Ukraine’s CERT has uncovered attacks distributing an archive containing the legitimate Notepad++ application and a malicious utility called LunchPoke disguised as a plugin to establish persistence.

The campaign has been attributed to a threat cluster tracked as UAC-0099, which primarily targets organizations in Ukraine and has previously been linked to providing initial access for attacks carried out by APT44, also known as Sandworm.

The attackers do not exploit any vulnerability or a supply-chain compromise impacting the popular software.

Notepad++ attack chain

CERT-UA observed that UAC-0099 changed their modus operandi recently and now delivers a ZIP archive with a VBS script disguised as a PDF document. When launched, the PDF retrieves another compressed file named Evernote.zip.

The second archive contains a complete copy of the legitimate editor Notepad++ version 8.8.3, a malicious plugin (NppExport.dll), a password-protected archive (updater.rar), and the legitimate WinRAR executable.

The VBS script installs the package into a randomly named directory, launches Notepad++, and then loads the malicious NppExport.dll via the application’s normal plugin-loading mechanism.

CERT-UA explains that this DLL is LunchPoke, a tool that creates a scheduled task on Windows and extracts the contents of the RAR file, including RemoteLibUpdater.exe and InitTest.dll.

The executable in the RAR file is BurnyBear, a loader for the DLL file that is the MatchBoil V2 malware loader.

BurnyBear also features a fallback mechanism in case launching RemoteLibUpdater.exe fails, triggering a resource exhaustion attack targeting the host’s RAM and CPU.

The latter creates another scheduled task, updates its configuration and command-and-control (C2) address, and then uses WinRAR to extract downloaded programs.

CERT-UA does not mention the final payloads delivered in the observed attacks, the purpose of the campaign, or the targeted organizations.

The researchers mention CVE-2025-56383, a DLL hijacking flaw in Notepad++ v8.8.3, the exact version used in these attacks, but note that the Notepad++ team has disputed this issue, claiming that plugin loading is standard functionality.

CERT-UA advises system administrators to update Notepad++ to version 8.9.7, 7-Zip to version 26.02, and WinRAR to version 7.23, to prevent hackers from exploiting known flaws in existing products and enabling stealthy attacks.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

There are over 32,000 entry-level PMET jobs available for Singapore’s fresh graduates

How is it possible that a graduate, who is the top of his cohort from a local university, equipped with four internships at companies like DBS Bank, attended 10 career fairs and networking events, and sent out more than 300 resumes in the finance sector, still hasn’t landed a full-time job?

The question is especially puzzling given the latest figures from Singapore’s Ministry of Manpower (MOM), which show there were 32,800 entry-level professional, managerial, executive and technician (PMET) vacancies available for new graduates.

Each year, around 25,000 to 30,000 degree holders enter the workforce—fewer than the more than 32,000 entry-level PMET vacancies that have been available in recent quarters. In other words, there are, at least on paper, more entry-level jobs than fresh graduates to fill them.

Yet, despite what the numbers suggest, some graduates are seemingly still struggling to secure full-time employment.

Some industries offer more opportunities

While vacancy numbers fluctuate quarter to quarter with hiring timelines and recruitment cycles, the share of entry-level roles within each sector has stayed broadly consistent.

Public administration and education, as well as health and social services, are the most fresh-graduate-friendly sectors, where more than half of the vacancies are suitable for applicants with little to no work experience.

Coming in next are the manufacturing, construction, transportation and storage, food and beverage services, and administrative and support services sectors, where there are many engineering and quantity-surveying jobs. In these sectors, more than four in 10 vacancies are open to entry-level applicants.

On the other end of the spectrum, the infocomm and financial and insurance services are two industries that graduates aspire to join for higher starting pay, attractive perks and strong career prospects. Yet, only 22.2% of infocomm vacancies and 25.3% of financial services roles are entry-level, per MOM’s Q1 2026 data.

For fresh graduates set on these sectors, breaking in is significantly harder.

Derrick Teo, chief executive of manpower consultancy Elitez Group, told The Straits Times: “The graduate job market is still active, but it is more uneven and selective compared with two or three years ago.” 

More graduates are having to take up temporary or contract roles as stepping stones towards a full-time gig, the publication wrote.

