Serious Discussion Sophisticated hacker bypasses powerful antivirus, how?

[rashmi]

Since these threads constantly appear on MT about being targeted by sophisticated cyberstalkers with all kinds of hackings - and all, more or less - have the same narrative, I tend to think it is all troll posting.

 

[Rov123]

No I am not trolling. I am genuinely targeted for some reason and I do not understand why. This targeting is one major reasons why my mental health has been so wrecked.
Here's something I did today and this is enough to tell you what kind of force I am dealing with.
I went to my local library to use the internet privately, since my entire devices at home are all hacked.
I did searched up the route to the library and location, and saved several photos on my phone, so I believe whoever it is that has been targeting me is aware of this fact.
When I arrived and started to use the computer, they immediately found me there. How? The same harassment as what happened at home.
How do you even explain this? So they hacked into the library too? Is this not starting to sound like APT or some very sophisticated or elite group? Why the ##### am I targeted?
Before going there, I made sure to turn my iPhone to airplane mode, cutting off all connections incase they can track me IRL through my phone. It makes no #####ing sense.

Also they engage in harassments similar to what bazang is doing, one or two words to degrade and dehumanize, "such as still living with mommy & daddy" is very degrading. I haven't been in contact with my parents for over many years and barely talk to any of my family members, I am a loner. Their harassments also made sure of that, that I am isolated and do not engage with anything else with my life aside from focusing on them.

 

[Sorrento]

There have been a fair amount of similar posts on here with similar rhetoric with an insurmountable problem usually involving unknown hackers with greater powers than The Q off Start Trek - The original post shows the member has advanced computer knowledge - I have drawn my own conclusions.

 

[Rov123]

greater powers than The Q off Start Trek

That's a hyperbole and you know it. What these people are doing is very possible, especially if they are a group of elite hackers/cybergang or criminal online that has spent years doing this. The real question you should be asking is why would they target someone like me?
My personal thought or answer for it? This is one of their hobbies. They are criminals online, most likely with cluster B disordered, and has been gaining wealth online as a group, engaging in illegal activities, same and similar descent (asian), and they think they are big dogs and above the world and law, and that they consider themselves very badass and independent, away from their own families and engaging with the world and strangers, so grown up.. Also, one of them resided or grew up in Vancouver BC, and most likely formulated a group originating from there IRL, either through school or other networks.

And one of their side hobbies is people watching and harassments, and I am one of the victims, that's my best guess. Also because I spoke out about them, reported them to FBI, and went against them many times, so they have incentive to really degrade and dehumanize me and revenge so on. Also, because they want to be my friend in the past, but I did not want to, so they get mad I don't want to associate with them.

*ALSO, you cannot claim I am a troll if I am willing to pay money to whoever wants to help me.

 

[bazang]

What these people are doing is very possible, especially if they are a group of elite hackers/cybergang or criminal online that has spent years doing this. The real question you should be asking is why would they target someone like me?

Elite hackers/cybergangs do not target people like you.

This targeting is one major reasons why my mental health has been so wrecked.

The way to solve the problem is not to fight or try to "fix" things to prevent perceived targeting.

The solution is to not let it bother you and stay off your devices. When you let it bother you, you are giving the power to people whom you claim are targeting you. You have to control your own mental and emotional state.

I am genuinely targeted for some reason and I do not understand why.

You stated why - which is that you are active on social media. You state it here:

And one of their side hobbies is people watching and harassments, and I am one of the victims, that's my best guess. Also because I spoke out about them, reported them to FBI, and went against them many times, so they have incentive to really degrade and dehumanize me and revenge so on. Also, because they want to be my friend in the past, but I did not want to, so they get mad I don't want to associate with them.

"such as still living with mommy & daddy" is very degrading.

It is not degrading. Lots of people still live with mommy & daddy. In some cultures children live with their parents their entire lives. There is no shame in it.

If you are a Canadian citizen or reside in Canada, I am guessing that you are a Vancouver downtown Eastside resident.

You have a lot of stuff going on and probably will not find what you are looking for here.

 

[Sandbox Breaker - DFIR]

That's a hyperbole and you know it. What these people are doing is very possible, especially if they are a group of elite hackers/cybergang or criminal online that has spent years doing this. The real question you should be asking is why would they target someone like me?
My personal thought or answer for it? This is one of their hobbies. They are criminals online, most likely with cluster B disordered, and has been gaining wealth online as a group, engaging in illegal activities, same and similar descent (asian), and they think they are big dogs and above the world and law, and that they consider themselves very badass and independent, away from their own families and engaging with the world and strangers, so grown up.. Also, one of them resided or grew up in Vancouver BC, and most likely formulated a group originating from there IRL, either through school or other networks.

And one of their side hobbies is people watching and harassments, and I am one of the victims, that's my best guess. Also because I spoke out about them, reported them to FBI, and went against them many times, so they have incentive to really degrade and dehumanize me and revenge so on. Also, because they want to be my friend in the past, but I did not want to, so they get mad I don't want to associate with them.

