A sophisticated phishing campaign has been discovered targeting organizations reliant on Microsoft’s Active Directory Federation Services (ADFS). This legacy single sign-on (SSO) solution, designed to streamline authentication across multiple applications, is being exploited by attackers to bypass multi-factor authentication (MFA)…
Tag: Cyber Security News
CISA Releases Guidance to Protect Firewalls, Routers, & Internet-Facing Servers
The Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with international cybersecurity authorities, has issued comprehensive guidance aimed at securing network edge devices. These devices, which include firewalls, routers, VPN gateways, Internet of Things (IoT) devices, internet-facing servers, and operational…
Critical Veeam Backup Vulnerability Let Attackers Execute Arbitrary Code to Gain Root Access
A critical vulnerability, identified as CVE-2025-23114, has been discovered in the Veeam Updater component, a key element of multiple Veeam backup solutions. This flaw enables attackers to execute arbitrary code on affected servers through a Man-in-the-Middle (MitM) attack, potentially granting…
0-Day Vulnerabilities in Microsoft Sysinternals Tools Allow Attackers To Launch DLL Injection Attacks on Windows
A critical security vulnerability has been identified in nearly all Microsoft Sysinternals tools, presenting a significant risk to IT administrators and developers who rely on these utilities for system analysis and troubleshooting. This vulnerability, outlining how attackers can exploit DLL…
Hackers Exploiting A Six-Year-Old IIS Vulnerability To Gain Remote Access
The eSentire Threat Response Unit (TRU) revealed that threat actors are actively exploiting a six-year-old IIS vulnerability in Progress Telerik UI for ASP.NET AJAX to gain remote access to systems. This vulnerability, identified as CVE-2019-18935, allows attackers to execute arbitrary…
TinyZero – Researchers Replicated DeepSeek’s R1-Zero Model for Just $30
In an impressive demonstration of cost-effective AI research, a group of researchers has successfully replicated DeepSeek’s R1-Zero model for just $30. Dubbed TinyZero, this project focuses on countdown and multiplication tasks, leveraging reinforcement learning (RL) to enable a 3-billion-parameter (3B)…
CISA Adds Apache, Microsoft Vulnerabilities to Its Database that Are Actively Exploited in the Wild
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has updated its Known Exploited Vulnerabilities (KEV) Catalog, adding several newly identified vulnerabilities to its authoritative list of security flaws exploited in the wild. This catalog Developed to assist cybersecurity professionals in…
Chrome Use-After-Free Vulnerabilities Let Attackers Execute Remote Code – Update Now
The Google Chrome team has officially released Chrome 133, now available on the stable channel for Windows, Mac, and Linux. This update, version 133.0.6943.53 for Linux and 133.0.6943.53/54 for Windows and Mac, brings a host of improvements and critical security…
AMD SEV Vulnerability Allows Malicious CPU Microcode Injection as Admin
AMD has disclosed a high-severity vulnerability (CVE-2024-56161) in its Secure Encrypted Virtualization (SEV) technology, which could allow attackers with administrative privileges to inject malicious CPU microcode. This flaw compromises the confidentiality and integrity of virtual machines (VMs) protected by SEV-SNP,…
New Tiny FUD Attacking macOS Users Bypassing Antivirus and Security Tools
A new, highly sophisticated malware known as Tiny FUD has been identified, targeting macOS users with advanced evasion techniques that allow it to bypass traditional antivirus and security tools. This malware leverages process name spoofing, DYLD injection, and C2-based command…
3 SOC Challenges Solved by Threat Intelligence
An organization’s cyber security operation center (SOC) is a unit in charge of cyber threat prevention and mitigation. Within this framework, several critical tasks imply gathering and analyzing data on threats, incidents and attacks. This process is usually referred to…
Critical Windows OLE Zero-Click Vulnerability Let Attacker to Execute Arbitrary Code
A critical security flaw, identified as CVE-2025-21298, has been disclosed in Microsoft’s Windows Object Linking and Embedding (OLE) technology. This zero-click vulnerability, which carries a CVSS score of 9.8, allows attackers to execute arbitrary code remotely by exploiting Microsoft Outlook…
Hackers Using HTTP Client Tools To Takeover Microsoft 365 Accounts
