MIL Mi28 HAVOC,A NEW UGANDAN COMBAT HELICOPTER

Mi-28 HAVOC

Crew

2

 

Propulsion	2 Turboshaft Engines
Engine Model	Klimov TW3-117VMA-SB3 / TV3-117VMA-SB3
Engine Power (each)	1638 kW	2197 shp

 

Speed	306 km/h	165 kts   190 mph
Service Ceiling	5.700 m	18.701 ft
Range	450 km	243 NM 280 mi.

 

Empty Weight	8.590 kg	18.938 lbs
max. Takeoff Weight	11.700 kg	25.794 lbs

 

Rotor Blades (main/tail)	5/4
Main Rotor Diameter	17,20 m	56 ft 5 in
Tail Rotor Diameter	3,84 m	12 ft 7 in
Rotor Disc Area	232,4 m²	2502 ft²
Length	17,01 m	55 ft 10 in
Height	3,82 m	12 ft 6 in

 

First Flight	10.11.1982
Production Status	in production

 

ICAO Code	MI28
NATO Code	Havoc
Data for (Version)	Mil Mi-28NE

 

The Al-Qaeda affiliate militant group, Harakat al Shabaab al Mujahideen (HSM) commonly known as Al-Shabaab continue to escalate attacks in East Africa, especially in Kenya and Somalia. Somalia has been fighting the Al-Shabaab jihadist insurgency for well over a decade and even with support from allies militarily, the jihadist group is not fully degraded.

Al-Shabaab’s deadly insurgency continues with no end in sight. The Islamist militant group consistently tries to keep up with local and regional military operations. The militant group has exploited a number of loopholes to step up attacks. Combined with dysfunction and division among their adversaries, the militants’ agility has enabled its operatives to embed themselves in Somali society. It also makes them hard and elusive to defeat.

In the month under review, the Islamist militant group has escalated attacks against military positions, government officials as well targeting on civilians. The surge in Al-Shabaab attacks has been noted especially in Somalia’s capital Mogadishu and localities in central and southern Somalia.

Notably, counterterrorism assets at Strategic Intelligence (S.I) have recorded at least 57 for Kenya and Somalia.  Somalia the home-base of Al-Shabaab has taken the largest share of these attacks. Attack patterns in Somalia remains almost the same, mostly occurring in central and southern Somalia. Most these attacks are notably repeat attacks, especially the ones targeted at Forward Operating Bases (FOBs) and military convoys.

Thus, threat posture continues to be skewed towards military operating bases and their patrols convoys besides military convoys on supply missions especially for Somalia. Most of the raids against the targets are notably ambushes and setting up of roadside IEDs with a number of repeat attacks being recorded. Assassination attempts on key officials also witnessed in Mogadishu and its environs as well as resumption of suicide operations.

Al-Shabaab has proven resilient, adjusting to counter-insurgency campaigns and entrenching itself deeper in parts of Somali society. Al-Shabaab militants still retains control over large swathes of rural Somalia and persistently mount attacks in urban centers a confirmation of the group’s resilient despite counter-operations on the group by coalition security operators and hurriedly claiming credit for the overly exaggerated operations for warfare purposes.

For Kenya, another key target of the Islamist Al-Shabaab, the militant group continue to stage low-scale attacks in an attempt to disrupt the calmness that has been witnessed for a number of months. The militant group is keen on disrupting the frontier counties (Mandera, Wajir, Garissa and Lamu) by emplacing IEDs on main roads and MSRs in an effort to target security assets on patrol missions.

 most wanted Al-Shabaab leaders & the group’s elusive intelligence chief, Mahad Karate ON THE RIGHT, who has $5 million bounty on his head

AS Recently Claimed Attacks: June 1^st – June 14^th

§  On June 1^st, Emerging reports in Mogadishu indicate that Major Salad Ishaq Yusuf, a senior Somali government official, escaped unhurt in an IED explosion in Daynile district, killing at least one of his bodyguards and wounding five others. Al-Shabaab claimed responsibility for the attack, few hours after the attack.

§  On June 1^st, Al-Shabaab claimed to have detonated an IED targeting a Somali National Army (SNA) convoy in Mogadishu. The IED killed one soldier, wounded one other, and wounded two civilians as per local sources.

§  On June 1^st, heavily armed Al-Shabaab militants claimed to have attacked an AMISOM and Somali government base in Barire area of Lower Shabelle, but no casualties were reported.

