April 5, 2025 – Ivanti has issued an urgent security advisory for CVE-2025-22457, a critical vulnerability impacting Ivanti Connect Secure, Pulse Connect Secure, Ivanti Policy Secure, and ZTA Gateways. Rated at a CVSS score of 9.0, this stack-based buffer overflow…
Tag: GBHackers Security | #1 Globally Trusted Cyber Security News Platform
Beware! Fake Unpaid Tolls Messages Used in Phishing Attack to Steal Login Credentials
A surge in phishing text messages claiming unpaid tolls has been linked to a massive phishing-as-a-service (PhaaS) operation. These scams, which have been hitting users’ phones in waves, are part of a sophisticated campaign leveraging a platform called Lucid. Cybercriminals…
PoisonSeed Targets CRM and Bulk Email Providers in New Supply Chain Phishing Attack
A sophisticated phishing campaign, dubbed “PoisonSeed,” has been identified targeting customer relationship management (CRM) and bulk email providers to facilitate cryptocurrency-related scams. The threat actors behind this campaign are leveraging compromised credentials to export email lists and send bulk phishing…
EncryptHub Ransomware Uncovered Through ChatGPT Use and OPSEC Failures
EncryptHub, a rapidly evolving cybercriminal entity, has come under intense scrutiny following revelations of operational security (OPSEC) failures and extensive reliance on ChatGPT for its operations. This emerging threat actor has been linked to ransomware campaigns, data theft, and the…
Beware! Weaponized Job Recruitment Emails Spreading BeaverTail and Tropidoor Malware
A concerning malware campaign was disclosed by the AhnLab Security Intelligence Center (ASEC), revealing how threat actors are leveraging fake recruitment emails to distribute malicious payloads. The attackers impersonated Dev.to, a prominent developer community, and lured victims with promises of…
Malicious PyPI Package Targets E-commerce Sites with Automated Carding Script
Cybersecurity researchers from Socket have exposed a malicious Python package on PyPI, named disgrasya, designed to automate credit card fraud on WooCommerce-based e-commerce sites. Unlike conventional supply chain attacks that rely on deception or typosquatting, disgrasya was overtly malicious, leveraging…
DeepSeek-R1 Prompts Abused to Generate Advanced Malware and Phishing Sites
The release of DeepSeek-R1, a 671-billion-parameter large language model (LLM), has sparked significant interest due to its innovative use of Chain-of-Thought (CoT) reasoning. CoT reasoning enables the model to break down complex problems into intermediate steps, enhancing performance on tasks…
Beware of Clickfix: ‘Fix Now’ and ‘Bot Verification’ Lures Deliver and Execute Malware
A sophisticated browser-based malware delivery method, dubbed ClickFix, has emerged as a significant threat to cybersecurity. Leveraging deceptive prompts like “Fix Now” and “Bot Verification,” ClickFix tricks users into executing malicious commands by exploiting familiar system actions. This technique bypasses…
Hackers Use URL Shorteners and QR Codes in Tax-Themed Phishing Attacks
As the United States approaches Tax Day on April 15, cybersecurity experts have uncovered a series of sophisticated phishing campaigns leveraging tax-related themes to exploit unsuspecting users. Microsoft has identified these campaigns as employing advanced redirection techniques such as URL…
State Bar of Texas Confirms Data Breach, Begins Notifying Affected Consumers
The State Bar of Texas has confirmed a data breach following the detection of unauthorized activity on its network earlier this year. According to an official notice, the breach occurred between January 28, 2025, and February 9, 2025, during which…
Chinese Hackers Exploit Ivanti VPN Vulnerability to Deliver Malware Payloads
Ivanti disclosed a critical security vulnerability, CVE-2025-22457, affecting its Connect Secure (ICS) VPN appliances, particularly versions 22.7R2.5 and earlier. This buffer overflow vulnerability enables attackers to achieve remote code execution when exploited successfully. Security researchers from Mandiant and Ivanti have…
Top 20 Best Open-Source SOC Tools in 2025
As cyber threats continue to evolve, Security Operations Centers (SOCs) require robust tools to detect, analyze, and respond to incidents effectively. Open-source SOC tools provide cost-effective, customizable, and community-supported solutions for organizations of all sizes. In this article, we’ll explore…
Hackers Exploit Fast Flux to Evade Detection and Obscure Malicious Servers
