Cybersecurity researchers have identified a renewed wave of attacks involving the Dark Crystal RAT (DCRat), a dangerous remote access Trojan that has resurfaced through a Malware-as-a-Service (MaaS) model. Attackers are actively targeting gamers by distributing malicious software disguised as gaming…
Tag: GBHackers Security | #1 Globally Trusted Cyber Security News Platform
Fully Undetected Anubis Malware Enables Hackers to Execute Remote Commands
A recent alert has highlighted the emergence of the AnubisBackdoor, a Python-based backdoor attributed to the Savage Ladybug group, which is reportedly linked to the notorious FIN7 cybercrime gang. This malware is designed to provide remote access, execute commands, and…
PHP XXE Injection Vulnerability Allows Attackers to Access Config Files & Private Keys
A newly uncovered XML External Entity (XXE) injection vulnerability in PHP has demonstrated how attackers can bypass multiple security mechanisms to access sensitive configuration files and private keys. The vulnerability, detailed by web application security researcher Aleksandr Zhurnakov, highlights the…
Over 400 IPs Actively Exploiting Multiple SSRF Vulnerabilities in the Wild
A recent surge in Server-Side Request Forgery (SSRF) exploitation has been detected by GreyNoise, highlighting the ongoing threat posed by these vulnerabilities. GreyNoise observed a coordinated increase in SSRF attacks, with at least 400 unique IPs actively exploiting multiple SSRF-related…
Hackers Exploit Advanced MFA Bypass Techniques to Compromise User Accounts
In recent years, phishing has remained the most prevalent form of cyberattack, with approximately 1.2% of global email traffic being phishing attempts, amounting to about 3.4 billion emails daily. Despite a low success rate, with only 3% of employees clicking…
Enhanced XCSSET Malware Targets macOS Users with Advanced Obfuscation
Microsoft Threat Intelligence has recently uncovered a new variant of the XCSSET malware, a sophisticated modular macOS malware known for infecting Xcode projects. This latest iteration features enhanced obfuscation methods, updated persistence mechanisms, and new infection strategies, making it more…
Chinese Hackers Deploy New ‘Squidoor’ Malware to Target Global Organizations
A recent cybersecurity threat has emerged in the form of a sophisticated backdoor malware named Squidoor, attributed to a suspected Chinese threat actor. This malware has been targeting various sectors globally, including governments, defense, telecommunications, education, and aviation, particularly in…
Jaguar Land Rover Allegedly Hacked – 700 Internal Documents Including Source Code Leaked
A threat actor known as “Rey” has come forward on a prominent dark web forum, claiming responsibility for a significant cyberattack on Jaguar Land Rover. The British multinational automotive company, renowned for its luxury and off-road vehicles, is said to…
CISA Warns of Windows NTFS Vulnerability Exploited for Data Theft
The Cybersecurity and Infrastructure Security Agency (CISA) highlighted a critical vulnerability in Microsoft Windows’ New Technology File System (NTFS). The vulnerability, designated as CVE-2025-24984, pertains to an information disclosure issue that could potentially allow attackers to access sensitive data stored…
Jaguar Land Rover Allegedly Hit by Cyberattack, Hacker Claims
A threat actor known as “Rey” has come forward on a prominent dark web forum, claiming responsibility for a significant cyberattack on Jaguar Land Rover. The British multinational automotive company, renowned for its luxury and off-road vehicles, is said to…
Zoom Client Security Flaws Could Lead to Data Breaches
Recent security bulletins from Zoom have highlighted several high-severity vulnerabilities in their client software, raising concerns about potential data breaches for users. The latest security updates, issued on March 11, 2025, address multiple critical issues that could impact the privacy…
CISA Alerts on Active Exploitation of Microsoft Windows MMC Vulnerability
The Cybersecurity and Infrastructure Security Agency (CISA) has warned of the active exploitation of a significant vulnerability in Microsoft Windows affecting the Microsoft Management Console (MMC). This security threat underscores the ongoing challenges faced by organizations in managing vulnerabilities and…
macOS NULL Pointer Dereference Vulnerability Allow Attackers Exploits Kernel
Historically, NULL pointer dereferences have been a significant vulnerability in operating systems, including macOS. These occur when software attempts to access memory at address 0 via a NULL pointer, leading to potential crashes or, under certain conditions, exploitation by attackers.…
Ebyte Ransomware Targets Windows Users with Advanced Encryption Techniques
A new ransomware variant, known as Ebyte Ransomware, has emerged as a significant threat to Windows users. Developed in the Go programming language, this ransomware employs sophisticated encryption techniques, including ChaCha20 and Elliptic Curve Integrated Encryption Scheme (ECIES), to lock…
Threat Actors Evade Security Measures to Launch SIM Swap Attacks
SIM swapping fraud continues to pose a significant threat to individuals and financial institutions, despite ongoing efforts by telecom providers and regulatory bodies to enhance security measures. This type of fraud involves fraudsters gaining control of a victim’s phone number…
Apache Camel Vulnerability Allows Attackers to Inject Arbitrary Headers