§  On June 2^nd, A car bomb exploded in the general vicinity of Daynile, Mogadishu, killing at least two police officers and wounding several others. Al-Shabaab claimed responsibility for the targeted IED explosion through radio Andalus.

§  On June 2^nd, Al-Shabaab claimed responsibility for assassination of a Turkish Embassy staffer in Mogadishu. The staffer was also an electoral delegate.

§  On June 2^nd, Al-Shabaab claimed to have launched attacks against Kenyan security troops on the outskirts of Garissa town. Using light weapons, the militants claimed to have attacked Ura Madow camp and also ambushed the convoy was traveling from the military camp towards Bura, Tana River County.

§  On June 6^th, Al-Shabaab claimed to have detonated an improvised explosive device (IED) targeting a Kenyan police convoy and a lawmaker near Sangaliu, Garissa County, eastern Kenya. The targeted police convoy was traveling from Masalani, Tana River County, eastern Kenya, to Sangaliu, Garissa County. Local officials claimed the IED caused fatalities from the Critical Infrastructure Protection Unit.

§  On June 6^th, Al-Shabaab assassinated a Burundian African Union Transition Mission in Somalia (ATMIS) soldier in Balad, Middle Shabelle region, central Somalia.

§  On June 6^th, Al-Shabaab claims to have killed some Kenyan security officers, injured others following a roadside bomb attack on a police vehicle in Lamu county of Kenya.

§  On June 9^th, at least four Somali Soldiers have been injured after a vehicle they were travelling in was hit by an improvised explosive device (IED) outside the Somali capital, Mogadishu. Al-Shabaab claimed responsibility for the IED blast via its media.

§  On June 9^th, several explosions, believed to be mortar rounds, heard near Mogadishu airport amidst lockdown as the Somali capital hosted foreign delegations who attended the inauguration of new Somalia President Hassan Sheikh Mohamud.

§  On June 9^th, Al-Shabaab militants detonated an improvised explosive device (IED) targeting a US-trained Danab special forces convoy in Gululei, Bal’ad district, Middle Shabelle region, south-central Somalia. Al-Shabaab claimed the IED killed fifteen soldiers. The convoy was traveling from Mogadishu to Jowhar.

§  On June 11^th, Deadly clashes between Puntland security forces and Al-Shabaab militants reported in Bossaso. Corresponding local sources reported that two people were killed in the clashes in Bossaso, northern Somalia, one of them a security officer and the other a civilian.

§  On June 11^th, Al-Shabaab militants took credit for detonating an improvised explosive device (IED) targeting police officers in Badbaado internally displaced peoples camp, Dharkenley district, Mogadishu. Al-Shabaab claimed that the IED killed seven police officers at a police station while Local officials claimed the IED killed two police officers at a tea shop.

§  On June 12^th, Al-Shabaab claimed a brief attempted probe on ATMIS military base operated by the Kenyan troops in Hosingow, Lower Juba. No details on casualties were provided.

§  On June 12^th, Al-Shabaab claimed responsibility for a direct attack on ATMIS-Ugandan operating base in Qoryoley, Lower Shabelle region of Somalia, but no casualties were reported.

§  On June 13^th, suspected Al-Shabaab assassins reportedly shot and killed a prominent elder outside his house in the morning in Mogadishu’s Bar-Ubah neighborhood. Warsame Ismail is said to have been approached by people armed with pistols, who fired several rounds at him before fleeing the scene.

§  On June 14^th, Al-Shabaab claimed the killing of two Burundian soldiers serving under ATMIS in the outskirt of Bala’d district in Somalia’s Middle Shabelle region. Notably, claimed that they have used snipers, according to the affiliate accounts of the group.

Attacks from June 14^th – June 30^th

§  On June 15^th, Al-Shabaab militants raided a Kenyan African Union Transition Mission in Somalia (ATMIS) base in Kulbiyow, Badhadhe district, Lower Jubba region, southern Somalia. The brief probe was successfully repulsed and no casualties were reported.    

§  On June 16^th, Al-Shabaab militants claimed responsibility for an attempted ambush on a KDF election security convoy near Riba, Wajir County, northeastern Kenya. No casualties were reported.

§  On June 16^th, Al-Shabaab militants claimed to have raided a Kenya Defense Forces (KDF) base in Kiunga, Lamu County, eastern Kenya. No casualties were reported.