*ALSO, you cannot claim I am a troll if I am willing to pay money to whoever wants to help me.

I can do a compromise assessment for you and help lock you down. I charge but let me know if interested.

 

[simmerskool]

Since these threads constantly appear on MT about being targeted by sophisticated cyberstalkers with all kinds of hackings - and all, more or less - have the same narrative, I tend to think it is all troll posting.

yes, I agree, I posted only after I saw some of our normal and experienced users offering suggestions.

 

[Victor M]

Put up a good fight. Do as @RoboMan says. If you don't know how to do it then pay @Sandbox Breaker - DFIR and let him help you. You can't expect to live 'a normal life' as if the hackings didn't happen. And it will continue if you don't do anything.

I am a bit indifferent as to whether it is a troll posting. It pulled together our combined forces and offered great help. It will be useful to those victims who don't post and just browse for help.

If @Rov123 can't afford to pay, I wonder what @Andy Ful would say if he were to use WHH Hard_Configurator/WindowsHybridHardening/Readme.md at master · AndyFul/Hard_Configurator to counter hacking. Or should he use his GitHub - AndyFul/Hard_Configurator: GUI to Manage Software Restriction Policies and harden Windows Home OS ? Since I remember vaguely that he has a particular definition for 'home user' and their risks. So maybe his software might not be a good fit here.

And @Rov123, you did not respond to a malware forum removal thread. A fix was offered to remove things from your infected PC. Since your PC is currently infected, post a message again in the malware removal forum and DO FOLLOW THRU.

 

[Andy Ful]

The author of this thread posted about possible crime. The best thing would be to hire a detective (to gather information about the attacker) or call the police. I am unsure if he has sufficient skills to apply the required protection following the advice from MT members. He probably needs to hire a professional to do it.

 

[i7ii]

How hard is it to do this? Does anyone knows? In the hacker's POV, you are essentially up against a team of skilled cybersecurity engineers that created those AV solutions, EDR solutions, operating system, firewall, router, etc. And you're able to bypass them all.

I'm 41 years old ffs, used to talk like that about other people when i was freaking kid, like: thinking Bruce Lee is the most powerful fighter - that he could beat an army alone - the God like being that he is among us mortal humans. Similar to OS development - he borrowed and reinvented a lot of martial arts moves - till with the help of media he became the most known martial arts fighter in the whole world. Again, with a kid's mind - who could foresee someone being able to beat Bruce Lee - even as an army of fighters - let alone 1 on 1?! But with time, while growing older - i started to wise-up about this BS worldwide marketing/propaganda - and coincidentally - around that time "the Chuck Norris memes became a thing". And that's basically how your post sounds like - while talking about this - so called skilled cybersecurity engineers and all the other devs who left their mark in the IT industry - with the products they released.

The answer and the reality of to your black hats hacking dilemma is rather simple: most of this people you hold in high regard "are just normal people - who had a passion for computers, for software and the way it works". Some are indeed geniuses (grasping things and the way the work faster and easier than others) - but even those are still humans (have their limits to what they can do). Point being, the majority learn from others - but the IT World is still a new thing - new tech (be it cyber/virtual or physical hardware) - that's constantly changing and evolving - while what this cybersecurity engineers know/understand (same goes for OS devs) - is borrowed from older knowledge (way of doing things). Simply put - they struggle to keep up with the times. While kids born with a smartphone/tablet in their hand - who develop their thinking around this gadgets - if they form a passion for black hat hacking (just because it's deemed as cool) - they can learn from the internet all the new ways to bypass this securities - "based on all the new exploits discovered recently (even among private black hat communities) - exploits whit the white hat hackers - might discover a month latter - place a label on them as Zero Day Exploits But discovering them is one thing "and patching them - is another (takes both time and awareness). Even Microsoft - they discover a vulnerability in June 2023 - and they patch it in January 2024. That's 6 months - when it can be exploited.

To make things worst - all this new ways developed to counter possible cybersecurity holes - end-up creating issues or even posing a risk themselves. Such is the case with Kernel-Level Security (and all its security features). After all, after the CrowdStrike fiasco - Microsoft even announced a desire to cut the plug and ban Kernel level access. Funny thing is, this days even Game developers - released Kernel-Level Anti-Cheats (here's a good article covering this subject). And let's not forget - we entered the age of A.I. Which, sure, could help in terms of security - but A.I. tool are also developed for harm (especially by governmental agencies - aiming to spy and breech the security of other governments). Still, for a home user (one of the masses) - kids hold a higher risk (breaching securities for fun). Same can be said about - the scamming industry (which at this point - actually is a major and widely spread industry) - who promote their "business models" on the most popular Social Media platforms - like Facebook and IG (whom are more concerned with profits - than the legitimacy of any customer renting virtual space on their platform - to spreads adds).