Cybersecurity agencies worldwide have issued a joint advisory warning against the growing threat posed by “fast flux,” a sophisticated technique used by malicious actors to evade detection and obscure the locations of their command-and-control (C2) servers. The advisory, released by…
Oracle Reports Data Breach, Initiates Client Notifications
Oracle Corporation has confirmed a data breach involving its older Gen 1 servers, marking its second cybersecurity incident disclosed in recent weeks. This breach underscores vulnerabilities in legacy systems and raises concerns about the company’s ability to safeguard sensitive client…
Vite Development Server Flaw Allows Attackers Bypass Path Restrictions
A critical security vulnerability, CVE-2025-31125, has been identified in the Vite development server. Due to improper path verification during URL request processing, attackers can bypass path restrictions and gain unauthorized access to arbitrary files on affected servers. This flaw is particularly…
Malicious PDFs Responsible for 22% of All Email-Based Cyber Threats
Malicious PDF files have emerged as a dominant threat vector in email-based cyberattacks, accounting for 22% of all malicious email attachments, according to a recent report by Check Point Research. With over 87% of organizations relying on PDFs for business…
New Android Spyware Tricks Users by Demanding Passwords for Uninstallation
A newly identified Android spyware app is elevating its tactics to remain hidden and unremovable by leveraging a password prompt for uninstallation. This unsettling feature effectively blocks users from removing the app unless the correct password—set by the person who…
Critical Apache Parquet Vulnerability Allows Remote Code Execution
A severe vulnerability has been identified in the Apache Parquet Java library, specifically within its parquet-avro module. This flaw, tracked as CVE-2025-30065, exposes systems to potential Remote Code Execution (RCE) attacks. It has been rated Critical with a CVSS score of 10.0, indicating the highest level of…
Ex-ASML Russian Employee Smuggled Trade Secrets to Moscow via USB
A former employee of Dutch semiconductor firm ASML, identified as German A. (43), stands accused of smuggling sensitive trade secrets to Russia over a span of nearly nine years. The engineer, originally from Russia, reportedly transferred confidential information using USB…
Halo ITSM Vulnerability Lets Attackers Inject Malicious SQL Code
A critical security flaw has been discovered in Halo ITSM, an IT support management software widely deployed across cloud and on-premise environments. The vulnerability, which allows attackers to inject malicious SQL code, poses a significant threat to organizations relying on the…
Australian Pension Funds Hacked: Members Face Financial Losses
Several of Australia’s largest superannuation funds have been targeted in a coordinated cyberattack, leading to unauthorized access to customer accounts and financial losses for some members. Among those affected are major funds such as REST, Hostplus, AustralianSuper, Australian Retirement Trust,…
Frida Penetration Testing Toolkit Updated with Advanced Threat Monitoring APIs
In a significant update to the popular dynamic instrumentation toolkit Frida, developers have introduced powerful new APIs for advanced threat monitoring and software analysis. These enhancements, released on April 4, 2025, offer security researchers and penetration testers unprecedented capabilities in…
Apache Traffic Server Flaw Allows Request Smuggling Attacks
A critical vulnerability has been discovered in Apache Traffic Server (ATS), an open-source caching proxy server. Identified as CVE-2024-53868, this flaw enables attackers to exploit request smuggling via malformed chunked messages. Users of Apache Traffic Server are urged to upgrade to…
OpenVPN Flaw Allows Attackers Crash Servers and Run Remote Code
OpenVPN, a widely-used open-source virtual private network (VPN) software, has recently patched a security vulnerability that could allow attackers to crash servers and potentially execute remote code under certain conditions. The flaw, identified as CVE-2025-2704, affects OpenVPN servers using specific configurations…
Operation HollowQuill Uses Malicious PDFs to Target Academic and Government Networks
A newly uncovered cyber-espionage campaign, dubbed Operation HollowQuill, has been identified as targeting academic, governmental, and defense-related networks in Russia using weaponized PDF documents. The operation, tracked by SEQRITE Labs APT-Team, leverages decoy research invitations to infiltrate systems associated with…