§  On June 17^th, Al-Shabaab, Ahlu Sunna wa al Jama’a (ASWJ) militia fighters and regional forces clashed in Badho village, Adado district, Galgudud region, central Somalia. Warring sides reported successes. The defending forces claimed to kill at least 67 al Shabaab militants, wound at least 33 more, and capture a suicide vehicle improvised explosive device (VBIED) and the driver and Al-Shabaab claimed to have killed 27 defending forces.

§  On June 19^th, Al-Shabaab claimed to briefly captured Rhamu, Mandera County, NEP and lectured locals.s

§  On June 20^th, Al-Shabaab terrorists stormed and overran El-Bur district hospital in Galgadud region and forcibly discharged all the patients including malnourished children and pregnant women to hospitalize 80 of their members who were wounded in Friday’s Bahdo fighting as per State Media.

§  On June 21^st, Al-Shabaab militants claimed to have detonated an improvised explosive device targeting a communications tower in Rhamu, Mandera County, NEP Kenya.

§  On June 22^nd, Civilian casualties were reported as a result of a roadside bomb attack on the outskirts of Kismayo, especially between the Bar area and the area known as Barbara. Al-Shabaab claimed responsibility saying it targeted Somali government troops.

§  On June 23^rd, Al-Shabaab militants claimed responsibility for detonating an improvised explosive device targeting a Turkish-trained Gorgor special forces convoy in Mogadishu. No details on casualties were provided.

§  O June 23^rd, Al-Shabaab claimed to have shot and killed a Burundian soldier guarding a military base in general vicinity of Mahaday district of Middle Shabelle and wounded one other.

§  On June 24^th, Al-Shabaab militants stopped a bus heading to Mandera, Kenya from Nairobi and searched for non-locals on Friday. The militants also lectured passengers in Somali language for 2-hours.

§  On June 25^th, Al-Shabaab claimed an operation on SNA operated base in the general vicinity of Dharkenley district of Mogadishu where two soldiers of Federal Government were killed.

§  On June 25^th, Al-Shabaab claimed to have targeted and killed a government official identified as Hussein Hassan Gurey in the general vicinity of Afgoye, Lower Shabelle region.

§  On June 27^th, Al-Shabaab militants raided three Jubbaland State security forces bases in Buda Dariq, Garaska and Sangaleer, Kismayo district, Lower Jubba region, southern Somalia. Al-Shabaab claimed to kill at least eight soldiers in the attacks

§  On June 27^th, at least three SNA soldiers were killed and several others, including two journalists, wounded in a landmine blast in Qabno areas of the Mataban district in the Hiran region on Monday. The attack targeted convoy that carrying the governor of the Hiran region and army officials.

§  On June 27^th, Al-Shabaab claimed responsibility for a direct gun attack on government troops in general vicinity of Daynunay village on the outskirts of Baidoa, Bay region of Somalia killing two soldiers.

§  On June 29^th, Al-Shabaab claimed to have conducted mortar shelling and direct attacks on SNA Defense post killing one government soldier in the general vicinity of Weydow, west of the Somalia capital Mogadishu.

§  On June 29^th, In the Lower Jubba region, the Islamist militant claimed to have launched a major offensive against ATMIS base operated by the Kenyan troops in Taabto area but no casualties were reported.

§  On June 30^th, reports from Middle Shabelle indicated that Al-Shabaab jihadist fighters blew up the house of a former minister in the self-proclaimed Hirshabelle administration in Jowhar town.

§  On June 30^th, Al-Shabaab fighters claimed responsibility for targeting the base of the Puntland forces in Galgala area of Bossaso. The fighters claimed to have fired several rounds of mortar shells causing casualties of five soldiers and damage of military property.

Assessments/Observations & Insights

Despite many years of sustained counterterrorism pressure, Somali forces supported by allied AMISOM partners and the U.S, the terrorist threat in East Africa is not degraded. Instead, Al-Shabaab has adopted guerilla tactics and managed to consolidate control of rural areas, while regularly conducting deadly attacks on Somali cities.

Notably the Al-Qaeda associated Al-Shabaab continue to position itself as an alternative authority in Somalia coming up with some interventions such as education, humanitarian interventions and latest being the construction of a hospital. Al-Shabaab claimed to have built and opened a new state of the art Hospital, which includes a Maternity Ward in the Al-Shabaab controlled town of Jilib in the Middle Jubba province of Somalia which will be open for the locals. These interventions are clever ways/strategies by the jihadist group to woo Somali masses to their side/fold.

Al-Shabaab claims credit of having built and opened a new state of the art Hospital, which includes a Maternity Ward in the Al-Shabaab controlled town of Jilib in the Middle Jubba province of Somalia.