Hackers have increasingly been using HTTP client tools to orchestrate sophisticated account takeover attacks on Microsoft 365 environments. A staggering 78% of Microsoft 365 tenants have been targeted at least once by such attacks, highlighting the evolving tactics of threat…
Google Patched Linux Kernel RCE Vulnerability In Android Allow Attackers Gain Read/Write Access
Google has released its February 2025 Android Security Bulletin, which addresses 47 vulnerabilities impacting Android devices. A notable issue is a patched Linux kernel vulnerability (CVE-2024-53104) that could enable attackers to execute remote code (RCE), granting unauthorized read/write access to affected systems.…
Abandoned AWS S3 Buckets Can be Reused to Hijack Global Software Supply Chain
Researchers at WatchTowr Labs have uncovered a critical security vulnerability in abandoned Amazon Web Services (AWS) S3 buckets that could enable attackers to hijack the global software supply chain. The research highlights how these neglected cloud storage resources could facilitate…
New Attack Technique to Bypassing EDR as Low Privileged Standard User
A new cyberattack technique has emerged, enabling attackers to bypass Endpoint Detection and Response (EDR) systems while operating under a low-privileged standard user account. Traditionally, EDR evasion requires elevated privileges, such as administrative or system-level access. However, this innovative approach…
Microsoft Azure AI Face Service Elevation of Privilege Vulnerability Let Attackers Gain Network Access
Microsoft has disclosed a critical vulnerability, CVE-2025-21415, impacting the Azure AI Face Service, which is classified as an Elevation of Privilege issue, allowing attackers to bypass authentication mechanisms via spoofing, escalating their privileges over a network. However, Microsoft has confirmed…
Roundcube XSS Vulnerability Let Attackers Inject Malicious Files
A critical Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2024-57004, has been discovered in Roundcube Webmail version 1.6.9. This flaw allows remote authenticated users to upload malicious files disguised as email attachments, posing significant risks to individuals and organizations using the…
Canadian National Charged for Stealing $65 Million in Crypto
U.S. prosecutors have charged Andean Medjedovic, a 22-year-old Canadian, with five counts of criminal indictment for allegedly orchestrating a sophisticated cryptocurrency theft. Medjedovic is accused of exploiting vulnerabilities in the KyberSwap and Indexed Finance DeFi protocols, resulting in significant financial…
ValleyRAT Attacking Org’s Accounting Department With New Delivery Techniques
Researchers unveiled a sophisticated malware campaign in a recent cybersecurity alert involving ValleyRAT, a Remote Access Trojan (RAT) frequently linked to the Silver Fox APT group. This threat has evolved with new delivery techniques, targeting key roles within organizations, particularly…
Crtical Microsoft Accounts Authentication Bypass Vulnerability Let Attackers Gain Remote Access
Microsoft has issued a security advisory for CVE-2025-21396, a critical authentication bypass vulnerability that could allow attackers to spoof credentials and gain unauthorized access to Microsoft accounts. Cybersecurity experts are urging users and organizations to swiftly address this issue by…
Multiple Dell PowerProtect Vulnerabilities Let Attackers Compromise System
Dell Technologies has disclosed multiple critical vulnerabilities affecting its PowerProtect product line, including Data Domain (DD) appliances, PowerProtect Management Center, and other associated systems. These vulnerabilities, if exploited, could allow attackers to compromise system integrity, escalate privileges, or execute arbitrary…
AsyncRAT Abusing Python and TryCloudflare For Stealthy Malware Delivery
A recent cybersecurity threat has emerged in the form of AsyncRAT, a remote access trojan (RAT) that leverages Python and TryCloudflare for stealthy malware delivery. This sophisticated campaign involves a complex sequence of events, starting with phishing emails that deceive…
Casio UK Web Store Hacked to Inject Customer Credit Card Stealing Scripts
A sophisticated web-skimming campaign targeting multiple websites, including the UK online store of electronics giant Casio (casio[.]co.uk). The attack, which exposed sensitive customer data, highlights ongoing vulnerabilities in e-commerce platforms and the evolving tactics of cybercriminals. The breach on casio.co.uk…
PoC Exploit Released for Active Directory Domain Services Privilege Escalation Vulnerability