Long story short: in 2025 - cyber security is a game of make belief, where we're simply pretending to be secure. All this security solutions work - till they don't. Even so, they're ways to limit the (financial) damage anyone could cause. Sure, it helps to be a poor nobody (so you won't catch anyone's interest) - who struggles to survive (you'd be a cyber criminal most unfortunate target - to waste its time breaching your system and getting a hold of your credit card details - only to find out... you have 7.20 $ on your account). But if you have enough money to spare - buy a PC just for shopping and use it only on legitimate sites (banking & shopping), don't mix it with your home PC used for anything else. It's easier to target a system that's consonantly (or most of the time) on the internet, that's active on social media and most of the other sites. Yet kinda hard to target a system - used only for banking or on major shopping sites (unless you're using Public Wi-Fi to access the internet - which is basically self-sabotage - like walking with a "Scam Me Please" sign on top of your head).

 

[bazang]

Long story short: in 2025 - cyber security is a game of make belief, where we're simply pretending to be secure. All this security solutions work - till they don't.

For those that do not want to do what is required and live in denial, cyber security is a game.

Cyber security at a very high level is achievable, but it requires doing things that typical people just do not want to do or do not know what to do.

For one it requires locking users out of their systems and not allowing them to do a lot of things that they do now.

Then again, it is a moot point because securing a user's localhost only provides a tiny modest improvement in security whenever the user's (and their family's) most valuable personal data has been stolen many times from third parties and lies on the dark web for anyone to get and abuse. The only thing that protects users is the fact that threat actors have a difficult time - logistically - turning tens of billions of personal data records into a financial windfall. Instead they send scammer emails threatening to dump videos of you fapping to porn to your mom & dad if you don't pay them 0.1 Bitcoin.

Malware and direct hacking of home users has not been the greatest threat for over a decade and yet there are places like this where people obsess about protecting their digital devices as if they have the nuclear launch codes of China, Russia and the US on them. Meanwhile the average forum user does not even have 125 Euros in savings, let alone a bank account for hackers to target.

 

[i7ii]

Cyber security at a very high level is achievable, but it requires doing things that typical people just do not want to do or do not know what to do.

For one it requires locking users out of their systems and not allowing them to do a lot of things that they do now.

Already covered that part (in my previous post). But there's also projects like: Qubes OS: A reasonably secure operating system - where one could play the cyber security game at a different level. Feasible, but not "comfortable enough" - to be used even by people who are aware of its cyber security potential (even tho, all it takes is practice - after all - humans are creatures of habit: same way they learned to be lazy - "by practice" - they can also learn to be more active - "by practice"). Same can't be said about most "home users (who aim/yearn only for comfort - and highest level of ignorance - where stuff just works with minimum effort and preferably no understanding whatsoever - how it works and what it involves). And that's why it's so "fashionable" to play pretend - in more ways than one (there's more to I.T. ignorance - than cyber security, i mean... "Apple" - this word alone says more than enough).

Then again, it is a moot point because securing a user's localhost only provides a tiny modest improvement in security whenever the user's (and their family's) most valuable personal data has been stolen many times from third parties and lies on the dark web for anyone to get and abuse. The only thing that protects users is the fact that threat actors have a difficult time - logistically - turning tens of billions of personal data records into a financial windfall. Instead they send scammer emails threatening to dump videos of you fapping to porn to your mom & dad if you don't pay them 0.1 Bitcoin.

Darkweeb is a place of taboos and insanity, but c'mon - a lot of that stuff ends-up on the public side of the internet. Maybe 4chan is controversial enough to be deemed "darkWeeb-like" but it's a public domain. Even tho, many Black Hat hatters - were smart enough to find their way around a multitude of systems and their vulnerabilities - they're still human - still acting from a place of pride and rather stupid about it too... since their hacked/breached content - ends up all over the internet and quite easy to be found - even with the most popular public search engine (Google). Such was the case with the infamous iCloud leak known as " The fappening (or Celebgate)".

And here's some of the qulity please:

"In March 2016, 36-year-old Ryan Collins of Lancaster, Pennsylvania, agreed to plead guilty to one count of unauthorized access to a protected computer to obtain information resulting in an 18-month sentence. While no victims were named in the court documents, numerous media outlets connected Collins' case to the breach. During the investigation, it was found that Collins phished by sending e-mails to the victims that looked like they had been sent by Apple or Google, warning the victims that their accounts might be compromised and asking for their account details. The victims would enter their passwords, and Collins gained access to their accounts, downloading e-mails and iCloud backups.[69] In October 2016, Collins was sentenced to 18 months in prison.

In August 2016, 28-year-old Edward Majerczyk of Chicago, agreed to plead guilty to a similar phishing scheme, although authorities believe he worked independently and he was not accused of selling the images or posting them online. On January 24, 2017, Majerczyk was sentenced to nine months in prison and was ordered to pay $5,700 in restitution to cover the counseling services of one unnamed celebrity victim.