Notably, an average of at least one or two attacks are recorded from across the regions of Somalia. Regions mostly targeted in frequent attacks include the capital and the ones in central and southern Somalia where the militant group maintains quite some control. As for Kenya, retaliatory and disruptive incidents linked to Al-Shabaab are also being reported along the volatile border prefectures with Somalia especially; Mandera, Wajir, Garissa and Lamu. CT assets in those prefectures continue to be alert, reporting few cases on attempted probes and enemy signatures.

Al-Kataib and Radio Andalus has continually over exaggerated on the number of operations it has conducted in East Africa as well as number of fatalities/casualties caused. Preferred attack types remain the use of IEDs, landmines and roadside bombs. Ambush raids are also gaining traction on the military targets. However, the Islamist militant group through its propaganda media channels. Recently Al-Shabaab propaganda media wing released a video showcasing its recent operations from across Somalia theaters, ranging from small scale to complex operations especially on military positions (Convoys and FOBs).

Conclusion

Continuous monitoring, surveillance and scouting encouraged several meters away from forward operating bases/police outpost for both Kenya and Somalia. Al-Shabaab ultimate goals is to stage attacks on FOBs and Defense Posts, as such counterterrorism assets advised to observe convoy discipline citing Al-Shabaab continuous IED contamination on Military Supply Routes (MSRs).

Counterterrorism assets especially for Kenya have been able to sustain robust counteroperations against the Islamist Al-Shabaab waging surprise attacks in prefectures bordering Somalia. However, counterterrorism operators urged to be alert, collaborate with locals to get the much-needed HUMINT in an attempt to thwart attacks in the future. Threat posture, remains skewed towards military operating bases and defense posts proximal to the border with Somalia, thus security troops/patrol teams are highly advised to maintain an offensive posture.

 

How to Secure Your Email From Common Hacking Threats

 

For organizations, email is the first line of defense from hacking, and it has to be protected the most. According to research, over three billion infected emails are sent daily — which means that it’s highly likely that you’ll receive an infected email in your inbox.

Namely, emails are highly targeted by cybercriminals. The main reason is that everyone has an email address, and it’s relatively easy to obtain a lot of them as well as send malicious links that contain a virus.

So, what can you do about it?

Start by strengthening your email security.

What is email security all about? Well, it’s about changing your password to a stronger one, but also having the tools that protect you against common cyberattacks.

Which cyberattacks should you learn to recognize and how to set up a strong password to protect your email?

Let’s find out.

Contents [show]

Recognize Obvious Phishing Attacks

Emails are the number one target of phishing attacks. Therefore, it’s important to recognize a phishing attack.

What all phishing attacks have in common is that they impersonate someone you trust. Cybercriminals don’t want you to second guess if an email is a scam, a legit offer, or a genuine concern.

For example, common scams include the impersonation of banks and notifying you that your account has been hacked.

To protect that same account, they might request to click on a certain link that connects data or even your PIN — even though a bank would never ask you to disclose it over an email.

Lately, there has been an increased number of attacks that include the impersonation of medical institutions due to COVID-19. Hackers send infected files with information about the latest measures concerning coronavirus.

Medical and financial scams include emails that are sent to a lot of people. Avoid clicking on any links or opening attachments, even if you get an email that looks like it’s from your bank or official medical institution.

The goals of phishing emails are different. Some might ask you to transfer money and others might pretend to help you and urge you to click on a certain link or install attachments that contain malware.

Some clues that you received a phishing email are:

Sense of urgency — scammers put pressure on you to react as soon as possible

Grammatical errors — scam emails are known to have a lot of grammatical errors

Generic greeting — email filters can recognize certain templates that hackers use, and it’s common for them to start with a greeting such as “Dear valued member” or even “Dear customer”

Use Trustworthy Anti-Malware

Reliable antivirus installed on all of your devices is a must. Scamming via email is frequently accompanied by a link to a website that is infected with malware or an attachment containing a virus looking to get installed on your computer.

Therefore, even if you don’t transfer money upon their request, cybercriminals might find another way to get into your bank account. They could monitor your activity using the remote access they gained after you installed malware on your device.

Antivirus software from a trustworthy company can detect viruses on your device and mitigate them before hackers cause any damage or get access to your sensitive information and demand ransom.

Set up a Strong Password

To be impenetrable, your password must contain at least 8 or 13 characters. It also has to consist of a unique combination of both uppercase and lowercase letters, numbers, and special symbols.

