Weekly Threats: Ransomware Betrayals, WhatsApp RATs, and More

Ransomware affiliates are turning on their own gangs, while attackers are leaving servers exposed with tools and intrusion traces. Malicious code has been found in developer packages and extensions, and phishing emails are using familiar online services to appear legitimate. Basic file upload flaws and weak session cookies are also enabling attacks. AI assistants are now targeted with phishing messages containing hidden instructions. The gap between effort and results in cyber attacks is notable, with some requiring complex multi-stage processes and others exploiting simple design flaws. Key incidents include malicious VS Code themes, the BraZetsu C2 infrastructure, a WhatsApp-delivered Windows RAT, and a Qilin ransomware suspect extradited to Germany.