A proof-of-concept (PoC) exploit code has been released for CVE-2025-21293, a critical Active Directory Domain Services Elevation of Privilege vulnerability. This vulnerability, discovered in September 2024 and patched in January 2025, has raised concerns due to its potential to allow…
Casio UK Store Hacked to Inject Customer Credit Card Stealing Scripts
A sophisticated web-skimming campaign targeting multiple websites, including the UK online store of electronics giant Casio (casio[.]co.uk). The attack, which exposed sensitive customer data, highlights ongoing vulnerabilities in e-commerce platforms and the evolving tactics of cybercriminals. The breach on casio.co.uk…
British PM Keir Starmer’s Personal Email Allegedly Hacked by Russian Operatives
British Prime Minister Keir Starmer was reportedly the target of a sophisticated cyberattack by Russian-linked hackers in 2022, prior to his tenure as prime minister. The revelations, detailed in the newly published book “Get In: The Inside Story of Labour…
768 Vulnerabilities Exploited in the Wild in 2024: A 20% Year-Over-Year Surge
2024 marked a record-breaking year for cybersecurity challenges as threat actors ramped up their exploitation of vulnerabilities. According to the latest findings from VulnCheck, 768 Common Vulnerabilities and Exposures (CVEs) were publicly reported as exploited in the wild for the…
New Malware Campaign Mimic Tax Agencies Attacking Financial Organizations
Cybersecurity researchers have uncovered a sophisticated malware campaign exploiting tax season to target financial organizations and individuals globally. The campaign involves phishing emails impersonating tax agencies and financial institutions, delivering malware and harvesting sensitive credentials. The malicious actors behind this…
MediaTek Chipsets WLAN Vulnerabilities Exposes Million of Devices to Remote Attacks
Researchers have identified critical vulnerabilities in MediaTek wireless LAN (WLAN) drivers that could potentially expose millions of devices to severe security risks. These vulnerabilities, tracked under the Common Vulnerabilities and Exposures (CVE) identifiers CVE-2025-20631, CVE-2025-20632, and CVE-2025-20633, allow attackers to…
Globe Life Ransomware Attack – 850,000+ Users Personal & Health Data Exposed
Globe Life Inc. has become the latest victim of a high-profile cybersecurity incident, with a threat actor claiming access to sensitive personal and health data of over 850,000 individuals. The attack, while not involving traditional ransomware, appears to be an…
Microsoft Announces AI Avatar for Teams Meeting
Microsoft has announced the rollout of Avatars for Microsoft Teams, a feature that allows users to create personalized avatars for meetings using Artificial Intelligence (AI). This revolutionary update is designed to make virtual meetings more engaging and inclusive by enabling…
ChatGPT Announces Deep Research That Handles Complex Tasks Faster Than Humans
OpenAI has introduced an innovative feature for ChatGPT called “Deep Research,” designed to handle complex, multi-step research tasks with exceptional efficiency. Powered by the upcoming OpenAI o3 model, this tool promises to revolutionize how professionals and everyday users approach in-depth…
Arm Mali GPU Kernel Driver 0-Day Vulnerability Actively Exploited in the Wild
Arm, a leader in semiconductor technology, has disclosed a series of critical security vulnerabilities affecting its Mali GPU Kernel Drivers and firmware. These vulnerabilities, spanning across multiple GPU architectures, including Bifrost, Valhall, and the Arm 5th Gen GPU Architecture, pose…
Hackers Abusing AWS & Microsoft Azure To Launch Large-Scale Cyber Attacks
Hackers are increasingly leveraging cloud platforms like Amazon Web Services (AWS) and Microsoft Azure to orchestrate large-scale cyber attacks. These platforms, which host critical infrastructure for businesses worldwide, are being exploited through sophisticated methods, including fraudulent account setups, API key…
New Phishing Attack Hijacking High-Profile X Accounts To Promote Phishing Sites
A sophisticated phishing campaign has emerged, targeting high-profile X (formerly Twitter) accounts to promote fraudulent cryptocurrency schemes. The attack exploits the credibility of verified accounts, leveraging their reach to deceive users into visiting phishing sites. The attackers employ a variety…
Alibaba Cloud Storage Service Vulnerability Allows Unauthorized Data Uploads
A significant security vulnerability has been discovered in Alibaba Cloud Object Storage Service (OSS), enabling unauthorized users to upload data to cloud storage. This misconfiguration poses risks such as unauthorized data storage, overwriting sensitive files, and potential data breaches. The…
