VP.NET Launches SGX-Based VPN to Transform Online Privacy  The virtual private network market is filled with countless providers, each promising secure browsing and anonymity. In such a crowded space, VP.NET has emerged with the bold claim of changing how VPNs function altogether. The company says it is “the only VPN that can’t spy on you,” insisting that its system is built in a way that prevents monitoring, logging, or exposing any user data.  To support its claims, VP.NET has gone a step further by releasing its source code to the public, allowing independent verification. VP.NET was co-founded by Andrew Lee, the entrepreneur behind Private Internet Access (PIA). According to the company, its mission is to treat digital privacy as a fundamental right and to secure it through technical design rather than relying on promises or policies. Guided by its principle of “don’t trust, verify,” the provider focuses on privacy-by-design to ensure that users are always protected.  The technology behind VP.NET relies on Intel’s SGX (Software Guard Extensions). This system creates encrypted memory zones, also called enclaves, which remain isolated and inaccessible even to the VPN provider. Using this approach, VP.NET separates a user’s identity from their browsing activity, preventing any form of link between the two.  The provider has also built a cryptographic mixer that severs the connection between users and the websites they visit. This mixer functions with a triple-layer identity mapping system, which the company claims makes tracking technically impossible. Each session generates temporary IDs, and no data such as IP addresses, browsing logs, traffic information, DNS queries, or timestamps are stored.  VP.NET has also incorporated traffic obfuscation features and safeguards against correlation attacks, which are commonly used to unmask VPN users. In an effort to promote transparency, VP.NET has made its SGX source code publicly available on GitHub. By doing so, users and researchers can confirm that the correct code is running, the SGX enclave is authentic, and there has been no tampering. VP.NET describes its system as “zero trust by design,” emphasizing that its architecture makes it impossible to record user activity.  The service runs on the WireGuard protocol and includes several layers of encryption. These include ChaCha20 for securing traffic, Poly1305 for authentication, Curve25519 for key exchange, and BLAKE2s for hashing. VP.NET is compatible with Windows, macOS, iOS, Android, and Linux systems, and all platforms receive the same protections. Each account allows up to five devices to connect simultaneously, which is slightly lower than competitors like NordVPN, Surfshark, and ExpressVPN. Server availability is currently limited to a handful of countries including the US, UK, Germany, France, the Netherlands, and Japan.  However, all servers are SGX-enabled to maintain strong privacy. While the company operates from the United States, a jurisdiction often criticized for weak privacy laws, VP.NET argues that its architecture makes the question of location irrelevant since no user data exists to be handed over.  Despite being relatively new, VP.NET is positioning itself as part of a new wave of VPN providers alongside competitors like Obscura VPN and NymVPN, all of which are introducing fresh approaches to strengthen privacy.  With surveillance and tracking threats becoming increasingly sophisticated, VP.NET’s SGX-based system represents a technical shift that could redefine how users think about online security and anonymity.

VP.NET Launches SGX-Based VPN to Transform Online Privacy #DataSafetyUserData #enhanceduserprivacy #OnlinePrivacy