Avoid using any of your personal information when choosing your password. Numbers such as anniversaries or birthdays are easier to trace back to you – especially on social media.

What’s more, avoid having any words from a dictionary in your password. Hackers can use the dictionary to crack your credentials.

When was the last time you changed your passwords? Has it been over six months or even longer? If not, it’s time to change it.

Also, do you use your password for more than one account?

If that’s the case, it means that hackers can hack into your email and use the same password to get into all the other sites and services that you sign up with using the same credentials.

Secure Your Corporate Email

Companies need more complex measures to protect their networks and corporate emails. Having stronger tools that protect your system against the latest cyberattacks, basic employee training about cybersecurity, and employing zero trust is a good start.

Your tools should be able to scan for and mitigate phishing attacks and other likely attacks that target email. They should block installing of the attachments and access to sites that are suspicious, but also remove threats that are already on your computer.

Employee training is an efficient way to combat some possible flaws in security.

Not all of your employees are tech-savvy, and some of them might cause a vulnerability in your system. They might click on an infected link within the body of the email or download an attachment from an unknown sender.

However, your employees are not cybersecurity experts, and it’s not solely their responsibility to protect your network.

Employ zero trust by limiting access to certain parts of your systems, and use cybersecurity tools that continually scan for unwanted access.

Email is a Goldmine of Information for Hackers — Protect it

The information that you have on your email is precious, and it has to be protected — even if you firmly believe that you have nothing or already share a lot about yourself on your social media.

Emails can contain information about your bank account, private information about you, your family, your clients, and more.

For better email security, you can start by replacing your password with a more secure one and have tools that remove malware in case you click accidentally click on a malicious link.

Best Windows 10 Hidden Features

 

   

News

1.God Mode

If you have always wanted to take full control of your computer’s operating system then God Mode will definitely impress you. With this shortcut, you will get access to a master version of the Control Panel that has extended settings.

To enable it, create a new folder with the name,

GodMode.{ED7BA470-8E54-465E-825C-99712043E01C}

Once again only use this hidden feature on Windows 10 if you are a power user or an IT professional. Using God Mode you can also customize the Windows OS as per your liking.

2. Doom’s Dedicated Port

Next on the list, we have game-related Windows Easter Eggs. If you were born in the 90s then you might know that Doom95 was one of the first mainstream first-person shooters available for the Windows platform.

When the game got released for Windows it used port 666. Well, this is a reference to the Number of the Beast. To this day, even in Windows 10 port 666 is the only port reserved for doom.

To check out this gaming Windows 10 easter egg head on to C:WindowsSystem32driversetc and open the file “services” in Notepad.

3. Make Phone Calls

Yes, you read that right!

Windows OS comes with a built-in phone dialer. If you have a telephone device or a modem connected to your computer then you can make and receive phone calls.

To do so, simply run the executable file by pressing Windows + R. Next you have to type dialer.exe and press enter. If everything goes well, the dialer program will launch.

If you don’t have a telephone device connected then a warning will pop up.

4. Secret Start Menu

Secret Start Menu is a hidden Windows 10 feature that’s right in front of you every day but you never really notice. To activate this menu simply right-click on the start menu button.

Once activated a textual jump menu will pop up and here you will see a number of familiar destinations, like Apps and Features, Search, and Run. If you have used older versions of Windows like Windows 7/Vista/XP then you might be aware of this textual start menu.

It definitely comes in handy when you want to do something really quickly.

5. Star Wars CMD Movie

Next, upon this list, we have one of the coolest command prompt Easter Eggs namely Star Wars CMD code. Before using this cool easter egg please ensure that Telnet is enabled on your computer.

If it’s not enabled, open the start search bar and type “telnet”. Next click on “Turn Windows Features on or off from the results”. You have to now locate the Telnet Client entry. Once located check the box and press OK.

Next to have fun with this easter egg open the command prompt and type

telnet towel.blinkenlights.nl

Now sit back, relax, grab a drink and enjoy star wars in ASCII characters. In addition to Windows 10, you can use this code on all Operating Systems that support Telnet and has a terminal or command line.

6. Show Desktop Button

Using an almost hidden button in Windows 10 you can instantly jump back to the desktop no matter how many programs you have open. If your taskbar is located at the bottom of the screen then you can locate this button in the bottom-right corner.

Can’t locate it yet? Well, it’s right after the time and the notifications button. Simply press this small transparent sliver button and you will be on your desktop.

