use threat emulation, intrusion prevention systems, and endpoint protection (e.g., Check Point Harmony, PTR IPS)
research.checkpoint.com

Monitor logs for unusual service installations (Event ID 7045), creation of PDF or VHD files, or .url files launching legitimate processes – indicators include filenames like TLM.005_*.pdf, %TEMP%\…vhdx, ds_notifier, etc.

5. Incident Response & Visibility
Watch for new executables named route.exe, unusual file drops, or anomalous behavior from Edge/IE diagnostic tools.

Keep threat intelligence feeds up-to-date with IOCs like URL hashes provided by Check Point.

Summary
CVE-2025-33053, exploited by Stealth Falcon, is a potent zero-day involving deceptive shortcut files and a sophisticated implant deployment pipeline culminating in the stealthy Horus Agent. If you haven’t already, patch now, enforce strict execution controls, and monitor your network for signs of exploitation.

Need help with implementation or want a deeper technical breakdown? Just reach out or leave a comment!

How it works: