Researchers discovered Celestial Stealer, a JavaScript-based MaaS infostealer targeting Windows systems that, evading detection with obfuscation and anti-analysis techniques, steals data from various browsers, applications, and cryptocurrency wallets. It operates as an Electron or NodeJS application, injecting code into vulnerable…
Category: GBHackers Security | #1 Globally Trusted Cyber Security News Platform
Russian Hackers Hijacked Pakistani Actor Servers For C2 Communication
Secret Blizzard, a Russian threat actor, has infiltrated 33 command-and-control (C2) servers belonging to the Pakistani group Storm-0156, which allows Secret Blizzard to access networks of Afghan government entities and Pakistani operators. They have deployed their own malware, TwoDash and…
Russian BlueAlpha APT Exploits Cloudflare Tunnels to Distribute Custom Malware
BlueAlpha, a Russian state-sponsored group, is actively targeting Ukrainian individuals and organizations by using spearphishing emails with malicious HTML attachments to deliver GammaLoad malware. To evade detection, BlueAlpha is leveraging Cloudflare Tunnels to conceal their infrastructure and using DNS fast-fluxing…
CapibaraZero Firmware With ESP32-S3 Hardware Enables Low Cost Flipper Zero alternative
The open-source tech landscape continues to innovate, and the release of the CapibaraZero firmware marks another breakthrough. Designed for ESP32-S3-based hardware platforms, CapibaraZero provides a low-cost alternative to the highly popular—but expensive—Flipper Zero, a multifunctional tool for penetration testers, ethical…
Multiple SonicWall Vulnerabilities Let Attackers Execute Remote Code
SonicWall has issued a critical alert regarding multiple vulnerabilities in its Secure Mobile Access (SMA) 100 series SSL-VPN appliances. These vulnerabilities could allow attackers to execute remote code, bypass authentication, or compromise system integrity. SonicWall urges users to take immediate…
Django Security Update, Patch for DoS & SQL Injection Vulnerability
The Django team has issued critical security updates for versions 5.1.4, 5.0.10, and 4.2.17. These updates address two vulnerabilities: a potential denial-of-service (DoS) attack in the strip_tags() method and a high-severity SQL injection risk in Oracle databases. All developers and system administrators…
Rockwell Automation Warns of Multiple Code Execution Vulnerabilities in Arena
Rockwell Automation has issued a critical security advisory addressing multiple remote code execution (RCE) vulnerabilities discovered in its Arena® software. These vulnerabilities, reported by the Zero Day Initiative (ZDI), expose systems to potential exploitation by adversaries looking to execute arbitrary…
Europol Dismantled 50+ Servers Used For Fake Online Shopping Websites
Europol, in collaboration with law enforcement across Europe, has taken down a sophisticated cybercriminal network responsible for large-scale online fraud. Over 50 servers were seized, a trove of digital evidence was secured, and two primary suspects are now in pretrial…
Multiple ICS Advisories Released by CISA Detailing Exploits & Vulnerabilities
The Cybersecurity and Infrastructure Security Agency (CISA) has released two advisories highlighting significant security vulnerabilities in Industrial Control Systems (ICS) software and hardware. These vulnerabilities, identified in AutomationDirect’s C-More EA9 Programming Software and Planet Technology’s industrial switch WGS-804HPT, could pose…
Researchers Released hrtng IDA Pro Plugin for Malware Analyst to Make Reverse Engineering Easy
The Global Research and Analysis Team (GReAT) has announced the release of hrtng, a cutting-edge plugin for IDA Pro, one of the most prominent tools for reverse engineering. Designed specifically to enhance the efficiency of malware analysis, hrtng provides analysts with powerful…
Windows NTLM Zero-Day Vulnerability Exposes User Credentials
A critical zero-day vulnerability affecting all modern Windows Workstation and Server versions has been discovered. The flaw enables attackers to steal NTLM credentials with minimal user interaction, posing a significant security risk. It impacts systems from Windows 7 and Server…
HCL DevOps Deploy / Launch Vulnerability Let Embed arbitrary HTML tags
Recently identified by security researchers, a new vulnerability in HCL DevOps Deploy and HCL Launch has emerged, allowing users to embed arbitrary HTML tags within the Web UI. This vulnerability tracked as CVE-2024-42195, poses a potential risk of sensitive information…
CISA Warns of Zyxel Firewalls, CyberPanel, North Grid, & ProjectSend Flaws Exploited in Wild
The Cybersecurity and Infrastructure Security Agency (CISA) has issued warnings about several vulnerabilities being actively exploited in the wild. The vulnerabilities affect popular software and hardware products, including Zyxel firewalls, CyberPanel, North Grid, and ProjectSend. Organizations using these products are…