Qilin Operators Imitate ScreenConnect Login Page to Deploy Ransomware and Gain Admin Access
In a recent cyberattack attributed to the Qilin ransomware group, threat actors successfully compromised a Managed Service Provider (MSP) by mimicking the login page of ScreenConnect, a popular Remote Monitoring and Management (RMM) tool. The attack, which occurred in January…
Hunters International Linked to Hive Ransomware in Attacks on Windows, Linux, and ESXi Systems
Hunters International, a ransomware group suspected to be a rebrand of the infamous Hive ransomware, has been linked to widespread attacks targeting Windows, Linux, FreeBSD, SunOS, and ESXi systems. Emerging in October 2023, the group has gained notoriety for its…
UAC-0219 Hackers Leverage WRECKSTEEL PowerShell Stealer to Extract Data from Computers
In a concerning development, CERT-UA, Ukraine’s Computer Emergency Response Team, has reported a series of cyberattacks attributed to the hacker group identified as UAC-0219. These attacks, which have been ongoing since the fall of 2024, utilize an advanced PowerShell-based malware…
New Phishing Campaign Targets Investors to Steal Login Credentials
Symantec has recently identified a sophisticated phishing campaign targeting users of Monex Securities (マネックス証券), a prominent online securities company in Japan formed through the merger of Monex, Inc. and Nikko Beans, Inc. The company provides individual investors with a range…
SonicWall Firewall Vulnerability Enables Unauthorized Access
Researchers from Bishop Fox have successfully exploited CVE-2024-53704, an authentication bypass vulnerability that affects SonicWall firewalls. This critical flaw allows remote attackers to hijack active SSL VPN sessions, enabling unauthorized network access without requiring user credentials. If left unpatched, the vulnerability…
DarkCloud Stealer Uses Weaponized .TAR Archives to Target Organizations and Steal Passwords
A recent cyberattack campaign leveraging the DarkCloud stealer has been identified, targeting Spanish companies and local offices of international organizations across various industries. The attackers are spoofing a legitimate Spanish company specializing in mountain and skiing equipment to deliver malicious…
New Trinda Malware Targets Android Devices by Replacing Phone Numbers During Calls
Kaspersky Lab has uncovered a new version of the Triada Trojan, a sophisticated malware targeting Android devices. This variant has been found pre-installed in the firmware of counterfeit smartphones mimicking popular models, often sold at discounted prices through unauthorized online…
Cisco AnyConnect VPN Server Vulnerability Allows Attackers to Trigger DoS
Cisco has disclosed a significant vulnerability in its AnyConnect VPN Server for Meraki MX and Z Series devices, allowing authenticated attackers to trigger denial-of-service (DoS) conditions. The flaw (CVE-2025-20212) stems from an uninitialized variable during SSL VPN session establishment and affects over 20 hardware…
Hackers Exploit Apache Tomcat Flaw to Hijack Servers and Steal SSH Credentials
A newly discovered attack campaign has exposed vulnerabilities in Apache Tomcat servers, allowing hackers to hijack resources and steal SSH credentials. Researchers from Aqua Nautilus revealed that these attacks, which weaponized botnets within 30 hours of discovery, employ encrypted payloads…
New Web Skimming Attack Exploits Legacy Stripe API to Validate Stolen Card Data
A sophisticated web-skimming campaign has been discovered, leveraging a deprecated Stripe API to validate stolen credit card data before exfiltration. This novel strategy ensures that only valid and usable card details are exfiltrated, making the operation highly efficient and harder…
AI-Powered Gray Bots Target Web Applications with Over 17,000 Requests Per Hours
Web applications are facing a growing challenge from “gray bots,” a category of automated programs that exploit generative AI to scrape vast amounts of data. Unlike traditional malicious bots, gray bots occupy a middle ground, engaging in activities that, while…
EvilCorp and RansomHub Collaborate to Launch Worldwide Attacks on Organizations
EvilCorp, a sanctioned Russia-based cybercriminal enterprise, has been observed collaborating with RansomHub, one of the most active ransomware-as-a-service (RaaS) operations. This partnership has heightened the threat landscape, as both entities leverage advanced tools and techniques to target organizations across the…
Russian Seashell Blizzard Targets Organizations Using Custom-Built Hacking Tools
