gdatasoftware.com

Threat actors recompile open source software such as the 7zip SFX stub to sneak a reflective loader into it. Such kind of open source patch is easy to miss by analysts, but to understand why, we need to look at how 7zip SFX generally works and how the loader is hidden in there. OpenSUpdater has been reported in 2021 by Google for breaking “certificate parsing to avoid detection”. Recent samples, which are detected as OpenSUpdater by ESET or Snackarcin by Microsoft, use even more insidious evasion.

Cyberattacks often begin in an inconspicuous way – for example, by clicking on an email attachment or a phishing link. Whether this leads to a serious security incident depends primarily on how quickly suspicious activity is detected and stopped. This is precisely the role of the Managed Security Operations Centre (SOC) at G DATA CyberDefense. But how does a SOC actually operate in practice?

(This text was translated from English into German with the help of AI.) Critical systems fail, customers report problems and the head of IT declares a state of emergency. In the event of a cyberattack, fast and structured action is essential to limit the impact. Management must be prepared for such a scenario, because without an emergency plan, an attack can threaten the very existence of the company.

The debate over the use of a US company within the Berlin administration serves as a prime example of the challenge Germany faces when it comes to digital sovereignty. Following a cyberattack, rapid assistance, high-performance technology and experienced specialists are needed. There is no doubt about that. (This text was translated from English into German with the help of AI.) What is more worthy of discussion is the fact that the work of the US company is described as ‘without alternative’.

A phishing email sets a consequential attack by a ransomware group in motion: In August 2026, data from the Berlin Senate Administration was leaked. The case shows why security is not solely the responsibility of the user sitting in front of the computer. The BSI (German Federal Office for Information Security) has now published a report explaining the technical details of the attack path. It states that the entry point was a phishing email leading to a fake CAPTCHA prompt.

Your Google account is more than just an email inbox. It is the central key to a wide range of services, from Google Drive and Google Photos to logging in to countless third-party websites. This central role makes your Gmail account a prime target for cybercriminals. A successful phishing attack on your account can mean not only the loss of your emails, but potentially far-reaching access to your digital identity.

Pointing back to the source for information is a core component in security research. If you cannot prove what you claim using the source material, you're in trouble. People are confused and some will start calling you out. Further down the line, people might also become wary of publications that quote or share your research. This is not good for the public’s trust in the long run. No, this article is not about why you should not blindly trust what comes out of an LLM.

(This text was translated from English into German with the help of AI.) Which companies benefit from XDR? In short: most of them. The need for protection has increased in recent years across all industries — and with it, the requirements for effective defense. G DATA XDR extends classic endpoint protection with additional sensors and links the information from all endpoints within a company.

Users of LiteLLM may have become targets of an attacker group. As early as March, it became known that the “TeamPCP” group had managed to obtain confidential information for various platforms, including Kubernetes secrets, SSH keys, repository credentials, cloud platforms such as AWS, as well as tokens for AI environments. Information on who was affected and what data the attackers were able to steal can be viewed in an online database.

Projextor disguises itself as a productivity application, that looks and works like legitimate software, making it easy for users to trust them without realizing they contain hidden malicious code. Productivity software has become one of the most indispensable and exploited delivery vectors in modern threat campaigns. The popularity of free productivity tools makes it easier for Projextor to spread, as users often trust and download these applications without verifying where they came from.