Emilio Herrera, also from Chicago, had first been named in the press in 2014;he pleaded guilty to one count of unauthorized access to a protected computer to obtain information in October 2017. Herrera had accessed the accounts of unnamed celebrities and others but was not accused of being involved in leaking or sharing the photos and videos he obtained. He was sentenced to 16 months in jail in March 2018.

In April 2018, 26-year-old George Garofano of North Branford, Connecticut, pleaded guilty to one count of unauthorized access to a protected computer to obtain information. Garofano's attorney said he had been led into the phishing scheme by criminals. On August 29, 2018, a federal court sentenced Garofano to eight months in prison.

On October 22, 2018, Christopher Brannan, a former Virginia teacher, became the fifth man to be convicted in relation to the hacking. Brannan pled guilty to federal charges of aggravated identity theft and unauthorized access to a protected computer. Through a phishing expedition[further explanation needed], he hacked more than 200 people. In addition to his celebrity victims, Brannan targeted his underage sister-in-law, as well as teachers and students at the school where he used to teach. Brannan was sentenced to 34 months in prison on March 1, 2019."

But those are just random black hat hackers, which brings me to the next point...

Malware and direct hacking of home users has not been the greatest threat for over a decade and yet there are places like this where people obsess about protecting their digital devices as if they have the nuclear launch codes of China, Russia and the US on them. Meanwhile the average forum user does not even have 125 Euros in savings, let alone a bank account for hackers to target.

You couldn't be further from the truth/reality (objective - that is). 10 years ago cyber criminality - was barely laying its foundation (did impact a lot of people even them - but the ones involved were rather messy at it - mostly annoying for a lack of better words). While now it's a highly developed and globally expanded industry. There's quite literally people - who get in the morning at 5, and "work (as an actually job - where they get paid based on performance)" 10 to12 hours a day (if not more) - scamming people. Even more than that, this are not people - who found their passion for computers and have more than a decade of studies and practice in the I.T. field. Not at all, rather average it - they were simply trained to use some tools developed for breaching vulnerable systems (as it's the case with the majority - of home computers).

Side note: You are aware, that most OEMs drop support for security updates - on quite a lot of I.T. systems and gadgets - which barely got out of warranty (2 or 3 years since release)? So, you're not even getting a basic level of security - which can bypass so many 3rd party cyber security solutions. Such is the case with Intel's Management Engine. Whom, made public most of the currently known vulnerabilities: Intel® Converged Security and Management Engine Version Detection Tool (Intel® CSMEVDT) And yet, with OEMs - if their products was not released in last 3 years or so - there's quite a high probability for that given product to lack a patched firmware - covering the current known vulnerabilities. Same goes for most mobile devices.

Anyway, 10 years ago - took a bit more skill, and a bit more work to be targeted and hacked. While this days - whit the cyber criminals industry expanding 100 folds (or maybe 1000 fold) - and whit direct hacking became so accessible (to actual amateurs) - hacking home users has never been easier (happens quite often - so hey, you'll get your turn). All it takes this days is a phone call (no annoying malware and its pop-up warnings and such) - all you have to do is answer a phone call and your device is breached. And that, by a freaking amateur - who was trained to use an app similar to an office user trained to use Excel. But hey, believe what you want - tho, i can also agree - that it's not worth worrying - even if it can happen (quite similar to any real life criminal who could hurt you in some way - even tho, it's simpler in the virtual world).

Just my 2 cents.

 

[bazang]

Qubes OS: A reasonably secure operating system

Even "advanced" users here cannot handle Qubes OS.

Darkweeb is a place of

It is attracting more and more one-person and small-team malicious actors, especially with the sale of malware as a service (MaaS), ransomware as a service (RaaS), and other capabilities. But these are small fry and do not pose a massive threat globally.

You couldn't be further from the truth/reality (objective - that is). 10 years ago cyber criminality - was barely laying its foundation (did impact a lot of people even them - but the ones involved were rather messy at it - mostly annoying for a lack of better words). While now it's a highly developed and globally expanded industry.

The shotgun malware campaigns of decades ago trying to infect any connected internet user are not the primary types of campaigns nowadays. Threat actors are more focused and want better return on their effort than hacking an MT member based in India who has 5 Euros on a pre-paid bank card or an South American with 125 Euros in an unconnected bank account.

If malware campaigns are going to be global in scale, then they will target exploitable operating systems and widely-distributed application code - none other than Windows and Android - with network stack and kernel exploits - a la WannaCry and HummingBad. But those kinds of campaigns are one-offs and happen rarely.