HackSynth : Autonomous Pentesting Framework For Simulating Cyberattacks
HackSynth is an autonomous penetration testing agent that leverages Large Language Models (LLMs) to solve Capture The Flag (CTF) challenges without human intervention. It utilizes a two-module architecture: a planner to create commands and a summarizer to understand the hacking…
Fuji Electric Indonesia Hit by Ransomware Attack
Fuji Electric Indonesia has fallen victim to a ransomware attack, impacting its operations and raising concerns about data security and business continuity. The attack was publicly disclosed by Fuji Electric’s headquarters on December 2, 2024, through an official notice, which…
Thinkware Cloud APK Vulnerability Allows Code Execution With Elevated Privileges
A critical vulnerability identified as CVE-2024–53614 has been discovered in the Thinkware Cloud APK version 4.3.46. This vulnerability arises from the use of a hardcoded decryption key within the application. It allows malicious actors to access sensitive data and execute…
ChatGPT Next Web Vulnerability Let Attackers Exploit Endpoint to Perform SSRF
Researchers released a detailed report on a significant security vulnerability named CVE-2023-49785, affecting the ChatGPT Next Web, popularly known as NextChat. This vulnerability has raised concerns within the cybersecurity community due to its potential for exploitation through Server-Side Request Forgery…
I-O DATA Routers Command Injection Vulnerabilities Actively Exploited in Attacks
I-O DATA DEVICE, INC. has announced that several critical vulnerabilities in their UD-LT1 and UD-LT1/EX routers are being actively exploited. These vulnerabilities pose significant risks to users, necessitating urgent attention and action. Below is a detailed look at each vulnerability,…
Cisco NX-OS Vulnerability Allows Attackers to Bypass Image Signature Verification
A critical vulnerability has been identified in the bootloader of Cisco NX-OS Software, potentially allowing attackers to bypass image signature verification. This flaw, which affects several Cisco product lines, could enable unauthorized users to load unverified software onto affected devices.…
Deloitte UK Hacked – Brain Cipher Group Claim to Have Stolen 1 TB of Data
Brain Cipher has claimed to have breached Deloitte UK and exfiltrated over 1 terabyte of sensitive data. Emerging in June 2024, Brain Cipher has quickly established a reputation for its aggressive cyberattacks, with a notable incident involving According to statements…
Weaponized Word Documents Attacking Windows Users to Deliver NetSupport & BurnsRAT
The threat actors distributed malicious JS scripts disguised as legitimate business documents, primarily in ZIP archives with names like “Purchase request” or “Request for quote.” They enriched their phishing emails with authentic-looking documents like passports, tax registrations, and company cards,…
Hackers Exploit Docker Remote API Servers To Inject Gafgyt Malware
Attackers are exploiting publicly exposed Docker Remote API servers to deploy Gafgyt malware by creating a Docker container using a legitimate “alpine” image to deploy the malware and infect the victim system with Gafgyt botnet malware. It allows attackers to…
Cloudflare Developer Domains Abused For Cyber Attacks
Cloudflare Pages, a popular web deployment platform, is exploited by threat actors to host phishing sites, as attackers leverage Cloudflare’s trusted infrastructure, global CDN, and free hosting to quickly set up and deploy convincing phishing sites. Automatic SSL/TLS encryption enhances…
CISA Releases Advisory to Monitor Networks to Detect Malicious Cyber Actors
The National Security Agency (NSA) has partnered with the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and other entities to release a critical advisory. This initiative comes in response to the exploitation of major global…
MobSF XSS Vulnerability Let Attackers Inject Malicious Scripts
A critical vulnerability has been identified in the Mobile Security Framework (MobSF) that allows attackers to inject malicious scripts into the system. This vulnerability, CVE-2024-53999 is a Stored Cross-Site Scripting (XSS) flaw found in the “Diff or Compare” functionality, which…
Progress WhatsUp Gold RCE Vulnerability – PoC Exploit Released
A registry overwrite remote code execution (RCE) vulnerability has been identified in NmAPI.exe, part of the WhatsUp Gold network monitoring software. This vulnerability, present in versions before 24.0.1, allows an unauthenticated remote attacker to execute arbitrary code on affected systems,…
Google Chrome Security Update, Patch for High-severity Vulnerability
Google has released a significant security update for its Chrome browser, aiming to address several vulnerabilities and enhance user safety. The Stable channel has been updated to version 131.0.6778.108/.109 for Windows, and Mac, and version 131.0.6778.108 for Linux. These updates…
