cyber.hendryadrian.com
Security News · darkowl.com

Threat Intelligence Roundup Highlights Phishing, Spyware and Wiper Attacks

· Original article ↗

Summary

A weekly threat intelligence roundup covers credential-stealing phishing, Predator spyware research, APT-linked malware campaigns, a claimed wiper attack on Stryker, help-desk vishing recruitment, and attacks targeting government organizations.

Key points

  • A phishing campaign used a fake Google security page and a web app to steal credentials and MFA codes, and potentially access contacts, GPS data, and clipboard contents.
  • Researchers documented how Predator spyware hides iOS microphone and camera activity after obtaining kernel-level access.
  • Silver Dragon and SloppyLemming campaigns targeted government organizations using malware, phishing, and other intrusion techniques.
  • Handala claimed responsibility for wiping systems and extracting data from medical technology company Stryker; the claims are attributed to the group.
  • Scattered Lapsus$ Hunters advertised payments to recruit callers for help-desk vishing attacks.
  • Poland’s National Centre for Nuclear Research said its defenses blocked an attack before information was accessed; attribution remains unconfirmed.

Article Details

Event Type
Threat intelligence roundup covering phishing and credential theft, spyware, cyberattacks, malware campaigns, and threat-actor activity.
Impact
The reported incidents include credential and MFA-code theft, surveillance and data collection, malware delivery and persistence, and attacks targeting financial institutions, government agencies, critical infrastructure, and Stryker. Handala claimed to have wiped more than 200,000 Stryker systems and extracted 50 terabytes of data, but those figures are unverified claims. Poland’s National Centre for Nuclear Research said its defenses blocked a cyberattack before information was accessed; authorities described a possible Iran connection as preliminary and warned it could be a false flag.

Indicators of compromise

TypeIndicatorContext
DOMAINgoogle-prism[.]comDomain used by the phishing campaign’s fake Google Account security page to steal credentials and MFA codes.

MITRE ATT&CK

T1102.002 · Bidirectional CommunicationGearDoor used Google Drive as its command-and-control channel.T1566.001 · Spearphishing AttachmentThe reported campaigns used spear-phishing emails with links or malicious attachments.T1574.002 · DLL Side-LoadingSloppyLemming’s reported attack chain used DLL sideloading to run a malicious file.

Threat Actors

DaVinci GroupNamed alongside UAC-0050 in connection with attacks targeting European financial institutions; the article does not explicitly establish whether this is an alias.HandalaIran-linked, pro-Palestinian hacktivist group that claimed responsibility for wiping Stryker systems and extracting data.Scattered Lapsus$ HuntersGroup reported to recruit callers for help-desk vishing attacks; the article gives SLH as its abbreviation.Silver DragonThreat group reported to target government organizations and operate within the umbrella of APT41.SloppyLemmingThreat activity cluster linked to two attack chains targeting government agencies and critical infrastructure operators in Pakistan and Bangladesh.SPIRE CASTLENamed as the umbrella under which Silver Dragon was reported to operate.UAC-0050Attributed by researchers to social engineering attacks targeting European financial institutions; the article also names DaVinci Group in connection with this actor.

Malware

GearDoorOn compromised systems, they deploy Cobalt Strike beacons to maintain persistence, along with GearDoor, a backdoor that uses Google Drive as its command-and-control (C2) channel.Predator3. Predator spyware hooks iOS SpringBoard to hide mic, camera activity – Bleeping Computer

Vendors

IntellexaSurveillance firm, Intellexa, utilizes a single hook function (‘HiddenDot::setupHook()’) inside Springboard that prevents sensor activity updates in IOS products.Stryker5. Medtech giant Stryker offline after Iran-linked wiper malware attack – Bleeping Computer

Products

Google Drive4. APT41-Linked Silver Dragon Targets Governments Using Cobalt Strike and Google Drive C2 – The Hacker NewsiOS3. Predator spyware hooks iOS SpringBoard to hide mic, camera activity – Bleeping ComputerRemote Manipulator SystemIf the victim opens the fake “PDF,” the malicious file runs and installs an MSI package for Remote Manipulator System (RMS).SpringBoard3. Predator spyware hooks iOS SpringBoard to hide mic, camera activity – Bleeping Computer

Tools

Cobalt Strike4. APT41-Linked Silver Dragon Targets Governments Using Cobalt Strike and Google Drive C2 – The Hacker News

Countries

Bangladesh8. SloppyLemming Targets Pakistan and Bangladesh Governments Using Dual Malware Chains – The Hacker NewsIran5. Medtech giant Stryker offline after Iran-linked wiper malware attack – Bleeping ComputerPakistan8. SloppyLemming Targets Pakistan and Bangladesh Governments Using Dual Malware Chains – The Hacker NewsPoland7. Poland’s nuclear research centre targeted by cyberattack – Bleeping Computer

Industries

Critical infrastructurehas been linked to two separate attack chains that delivered malware to government agencies and critical infrastructure operators in Pakistan and Bangladesh between January 2025 and January 2026.GovernmentThe group’s operations appear to specifically target government organizations.Nuclear research7. Poland’s nuclear research centre targeted by cyberattack – Bleeping Computer

Related Articles