The mismatch between job openings & degree holders

“The issue is not that there are no jobs. It is that there is a mismatch between where graduates want to work, where employers are hiring, and the skills employers now expect from fresh graduates,” Teo added. 

The mismatch is particularly evident in the infocomm sector, where the post-pandemic hiring boom has cooled. There were 4,600 vacancies in Q1 2020, before it surged to 11,700 in Q1 of 2022, and fell to around 5,300 in the first quarter of 2026.

Of those 5,300 vacancies, only about 1,200 are suitable for entry-level applicants.

In 2020, that would have been almost enough to accommodate the 1,367 information technology graduates. But by 2024, the number of IT graduates had almost doubled to 2,694, according to data from the Ministry of Education, making competition much more intense.

The tables have turned. Employers now hold the power that graduates once commanded.

Computing students used to land multiple job offers before graduation. Now, many take longer to secure their first role, said Li Xiaoli, head of the Information Systems Technology and Design Pillar at Singapore University of Technology and Design (SUTD).

With a larger pool of candidates to choose from, companies have the “luxury of selecting the very best,” he said. 

Internships are a prerequisite, but there just aren’t enough

One recent computer science graduate, Gary, whom the Straits Times spoke to, said that employers have become far more selective even when hiring interns.

As internships are increasingly being a prerequisite for full-time jobs, more students are stacking multiple stints to bolster their resumes.

This makes competition stiffer for everyone. 

Final-year students who need internships to fulfil graduation requirements now vie not just with peers, but juniors chasing the same spots.

“Quite a number of students did capstone projects in place of internships because they couldn’t find one,” Gary said, referring to final-year projects where students apply what they have learnt.

He felt his coursemates’ lack of real-world experience would put them at a further disadvantage in the job hunt.

Gary explained that was why he decided to “bite the bullet” and grab any internship opportunity that came his way, even if it was an SME or a company with discouraging Glassdoor (job and recruiting platform) reviews. 

Employers are increasingly looking for candidates who can “demonstrate practical experience, specific skills, adaptability and readiness to contribute from the outset,” said Susanna Leong, deputy president (academic) and provost at Singapore Institute of Technology.

Prasanthi Guda, Acting Director of Career and Employability Services at Singapore Management University’s (SMU) Dato’ Kho Hui Meng Career Centre, said that employers are also hiring more cautiously in response to economic uncertainty, geopolitical developments and rapid technological change.

Graduates are also picky amid a tougher job market

But employers aren’t the only ones being choosy. Even in a tougher market, many graduates remain selective about where they apply.

Some prefer a more targeted approach, relying on personal connections for job leads and applying only for positions they genuinely want. Others are taking their time with applications, and choosing alternative paths like furthering their studies. 

Some are even holding out for a better job with higher pay, despite qualifying for other sectors. 

Calvin Chung, JTC’s assistant chief executive for engineering and operations, told the Straits Times that attracting fresh graduates to the built environment sector—construction, engineering, and related fields—remains challenging, especially as enrolment in these courses declines.

“The perception problem is real, as younger students see the sector as traditional, physically demanding and slow to change, especially when compared with industries like tech and finance,” he said.

“The reality is actually different, where engineers today work with sophisticated digital tools on impactful projects,” he added.

Unrealistic expectations?

A 2025 MOM School-to-Work Transition Study of 2,500 recent graduates found most expected higher starting salaries than the actual median in their fields. Only law, education, and fine and applied arts graduates had realistic expectations.

The mismatch was especially pronounced among graduates in information technology, business, and the natural and mathematical sciences.

Many had looked at the Graduate Employment Survey—based on self-reported earnings—and expected over S$5,000 for their first job. But recent postings suggest employers are offering around S$4,000, Gary said.

SUTD’s Li said it is common for students, especially the most competent and ambitious ones, to aim for high-paying jobs at companies such as Google or OpenAI. But he added that they should be “realistic” as tech multinational companies are becoming more cautious about their headcount.

Shamim Akhtar, course chair at Temasek Polytechnic’s School of Informatics and IT, urged students to broaden their job search. “We should not be fixated on tech companies,” he said, noting that financial institutions, government agencies, and healthcare organisations also need tech talent.