New TLDs Such as .shop, .top and .xyz Leveraged by Phishers
Phishing attacks have surged nearly 40% in the year ending August 2024, with a significant portion of this increase linked to new generic top-level domains (gTLDs) like .shop, .top, and .xyz. These domains, known for their minimal registration requirements and…
Hackers Exploited Windows Event Logs Tool log Manipulation, And Data Exfiltration
wevtutil.exe, a Windows Event Log management tool, can be abused for LOLBAS attacks. By manipulating its capabilities, attackers can execute arbitrary commands, download malicious payloads, and establish persistence, all while evading traditional security measures. It is a Windows tool for…
Hackers Cloning Websites, Exploiting RCE Flaws To Gain Access To Shopping Platforms
Cybercriminals are leveraging AI-powered phishing attacks, website cloning tools, and RCE exploits to target e-commerce platforms during the holiday season, which allow attackers to craft convincing phishing emails, replicate legitimate websites, and gain unauthorized access to systems. The objective of…
PEFT-As-An-Attack, Jailbreaking Language Models For Malicious Prompts
Federated Parameter-Efficient Fine-Tuning (FedPEFT) is a technique that combines parameter-efficient fine-tuning (PEFT) with federated learning (FL) to improve the efficiency and privacy of training large language models (PLMs) on specific tasks. However, this approach introduces a new security risk called…
Threat Actors Allegedly Claims Breach of EazyDiner Reservation Platform
Reports have emerged of a potential data breach involving EazyDiner, a leading restaurant reservation platform. Alleged by a tweet from DailyDarkWeb, the breach is said to have compromised sensitive user data, including names, email addresses, phone numbers, and reservation details.…
TP-Link HomeShield Function Vulnerability Let Attackers Inject Malicious Commands
A significant vulnerability has been identified in TP-Link’s HomeShield function, affecting a range of their devices, including the Archer, Deco, and Tapo series routers. This vulnerability, labeled CVE-2024-53375, allows attackers to exploit a flaw in the device firmware, leading to…
Salesforce Applications Vulnerability Could Allow Full Account Takeover
A critical vulnerability has been discovered in Salesforce applications that could potentially allow a full account takeover. The vulnerability, uncovered during a penetration testing exercise, hinges on misconfigurations within Salesforce Communities, particularly exploiting the Salesforce Lightning component framework. The implications…
ElizaRAT Exploits Google, Telegram, & Slack Services For C2 Communications
APT36, a Pakistani cyber-espionage group, has recently upgraded its arsenal with ElizaRAT, a sophisticated Windows RAT that, initially detected in 2023, employs advanced evasion tactics and robust C2 capabilities to target Indian government agencies, diplomatic personnel, and military installations. The…
Russia Sentenced Hydra Dark Web Market Developer for Life Time
A Russian court has sentenced Stanislav Moiseyev, believed to be the founder of the notorious Hydra darknet marketplace, to life imprisonment. The Moscow Regional Court delivered the verdict on charges related to organized crime and drug trafficking, concluding a significant…
New CleverSoar Malware Attacking Windows Users Bypassing Security Mechanisms
CleverSoar, a new malware installer, targets Chinese and Vietnamese users to deploy advanced tools like Winos4.0 and Nidhogg rootkit. These tools enable keylogging, data theft, security circumvention, and stealthy system control for potential long-term espionage. It was initially uploaded to…
HPE IceWall Flaw Let Attackers cause Unauthorized Data Modification
Hewlett Packard Enterprise (HPE) has issued an urgent security bulletin addressing a critical vulnerability in its IceWall product line. Identified as CVE-2024-11856, this flaw could allow attackers to remotely modify data without authorization. This flaw is capable of enabling unauthorized…
Beware Of Malicious PyPI Packages That Inject infostealer Malware
Recent research uncovered a novel crypto-jacking attack targeting the Python Package Index (PyPI), where malicious actors uploaded a legitimate-seeming cryptocurrency client package, “aiocpa,” to gradually build a user base. Subsequently, a malicious update was pushed, compromising user wallets. By utilizing…
Amazon GuardDuty Enhanced With AI/ML Threat Detection Capabilities for Cloud Security
Amazon has taken a significant step forward to enhance the security of its cloud environment. The introduction of advanced AI/ML threat detection capabilities in Amazon GuardDuty marks a major milestone in securing applications, workloads, and data against modern threats. This…
Linux 6.13-rc1 Released: What’s New!
