Silver Bullet Security

💎🛡️A Romanian hacker has been sentenced to nearly five years (57 months) in a U.S. federal prison after being extradited to face charges for unauthorized access to the computer networks of various U.S. companies and organizations. The hacker was found guilty of compromising these systems to steal sensitive data and deploy malicious software. This successful prosecution highlights the effective collaboration between the U.S. Department of Justice and Romanian law enforcement, underscoring the U.S. government’s unwavering commitment to prosecuting international cybercriminals and demonstrating that global boundaries provide no sanctuary from the reach of the law. 🏛️

Read more: https://securityaffairs.com/192770/cyber-crime/romanian-hacker-gets-nearly-5-years-in-us-prison-over-network-intrusion.html

🎊🎁The Interchange 21 management team visited the office and give a gift basket to express our gratitude for your trust in our office rental services.✨💐

Google is set to significantly upgrade security on Android 17, focusing on blocking scams and preventing data theft. A key highlight is a partnership with banking apps to automatically detect and disconnect spoofed calls pretending to be financial institutions-a feature that will retroactively support devices down to Android 11.
Additionally, enhanced AI will monitor malicious apps attempting to intercept SMS messages, while a new "Mark as Lost" mode enforces biometric authentication, preventing thieves from unlocking or untracking the device even if they know the PIN. Other notable protections include hiding OTP codes from third-party apps for three hours and allowing users to disable outdated 2G networks to block potential eavesdropping.

Read More : https://www.bleepingcomputer.com/news/security/android-17-to-expand-banking-scam-call-and-privacy-protections/

🌐The threat actor UNC6692 utilizes Email Bombing to overwhelm inboxes and create a false sense of urgency. Attackers then impersonate IT personnel via Microsoft Teams to trick victims into installing malware, disguised as a "patch" to resolve the spam issue.
🌐 Capabilities of the “Snow” Malware Suite
The Snow malware family operates as a coordinated ecosystem: SnowBelt ensures persistence through browser integration, SnowGlaze establishes communication with Command-and-Control (C2) servers, and SnowBasin acts as a backdoor for remote command ex*****on, data theft, and screen capturing.
🌐 Network Intrusion and Data Exfiltration
After gaining initial access, the attackers move laterally through the network to compromise the Domain Controller. They employ memory dumping techniques to steal credentials and use FTK Imager to extract critical organizational databases. Finally, the stolen data is exfiltrated via LimeWire to maximize impact and facilitate further attacks.
🌐 Read more https://www.bleepingcomputer.com/news/security/threat-actor-uses-microsoft-teams-to-deploy-new-snow-malware/%0A

Security researchers from CloudSEK have identified a critical vulnerability in over 22 popular Android applications (totaling over 500 million downloads). These apps were found to have hardcoded Google API Keys within their source code. Because of how Google Cloud handles permissions, these keys—originally intended for basic services—can be exploited to gain unauthorized access to Google’s Gemini AI services.

The Shift in API Key Status: Historically, Google suggested that API keys for public services (like Google Maps) did not necessarily need to be kept secret. However, if a developer enables the Gemini API (Generative Language API) within that same Google Cloud project, the "public" key automatically gains the power to access Gemini.
Access to Sensitive Data: Attackers can extract these keys by decompiling the Android app. Once obtained, they can access files uploaded to Gemini, retrieve cached content, and execute AI models under the project owner’s identity.
Financial Impact: Attackers can exhaust AI quotas or rack up massive bills. Some reports indicate victims being charged as much as $15,400 (approx. 500,000 THB) within just a few hours of an exploit.
Read more : https://www.securityweek.com/google-api-keys-in-android-apps-expose-gemini-endpoints-to-unauthorized-access/

🌐🛡️Security researchers have discovered the DarkSword exploit kit, which chains six vulnerabilities (including CVE-2025-31277 and CVE-2026-20700) to compromise iPhones via Safari. By bypassing the sandbox and gaining kernel read/write access, it deploys the GHOST malware family (GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER) to steal sensitive data, such as passwords, photos, WhatsApp/Telegram databases, crypto wallets (Binance/Ledger), and health information.
Linked to threat actors like UNC6748, UNC6353, and PARS Defense, the campaign utilizes fraudulent websites and watering hole tactics. DarkSword is designed for high-speed ex*****on, automatically deleting its footprint after data exfiltration to evade detection. Apple has released patches for these flaws; therefore, users are urged to update to iOS 26.3.1 immediately, while high-risk individuals should enable Lockdown Mode.

Read More ; https://www.bleepingcomputer.com/news/security/new-darksword-ios-exploit-used-in-infostealer-attack-on-iphones/

The 2026 breach of over 600 FortiGate firewalls serves as a stark reminder of how Generative AI is being weaponized as an 'assembly line' for cyberattacks. By automating vulnerability scanning and brute-force attempts, AI has lowered the entry barrier, enabling less-skilled attackers to execute large-scale, complex operations. This incident highlights that even in the age of AI, fundamental security hygiene-such as securing management ports, enforcing strong passwords, and mandating Multi-Factor Authentication (MFA)-remains the most effective defense against modern threats.

Readmore: https://www.securityweek.com/hundreds-of-fortigate-firewalls-hacked-in-ai-powered-attacks-aws/?

✨Our monitoring solutions can either be on-site at your location where it is installed, configured and maintained by us, or off-site through our Cyber Security Operations Center (CSOC).

🔐Recently, a concerning report was released regarding a group of hackers linked to the Chinese government. The group has been exploiting a critical zero-day vulnerability in Dell software to conduct espionage and maintain a presence within the networks of organizations worldwide since mid-2024.
🔐The vulnerability is identified as CVE-2026-22769, with a maximum severity rating of 10/10 (CVSS), and it affects Dell RecoverPoint for Virtual Machines, a tool used for backup and disaster recovery in VMware environments. The primary cause of this flaw is the presence of 'hardcoded credentials' within the software's Apache Tomcat Manager, which allows hackers—tracked as group UNC6201 (a PRC-nexus group)—to gain root-level control over the system without any authentication.
Investigations by researchers at Mandiant revealed that this group is highly sophisticated. They specifically target 'edge devices'—network endpoints that are often blind spots for Endpoint Detection and Response (EDR) software. Furthermore, they utilized malware families known as BRICKSTORM and GRIMBOLT, along with complex techniques such as 'Ghost NICs' (creating temporary virtual network interface cards) to mask their activity while moving data within the victims' networks. These tactics allowed them to remain undetected for 18 months before they were finally discovered.

Read more : https://www.bleepingcomputer.com/news/security/chinese-hackers-exploiting-dell-zero-day-flaw-since-mid-2024/

.

🛡️🌐Silver Bullet Security Services Company Team was honored to be invited to attend Cybersec Asia x Thailand International Cyber Week 2026
(Powered by NCSA)

📅 Date: 4–5 February 2026
📍 Venue: Plenary Halls, QSNCC, Bangkok, Thailand

🤖 Cybersec Asia x International Cyber Week 2026 (powered by NCSA), co-located with AI ASIA: explore key insights and expert perspectives that are shaping the future of Cybersecurity and AI across the region.