Seashell Blizzard, also known as APT44, Sandworm, and Voodoo Bear, has emerged as a sophisticated adversary targeting critical sectors worldwide. Associated with Russia’s Military Intelligence Unit 74455 (GRU), this group has been active since at least 2009, focusing on sectors…
Multiple Jenkins Plugin Vulnerabilities Expose Sensitive Information to Attackers
Jenkins, the widely used open-source automation server, faces heightened security risks after researchers disclosed 11 critical vulnerabilities across its core software and eight plugins. These flaws expose sensitive data, enable code execution, and allow unauthorized configuration changes. Key Vulnerabilities and Risks Affected…
Google’s Quick Share for Windows Vulnerability Allows Remote Code Execution
Cybersecurity researchers from SafeBreach Labs have revealed new vulnerabilities in Google’s Quick Share file-transfer utility for Windows, including a critical flaw that allows attackers to execute code on targeted devices. The findings, disclosed this week, highlight risks in the widely…
Hackers Selling SnowDog RAT Malware With Remote Control Capabilities Online
A sophisticated remote access trojan (RAT) dubbed SnowDog has surfaced on underground cybercrime forums, prompting alarms among cybersecurity experts. Advertised as a tool for “corporate espionage and advanced intrusions,” the malware is being sold by an unidentified threat actor with claims of…
Authorities Shut Down Kidflix Child Abuse Platform in Major Takedown
In one of the most significant operations against child sexual exploitation in recent history, authorities have announced the shutdown of “Kidflix,” one of the world’s largest platforms for the distribution of child sexual abuse material (CSAM). The meticulously planned international…
Massive GitHub Leak: 39M API Keys & Credentials Exposed – How to Strengthen Security
Over 39 million API keys, credentials, and other sensitive secrets were exposed on GitHub in 2024, raising considerable alarm within the developer community and enterprises globally. The scale and impact of this leak have underscored the growing risks tied to…
GoResolver: A Powerful New Tool for Analyzing Golang Malware
Analyzing malware has become increasingly challenging, especially with the growing popularity of programming languages like Golang. Golang, or Go, has captivated developers for its extensive features but has also proven to be an attractive choice for malware authors, thanks to…
Verizon Call Filter App Vulnerability Exposed Call Log Data of Customers
A vulnerability in Verizon’s Call Filter app for iOS has been discovered, allowing unauthorized access to customer call logs. This flaw allowed any individual with the requisite technical knowledge to retrieve incoming call data—complete with timestamps—for any Verizon phone number,…
Cisco Smart Licensing Utility Flaws Allowed Attackers to Gain Admin Access
Cisco has disclosed critical vulnerabilities in its Smart Licensing Utility software, identified as CVE-2024-20439 and CVE-2024-20440, which could allow unauthenticated, remote attackers to gain administrative access or collect sensitive information from compromised systems. These flaws, rated with a severity score…
Over 1,500 PostgreSQL Servers Hit by Fileless Malware Attack
A sophisticated malware campaign has compromised over 1,500 PostgreSQL servers, leveraging fileless techniques to deploy cryptomining payloads. The attack, identified by Wiz Threat Research and attributed to the threat actor group JINX-0126, exploits publicly exposed PostgreSQL instances configured with weak…
Hackers Exploit Cloudflare for Advanced Phishing Attacks
A sophisticated phishing campaign orchestrated by a Russian-speaking threat actor has been uncovered, revealing the abuse of Cloudflare services and Telegram for malicious purposes. Researchers at Hunt.io have identified this new wave of attacks, which employs Cloudflare-branded phishing pages and…
New Malware Targets Magic Enthusiasts to Steal Logins
A newly discovered malware, dubbed Trojan.Arcanum, is targeting enthusiasts of tarot, astrology, and other esoteric practices. Disguised as a legitimate fortune-telling application, this Trojan infiltrates devices to steal sensitive data, manipulate users through social engineering, and even deploy cryptocurrency mining…
SmokeLoader Malware Uses Weaponized 7z Archives to Deliver Infostealers
A recent malware campaign has been observed targeting the First Ukrainian International Bank (PUMB), utilizing a stealthy malware loader, Emmenhtal, in conjunction with the SmokeLoader malware. This campaign demonstrates advanced tactics by financially motivated threat actors to distribute infostealers like…