In a recent announcement, Linus Torvalds, the creator of Linux, officially released the first release candidate (RC1) for Linux kernel version 6.13. This release marks the end of the merge window, and for the first time in recent memory, the…
Windows Server 2012 0-day Vulnerability Exposes Critical Security Flaw
Cybersecurity researchers have identified a critical 0-day vulnerability in Windows Server 2012 and Server 2012 R2. This previously unknown security flaw allows attackers to bypass the Mark of the Web (MoTW) verification on certain files, posing a significant threat to…
Apple Safari JavaScriptCore Remote Code Execution Flaw Exploited in the Wild
A critical vulnerability identified as CVE-2024-44308 has been actively exploited in the wild, affecting multiple versions of Apple Safari across iOS, visionOS, and macOS platforms. This flaw, located within WebKit’s DFG JIT compiler, poses a significant threat by allowing remote…
Poison Ivy APT Launches Continuous Cyber Attack on Defense, Gov, Tech & Edu Sectors
Researchers uncovered the resurgence of APT-C-01, also known as the Poison Ivy group, an advanced persistent threat organization notorious for its sustained cyber attacks. This group has been actively targeting sectors such as defense, government, technology, and education since 2007,…
MediaTek Processor Vulnerabilities Let Attackers Escalate Privileges
Several vulnerabilities affecting MediaTek processors have been identified, potentially allowing attackers to escalate privileges on affected devices. These vulnerabilities span multiple components, including video decoding, telephony, power management, and modem functionalities, posing significant risks to users worldwide. Overview of Vulnerabilities…
Ransomware Developer Mikhail Matveev Arrested in Russia
Russian authorities have arrested Mikhail Matveev, a notorious Russian hacker linked to multiple ransomware attacks worldwide. Matveev, who was also known by online aliases such as Wazawaka, Uhodiransomwar, m1x, and Boriselcin, was detained in Kaliningrad, Russia, following an investigation into…
Hackers Can Secretly Access ThinkPad Webcams by Disabling LED Indicator Light
In a presentation at the POC 2024 conference, cybersecurity expert Andrey Konovalov revealed a novel method for covertly disabling the LED indicator of the ThinkPad X230’s webcam, highlighting ongoing vulnerabilities in USB-connected devices. Like many laptops, the ThinkPad X230 has…
New Phishing Attack Targeting Corporate Internet Banking Users
A sophisticated phishing scam has surfaced in Japan, targeting corporate internet banking users. This attack, which has rapidly gained attention nationwide, involves fraudsters impersonating bank representatives to deceive victims into providing sensitive banking information. The attack begins with a phone…
Uniswap Labs to Offer $15.5 Million Bounty for Bug Hunters
Uniswap Labs has launched a $15.5 million bug bounty program to ensure the security of its latest protocol, Uniswap v4. This substantial bounty is the largest ever offered in the history of the DeFi sector. Uniswap v4 represents the latest…
600,000+ Sensitive Records Exposed From Background Checks Service Provider
A publicly exposed database has left the sensitive information of hundreds of thousands of individuals vulnerable to potential misuse. Not protected by passwords or encryption, the database contained 644,869 PDF files, totaling 713.1 GB, exposing a treasure trove of personal…
UK Healthcare Provider Hit by Cyberattack, Services Affected
Wirral University Teaching Hospital in the UK has been hit by a targeted cyberattack, leading to the declaration of a major incident. The cyberattack has affected the hospital’s IT systems, necessitating a shift from digital to paper-based processes in certain…
Zyxel Firewall Vulnerability Actively Exploited in Attacks
Zyxel has announced awareness of active exploitation attempts by threat actors targeting their firewall products. This follows a detailed report by cybersecurity firm Sekoia highlighting vulnerabilities previously disclosed in Zyxel’s systems. The company has responded swiftly to these potential threats,…
APT-C-60 Attacking HR Department With Weaponized Resumes