NVIDIA GPU Display Driver Vulnerability Lets Attackers Steal Files Remotely – Update Now
NVIDIA has released a critical software security update to address multiple vulnerabilities affecting its GPU Display Driver and Virtual GPU (vGPU) software. Among these is CVE‑2024‑0149, a vulnerability in the NVIDIA GPU Display Driver for Linux that could allow attackers unauthorized…
Linux 6.14 Released – 500,000 Lines of Code Modified
Linus Torvalds, the creator of the Linux kernel, has announced the release of Linux 6.14-rc1, marking the end of the two-week merge window. This release is notably smaller than usual, attributed to reduced development activity during the holiday season. Despite…
U.S Community Health Center Hacked – 1 Million Patients Data Stolen
Community Health Center, Inc. (CHC), a Connecticut-based federally qualified health center, has disclosed a data breach following a criminal cyberattack on its systems. The breach potentially exposed the sensitive personal and health information of patients and individuals who received COVID-19…
APT37 Hackers Abusing Group Chats To Attack Via Malicious LNK File
The North Korean state-sponsored hacking group APT37 (aka ScarCruft, Reaper), has been identified leveraging group chat platforms to distribute malicious LNK files. This latest tactic highlights the group’s evolving methods to infiltrate systems and exfiltrate sensitive data. APT37’s recent campaign…
Parrot 6.3 Released With Improved Security & New Hacking Tools
ParrotOS, the cybersecurity-focused Linux distribution, has recently released its latest update, Parrot 6.3, which includes a number of new features, performance improvements, and updated tools to enhance the user experience. This release is designed to make ParrotOS faster, more stable,…
5 Best Infrastructure as Code (IaC) Vulnerability Scanning Tools in 2025
As organizations increasingly adopt Infrastructure as Code (IaC) to automate and manage their cloud environments, ensuring the security of these configurations has become a critical priority. IaC allows teams to define infrastructure using code, enabling rapid deployment and scalability, but…
Devil-Traff – New Malicious Bulk SMS Portal That Fuels Phishing Attacks
A new threat to cybersecurity has emerged in the form of Devil-Traff, a bulk SMS platform designed to facilitate large-scale phishing campaigns. Leveraging advanced features such as sender ID spoofing, API integration, and support for malicious content, this platform has…
10 Best Web Application Firewall (WAF) – 2025
A Web Application Firewall (WAF) is a security solution designed to protect web applications by monitoring, filtering, and blocking malicious HTTP/S traffic. Operating at the OSI model’s application layer (Layer 7), a WAF acts as a reverse proxy between users…
New Windows 11 (x64) Modern Kernel Race Conditions Uncovered – PoC Released
A sophisticated race condition vulnerability affecting Windows 11 (x64) kernel operations, highlighting ongoing concerns about kernel-level security in modern operating systems. These race conditions, which stem from the operating system’s inability to synchronize shared resources during concurrent operations properly, could…
New Process Hollowing Attack Vectors Uncovered in Windows 11 (24H2)
The recent release of Windows 11 version 24H2 has introduced a range of new features and updates, but it has also raised significant cybersecurity concerns. A longstanding malware technique known as Process Hollowing or RunPE has encountered compatibility issues on…
Weekly Cybersecurity Update: Recent Cyber Attacks, Vulnerabilities, and Data Breaches
Welcome to this week’s Cybersecurity Newsletter, which presents the latest updates and key insights from the continuously evolving domain of cybersecurity. In the fast-paced digital environment of today, it is imperative to remain informed, and our objective is to provide…
National Change Your Password Day! – CISA Recommends to Enable MFA
February 1 marks National Change Your Password Day, a timely initiative to combat escalating cyber risks by promoting stronger password practices. With hacking incidents surging globally, the Cybersecurity and Infrastructure Security Agency (CISA) emphasizes the critical role of multi-factor authentication (MFA) in safeguarding digital accounts. Despite annual reminders to update…
WantToCry Ransomware Exploits SMB Vulnerabilities to Remotely Encrypts NAS Drives
