Daily Security Review

About Daily Security Review

Daily Security Review, the premier source for news and information on security threats, Ransomware and vulnerabilities

Publisher

Daily Security Review

Category

news · technology

Language

en

Explicit

No

First episode

6 Feb 2025

Latest episode

29 Oct 2025

Latest episodes

294 of 410 episodes have a transcript.

1. 

   29 Oct 2025TRANSCRIPT

   Palo Alto Networks Uncovers 194,000-Domain Smishing Campaign Linked to “Smishing Triad”

   A global smishing campaign of unprecedented scale has been uncovered by Palo Alto Networks, revealing the vast operations of a Chinese-speaking threat actor known as the Smishing Triad. Since January 2024, the group has deployed more than 194,000 malicious domains, impersonating legitimate organizations ranging from toll and postal services to banks, cryptocurrency exchanges, and delivery companies. This campaign, active across the U.S., Europe, Asia, and the Middle East, leverages personalized SMS messages designed to trick recipients into divulging sensitive personal or financial information. Palo Alto Networks’ threat intelligence analysis describes the Smishing Triad as operating under a Phishing-as-a-Service (PhaaS) model—a decentralized criminal ecosystem in which specialized actors handle everything from domain registration and hosting to SMS distribution and phishing kit development. The infrastructure churns through thousands of new domains weekly, with most lasting less than two weeks, making detection and takedown efforts nearly impossible to sustain. Impersonating legitimate entities such as the U.S. Postal Service, India Post, and major financial institutions, the attackers craft highly convincing lures that exploit urgency and trust. Victims are redirected to counterfeit login portals where they unknowingly hand over credentials, Social Security numbers, or banking information. According to Palo Alto Networks, this high-volume, low-lifespan domain model allows the Smishing Triad to evade signature-based defenses and continuously scale their attacks. Beyond its scale, what distinguishes this campaign is its professionalization—an industrialized cybercrime model where phishing capabilities are outsourced and sold as services. As a result, even novice criminals can launch large-scale smishing attacks with minimal technical skill. The report warns that this trend marks a dangerous evolution of the cybercrime economy, merging automation, deception, and distributed infrastructure to sustain a global fraud operation. Palo Alto Networks recommends heightened vigilance, staff awareness training, and strict verification protocols for unsolicited messages, particularly those claiming to be from official entities demanding immediate action. As the Smishing Triad continues to evolve, it stands as a clear reminder that the boundaries between state-linked actors and organized cybercriminal enterprises are increasingly blurred—and that mobile-based phishing remains one of the fastest-growing global threats to individual and enterprise security alike. #SmishingTriad #PaloAltoNetworks #Smishing #PhishingAsAService #Cybercrime #MobileSecurity #SMSPhishing #PhishingCampaign #OpenSourceIntelligence #ThreatIntelligence #Cybersecurity #InformationSecurity #GlobalThreats #PhishingAttack #Infosec #PhaaS #CyberDefense #DarkWeb

2. 

   29 Oct 2025TRANSCRIPT

   Operation ForumTroll: Chrome Zero-Day Tied to Italian Spyware Developer Memento Labs

   A newly uncovered cyber-espionage operation known as Operation ForumTroll has revealed the resurgence of commercial spyware in state-sponsored surveillance campaigns. According to new research from Kaspersky, the campaign exploited a Google Chrome zero-day vulnerability (CVE-2025-2783) and targeted Russian and Belarusian organizations in government, research, and media sectors. The attacks were traced to tools developed by Memento Labs, the Italian surveillance vendor formerly known as the Hacking Team, whose legacy spyware once sparked global controversy for being sold to authoritarian regimes. The operation began with highly tailored phishing emails disguised as invitations to the “Primakov Readings” — a major international policy forum — luring recipients into visiting short-lived malicious links. Once clicked, victims were redirected to a drive-by exploit that leveraged the Chrome sandbox escape vulnerability, allowing attackers to execute code on the underlying operating system. Kaspersky’s researchers later identified a similar flaw in Firefox (CVE-2025-2857), broadening the attack surface for the same threat actors. Once inside, the attackers deployed a dual-implant structure: a custom spyware loader named LeetAgent, and a far more advanced commercial implant called Dante, developed by Memento Labs. Both tools shared identical persistence mechanisms, specifically COM hijacking, a telltale indicator linking the two. While LeetAgent operated as a modular espionage platform capable of keylogging, code injection, and document theft, the Dante implant exhibited industrial-grade sophistication. Protected by VMProtect obfuscation, Dante was found to contain a central orchestrator module that decrypts and loads AES-encrypted payloads, all bound cryptographically to a specific victim machine—ensuring the spyware could not run elsewhere. Forensic analysis uncovered unmistakable evidence connecting Dante to Hacking Team’s legacy Remote Control Systems (RCS) spyware. Once researchers removed the VMProtect layer, the name “Dante” appeared directly in the code, confirming its lineage. This finding completes a technological chain linking Memento Labs’ “rebooted” surveillance suite to the same underlying codebase once used by Hacking Team—a company whose previous exposure in 2015 caused international uproar. The technical core of Operation ForumTroll rested on CVE-2025-2783, a flaw in Chrome’s Inter-Process Communication (IPC) framework that mishandled Windows pseudo-handles. This allowed attackers to exploit a logic error and execute arbitrary code outside the browser’s sandbox, achieving full system compromise. Before triggering the exploit, the attackers ran an intricate validation process using WebGPU-based hardware checks and ECDH encryption to ensure the victim was a genuine human target, not a researcher or sandbox system—a sophisticated evasion method rarely seen in commercial spyware delivery. Kaspersky’s attribution of Operation ForumTroll to Memento Labs represents one of the clearest connections yet between a commercial surveillance vendor and a state-backed cyber operation. The exposure carries significant implications for the spyware industry, signaling that tools developed under the guise of “lawful interception” continue to reappear in covert geopolitical campaigns. Analysts believe this revelation may force Memento Labs to re-engineer its flagship Dante suite, much as it did when rebranding from Hacking Team years earlier. This operation serves as a powerful reminder of the blurred boundaries between private surveillance companies and state cyber operations—and how vulnerabilities in everyday software can be weaponized through the global spyware market. A full list of Indicators of Compromise (IoCs) from the campaign has been released by Kaspersky to help defenders detect and mitigate related threats. #OperationForumTroll #MementoLabs #HackingTeam #DanteSpyware #LeetAgent #CVE20252783 #ChromeZeroDay #CyberEspionage #Kaspersky #CommercialSpyware #CVE20252857 #Cybersecurity #SpywareMarket #ThreatIntelligence #ZeroDayExploit #APT #SurveillanceTechnology #CyberDefense #Infosec