APT-C-60 launched a phishing attack in August 2024, targeting domestic organizations with malicious emails disguised as job applications. These emails, sent to recruitment departments, contained malware designed to compromise systems and potentially steal sensitive data. The attack leverages a targeted…
Helldown Ransomware Attacking Windows And Linux Servers Evading Detection
Helldown Ransomware, a sophisticated cyber threat, actively targets critical industries worldwide by leveraging advanced cross-platform capabilities, including Windows and Linux, to encrypt files and exploit system vulnerabilities. Its modular design and anti-detection techniques enable continuous evolution and persistent attacks, which…
SMOKEDHAM Backdoor Mimic As Legitimate Tools Leveraging Google Drive & Dropbox
UNC2465, a financially motivated threat actor, leverages the SMOKEDHAM backdoor to gain initial access to target networks, which are often delivered via phishing emails, trojanized software, or supply chain attacks, enabling persistence and lateral movement. Once in the network, UNC2465…
New Skimmer Malware Steals Credit Card Data From Checkout Pages
A JavaScript-based malware targeting Magento eCommerce websites has been identified, which is designed to skim payment card details and activates exclusively on checkout pages. The malware dynamically generates a fraudulent credit card form or directly extracts sensitive payment information, where…
Researchers Detailed New Exfiltration Techniques Used By Ransomware Groups
Ransomware groups and state-sponsored actors increasingly exploit data exfiltration to maximize extortion and intelligence gains by leveraging a mix of custom and legitimate tools to steal sensitive data, including financial, personal, and classified information. To mitigate risks, organizations must implement…
Critical Jenkins Vulnerability Let Attackers Trigger DoS & Inject Scripts
A series of vulnerabilities have been identified, posing significant risks to the system’s security. These vulnerabilities could allow attackers to trigger denial of service (DoS) attacks and execute script injections, as highlighted in recent advisories. Denial of Service Vulnerability in…
Shut Down Phishing Attacks -Detection & Prevention Checklist
In today’s interconnected world, where digital communication and transactions dominate, phishing attacks have become an ever-present threat. By masquerading as trustworthy entities, phishing attacks deceive users and organizations into divulging sensitive information, such as passwords, financial data, and personal details.…
New Windows 11 Vulnerability Lets Attackers Elevate Privileges
A new vulnerability has been discovered in Windows 11, specifically affecting the 23H2 version. This vulnerability is identified in the ksthunk.sys driver, allows attackers to exploit an integer overflow in the CKSAutomationThunk::ThunkEnableEventIrp function to escalate their privileges on the system. Technical Details The flaw…
Microsoft Re-Releasing Exchange Server Nov 2024 Security Update Fixing Transport Rules
Microsoft has re-released the November 2024 Security Update (SU) with enhancements to rectify problems encountered with transport rules. Originally rolled out on November 12, 2024, as part of its ongoing security update efforts, the initial SU (referred to as Nov…
“Bootkitty” – A First Ever UEFI Bootkit Attack Linux Systems
Cybersecurity researchers have uncovered the first-ever UEFI bootkit designed to target Linux systems. This discovery, named ‘Bootkitty’, marks a new chapter in UEFI threats, which have predominantly targeted Windows systems until now. The UEFI (Unified Extensible Firmware Interface) threat landscape…
Europol Dismantled Major Illegal IPTV Streaming Network Providers
In a major crackdown on illegal streaming, law enforcement authorities across Europe, supported by Europol and Eurojust, have successfully dismantled one of the largest illegal streaming networks operating both within and outside the EU. The extensive operation targeted a network…
Matrix, A Single Actor Orchestrate Global DDOS Attack Campaign
Cybersecurity researchers have uncovered a widespread Distributed Denial-of-Service (DDoS) campaign attributed to a threat actor using the alias “Matrix.” This campaign, characterized by its global scale and the actor’s low technical sophistication, highlights the evolving landscape of cyber threats where…
Microsoft Patches Multiple Vulnerabilities Allow Attackers to Elevate Privileges