The notorious WantToCry ransomware group leverages misconfigured Server Message Block (SMB) services to infiltrate networks and launch widespread attacks. The weaknesses in SMBs, such as weak credentials, outdated software, and poor security configurations, are providing attackers with an easy entry…
Israeli Firm Paragon Attack WhatsApp With New Zero-Click Spyware
WhatsApp revealed on Friday that a “zero-click” spyware attack, attributed to the Israeli firm Paragon, has targeted scores of users worldwide, including journalists and members of civil society. The spyware targeted nearly 100 WhatsApp users, including journalists, and did not…
WhatsApp New Privacy Let Users Control who Can See The Profile Photo
In a move to enhance user privacy, WhatsApp has rolled out a significant update allowing users to control who can view their profile photos. This feature, available on both iOS and Android devices, provides users with more granular control over…
Google Has Blocked 2.28 Million Malicious Apps Entering Into Play Store
Google announced today it blocked a record 2.28 million policy-violating apps from entering the Play Store in 2023, leveraging advanced machine learning, stricter developer vetting, and cross-industry collaborations to combat evolving cyberthreats. The milestone underscores efforts to uphold its SAFE…
New Threat Hunting Technique to Uncover Malicious Infrastructure Using SSL History
As internet security evolves, SSL (Secure Sockets Layer) certificates, cornerstones of encrypted communication, are stepping into a brand-new role as vital tools in the fight against cyberattacks. Experts are now leveraging SSL intelligence and historical SSL data to expose hidden…
SSL Intelligence – New Threat Hunting Technique to Uncover Malicious Infrastructure Using SSL History
As internet security evolves, SSL (Secure Sockets Layer) certificates, cornerstones of encrypted communication, are stepping into a brand-new role as vital tools in the fight against cyberattacks. Experts are now leveraging SSL intelligence and historical SSL data to expose hidden…
TAG-124 Hacked 1000+ WordPress Sites To Embed Payloads
A sophisticated cyber campaign orchestrated by the threat group TAG-124 has compromised over 1,000 WordPress websites to deploy malicious payloads. The operation leverages a multi-layered Traffic Distribution System (TDS) to infect users with malware, demonstrating advanced evasion tactics and infrastructure…
Hackers Abusing GitHub Infrastructure to Deliver Lumma Stealer
Cybersecurity researchers have uncovered a sophisticated campaign leveraging GitHub’s trusted release infrastructure to distribute the Lumma Stealer malware. This information-stealing malware, part of a growing trend of cybercriminals abusing legitimate platforms, poses significant risks by exfiltrating sensitive data and deploying…
New York Blood Center Hit By Ransomware Attack – IT Systems Affected
The New York Blood Center Enterprises (NYBC), a vital organization responsible for supplying blood and blood products to hospitals across the region, has fallen victim to a ransomware attack. The incident has significantly disrupted its IT systems, forcing the organization…
DeepSeek’s Growing Influence Sparks a Surge in Frauds and Phishing Attacks
The rapid rise of DeepSeek, a Chinese artificial intelligence (AI) company, has not only disrupted the AI industry but also attracted the attention of cybercriminals. As its AI Assistant app became the most downloaded free app on the iOS App…
GitHub Copilot Jailbreak Vulnerability Let Attackers Train Malicious Models
Researchers have uncovered two critical vulnerabilities in GitHub Copilot, Microsoft’s AI-powered coding assistant, that expose systemic weaknesses in enterprise AI tools. The flaws—dubbed “Affirmation Jailbreak” and “Proxy Hijack”—allow attackers to bypass ethical safeguards, manipulate model behavior, and even hijack access…
Coyote Banking Malware Weaponizing Windows LNK Files To Execute Malicious Scripts
A new wave of cyberattacks leveraging the Coyote Banking Trojan has been identified, targeting financial institutions in Brazil. This sophisticated malware employs malicious Windows LNK (shortcut) files as an entry point to execute PowerShell scripts, enabling multi-stage infection chains that…
Cisco’s Webex Chat Vulnerabilities Let Attackers Access Organizations Chat Histories
Cisco’s Webex Chat (formerly known as IMI Chat) was found to have a significant security flaw that exposed the sensitive chat histories of hundreds to thousands of organizations. The exploit allowed unauthorized attackers to access millions of live customer support…
Malware Found in Healthcare Patient Monitors Linked to Chinese IP Address