Hackers Use DeepSeek and Remote Desktop Apps to Deploy TookPS Malware
A recent investigation by cybersecurity researchers has uncovered a large-scale malware campaign leveraging the DeepSeek LLM and popular remote desktop applications to distribute the Trojan-Downloader.Win32.TookPS malware. The attackers targeted both individual users and organizations by disguising malicious software as legitimate…
Firefox 137 Launches with Patches for High-Severity Security Flaws
Mozilla has officially launched Firefox 137 with crucial security fixes aimed at addressing several high-severity vulnerabilities reported by security researchers. As part of its April 1, 2025, Mozilla Foundation Security Advisory (MFSA 2025-20), the foundation detailed three significant Common Vulnerabilities…
Google Cloud Platform Vulnerability Exposes Sensitive Data to Attackers
A privilege escalation vulnerability in Google Cloud Platform (GCP), dubbed “ImageRunner,” was recently discovered and fixed. The flaw, which Tenable Research brought to light, potentially allowed attackers to exploit Google Cloud Run permissions and access sensitive data stored in private…
20,000 WordPress Sites at Risk of File Upload & Deletion Exploits
A critical security alert has been issued to WordPress site administrators following the discovery of two high-severity vulnerabilities in the “WP Ultimate CSV Importer” plugin. With over 20,000 active installations, the plugin’s flaws pose a significant risk to affected websites,…
Apple Fined $162 Million by France Authorities for Mobile Ad Market Domination
French antitrust regulators have imposed a hefty fine of €150 million ($162.4 million) on tech giant Apple for abusing its dominant position in mobile app advertising through its App Tracking Transparency (ATT) tool. The ruling marks the first fine by…
QR Code Phishing (Quishing) Attack Your Smartphones To Steal Microsoft Accounts Credentials
Cybersecurity researchers have identified a growing trend in phishing attacks leveraging QR codes, a tactic known as “quishing.” These attacks exploit the widespread use of smartphones to deceive users into exposing sensitive credentials, particularly targeting Microsoft accounts. According to recent…
Prince Ransomware – An Automated Open-Source Ransomware Builder Freely Available on GitHub
The cybersecurity landscape has witnessed a concerning development with the emergence of “Prince Ransomware,” an open-source ransomware builder that was freely accessible on GitHub until recently. This tool, written in the Go programming language, has been exploited by cybercriminals to…
Gootloader Malware Spreads via Google Ads with Weaponized Documents
The notorious Gootloader malware has resurfaced with a new campaign that combines old tactics with modern delivery methods. This latest iteration leverages Google Ads to target users searching for legal document templates, such as non-disclosure agreements (NDAs) or lease agreements.…
Hackers Hijack Telegram Accounts via Default Voicemail Passwords
The Israeli Internet Association has issued a public warning about a surge in cyberattacks targeting Telegram accounts in Israel. The campaign, traced to hackers in Bangladesh and Indonesia, exploits vulnerabilities in voicemail systems to hijack accounts and, in some cases,…
North Korea IT Workers Expand Their Employment Across Europe To Infiltrate the Company Networks
North Korean IT workers have intensified their global operations, expanding their employment footprint across Europe to infiltrate corporate networks and generate revenue for the regime. According to the latest report by Google Threat Intelligence Group (GTIG), these workers pose as…
Google Introduces End-to-End Encryption for Gmail Business Users
Google has unveiled end-to-end encryption (E2EE) capabilities for Gmail enterprise users, simplifying encrypted email communication for businesses of all sizes. This feature, launched in beta today to coincide with Gmail’s birthday, aims to bridge the gap between robust security and…
New Outlaw Linux Malware Using SSH brute-forcing To Maintain Botnet Activities for long Time
A persistent Linux malware known as “Outlaw” has been identified leveraging unsophisticated yet effective techniques to maintain a long-running botnet. Despite its lack of advanced evasion mechanisms, Outlaw continues to propagate and monetize its activities by employing SSH brute-forcing, cron-based…
Hackers Exploit JavaScript & CSS Tricks to Steal Browsing History