Microsoft has recently released patches addressing multiple vulnerabilities that could enable attackers to elevate privileges across various Microsoft products. The patches are part of Microsoft’s continuous efforts to enhance security and protect its users from threats. The Microsoft Security Response…
Why the MITRE ATT&CK Evaluation Is Essential for Security Leaders
In today’s dynamic threat landscape, security leaders are under constant pressure to make informed choices about which solutions and strategies they employ to protect their organizations. The “MITRE Engenuity ATT&CK Evaluations: Enterprise” stands out as an essential resource for cybersecurity decision-makers…
Lazarus Hackers Exploits macOS Extended Attributes To Evade Detection
The xattr command in Unix-like systems allows for the embedding of hidden metadata within files, similar to Windows ADS, known as Rustyattr, which is being exploited by threat actors like Lazarus Group to stealthily conceal malicious payloads within seemingly benign…
ProjectSend Authentication Vulnerability Exploited in the Wild
ProjectSend, an open-source file-sharing web application, has become a target of active exploitation following the recent assignment of CVE-2024-11680 on November 25, 2024. Despite the availability of a patch for more than a year, adoption rates remain alarmingly low, leaving…
NVIDIA UFM Vulnerability Leads to Privilege Escalation & Data Tampering
NVIDIA has released a critical security update addressing a significant vulnerability in its Unified Fabric Manager (UFM) products. This flaw, identified as CVE-2024-0130, poses a high-severity risk to users, with a CVSS v3.1 base score of 8.8. The vulnerability could allow attackers…
Junior School Student Indicted for Infecting Computers With Malware
Fukui Prefectural Police have indicted a 15-year-old junior high school student from Saitama Prefecture for allegedly creating and distributing malware. The young suspect, who was only 14 at the time of the incidents, faces charges under Japan’s Unauthorized Access Prevention…
Critical Gitlab Vulnerability Let Attackers Escalate Privileges
GitLab, a widely used platform for DevOps lifecycle management, has released critical security updates for its Community Edition (CE) and Enterprise Edition (EE). The updates address multiple vulnerabilities, including a high-severity issue that could allow attackers to escalate privileges via…
Firefox 133.0 Released with Multiple Security Updates – What’s New!
Mozilla has officially launched Firefox 133.0, offering enhanced features, significant performance improvements, and critical security fixes. This latest release enhances privacy, developer tools, and enterprise functionality while introducing several new features and updates. Here’s everything you need to know! One…
RomCom Hackers Exploits Windows & Firefox Zero-Day in Advanced Cyberattacks
In a new wave of cyberattacks, the Russia-aligned hacking group “RomCom” has been found exploiting critical zero-day vulnerabilities in Microsoft Windows and Mozilla Firefox products. Security researchers at ESET uncovered the alarming attack chain, which uses the vulnerabilities to deploy…
Chinese APT Hackers Using Multiple Tools And Vulnerabilities To Attack Telecom Orgs
Earth Estries, a Chinese APT group, has been actively targeting critical sectors like telecommunications and government entities since 2023. They employ advanced techniques, including exploiting vulnerabilities, lateral movement, and deploying multiple backdoors like GHOSTSPIDER, SNAPPYBEE, and MASOL RAT, which have…
200,000 WordPress Sites Exposed to Cyber Attack, Following Plugin Vulnerability
A critical security vulnerability has been discovered in the popular WordPress plugin Anti-Spam by CleanTalk, which is installed on over 200,000 websites. The vulnerability, which includes two distinct flaws (CVE-2024-10542 and CVE-2024-10781), could allow attackers to install and activate arbitrary plugins…
Beware Of SpyLoan Apps Exploits Social Engineering To Steal User Data
SpyLoan apps, a type of PUP, are rapidly increasing, exploiting social engineering to deceive users into granting excessive permissions, where these apps, installed millions of times, exfiltrate sensitive data to C2 servers via encrypted HTTP requests. Primarily targeting South America,…