A critical cybersecurity vulnerability has been uncovered in Contec CMS8000 patient monitors, revealing embedded malware that poses significant risks to patient safety and data security. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported that the devices include a backdoor…
Authorities Take Down Cracked & Nulled Hacking Forums Used by 10 Million Users
In a law enforcement operation dubbed “Operation Talent,” an international coalition of law enforcement agencies led by Germany’s Bundeskriminalamt (BKA) and Europol has dismantled two of the world’s largest cybercrime forums: Cracked.io and Nulled.to. These platforms, which collectively hosted over…
D-Link Routers Vulnerability Let Attackers Gain Full Router Control Remotely
A critical unauthenticated Remote Code Execution (RCE) vulnerability has been affecting DSL-3788 routers, allowing attackers to acquire complete control over the router remotely. The flaw has been detected in firmware versions v1.01R1B036_EU_EN and below. This vulnerability was reported by Max…
Microsoft to Boost M365 Bounty Program With New Products & Rewards Up to $27,000
A significant extension of Microsoft’s Microsoft 365 (M365) Bounty Program has been announced. The program now includes new Viva products under its scope for identifying vulnerabilities, with rewards reaching up to $27,000 for critical submissions. This update underscores Microsoft’s commitment…
VMware Aria Operations Vulnerabilities Let Attackers Perform Admin Operations
Broadcom has addressed multiple vulnerabilities in its VMware Aria Operations for Logs and VMware Aria Operations products. These vulnerabilities, identified as CVE-2025-22218, CVE-2025-22219, CVE-2025-22220, CVE-2025-22221, and CVE-2025-22222, pose significant risks, including unauthorized access to sensitive data and privilege escalation. The…
Windows Vulnerability in COM Objects Trigger RCE To Control The Systems Remotely
James Forshaw of Google Project Zero has shed light on a significant security vulnerability in Windows related to accessing trapped COM objects through the IDispatch interface. This research highlights an intriguing bug class that exploits cross-process communication features in object-oriented…
New Jailbreak Techniques Expose DeepSeek LLM Vulnerabilities, Enabling Malicious Exploits
Recent revelations have exposed critical vulnerabilities in DeepSeek’s large language models (LLMs), particularly DeepSeek-R1, through advanced jailbreaking techniques. These exploits, including “Bad Likert Judge,” “Crescendo,” and “Deceptive Delight,” have demonstrated the ease with which malicious actors can bypass safety measures…
Tata Technologies Hacked – Ransomware Attack Compromises IT Systems
In a recent disclosure to the stock exchanges, Tata Technologies Limited announced that it has been the victim of a ransomware attack affecting some of its IT assets. Tata Technologies, headquartered in Pune, India, is a subsidiary of the Tata…
ChatGPT-4o Jailbreak Vulnerability “Time Bandit” Let Attackers Create Malware
A new jailbreak vulnerability in OpenAI’s ChatGPT-4o, dubbed “Time Bandit,” has been exploited to bypass the chatbot’s built-in safety functions. This vulnerability allows attackers to manipulate the chatbot into producing illicit or dangerous content, including instructions for malware creation, phishing…
Tor Project X Account Hacked to Promote Cryptocurrency Scheme
The Tor Project, a renowned organization dedicated to online privacy and anonymity, has fallen victim to a cyberattack. On January 30, 2025, the group’s official X (formerly Twitter) account was compromised and used to promote a fraudulent cryptocurrency scheme. The…
Tria Stealer Trojan Exploits Android Phones To Exfiltrate SMS Messages
A newly discovered Android malware campaign, dubbed Tria Stealer, has been targeting users in Malaysia and Brunei since mid-2024. Leveraging fake wedding invitations as a lure, this Trojan steals sensitive data, including SMS messages, call logs, and app notifications, and…
Phorpiex Botnet Distributes LockBit Ransomware Through Compromised Websites
Cybersecurity experts have uncovered the use of the Phorpiex botnet to distribute LockBit Black ransomware (LockBit 3.0) through millions of phishing emails and compromised websites. This campaign, active since April 2024, marks a significant evolution in ransomware delivery methods, leveraging…
Top 3 Most Popular Malware TTPs of the Past Year
Cyber threats evolve rapidly, but some tactics stand out for their widespread use and effectiveness. In its latest 2024 trends report, ANY.RUN identified the top malware Tactics, Techniques, and Procedures (TTPs) employed by cyber attackers for malicious purposes. Let’s dive…