The web browsing history feature, designed to enhance user convenience by styling visited links differently, has inadvertently created a privacy vulnerability. Hackers have exploited this feature, using JavaScript and CSS techniques to deduce users’ online habits, revealing a concerning loophole…
Hackers Exploiting Vulnerabilities in SonicWall, Zoho, F5 & Ivanti Systems
A surge in cyber activity targeting critical edge technologies and management tools, including SonicWall, Zoho, F5, Ivanti, and other systems, has been flagged by cybersecurity intelligence firm GreyNoise. The sudden spike in probing and exploitation attempts highlights an alarming trend:…
Hackers Exploit Microsoft Teams Messages to Deliver Malware
Cybersecurity experts have uncovered a new malware campaign targeting Microsoft Teams users to infiltrate corporate systems. By exploiting the platform’s communication vulnerabilities and leveraging malicious PowerShell scripts, attackers bypassed traditional defenses, delivering malware capable of stealing credentials and establishing persistent…
Python Introduces New Standard Lock File Format for Enhanced Security
The Python Software Foundation (PSF) has officially announced the adoption of a new standardized lock file format, outlined in PEP 751. This development is a major milestone for the Python packaging ecosystem, aiming to make dependency management more secure, reproducible, and…
CISA Alerts on Active Exploitation of Apache Tomcat Vulnerability
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a high-priority alert regarding the active exploitation of CVE-2025-24813, a critical vulnerability within Apache Tomcat. This newly identified flaw poses a significant risk to organizations using affected versions of the popular…
APT34 Deploys Custom Malware Targeting Finance and Telecom Sectors
APT34, also known as OilRig or Helix Kitten, has intensified its cyber-espionage campaigns, deploying custom malware to target entities within the finance and telecommunications sectors. The group, active since 2012, is a well-documented advanced persistent threat (APT) actor linked to…
KoiLoader Exploits PowerShell Scripts to Drop Malicious Payloads
Cybersecurity experts at eSentire’s Threat Response Unit (TRU) uncovered a sophisticated malware campaign leveraging KoiLoader, a malicious loader designed to deploy information-stealing payloads. This campaign utilized PowerShell scripts and obfuscation techniques to bypass security measures and infect systems. The investigation…
New Surge of IRS-Themed Attacks Targets Taxpayers’ Mobile Devices
As the U.S. tax filing deadline approaches, cybercriminals are intensifying their efforts to exploit taxpayers through a new wave of IRS-themed scams. Research from McAfee Labs has revealed a sharp increase in fraudulent activities targeting mobile devices, with scammers using…
Ransomware Threatens 93% of Industries— Resilience Is Critical
Ransomware continues to be one of the most disruptive cyber threats, with recent data revealing that it affects 93% of industries globally. According to Verizon’s 2024 Data Breach Investigations Report, ransomware is implicated in one-third of all data breaches, underscoring…
Sliver Framework Customized Enhances Evasion and Bypasses EDR Detection
The Sliver Command & Control (C2) framework, an open-source tool written in Go, has been a popular choice for offensive security practitioners since its release in 2020. However, as detection mechanisms evolve, out-of-the-box Sliver payloads are increasingly flagged by Endpoint…
Massive 400GB X (Twitter) Data Leaked – 2.8 Billion Records Exposed
A colossal 400GB trove containing data from 2.873 billion X (formerly Twitter) users has surfaced on hacker forums. The breach, allegedly dated January 2025, is now being deemed one of the largest data leaks in social media history. Breach Origin…
Massive 400GB X (Twitter) Data Leak Surfaces on Hacker Forums
A colossal 400GB trove containing data from 2.873 billion X (formerly Twitter) users has surfaced on hacker forums. The breach, allegedly dated January 2025, is now being deemed one of the largest data leaks in social media history. Breach Origin…
PortSwigger Launches Burp AI to Enhance Penetration Testing with AI
PortSwigger, the makers of Burp Suite, has taken a giant leap forward in the field of cybersecurity with the launch of Burp AI, a groundbreaking set of artificial intelligence (AI) features designed to streamline and enhance penetration testing workflows. With Burp…
Chord Specialty Dental Partners Data Breach Exposes Customer Personal Data
