Cytela

Elite Iranian Hackers Use AI to Attack Israeli Cyber Experts

Cytela has been monitoring cyber attacks attributed to an Iranian state-sponsored threat group known as Educated Manticore, also tracked as APT42, Charming Kitten, and Mint Sandstorm.

This advanced persistent threat (APT) group is widely believed to operate under the auspices of Iran’s Islamic Revolutionary Guard Corps (IRGC), and has a well-documented history of cyber espionage campaigns targeting high-profile individuals.

The current operation, began in mid-June 2025 following the escalation of hostilities between Iran and Israel. The campaign specifically targets Israeli experts using advanced social engineering techniques to exfiltrate sensitive credentials and bypass two-factor authentication (2FA) protections.

Read more:

Elite Iranian Hackers Use AI to Attack Israeli Cyber Experts in Stealth Phishing Blitz Iranian state-sponsored hackers linked to the IRGC have launched a sophisticated phishing campaign using AI-generated lures to target Israeli experts.

The #1 Lie Small Business Owners Believe About Cybersecurity

Many small business owners unknowingly operate under a dangerous assumption: “We’re too small to be a target.” This false sense of security is precisely what cybercriminals exploit. While a large percentage of Philippine SMB still underestimate their risk.

Read more:

The #1 Lie Small Business Owners Believe About Cybersecurity Think hackers won’t target your small business? Think again. Discover why you're at risk and the 5 critical protections you need NOW before it's too late.

Microsoft Copilot Hacked Itself: The Truth Behind EchoLeak ZeroClick Prompt Injection

A critical zero-click vulnerability, dubbed EchoLeak (CVE-2025-32711), exposed a disturbing reality in 2025

Cytela urges organizations to approach AI as a new class of digital infrastructure, demanding the same rigor, oversight, and layered defense as any mission-critical system.

Read More:
https://cytela.com/blog/post-9/

Threat Alert: PDF Phishing Malware Campaign
📍 Target Location: Philippines
🔗 Attack Chain: Email → PDF → ZIP → JavaScript → PowerShell Script → EXE

Sophisticated Multi-Stage Attack—Are You Prepared?

Cybercriminals are deploying an advanced phishing campaign designed to bypass traditional defenses. This attack begins with a deceptive email containing a seemingly legitimate PDF document, luring victims into downloading a malicious ZIP archive. Inside, a JavaScript loader executes a Base64-encoded, encrypted PowerShell script, ultimately injecting a stealer payload into regasm.exe, compromising system integrity.

Indicators of Compromise (IOCs)—Know the Signs
🔹 PDF: 73f9dc5eeddb52886205a50614a7bf62d9129afe
🔹 ZIP: cd3a338d462915ea99c49ae882b35e4029a90b46
🔹 JavaScript​: b97127d918d09529626e04a4320531609b224df9
🔹 PowerShell: a0bd25d583fadd59422ea0b03de9e342856a5189
🔹 EXE: 79c2794440adb6bb470d29422f8e53b814c78979

How Cytela Keeps You Safe:
🔒 Cytela Managed SOC swiftly identifies and neutralizes phishing emails before they reach inboxes, eliminating risk exposure.
🚫 Dropper File Interception: Malicious files are blocked before ex*****on, preventing unauthorized system compromise.
🛡️ Proactive Cyber Defense: Our 24/7 monitoring and response capabilities ensure comprehensive protection against evolving threats.

Don't let cybercriminals gain the upper hand, partner with Cytela to secure your digital assets now.

🔐 Secure Today. 🛡️ Safer Tomorrow. ✅ Cytela Got You Covered