Arcus Media Ransomware Delete Backup, Clear Logs, Disable Remote After Lock The Files
The Arcus Media ransomware has emerged as a significant cybersecurity threat, employing advanced techniques to maximize disruption and hinder recovery efforts. Operating under a Ransomware-as-a-Service (RaaS) model, the group has targeted industries worldwide, including business services, retail, and media, since…
New Android Malware Exploiting Wedding Invitations to Steal Victims WhatsApp Messages
A sophisticated Android malware campaign, dubbed Tria Stealer, has been targeting users in Malaysia and Brunei since mid-2024. The malware uses fake wedding invitations as a lure to trick victims into installing a malicious Android Package Kit (APK). Once installed,…
Canon Printer Vulnerabilities Let Attackers Execute Arbitrary Code Remotely
Multiple critical security vulnerabilities affecting Canon Laser Printers and Small Office Multifunctional Printers. These vulnerabilities, identified as buffer overflow flaws, could allow attackers to execute arbitrary code remotely or render the devices inoperative through Denial-of-Service (DoS) attacks. The affected models…
Windows 11 Start Menu Now Let Users Access Their Android & iPhones
Microsoft has unveiled a significant update to Windows 11, enhancing the Start menu with seamless integration for both Android and iPhone devices. This feature, previously exclusive to Android users, now extends to iPhone owners, allowing them to access their phone’s…
Hackers Exploit Public-facing Vulnerable IIS, Apache, SQL Servers to Attack Gov & Telcom Networks
A sophisticated cyberespionage campaign, tracked as CL-STA-0048, has been identified targeting government and telecommunications networks in South Asia. The attackers exploited vulnerabilities in public-facing servers running Microsoft IIS, Apache Tomcat, and MSSQL to gain unauthorized access and exfiltrate sensitive data.…
North Korean APT Lazarus Compromises Developers via Malicious NPM Packages
The North Korean state-sponsored hacking group Lazarus has been implicated in a sophisticated supply chain attack targeting developers through malicious Node Package Manager (NPM) packages. Security researchers have identified the package, postcss-optimizer, as a key vector for delivering malware to…
Hackers Use 10,000 WordPress Sites To Deliver Malware To macOS and Microsoft Systems
A sophisticated cyberattack has compromised over 10,000 WordPress websites, delivering cross-platform malware to unsuspecting users. The campaign exploits outdated WordPress versions and plugins, redirecting visitors to fake browser update pages that deploy malicious software targeting both macOS and Windows systems.…
Hackers Poisoning DNS Responses to Exploit Vulnerabilities in Active Directory Environments
A new implementation of Kerberos relaying over HTTP has been unveiled, leveraging multicast poisoning to exploit vulnerabilities in Active Directory environments. The research, published by Quentin Roland, builds on previous work by cybersecurity expert James Forshaw, demonstrating how attackers can…
Lazarus Hackers Altering Legitimate Software Packages To Launch Large-Scale Cyber Attack
The notorious Lazarus Group, a North Korean state-sponsored Advanced Persistent Threat (APT), has been implicated in a large-scale cyberattack campaign dubbed “Operation Phantom Circuit.” This operation involves embedding malicious backdoors into legitimate software packages, targeting developers and organizations worldwide. The…
New SystemBC RAT Attack Linux Systems to Hack Corporate Infrastructure
A new variant of the SystemBC Remote Access Trojan (RAT) has emerged, explicitly targeting Linux-based systems. Known for its stealth capabilities, this malware is designed to infiltrate corporate networks, cloud servers, and IoT devices, posing a significant threat to internal…
DeepSeek AI is Now Powering With Huawei Ascend 910C Chip
DeepSeek AI has announced that its latest AI model, DeepSeek R1, now relies on Huawei’s Ascend 910C chip for inference tasks in a bold move that could ripple through the tech industry. This shift comes after the model was initially…
Critical RCE Vulnerability Found In AI Development Platform Lets Attackers Gain Root Access
A critical Remote Code Execution (RCE) vulnerability was discovered in the Lightning AI platform, a widely used tool for AI development. The flaw, which has since been patched, allowed attackers to gain root access by exploiting a hidden URL parameter.…
TeamViewer Windows App Let Attackers Escalate Privileges to System User