It is a waste of time to excessively worry about protecting localhost and hardening the home network in well-off financially Europe, North America, Japan, Australia, Singapore, Brunei, the Arab Gulf states, etc. People in those nations are better off doing the things which actually provide very robust protections against digital criminals such as locking-down their credit files/lines of credit, constantly reviewing their credit files, placing fraud alerts on their credit files, continuously scrutinize their bank accounts, use off-line banking (have to walk into a bank to transact), use a limited amount-capped bank account, low limit pre-paid debit or credit card for online transactions [example Amazon], never use debit cards where possible/always use credit cards with all protections enabled (the consumer has to know what these are and request them to be enabled), use 2 and 3 MFA on all accounts, and other things. And the thing that nobody except old people seem capable of doing - never, ever, EVA! - use mobile phone apps (Android in particular) for ANY transactions. Period.

But even with all of that, all that juicy user data on third, fourth, fifth, sixth, seventh party data processes and holders makes the greedy criminals (and nation-states) drool like beasts in heat. Attracts the criminals like vultures to a kill. So that is what these criminals target. The ones sending phishing emails from their mommy & daddy's basement or some Nigerian Net Cafe are a minor threat. Now it is the automated botnets and sophisticated highly-protected hosted criminal platforms that spam the four corners of the Earth. AV and localhost hardening is not going to protect against phishing sites that are up for only 60 minutes or less. The user has to be able to identify what is happening in an email.

Then robocalls and other voice call scammers - that takes educating people against such campaigns. Not installing AV.

99% or more of people have little visibility and knowledge of what to do, how to protect themselves in the digital economy. Their nations and governments have failed them. Society has failed them. The education system has failed them. Device manufacturers have failed them. Operating System publishers have failed them. Application software publishers of every single type have failed them. The banking system and corporations have failed them (particularly in nations where banking is only available to the comparatively well-off, such as India).

Security is not software. It is a process. It requires a top-down approach and that only happens if it is a top national priority. It requires heavy-handed regulations, very intrusive regulations (such as registering devices) and monitoring, internet and device police going around checking devices everywhere, holding the non-compliant (governments themselves, corporations, OEM manufacturers, software developers, other institutions, and the people) accountable, and would be extremely expensive. More expensive globally than 10X that insane US defense budget. There has to also be a willingness for nations to disengage from cyberwar and to wage physical war against nation-states who are significant contributors to the global malware problem.

Want a malware free world? That's what it would take and more.

Digital security is far more problematic than public health. The public health policy makers have to deal with billions of people. At that scale, they just let people do what they want. Same applies to any other thing at that scale - such as digital security. These are insidious, ineffective societal models that achieve virtually nothing while wasting vast sums of money.

Can you imagine every government in the world requiring citizens to regularly weigh-in, obtain body composition scans, and forcing them to comply with healthy lifestyles or else? Take away people's Magic Masla, Coca Cola, and Oreos. That would be far worse than killing-off all social media. There would be global revolts and riots.

Now imagine taking away highly insecure things that people do digitally. A close second would be preventing those same citizens from doing most of what they can do today on most any digital device? Block porn? Even babies in cribs will jump off and grab an AK-47 to join the global mutiny if free, highly insecure porn sites are taken away.

Because people are people, there is far too much emphasis on the easy, software way = software as security ("Install AV and 'You are Protected'). Not enough educating people the world over on multi-device and financial system consumer protections and security. There is entirely inadequate education of "This is malicious," and "You need to stop doing this...".

Doctor: "Oh you're 300 kilos overweight with a body fat ratio of 90%, but you're OK. People at any body mass and composition can be healthy."

That sort of thing happens in the digital world with regards to security.

But given that I have seen people (users) in action across the globe over the past twenty years, I can tell everyone that all of them are as much of a problem as the society not educating part. How do you teach and educate people in third world nations who cannot read or even a basic functional education system? How do you do this when there is no money to educate them? How to you do it when there is war or their daily objective is feeding themselves and their families? What do you do when they just don't care about security (if there are available resources to educate them or not)?

 

[TairikuOkami]

*ALSO, you cannot claim I am a troll if I am willing to pay money to whoever wants to help me.

I am sorry to say, but no one can help you, it is not a simple solution, unless you hire someone to monitor your activities 24/7, it can not be helped.

I went to my local library to use the internet privately, since my entire devices at home are all hacked.

I guess you are one of those people, who "beg" to be hacked. Smart devices are great, in theory, in reality there are people, who love to hack them.
For starters, do not allow local smart devices to connect to the internet, make only one device, a local network, as the hub, and protect it at all cost.

To sum it up, take a hike, disconnect for a week, those hackers will get bored and they will move on. They are just stupid kids with nothing better to do.

 

[Studynxx]

I'm not sure how to contribute to this discussion, but I will say that default-deny, zero-trust and using one's brains to avoid social engineering attacks are the way to live.

 

[Studynxx]

I am sorry to say, but no one can help you, it is not a simple solution, unless you hire someone to monitor your activities 24/7, it can not be helped.