3. 

   28 Oct 2025TRANSCRIPT

   Coveware Reports Historic Drop in Ransomware Payments: Only 23% of Victims Paid in Q3 2025

   The global ransomware economy is collapsing under growing resistance from its targets. According to new data from cybersecurity firm Coveware, the third quarter of 2025 saw ransomware payments drop to a historic low, with just 23% of victims paying attackers—a continuation of a six-year downward trend. Even when ransoms were paid, the average payment plunged by 66%, marking one of the most dramatic contractions in cyber extortion profitability to date. This shift is not coincidental. Companies have learned that paying the ransom rarely prevents data leaks, and law enforcement guidance increasingly supports a strict no-payment stance. Privacy attorneys are also advising organizations to refuse payment, particularly in cases of data exfiltration-only attacks, where victims gain little to nothing by complying. As a result, the ransomware “business model” is faltering, with fewer payouts starving the criminal ecosystem that depends on steady Bitcoin inflows. Facing these headwinds, threat groups like Akira and Qilin have pivoted to a high-volume, low-demand strategy. Rather than chasing multi-million-dollar payouts from major enterprises, these gangs are now flooding mid-sized companies with smaller ransom demands—an approach that exploits limited budgets and weaker security postures. The data shows that the median victim size rose to 362 employees, suggesting that attackers are deliberately targeting organizations large enough to pay something, but small enough to lack enterprise-level defenses. Despite these strategic shifts, attackers continue to rely on basic entry points rather than sophisticated exploits. Over half of all ransomware incidents still begin with compromised remote access services, weak passwords, and misconfigured systems. Meanwhile, phishing campaigns and unpatched software vulnerabilities—most of them years old—remain the easiest paths for compromise. This underscores that ransomware operations thrive on poor hygiene, not innovation. Experts view this decline in ransom payments as an encouraging milestone. With fewer victims paying, the economics of ransomware are becoming unsustainable, forcing groups to fragment or lower their demands to stay operational. The Coveware report concludes that this trend represents meaningful progress: the more organizations refuse to pay, the less incentive attackers have to continue. However, the industry must remain vigilant—especially mid-sized companies, which now face a rising tide of smaller but more frequent attacks. As the ransomware economy contracts, the message is clear: resilience and refusal work. By focusing on foundational defenses—multi-factor authentication, strict patching, and secure remote access—organizations can help starve the cyber extortion ecosystem and push ransomware further toward collapse. #Ransomware #Coveware #CyberExtortion #AkiraRansomware #QilinRansomware #Cybersecurity #ThreatIntelligence #RansomwarePayments #Phishing #RemoteAccessSecurity #VulnerabilityManagement #InfoSec #DataBreach #CyberCrime #NoRansomPolicy #CyberDefense #IncidentResponse #Q32025 #CyberThreatReport

Inside a recent episode

Palo Alto Networks Uncovers 194,000-Domain Smishing Campaign Linked to “Smishing Triad”

Published 29 Oct 2025 · Transcript excerpt

[…] It's less about spotting technical flaws now and more about human vigilance. Because the attacks are so fast and so high quality, the absolute bedrock of protection has to be extreme skepticism. You basically have to treat any unsolicited message you get from any sender, especially if it has a link and talks about money or urgency with the default assumption that it's fake until you prove otherwise. So basically adopt a zero trust approach for all incoming SMS and messages. Okay, but what should people actually do instead of just ignoring it? What's the actionable step? You need to follow a strict verification protocol. […]

Who has been a guest on Daily Security Review

Names identified in recent episode analyses. Showing up to five guests.

• [Guest Name]
• [Guest Name Title]
• Eclypsium researchers
• Cybersecurity researchers
• Nick Jones

Reach and audience

Public platform figures. Ratings count people who left a rating, not total listeners.

YouTube views

937,183

Score snapshot 15 Sept 2025

Apple Podcasts (US)

3.0 / 5

1 ratings

Podcast Authority Score: 60 / 100

A composite of feed quality, social presence, YouTube performance and engagement. Read the methodology.

Quality

83

Social presence

0

YouTube

93

Engagement

0

Contact Daily Security Review

Guest appearances

Does not typically book guests

Based on episode analysis; this does not confirm that the show is currently accepting guests.

Questions about Daily Security Review