Telegram’s Alleged Ties to Russian Intelligence Raise Global Surveillance Fears  A new investigation by Russian media outlet Important Stories, in collaboration with the Organized Crime and Corruption Reporting Project (OCCRP), has sparked fresh scrutiny over Telegram’s connections to Russia’s intelligence services. The popular messaging platform, long regarded for its privacy features, may have indirect links to the Russian Federal Security Service (FSB), raising significant concerns for users worldwide. At the center of the probe is a company called Global Network Management (GNM), which plays a critical role in routing Telegram’s messages. Although GNM is officially incorporated in the Caribbean nation of Antigua and Barbuda, it operates primarily from Russia. Its owner, Vladimir Vedeneev, is a Russian engineer with long-standing ties to Telegram founder Pavel Durov. Legal filings show that Vedeneev is the only individual authorized to manage certain Telegram servers, including those based in the U.S.  Vedeneev also runs other firms—such as Globalnet and Electrontelecom—that reportedly supply telecommunications infrastructure to various Russian state entities, including the FSB. These companies have been linked to classified government projects involving surveillance and defense.  The IP addresses used by Telegram used to be owned by Russian firms with FSB affiliations. These IPs still appear to be registered in Russia, and might be responsible for allowing user activity to be traced back through Russian-controlled networks. Telegram users typically rely on regular cloud chats, which—unlike its secret chats—are not end-to-end encrypted and are stored on Telegram’s servers. Security analysts warn that if Vedeneev’s companies manage routing systems and network infrastructure, they could potentially access user metadata, including IP addresses, device IDs, and location data.  Though message content may remain encrypted, this metadata could still be exploited for surveillance. Moreover, Telegram transmits unique device identifiers in an unencrypted format, creating additional vulnerability. Experts caution that Russian intelligence could leverage this data to monitor users, particularly dissidents, journalists, or foreign nationals viewed as threats. Telegram has refuted the claims, stating that it has no employees or servers in Russia and that its infrastructure remains fully under the control of its internal teams.  The company maintains that no third party, including vendors, can access confidential user data or systems. However, Telegram has yet to directly address the investigation’s core claims regarding GNM, Vedeneev, or the related infrastructure providers. The platform also hasn’t explained how it protects users if server operators have potential intelligence ties or why certain data is still sent without encryption.  The issue is especially relevant in Ukraine, where Telegram has over 10 million users and is a major source of news and official communication. While President Volodymyr Zelensky’s administration uses the app for public updates, growing concerns around disinformation and espionage have prompted discussions about its continued use.  As the investigation raises critical questions about the app’s security, the broader implications for global digital privacy and national security remain in sharp focus.

Telegram’s Alleged Ties to Russian Intelligence Raise Global Surveillance Fears #Cloud #CyberSecurity #DataSafetyUserData

SK Telecom Malware Attack Exposes USIM Data in South Korea  SK Telecom, South Korea’s top mobile carrier, has disclosed a security incident involving a malware infection that exposed sensitive information tied to users’ Universal Subscriber Identity Modules (USIMs). The breach was detected on the night of April 19, 2025, during the weekend when many companies operate with reduced cybersecurity staffing.  With nearly half of South Korea’s mobile market share and around 34 million subscribers, SK Telecom holds a crucial position in the country’s telecommunications sector. In an official statement, the company explained that malware had infiltrated parts of its network, prompting immediate action to contain the threat.  The affected systems were isolated swiftly, and the malicious software was removed. So far, SK Telecom has stated there is no confirmed misuse of customer data linked to this breach. This was reported to the Korea Internet & Security Agency (KISA) on April 20, and to the Personal Information Protection Commission. Investigations are ongoing to determine how the attackers gained access and the extent of the data exposed. USIM cards store essential data such as International Mobile Subscriber Identity (IMSI) numbers, phone numbers (MSISDN), encryption keys for network authentication, and sometimes even stored contacts or text messages. Unauthorized access to this information could enable cybercriminals to conduct targeted surveillance, track users’ locations, or perform SIM-swapping attacks that could compromise online accounts and digital assets.  In response, SK Telecom has strengthened security around USIM card management, increasing checks on SIM card replacement activities and monitoring authentication processes for suspicious behavior. Accounts showing irregular activities could face automatic suspension to prevent potential fraud. Additionally, the carrier is advising customers to activate their USIM protection service, a preventive measure that restricts unauthorized SIM swaps, adding extra protection to user accounts.  A hacking group is yet to claim responsibility for the breach. SK Telecom emphasized that while the malware was neutralized quickly, they remain vigilant and are working closely with cybersecurity authorities to uncover more details about the intrusion and enhance future protections.  This breach highlights ongoing risks faced by large mobile operators, especially during periods when cyber defenses might be less robust. It also underscores the critical need for mobile carriers to adopt continuous security monitoring and proactive measures to protect customer data from emerging threats.  As investigations continue, SK Telecom has committed to updating customers and regulators about any new findings or developments related to the incident.