I guess you are one of those people, who "beg" to be hacked. Smart devices are great, in theory, in reality there are people, who love to hack them.
For starters, do not allow local smart devices to connect to the internet, make only one device, a local network, as the hub, and protect it at all cost.

To sum it up, take a hike, disconnect for a week, those hackers will get bored and they will move on. They are just stupid kids with nothing better to do.

For smart devices, I'd put them on an entirely separate VLAN that's isolated from the rest of the network, and thus, VLANs.

 

[Sorrento]

My long gone father gave me some good advice over 50 years go - 'The people you associate with will affect your life & your happiness, so choose people with good values & ethics' - I feel that was true in real life & just as relevant now in so called internet 'friends' - We have choices.

 

[i7ii]

Even "advanced" users here cannot handle Qubes OS.


It is attracting more and more one-person and small-team malicious actors, especially with the sale of malware as a service (MaaS), ransomware as a service (RaaS), and other capabilities. But these are small fry and do not pose a massive threat globally.


The shotgun malware campaigns of decades ago trying to infect any connected internet user are not the primary types of campaigns nowadays. Threat actors are more focused and want better return on their effort than hacking an MT member based in India who has 5 Euros on a pre-paid bank card or an South American with 125 Euros in an unconnected bank account.

If malware campaigns are going to be global in scale, then they will target exploitable operating systems and widely-distributed application code - none other than Windows and Android - with network stack and kernel exploits - a la WannaCry and HummingBad. But those kinds of campaigns are one-offs and happen rarely.

It is a waste of time to excessively worry about protecting localhost and hardening the home network in well-off financially Europe, North America, Japan, Australia, Singapore, Brunei, the Arab Gulf states, etc. People in those nations are better off doing the things which actually provide very robust protections against digital criminals such as locking-down their credit files/lines of credit, constantly reviewing their credit files, placing fraud alerts on their credit files, continuously scrutinize their bank accounts, use off-line banking (have to walk into a bank to transact), use a limited amount-capped bank account, low limit pre-paid debit or credit card for online transactions [example Amazon], never use debit cards where possible/always use credit cards with all protections enabled (the consumer has to know what these are and request them to be enabled), use 2 and 3 MFA on all accounts, and other things. And the thing that nobody except old people seem capable of doing - never, ever, EVA! - use mobile phone apps (Android in particular) for ANY transactions. Period.

But even with all of that, all that juicy user data on third, fourth, fifth, sixth, seventh party data processes and holders makes the greedy criminals (and nation-states) drool like beasts in heat. Attracts the criminals like vultures to a kill. So that is what these criminals target. The ones sending phishing emails from their mommy & daddy's basement or some Nigerian Net Cafe are a minor threat. Now it is the automated botnets and sophisticated highly-protected hosted criminal platforms that spam the four corners of the Earth. AV and localhost hardening is not going to protect against phishing sites that are up for only 60 minutes or less. The user has to be able to identify what is happening in an email.

Then robocalls and other voice call scammers - that takes educating people against such campaigns. Not installing AV.

99% or more of people have little visibility and knowledge of what to do, how to protect themselves in the digital economy. Their nations and governments have failed them. Society has failed them. The education system has failed them. Device manufacturers have failed them. Operating System publishers have failed them. Application software publishers of every single type have failed them. The banking system and corporations have failed them (particularly in nations where banking is only available to the comparatively well-off, such as India).

Security is not software. It is a process. It requires a top-down approach and that only happens if it is a top national priority. It requires heavy-handed regulations, very intrusive regulations (such as registering devices) and monitoring, internet and device police going around checking devices everywhere, holding the non-compliant (governments themselves, corporations, OEM manufacturers, software developers, other institutions, and the people) accountable, and would be extremely expensive. More expensive globally than 10X that insane US defense budget. There has to also be a willingness for nations to disengage from cyberwar and to wage physical war against nation-states who are significant contributors to the global malware problem.

Want a malware free world? That's what it would take and more.

Digital security is far more problematic than public health. The public health policy makers have to deal with billions of people. At that scale, they just let people do what they want. Same applies to any other thing at that scale - such as digital security. These are insidious, ineffective societal models that achieve virtually nothing while wasting vast sums of money.

Can you imagine every government in the world requiring citizens to regularly weigh-in, obtain body composition scans, and forcing them to comply with healthy lifestyles or else? Take away people's Magic Masla, Coca Cola, and Oreos. That would be far worse than killing-off all social media. There would be global revolts and riots.

Now imagine taking away highly insecure things that people do digitally. A close second would be preventing those same citizens from doing most of what they can do today on most any digital device? Block porn? Even babies in cribs will jump off and grab an AK-47 to join the global mutiny if free, highly insecure porn sites are taken away.