A critical security vulnerability has been identified in TeamViewer Clients for Windows, allowing attackers with local access to escalate their privileges to the system level. The flaw, tracked as CVE-2025-0065, affects versions of TeamViewer Full Client and Host prior to…
OPNsense 25.1 Released With Improved Security Zones & FreeBSD 14.2 Plus
OPNsense, the widely recognized open-source firewall and routing platform, celebrates its 10th anniversary with the release of version 25.1, codenamed “Ultimate Unicorn.” This milestone release introduces significant upgrades, including enhanced security zone configurations, a redesigned user interface, and the integration…
DeepSeek is Now Available With Microsoft Azure AI Foundry & GitHub
Microsoft has officially announced the integration of DeepSeek R1, an AI model, into its Azure AI Foundry platform and GitHub. This move positions DeepSeek R1 among over 1,800 models, including frontier, open-source, and task-specific AI solutions. The integration aims to…
Hackers Exploit RDP Protocol To Gain Windows Access To Control Browser Remotely
Cybercriminals have been exploiting vulnerabilities in the Remote Desktop Protocol (RDP) to gain unauthorized access to Windows systems and remotely control web browsers. This method not only compromises individual machines but also poses a significant threat to enterprise networks. RDP,…
Google’s Subdomain ‘g.co’ Hacked – A Tricky Phone Call Lets Hackers Access Your Google Account Remotely
Cybercriminals recently exploited Google’s g.co subdomain to carry out a meticulously crafted scam over a vishing call. The incident was chronicled by Zach Latta, founder of Hack Club, who nearly fell victim to the attack. His account sheds light on…
Threat Actors Exploit Government Website Vulnerabilities For Phishing Attacks
Cybercriminals are increasingly exploiting vulnerabilities in government websites to carry out phishing campaigns, leveraging the inherent trust users place in official domains. A recent report by Cofense Intelligence shows that how attackers are weaponizing .gov top-level domains (TLDs) across multiple…
DeepSeek Database Leaked – Full Control Over DB Secret keys, Logs & Chat History Exposed
A security vulnerability in DeepSeek, a prominent Chinese AI startup, exposed a publicly accessible ClickHouse database containing highly sensitive information, including over a million lines of log streams. The breach, which included chat logs, API keys, backend details, and operational…
Microsoft 365 Down – Widespread Outage Affects Users and Admins
Microsoft 365 users worldwide encountered significant disruptions today as multiple services, including the Microsoft 365 Admin Center, reported degradation or complete inaccessibility. The issue, first noted around 18:45 GMT, has left many users unable to access key services, with some…
Hackers Allegedly Selling Fortinet Vulnerability Exploit on Dark Web Forums
A significant cybersecurity threat has emerged as hackers on a prominent Russian dark web forum claim to be selling an active exploit targeting Fortinet devices. The exploit reportedly leverages a critical vulnerability, CVE-2024-55591, which affects FortiOS versions 7.0.0 through 7.0.16. …
Apple Chips Vulnerability Exposes Credit Cards & Location History to Hackers
Researchers have uncovered two critical vulnerabilities in Apple’s custom silicon chips, dubbed SLAP (Speculative Load Address Prediction) and FLOP (False Load Output Predictions). These flaws, found in Apple’s A- and M-series processors, expose sensitive user data such as credit card…
State-sponsored Actors Abusing Gemini to Fuel Cyber Attacks
The state-sponsored threat actors are increasingly exploiting Google’s AI-powered assistant, Gemini, to enhance their cyber operations. While generative AI tools like Gemini hold immense potential for innovation and productivity, their misuse by advanced persistent threat (APT) groups and information operations…
Windows 11 24H2 Update Breaks Web camera, Audio, & USB
The most recent update for Windows 11 24H2, identified as KB5050009, has caused various kinds of technical issues for users, affecting critical functionalities like audio, Bluetooth, USB devices, and webcams. Released earlier this month, the update was intended to enhance…
WhatsApp’s Image “View Once” Feature Flaw Allowing Unlimited Views
WhatsApp’s “View Once” option is one of the privacy features in the instant messaging space that is intended to provide users with a sense of security. This feature allows users to send photos or videos that disappear after being viewed…