Recent data from Infocomm Media Development Authority’s Singapore Digital Economy Report 2025 supports this, projecting faster growth in demand for tech professionals at non-tech firms than at tech firms.

Worries about AI

Competing against hundreds of graduates is tough enough. Now, many young job seekers face another worry: rapid AI adoption.

Except for sectors like health and social services, where jobs are believed to be “human-centric” and less prone to automation, concerns about AI replacing junior roles are looming, especially in knowledge-based industries. 

AI adoption is the highest in infocomm at 74.1%, followed by professional services at 57.5% and financial and insurance services at 56.4%, per MOM’s latest survey.

But the same survey suggests AI is, for now, reshaping work rather than eliminating jobs. Just 6.2% of adopting firms reported reducing headcount or hiring because of the technology.

Some industry watchers’ observations corroborate this.

“Not yet a market where recent graduates need to compromise“

Callam Pickering, Indeed’s senior APAC economist, said graduate demand picked up considerably in the first five months of 2026 versus the same period in 2025. Around 80% of those opportunities sit in occupations highly exposed to AI-driven transformation.

“This is not yet a market where recent graduates need to compromise,” he said.

Moreover, Sharon Tan, Vice-Dean (Industry Relations) at the National University of Singapore’s School of Computing, said AI adoption will create “a strong need for professionals who can design, build, evaluate and deploy these systems responsibly and effectively”.

“While hiring conditions may be more subdued now than during the recent technology boom, Singapore’s continued digitalisation and significant investments in AI research, innovation, infrastructure and enterprise adoption are expected to sustain demand for computing talent over the longer term,” she added.

Still, universities are increasingly weaving AI into existing curricula or launching AI-focused degrees to future-proof their students’ careers.

For students, demonstrating proper and effective AI use is critical, said Temasek Polytechnic’s Akhtar. They should learn to build applications using large language model APIs, document their process on platforms like GitHub, and show employers how AI enhances their work.

“Employers are looking at how you augment your thinking, rather than let AI replace your thinking,” he said.

In actuality, for many graduates, the bigger frustration right now isn’t AI taking their jobs—it’s AI deciding whether they even get an interview.

Several told the Straits Times that AI-driven resume screening has made hiring feel more opaque, with applications vanishing into what feels like a “black hole.” They agreed that waiting for responses that never come has become common. 

Some graduates, like Gary, have accepted that hearing back from a recruiter is no longer guaranteed.

Out of the 150 applications he has sent since Jan, he has received only one verbal offer, but has not heard from the company for almost two months.

• Read other articles we’ve written on Singapore’s job landscape here.

CISA is warning that the Russian state-sponsored hacking group Laundry Bear, also known as Void Blizzard, is targeting organizations using Zimbra Collaboration email servers by combining phishing attacks with the exploitation of a now-patched Zimbra vulnerability.

According to CISA, Laundry Bear has targeted and compromised users in organizations associated with the Defense Industrial Base (DIB), federal and local government, education, energy, law enforcement, media, non-governmental organizations, and technology.

The attackers exploit the Zimbra CVE-2025-66376 flaw, a cross-site scripting (XSS) vulnerability affecting Zimbra Collaboration Suite’s Classic UI.

The flaw allows JavaScript embedded in specially crafted HTML emails to execute automatically when a victim views the message, enabling attackers to steal account data without requiring the user to click a link or visit a phishing site.

According to CISA, Laundry Bear exploited the flaw as a zero-day before Zimbra patched it in November 2025 and continues to target organizations running unpatched servers. The vulnerability was later tagged by CISA as actively exploited in attacks.

CISA says Laundry Bear’s exploit is used to automatically collect and send the victim’s last 90 days of emails, email address, password, Global Address List (GAL), and two-factor authentication (2FA) tokens.

The attackers also create and send back a new Zimbra application passcode, which is used by legacy email clients like IMAP or ActiveSync that do not support the TOTP authentication flows. Using a passcode allows the attackers to retain access to the email account while bypassing MFA.

According to CISA, the malware exfiltrates stolen information over both DNS and HTTPS to an actor-controlled server running the group’s “Flowerbed” collection framework.