Because people are people, there is far too much emphasis on the easy, software way = software as security ("Install AV and 'You are Protected'). Not enough educating people the world over on multi-device and financial system consumer protections and security. There is entirely inadequate education of "This is malicious," and "You need to stop doing this...".

Doctor: "Oh you're 300 kilos overweight with a body fat ratio of 90%, but you're OK. People at any body mass and composition can be healthy."

That sort of thing happens in the digital world with regards to security.

But given that I have seen people (users) in action across the globe over the past twenty years, I can tell everyone that all of them are as much of a problem as the society not educating part. How do you teach and educate people in third world nations who cannot read or even a basic functional education system? How do you do this when there is no money to educate them? How to you do it when there is war or their daily objective is feeding themselves and their families? What do you do when they just don't care about security (if there are available resources to educate them or not)?

Walls of text infused with verbal diarrhea - where part of the statements are clearly subjective and void of reality (even contradicting yourself - which is also ironic - since your contradictions are proving my previous points) - is highly unproductive (pure wasted time). Seriously, even increasing the font and using bold text.... Which again, it's highly ironic in a contradictory way - after making it sound like we're living in a cyber-utopia for past decade:

Malware and direct hacking of home users has not been the greatest threat for over a decade

Which is way way way way way to farfetched from objective reality.

Maybe that's true for your subjective reality - i don't know the extents of your personal life for past decade - nor do i care (highly irrelevant for the subject in question), but it's highly egocentric - to make such general assumptions for the rest of the world. Who knows, maybe in your personal world A.I. is still a comic book fantasy, while in objective reality - it's an active phenomenon - even a new age of technological advancements (impacting hacking as well). And since i mentioned A.i. - we also have public access to such tools and thus, we can get detailed and accurate objective responses. Here's such answer for your decade old dilemma for example - since it's also on-topic:

Hacking has evolved significantly from 2015 to 2025, with advancements in both attack techniques and defensive technologies. Here's a comparison of the key changes over the decade:

1. Tech Landscape Evolution​

• 2015:
  • Focus on traditional exploits: Vulnerabilities like SQL injection, cross-site scripting (XSS), and buffer overflows were still common. Most attacks were aimed at exploiting known vulnerabilities in widely used software like web applications, operating systems, and browsers.
  • Ransomware: The emergence of ransomware began to gain attention, though it was not as sophisticated as it is now.
  • Lack of widespread cloud adoption: Cloud computing was growing, but many businesses still relied heavily on on-premises servers and networked systems.
• 2025:
  • Cloud and IoT: The increase in cloud computing, hybrid IT environments, and the IoT (Internet of Things) has led to new vulnerabilities. Hackers now exploit poorly secured smart devices, cloud misconfigurations, and APIs as primary targets.
  • Zero Trust models: Security strategies have evolved towards a Zero Trust architecture, focusing on identity, user behavior, and continuous monitoring rather than simply relying on network perimeter security.
  • AI-powered hacking: AI and machine learning are now used in both attack and defense, with hackers leveraging these technologies to automate and optimize attacks, and defenders using them to detect patterns or unusual behaviors.

2. Advanced Hacking Techniques​

• 2015:
  • Social Engineering and Phishing: Phishing remained a common method for gaining access to sensitive data or infiltrating networks. Techniques like spear-phishing (targeted, customized phishing) were on the rise.
  • Exploiting vulnerabilities in widely used software: Attackers would exploit flaws in operating systems, browsers, and CMS systems (like WordPress), or use outdated software with known vulnerabilities.
  • Distributed Denial of Service (DDoS): DDoS attacks were frequent, especially targeting large organizations and governmental bodies. Attackers often used botnets like Mirai for large-scale attacks.
  • Advanced Persistent Threats (APTs): Nation-state actors and well-funded hacker groups were targeting specific organizations for long-term espionage or data theft.
• 2025:
  • AI-Driven Phishing and Deepfakes: Social engineering is now hyper-targeted with the use of AI tools that automate phishing attempts, adapt to responses, and create realistic deepfakes (audio and video) to manipulate victims into providing credentials or making financial transfers.
  • Zero-Day Exploits: The number of zero-day exploits has increased due to the growing complexity of software and the advanced nature of modern applications. Hackers can also exploit vulnerabilities in open-source software, which is used widely across enterprises.
  • Ransomware as a Service (RaaS): Ransomware has evolved into a service offered by cybercriminals, allowing non-technical criminals to launch sophisticated attacks. Modern ransomware now uses double or triple extortion techniques, where hackers steal data, threaten to release it, and then demand payment to decrypt it.
  • AI-Powered Malware: AI is used to develop malware that can adapt to evade traditional security systems. These malware programs can learn from each environment they infect and optimize themselves to bypass detection.
  • Cloud Attacks and Misconfiguration Exploits: Hackers now target cloud misconfigurations, leveraging the complexity and scale of cloud environments to launch attacks, particularly exploiting weak permissions, improper isolation between cloud services, and unsecured cloud storage.