SK Telecom Malware Attack Exposes USIM Data in South Korea #CyberAttacks #DataSafetyUserData #datasecurity

Europcar GitLab Breach Exposes Sensitive User Data and Configuration Files  A cybersecurity breach allegedly targeting Europcar has brought attention to vulnerabilities in corporate development platforms. A threat actor operating under the alias “Europcar” recently claimed on an underground forum that they had gained unauthorized access to the car rental giant’s GitLab repository, leading to the extraction of thousands of sensitive files. The attacker reportedly obtained over 9,000 SQL files and at least 269 .ENV files, which are commonly used to store application configuration settings, API keys, and other sensitive operational data.  The scale of the breach raised concerns about the potential exposure of customer and internal company information. Europcar later confirmed the breach to BleepingComputer, clarifying that only a limited portion of its GitLab repository was compromised, and not the entire system as initially claimed. The company stated it is currently assessing the scope of the intrusion and is in the process of notifying affected users. Initial findings suggest that customer names and email addresses from affiliated brands such as Goldcar and Ubeeqo, generated between 2017 and 2020, may have been exposed. Importantly, payment data was not compromised in this incident.  The Europcar data breach is believed to have been part of an extortion attempt, although it remains unclear whether any ransom was paid. The method used to access Europcar’s GitLab remains under investigation, but cybersecurity experts suspect phishing or infostealer malware as the most likely attack vectors. Credential theft through malware or social engineering continues to be a leading cause of repository leaks across industries.   GitLab, a widely used platform for code collaboration and storage, is frequently targeted by cybercriminals. Attackers often exploit its popularity by spoofing repositories or distributing malicious packages. Developers are advised to exercise caution by verifying repository sources, reading user feedback, and implementing multi-layered security protocols. The GitLab repository leak highlights the broader issue of digital supply chain vulnerabilities.  When attackers gain access to development environments, the consequences can include compromised applications, internal data leaks, and reputational damage. This incident reinforces the importance of robust cybersecurity hygiene, particularly for companies managing user-sensitive platforms. As Europcar continues to investigate the breach and tighten security protocols, the incident serves as another reminder of the growing sophistication of cyberattacks and the urgent need for proactive security measures.

Europcar GitLab Breach Exposes Sensitive User Data and Configuration Files #DataBreach #DataSafetyUserData #datasecurity

Arcane Malware Steals VPN, Gaming, and Messaging Credentials in New Cyber Threat  A newly identified malware strain, Arcane, is making headlines for its ability to steal a vast range of user data. This malicious software infiltrates systems to extract sensitive credentials from VPN services, gaming platforms, messaging apps, and web browsers. Since its emergence in late 2024, Arcane has undergone several modifications, increasing its effectiveness and expanding its reach.  Unlike other cyber threats with long-established histories, Arcane is not linked to previous malware versions carrying a similar name. Analysts at Kaspersky have observed that the malware primarily affects users in Russia, Belarus, and Kazakhstan. This is an unusual pattern, as many Russian-based cybercriminal groups tend to avoid targeting their home region to steer clear of legal consequences.  Additionally, communications linked to Arcane’s operators suggest that they are Russian-speaking, reinforcing its likely origin. The malware spreads through deceptive content on YouTube, where cybercriminals post videos promoting game cheats and cracked software. Viewers are enticed into downloading files that appear legitimate but contain hidden malware. Once opened, these files initiate a process that installs Arcane while simultaneously bypassing Windows security settings.  This allows the malware to operate undetected, giving hackers access to private information. Prior to Arcane, the same group used a different infostealer known as VGS, a modified version of an older trojan. However, since November 2024, they have shifted to distributing Arcane, incorporating a new tool called ArcanaLoader. This fake installer claims to provide free access to premium game software but instead delivers the malware.  It has been heavily marketed on YouTube and Discord, with its creators even offering financial incentives to content creators for promoting it. Arcane stands out because of its ability to extract detailed system data and compromise various applications. It collects hardware specifications, scans installed software, and retrieves login credentials from VPN clients, communication platforms, email services, gaming accounts, and cryptocurrency wallets. Additionally, the malware captures screenshots, which can expose confidential information visible on the victim’s screen.  Though Arcane is currently targeting specific regions, its rapid evolution suggests it could soon expand to a broader audience. Cybersecurity experts warn that malware of this nature can lead to financial theft, identity fraud, and further cyberattacks. Once infected, victims must reset all passwords, secure compromised accounts, and ensure their systems are thoroughly cleaned.  To reduce the risk of infection, users are advised to be cautious when downloading third-party software, especially from unverified sources. Game cheats and pirated programs often serve as delivery methods for malicious software, making them a significant security threat. Avoiding these downloads altogether is the safest approach to protecting personal information.

Arcane Malware Steals VPN, Gaming, and Messaging Credentials in New Cyber Threat #Arcane #CyberAttacks #DataSafetyUserData