Smaller data is encoded and transmitted in DNS A-record queries, while larger payloads, including mailbox data, are uploaded over HTTPS as compressed archives to the attacker-controlled servers.

In addition to exploiting the Zimbra flaw, Laundry Bear also utilizes adversary-in-the-middle (AiTM) phishing kits designed to impersonate legitimate Zimbra login portals, stealing credentials and session cookies, allowing the attackers to gain access to targets’ email accounts.

CISA released IOCs that show the campaign used sites that impersonate Zimbra infrastructure, using domain names like ‘mailnalysis.com’, ’emailanalytics.com.ua’, ‘zimbrastat.com’, ‘zimbra-metadata.com’, ‘istc-cloud.com’, and ‘zmailanalytics.com’.

The advisory recommends that organizations using Zimbra:

• Update to the latest version of the software to install all available security updates.
• Review the published indicators of compromise.
• Investigate systems for connections to the identified domains and IP addresses.
• Monitor for suspicious authentication activity.
• Revoke any unauthorized application passcodes, especially those with the ‘ZimbraWeb’.
• Review accounts for unauthorized mailbox access.

CISA also recommends implementing phishing-resistant multi-factor authentication where possible.

Laundry Bear targeted governments, police, and Ukraine

The Laundry Bear hacking group was first attributed to cyberespionage attacks in May 2025 by the Dutch intelligence agencies.

The Dutch agencies publicly attributed the group to a 2024 compromise of the Dutch National Police that exposed the personal information of police personnel and led to the identification of a previously unknown Russian espionage group.

Microsoft tracks the same group under the name Void Blizzard.

Since at least 2024, the group has focused on intelligence collection against organizations aligned with Russian strategic interests, primarily targeting NATO member states and Ukraine.

Microsoft has also documented successful compromises of organizations supporting Ukraine, including entities in the defense, transportation, and aviation sectors.

Earlier this year, BleepingComputer reported on a separate Laundry Bear campaign targeting Ukraine’s military using charity-themed phishing emails to deliver malware disguised as donation requests.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

Mozilla has released Firefox 153, giving people a built-in way to keep work, personal, shopping, and banking activity apart. The update began rolling out to Release channel users on July 21 and also introduces HDR video playback on Windows, PDF improvements, and tighter controls over local files and network devices.

Containers open tabs in isolated spaces where cookies, logins, and site storage are not shared. Someone can remain signed into two accounts on the same website, keep a work Google account away from personal YouTube activity, or stop shopping cookies from following everyday browsing.

What can Firefox Containers actually do?

The feature is designed for people who regularly manage different online identities but do not want to rely on private windows or separate browser profiles. Company services can stay inside a Work container, financial websites inside Banking, and online stores inside Shopping.

Each container can have its own name, color, and icon, making its tabs easy to identify. To open one, right-click a tab and select “Open in New Container Tab.” Firefox includes Personal, Work, Banking, and Shopping categories, while custom options can also be created.

The technology itself is not new. Mozilla has offered it for years through the Multi-Account Containers extension. Firefox 153 builds the core experience into the browser, removing the need for an add-on for basic tab isolation.

The extension still offers more advanced controls, including assigning websites to specific containers and connecting individual containers through Mozilla VPN. Existing users can continue running it alongside the native feature.

What else is new in Firefox 153?

Firefox can now play HDR video on compatible Windows displays when HDR is enabled in system settings. Pages can also be shared through QR codes, while the PDF editor can merge files and add images as new pages.

Other additions include an address-bar color picker and experimental JPEG XL support through Firefox Labs. Extensions must now request separate permission to access local files, and websites need approval before connecting to devices or services on a local network.

For anyone who prefers a Chromium-based browser, Brave recently added a similar Containers feature to its desktop app. It offers the same basic way to keep accounts, cookies, and browsing sessions separate without switching profiles.

LG’s 85-inch QNED Mini LED TV has just dropped below $1000, a genuinely rare price for a screen this size.

That’s thanks to a 30% cut on the LG QNED73B that takes the price down from its $1,399.99 list price to $979.99, a straight $420 saving on one of LG’s largest Mini LED screens available this year.