3. Attack Vectors​

• 2015:
  • Web-based vulnerabilities: Attackers frequently targeted web servers using vulnerabilities like cross-site scripting (XSS), SQL injection, and remote code execution.
  • Malware: The traditional methods of distributing malware (via email attachments, malicious websites, or compromised software) were prevalent.
  • Weak password-based attacks: Password spraying, brute-forcing, and credential stuffing were still commonly used to gain unauthorized access.
• 2025:
  • Cloud-based breaches: With the widespread use of cloud storage and SaaS platforms, cloud-based breaches (like AWS, Azure, Google Cloud) have become common. Misconfigurations are a top target, as well as exploiting weak authentication systems.
  • Supply Chain Attacks: Attacks like the SolarWinds breach (2020) have led to a rise in targeting third-party suppliers or software dependencies to gain access to multiple organizations. This includes compromising updates or injecting malicious code into trusted software.
  • AI/ML Infiltration: As organizations adopt machine learning for various functions, AI-driven attacks may target machine learning models themselves, potentially poisoning data to influence decision-making or steal intellectual property.

4. Targeted Sectors​

• 2015:
  • Finance and Healthcare: These sectors were prime targets for cybercriminals due to the sensitive financial and personal information they held.
  • Small and Medium Enterprises (SMEs): SMEs were increasingly targeted with ransomware, DDoS, and data theft, often because they lacked the resources for advanced cybersecurity measures.
  • Governmental entities: Nation-state actors targeted government agencies, especially for espionage or disrupting political systems.
• 2025:
  • Critical Infrastructure: Hackers now target critical infrastructure like energy grids, transportation systems, and manufacturing (especially with industrial control systems - ICS). These are increasingly vulnerable to cyberattacks.
  • Healthcare and Biotech: The healthcare industry has seen more sophisticated attacks, including on biotech companies, pharma research, and hospital networks, particularly targeting vaccine research or intellectual property related to health technologies.
  • Big Tech and Data Brokers: With vast amounts of data being handled by major tech companies, their systems and the associated data brokers are now prime targets for data theft, sabotage, and espionage.

5. Defensive Technologies​

• 2015:
  • Antivirus and Firewalls: Traditional methods like signature-based antivirus, network firewalls, and intrusion detection/prevention systems (IDS/IPS) were the standard defenses.
  • Encryption: SSL/TLS encryption was used, though not always universally implemented.
• 2025:
  • Behavioral Analytics and AI-driven Defense: AI and machine learning are now used to monitor user behavior and network traffic in real time, flagging anomalous behavior that could indicate an attack. Systems are now more adaptive to unknown threats.
  • Next-Gen Firewalls and Intrusion Prevention Systems: Next-gen firewalls now include deep packet inspection and integrate threat intelligence feeds for real-time detection and prevention of advanced attacks.
  • Deception Technologies: Honeypots and deception technologies are being used to mislead and divert attackers away from real systems and gather intelligence on their techniques.
  • End-to-End Encryption and Advanced Authentication: Encryption standards have evolved, and there is now a strong push for end-to-end encryption on messaging platforms, along with advanced multi-factor authentication (MFA) systems (including biometric data).

Conclusion​

In essence, hacking has become more advanced, automated, and integrated with artificial intelligence. Attackers can now deploy more sophisticated, targeted, and stealthy attacks, leveraging new vulnerabilities in emerging technologies like the cloud, IoT, and AI. Defenders are responding with advanced threat detection, real-time analytics, and adaptive defenses, but the race between attackers and defenders continues to escalate.

 

[Sandbox Breaker - DFIR]

What a clown show

 

[bazang]

Walls of text infused with verbal diarrhea - where part of the statements are clearly subjective and void of reality (even contradicting yourself - which is also ironic - since your contradictions are proving my previous points) - is highly unproductive (pure wasted time). Seriously, even increasing the font and using bold text.... Which again, it's highly ironic in a contradictory way - after making it sound like we're living in a cyber-utopia for past decade:

You bothered to read it and respond. Complete waste of time. My facts are straight and based upon credible, reliable, real-world attack and malware campaign statistics. Not theory and technobabble from the cybersec marketing presses.

I work for a government. I have all the threat feeds and statistics from sensors throughout the global infrastructure. Those feeds and statistics from userland show that attacks on home users are so 2001.

Of course hackers have more sophisticated tools. Those tools cost more. Therefore, hackers - except for the script kiddies - target much more lucrative systems - which ain't home user systems. The payoff for a successful enterprise hack is 100X greater than the typical home hack - unless the threat actor manages to compromise a Bitcoin Whale's system and that whale is stupid enough to not store their Bitcoin in disconnected cold storage.

Hacking is a numbers game targeting high-value, lucrative targets. Home user localhost ain't it.

Try harder. You're just feeding the paranoid pigeons trying to protect their porn fapping archives.