Researchers Detailed Tools Used By Hacktivists Fueling Ransomware Attacks
CyberVolk, a politically motivated hacktivist group, has leveraged readily available ransomware builders like AzzaSec, Diamond, LockBit, and Chaos to launch DDoS and ransomware attacks against targets opposing Russian interests. The highly skilled members of the group modify and improve these…
Blue Yonder Ransomware Attack Impacts Starbucks & Multiple Supermarkets
A ransomware attack on Blue Yonder, a leading supply chain management software provider, has created ripples across global retail and manufacturing sectors, affecting major players like Starbucks and prominent UK supermarket chains. The breach, which occurred on November 21, underscores…
Multiple Flaws With Android & Google Pixel Devices Let Attackers Elevate Privileges
Several high-severity vulnerabilities have been identified in Android and Google Pixel devices, exposing millions of users to potential security risks. These flaws, categorized under various CVEs (Common Vulnerabilities and Exposures), range from privilege escalation to data theft and unauthorized access…
IBM Workload Scheduler Vulnerability Stores User Credentials in Plain Text
IBM has issued a security bulletin warning customers about a vulnerability in its Workload Scheduler software that allows user credentials to be stored in plain text. This issue, identified as CVE-2024-49351, could enable local users to access sensitive information such…
CISA Details Red Team Assessment Including TTPs & Network Defense
The Cybersecurity and Infrastructure Security Agency (CISA) recently detailed findings from a Red Team Assessment (RTA) conducted on a critical infrastructure organization in the United States. The assessment, carried out over three months, simulated real-world cyberattacks to evaluate the organization’s…
Dell Wyse Management Suite Vulnerabilities Let Attackers Exploit Affected Systems Remotely
Dell Technologies has released a security update for its Wyse Management Suite (WMS) to address multiple vulnerabilities that could allow malicious users to compromise affected systems. Wyse Management Suite is a flexible hybrid cloud solution that empowers IT admin to securely…
Python NodeStealer: Targeting Facebook Business Accounts to Harvest Login Credentials
The Python-based NodeStealer, a sophisticated info-stealer, has evolved to target new information and employ advanced techniques, whereas recent variants focus on stealing Facebook Ads Manager budget details, potentially enabling malicious ad campaigns. Now they pilfer credit card information alongside browser…
Threat Actors Exploit Google Docs And Weebly Services For Malware Attacks
Phishing attackers used Google Docs to deliver malicious links, bypassing security measures and redirecting victims to fake login pages hosted on Weebly, targeting telecommunications and financial sectors in late October 2024. Financially motivated threat actors exploit Weebly’s ease of use…
XSS Vulnerability in Bing.com Let Attackers Send Crafted Malicious Requests
A significant XSS vulnerability was recently uncovered in Microsoft’s Bing.com, potentially allowing attackers to execute malicious JavaScript and send crafted requests to interconnected Microsoft applications like Outlook, OneDrive, and Copilot. The exploit leveraged the trust placed in Bing’s root domain…
Meta Removed 2 Million Account Linked to Malicious Activities
Meta has announced the removal of over 2 million accounts connected to malicious activities, including sophisticated fraud schemes such as “pig butchering.” This move is part of Meta’s ongoing effort to combat organized criminal networks that exploit social media platforms…
Veritas Enterprise Vault Vulnerabilities Lets Attackers Execute Arbitrary Code Remotely
Critical security vulnerability has been identified in Veritas Enterprise Vault, a widely-used archiving and content management solution. The vulnerability, rated with a CVSS v3.1 Base Score of 9.8 (Critical), could allow attackers to execute arbitrary code on affected servers. This…
7-Zip RCE Vulnerability Let Attackers Execute Remote Code
A critical security vulnerability has been disclosed in the popular file archiving tool 7-Zip, allowing attackers to execute arbitrary code remotely. The flaw, identified as CVE-2024-11477, has been attributed to an integer underflow in the Zstandard decompression implementation, which could…