Chord Specialty Dental Partners is under scrutiny after revealing a data breach that compromised the personal and health information of its customers. The breach, which involved unauthorized access to employee email accounts, has left the sensitive data of thousands of…
LensDeal Data Breach Exposes 100,000 Customers’ Personal Information
A major data breach involving LensDeal, a Netherlands-based contact lens supplier, has reportedly exposed the personal information of over 100,000 customers. According to the Cyber Security Hub post, the breach affects 115,096 individuals and includes sensitive details such as full…
Kentico Xperience CMS XSS Vulnerability Allows Remote Code Execution
Kentico Xperience CMS, a widely used platform designed for enterprises and organizations, is under scrutiny after a vulnerability chain was discovered that exploits Cross-Site Scripting (XSS) to enable Remote Code Execution (RCE). This vulnerability was disclosed by researchers who demonstrated…
Microsoft Discovers GRUB2, U-Boot, and Barebox Bootloader Flaws with Copilot
Microsoft has disclosed the discovery of multiple critical vulnerabilities within the GRUB2, U-Boot, and Barebox bootloaders, leveraging its AI-driven Security Copilot platform for advanced threat analysis. These bootloaders, integral to the Unified Extensible Firmware Interface (UEFI) Secure Boot framework and…
Apple Issues Warning on Three 0-Day Vulnerabilities Under Active Exploitation
Apple has issued an urgent security advisory concerning three critical zero-day vulnerabilities – CVE-2025-24200, CVE-2025-24201, and CVE-2025-24085 – which are being actively exploited in the wild. These vulnerabilities affect a wide range of Apple devices, including iPhones, iPads, Macs, Apple Watches, and even the…
Rockwell Automation Vulnerability Allows Attackers to Execute Arbitrary Commands
Rockwell Automation has identified a critical flaw in its Verve Asset Manager software, exposing industrial systems to potential exploitation. The vulnerability, tracked as CVE-2025-1449, enables attackers with administrative access to execute arbitrary commands within the containerized service environment. This flaw has been rated…
Check Point Confirms Data Breach, Says Leaked Information is ‘Old’
Cybersecurity giant Check Point has confirmed that a recent post on a notorious dark web forum, BreachForums, attempting to sell allegedly hacked data from the company, relates to an “old, known, and pinpointed event.” The incident, according to Check Point,…
CrushFTP Security Vulnerability Under Attack After PoC Release
A recently disclosed security vulnerability in CrushFTP, identified as CVE-2025-2825, has become the target of active exploitation attempts following the release of publicly available proof-of-concept (PoC) exploit code. Shadowserver Foundation, a reputable cybersecurity monitoring organization, disclosed the alarming surge in…
CISA Warns of Cisco Smart Licensing Utility Credential Flaw Exploited in Attacks
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a security advisory warning organizations about a critical vulnerability in Cisco’s Smart Licensing Utility (SLU) software that has reportedly been exploited in cyberattacks. The vulnerability, assigned CVE-2024-20439, stems from a static…
Linux Lite 7.4 Final Released: Enhanced GUI and Bug Fixes
Linux Lite, a popular lightweight Linux distribution aimed at making Linux accessible to beginners, has officially released its Linux Lite 7.4 Final version. This release comes with several incremental updates that improve functionality, address bugs, and refine the user interface, ensuring a…
Hackers Deploy 24,000 IPs to Breach Palo Alto Networks GlobalProtect
A wave of malicious activity targeting Palo Alto Networks PAN-OS GlobalProtect portals has been observed, with nearly 24,000 unique IPs attempting unauthorized access over the past 30 days. This coordinated effort, flagged by cybersecurity firm GreyNoise, highlights the growing sophistication…
Triton RAT Uses Telegram for Remote System Access and Control
Cado Security Labs has uncovered a new Python-based Remote Access Tool (RAT) named Triton RAT, which leverages Telegram for remote system access and data exfiltration. This open-source malware, available on GitHub, is designed to execute a wide range of malicious…
DarkCloud: An Advanced Stealer Malware Sold on Telegram to Target Windows Data
DarkCloud, a highly advanced stealer malware, has emerged as a significant threat to Windows systems since its debut in 2022. Initially gaining traction through underground forums, the malware is now widely sold on Telegram, making it accessible to cybercriminals worldwide.…