Want to get back to work? Simply press it again and all your open windows will be back where you left them. This small button eliminates the need to minimize every open program just to go back to the desktop.

7. Unusable Names

For developing a newer version of Windows, Microsoft relies heavily on the previous versions so they don’t have to do everything from the ground up.

Due to this reason, you can’t use the following names for your folders,

CON

AUX

PRN

LPT# (# is a number)

COM#

NUL

CLOCK$

Windows reserves these names for device names. As a result, only Windows can use these names. Using these names will simply pop up an error.

8. SlideTo Shut Down

Next on the list of interesting Windows 10 Easter Eggs, we have the SlideToShutDown EXE file. As the name suggests using this EXE you can instantly shut down your Windows computer.

The EXE is located in the folder C:WindowsSystem32. If you want to use this EXE simply create its shortcut on your desktop and double-click the shortcut to shut down your PC.

Alternatively, on a Windows 10 laptop enable the Tablet mode and press the power button for 3 to 5 seconds to launch SlideToShutDown.

9. Windows 3.1 Explorer from 1992

Ever wondered what the File Explorer in Windows 3.1 looked like? Well, thanks to an easter egg present in Windows 10 you go can go back in time and experience a little trace of File Explorer from 1992.

To check out this easter egg search for the program ODBC Data Source. Once located open it and press the add button. Now select Windows Access Driver and press finish. Lastly under Database, hit Select.

Ta-da, you’re now looking at a slice of Windows history. In excitement, please don’t change any settings in ODBC Data Source.

10. Xbox Game Bar

Xbox Game Bar has to be one of the best feature introduced with Windows 10. With the Xbox Game Bar, you get access to many nifty gaming tools like a resource monitor, one-click gameplay recording, Xbox Social, Spotify playback controls, and many more.

To trigger the game bar simply use the keyboard shortcut Windows+G. Based on your preference you can even select the widgets that you want to be displayed and hide the ones that you don’t like.

In addition to games, the Xbox Game Bar can also be used with normal software and programs.

Phishing domains are spreading Windows 11 installers loaded with Vidar infostealer.

 

According to the cybersecurity firm Zscaler ThreatLabz, threat actors are trying to install info stealing malware on users’ devices through newly registered domains. Zscaler explained that these spoofed domains were first observed in April 2022 and created to distribute “malicious ISO files” (a PE32 binary) disguised as legit MS Windows 11 OS installers.

These malicious files deliver Vidar infostealer on the device. Some of the fake domains registered on 20 April include ms-win11com, win11-servcom, win11installcom, and ms-teams-appnet.

It is worth noting that Vidar malware was previously used in attacks against YouTubers and in a VPN scam in which a fake VPN website was discovered delivering password-stealing malware.

What is Vidar malware?

It is notorious info stealing malware that can perform spying on users. Its primary job is to steal sensitive user data such as operating system information, online accounts credentials, browser history, financial or banking data, and cryptocurrency wallet login details. It is generally distributed via the Fallout exploit kit.

How is Vidar Infostealer Distributed?

Vidar malware is delivered through phishing and attacker-controlled social media networks. ZScaler researchers noted that the Vidar malware variants extract the C2 configuration from these social media channels on the Mastodon networkwo cases examined by Zscaler, attackers created new user accounts and saved C2 server addresses in the profile section on Mastodon and Telegram channels. The same C2 was stored in the Channel Description tab. This helps attackers implant malware on vulnerable devices as these catch C2 configuration from the channels.

According to Zscaler’s blog post, those behind this campaign leverage backdoored versions of legitimate software like Adobe Photoshop and Microsoft Teams to distribute Vidar malware. Though the fake sites appear to be the central download portal, it is the ISO file that does the damage as it hides the malware payload and Themida.

This ISO file contains an unusually large-sized executable (more than 300MB) to avoid detection from anti-viruses. This file is signed with an expired certificate from Avast, and all binaries have been signed by a certificate featuring the same serial number.

Researchers believe that the certificate could be a part of the leaked data when Avast was targeted in October 2019. The ISO files, pretending to be Win 11 installers, also have a GitHub repository that stores the backdoored versions of Adobe Photoshop and other software.

The best strategy to mitigate Vidar malware’s threat is downloading software from official websites and avoiding using cracked or free versions, as these are potential lures for exploitation.

“The threat actors distributing Vidar malware have demonstrated their ability to social engineer victims into installing Vidar stealer using themes related to the latest popular software applications. As always, users should be cautious when downloading software applications from the Internet.”