Massive Credit Card Leak, Database of 1,221,551 Cards Circulating on Dark Web
A massive data breach has sent shockwaves across the globe, as a database containing sensitive financial information for over 1.2 million credit cards has been leaked on the dark web. According to reports from cybersecurity watchers, the database was shared…
Nearest Neighbor Attacks: Russian APT Hack The Target By Exploiting Nearby Wi-Fi Networks
Recent research has revealed that a Russian advanced persistent threat (APT) group, tracked as “GruesomeLarch” (also known as APT28, Fancy Bear, or Forest Blizzard), has unveiled a novel attack technique dubbed the “Nearest Neighbor Attack.” Leveraging compromised Wi-Fi networks close…
240+ Domains Used By PhaaS Platform ONNX Seized by Microsoft
Microsoft’s Digital Crimes Unit (DCU) has disrupted a significant phishing-as-a-service (PhaaS) operation run by Egypt-based cybercriminal Abanoub Nady, known online as “MRxC0DER.” Nady developed and sold “do-it-yourself” phishing kits under the fraudulent “ONNX” brand, enabling cybercriminals to easily launch large-scale…
Earth Kasha Upgraded Their Arsenal With New Tactics To Attack Organizations
Earth Kasha, a threat actor linked to APT10, has expanded its targeting scope to India, Taiwan, and Japan, leveraging spear-phishing and exploiting vulnerabilities in public-facing applications like SSL-VPN and file storage services. The group has deployed various backdoors, including Cobalt…
Russian TAG-110 Hacked 60+ Users With HTML Loaded & Python Backdoor
The Russian threat group TAG-110, linked to BlueDelta (APT28), is actively targeting organizations in Central Asia, East Asia, and Europe by deploying custom malware, HATVIBE and CHERRYSPY, to compromise government entities, human rights groups, and educational institutions. Initial access is…
Raspberry Robin Employs TOR Network For C2 Servers Communication
Raspberry Robin, a stealthy malware discovered in 2021, leverages advanced obfuscation techniques to evade detection and analysis by infiltrating systems primarily via USB drives, utilizing the TOR network for covert communication with its C2 servers. The malware’s multi-layered structure and…
145,000 ICS Systems, Thousands of HMIs Exposed to Cyber Attacks
Critical infrastructure, the lifeblood of modern society, is under increasing threat as a new report from Censys reveals that over 145,000 industrial control system (ICS) devices are exposed to the internet. Among these, thousands of human-machine interfaces (HMIs) — which…
DOJ Asks Google to Sell $20 Billion Worth Chrome to End Monopoly
In a dramatic escalation of its antitrust lawsuit against Google, the U.S. Department of Justice (DOJ) has proposed sweeping changes to the tech giant’s operations, including the forced sale of its Chrome browser and potentially its Android operating system. The…
US Seizes PopeyeTools Cybercrime Platform & Arrested Admins
The U.S. Department of Justice (DOJ) announced the seizure of the illicit PopeyeTools platform, a notorious online marketplace for stolen credit cards and cybercrime tools. Alongside the takedown, authorities unsealed criminal charges against three alleged administrators: Abdul Ghaffar (25) and…
Chinese Hackers Breached Deep Into US Telecom to Spy on Calls and Texts
In a breach that lawmakers are calling the most serious in U.S. history, Chinese hackers infiltrated the nation’s telecommunications systems, gaining the ability to listen to phone conversations and read text messages by exploiting outdated equipment and vulnerabilities in network…
FortiClient VPN Flaw Enables Undetected Brute-Force Attacks
A design flaw in the logging mechanism of Fortinet’s VPN servers has been uncovered, allowing attackers to conduct brute-force attacks without detection. This vulnerability, disclosed by cybersecurity researchers at Pentera, highlights a critical gap in Fortinet’s ability to log successful…
Helldown Ransomware Attacking VMware ESXi And Linux Servers
Helldown, a new ransomware group, actively exploits vulnerabilities to breach networks, as since August 2024, they have compromised 28 victims, leaking their data on a dedicated website. The ransomware group IS has updated its data leak site, removing three victims,…