“Lazarus Hackers Group” No Longer Refer to a Single APT Group But a Collection of Many Sub-Groups
The term “Lazarus Group,” once used to describe a singular Advanced Persistent Threat (APT) actor, has evolved to represent a complex network of sub-groups operating under shared objectives and tactics. This shift reflects the growing scale and diversification of their…
Earth Alux Hackers Use VARGIET Malware to Target Organizations
A new wave of cyberattacks orchestrated by the advanced persistent threat (APT) group Earth Alux has been uncovered, revealing the use of sophisticated malware, including the VARGEIT backdoor, to infiltrate critical industries. Linked to China, Earth Alux has been targeting…
Operation HollowQuill – Weaponized PDFs Deliver a Cobalt Strike Malware Into Gov & Military Networks
In a recent revelation by SEQRITE Labs, a highly sophisticated cyber-espionage campaign, dubbed Operation HollowQuill, has been uncovered. The operation targets academic, governmental, and defense-related networks in Russia using weaponized decoy PDFs to deliver Cobalt Strike malware implants. The campaign…
Konni RAT Exploit Windows Explorer Limitations To Launches a Multi-Stage Attack & Steal Data
Konni RAT, a highly advanced Remote Access Trojan (RAT), has emerged as a significant cybersecurity threat, leveraging Windows Explorer limitations to execute multi-stage attacks. This malware employs a combination of batch files, PowerShell scripts, and VBScript to infiltrate systems, exfiltrate…
Weaponized Zoom Installer Used by Hackers to Gain RDP Access and Deploy BlackSuit Ransomware
Cybersecurity researchers have uncovered a sophisticated attack campaign where threat actors utilized a trojanized Zoom installer to infiltrate systems, gain remote desktop protocol (RDP) access, and ultimately deploy the BlackSuit ransomware. The operation demonstrates a highly coordinated, multi-stage malware delivery…
Threat Actors Embed Malware in WordPress Sites to Enable Remote Code Execution
Security researchers have uncovered a new wave of cyberattacks targeting WordPress websites through the exploitation of the “mu-plugins” (Must-Use plugins) directory. This directory, designed to load plugins automatically without requiring activation, has become an attractive hiding spot for threat actors…
Russian Hackers Leverage Bulletproof Hosting to Shift Network Infrastructure
Russian-aligned cyber threat groups, UAC-0050 and UAC-0006, have significantly escalated their operations in 2025, targeting entities worldwide with a focus on Ukraine. These groups employ bulletproof hosting services to mask their network infrastructure, enabling sophisticated campaigns involving financial theft, espionage,…
Windows 11 Insider Released – Microsoft Removes BypassNRO.cmd Script to Enhance Security
Microsoft has launched Windows 11 Insider Preview Build 26200.5516 to the Dev Channel with exciting new updates, including innovative features and a key security enhancement. Among the major changes is the removal of the widely known BypassNRO.cmd script, a move aimed at bolstering…
A New Microsoft Tool Automatically Detects, Diagnoses, and Resolves Boot Issues in Windows
Microsoft has unveiled a transformational tool aimed at addressing one of the most frustrating challenges in modern computing: boot failures. Aptly named “Quick Machine Recovery,” this new feature automatically detects, diagnoses, and resolves critical system issues that prevent Windows devices…
Beware! A Fake Zoom Installer Drops BlackSuit Ransomware on Your Windows Systems
Cybersecurity analysts have uncovered a sophisticated campaign exploiting a fake Zoom installer to deliver BlackSuit ransomware across Windows-based systems. The attack, documented by DFIR experts, highlights how threat actors are leveraging popular software to deceive unsuspecting victims into installing malware…
Linux Distribution Nitrux3.9.1 Releaed – What’s New
Nitrux Linux, renowned for its innovative approach to desktop computing, has unveiled its latest release, Nitrux 3.9.1, codenamed “mk.” This distribution, rooted in Ubuntu and utilizing Nomad as its desktop environment, brings substantial updates to its framework, apps, and system. Designed…
CrushFTP Vulnerability Lets Hackers Bypass Security and Seize Server Control
A newly disclosed authentication bypass vulnerability (CVE-2025-2825) in CrushFTP file transfer software enables attackers to gain complete control of servers without valid credentials. The vulnerability affects versions 10.0.0 through 11.3.0 of the popular enterprise file transfer solution, exposing organizations to…