A newly disclosed security vulnerability in Apache Camel, tracked as CVE-2025-27636, has raised alarms across the cybersecurity community. The flaw allows attackers to inject arbitrary headers into Camel Exec component configurations, potentially enabling remote code execution (RCE). The vulnerability impacts several…
SCADA Vulnerabilities Allow Attackers to Cause DoS and Gain Elevated Privileges
A recent security assessment by Palo Alto Networks’ Unit 42 has uncovered multiple vulnerabilities in the ICONICS Suite, a widely used Supervisory Control and Data Acquisition (SCADA) system. These vulnerabilities, identified in versions 10.97.2 and earlier for Microsoft Windows, pose…
Blind Eagle Hackers Exploit Google Drive, Dropbox & GitHub to Evade Security Measures
In a recent cyber campaign, the notorious threat actor group Blind Eagle, also known as APT-C-36, has been leveraging trusted cloud platforms like Google Drive, Dropbox, GitHub, and Bitbucket to distribute malware and evade traditional security defenses. This sophisticated approach…
AI Becomes a Powerful Weapon for Cybercriminals to Launch Attacks at High Speed
Artificial intelligence (AI) has emerged as a potent tool in the arsenal of cybercriminals, enabling them to execute attacks with unprecedented speed, precision, and scale. The integration of AI in cybercrime is transforming the landscape of digital threats, making traditional…
AI-Generated Fake GitHub Repositories Steal Login Credentials
A concerning cybersecurity threat has emerged with the discovery of AI-generated fake GitHub repositories designed to distribute malware, including the notorious SmartLoader and Lumma Stealer. These malicious repositories, crafted to appear legitimate, exploit GitHub’s trusted reputation to deceive users into…
Google Warns Chromecast Owners Against Factory Reset
Google has issued a warning to Chromecast owners regarding the potential risks of performing a factory reset on their devices. This advisory comes as users have reported complications with device authentication after restoring their Chromecasts to factory settings. The warning…
PoC Released for SolarWinds Web Help Desk Vulnerability Exposing Passwords
A Proof-of-Concept (PoC) has been released for a significant vulnerability discovered in SolarWinds Web Help Desk, exposing encrypted passwords and other sensitive data. This vulnerability arises from the predictable encryption keys used in the application and the misuse of AES-GCM…
“Eleven11bot” Botnet Compromises 30,000 Webcams in Massive Attack
Cybersecurity experts have uncovered a massive Distributed Denial-of-Service (DDoS) botnet known as “Eleven11bot.” This new threat, discovered by Nokia’s Deepfield Emergency Response Team (ERT), shared in LinkedIn, has compromised a staggering 30,000 network devices, predominantly webcams and Network Video Recorders…
Hackers Compromise Windows Systems Using 5000+ Malicious Packages
A recent analysis by FortiGuard Labs has revealed a significant increase in malicious software packages, with over 5,000 identified since November 2024. These packages employ sophisticated techniques to evade detection and exploit system vulnerabilities, posing a substantial threat to Windows…
CISA Added 3 Ivanti Endpoint Manager Bugs to Wildly Exploited Vulnerabilities Catalog
The Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) catalog with the addition of three high-risk security flaws affecting Ivanti Endpoint Manager (EPM). These vulnerabilities, which involve absolute path traversal issues, have been observed being…
Lazarus Hackers Exploit 6 NPM Packages to Steal Login Credentials
North Korea’s Lazarus Group has launched a new wave of attacks targeting the npm ecosystem, compromising six packages designed to steal login credentials and deploy backdoors. The malicious packages is-buffer-validator, yoojae-validator, event-handle-package, array-empty-validator, react-event-dependency, and auth-validator have collectively been downloaded…
Apache Pinot Vulnerability Allows Attackers to Bypass Authentication
A significant security vulnerability affecting Apache Pinot, an open-source distributed data store designed for real-time analytics, has been publicly disclosed. The flaw, identified as CVE-2024-56325, allows remote attackers to bypass authentication on vulnerable installations, posing a critical threat to affected systems.…
SideWinder APT Deploys New Tools in Attacks on Military & Government Entities
The SideWinder Advanced Persistent Threat (APT) group has been observed intensifying its activities, particularly targeting military and government entities across various regions. This group, known for its aggressive expansion beyond traditional targets, has recently updated its toolset to include sophisticated…
SAP Security Update Released to Fix Multiple Vulnerabilities
SAP announced 21 new Security Notes and updates to 3 previously released notes on its latest Security Patch Day. This release addresses critical vulnerabilities within SAP products, underscoring the company’s commitment to safeguarding enterprise software. SAP strongly recommends customers prioritize…
Critical Veritas Vulnerability Allows Attackers to Execute Malicious Code
A critical vulnerability has been discovered in Veritas’ Arctera InfoScale product, a solution widely used for disaster recovery and high availability scenarios. The issue lies in the insecure deserialization of untrusted data in the .NET remoting endpoint, allowing attackers to…
Latest Chrome Update Addresses Multiple High-Risk Security Issues
Google has released a critical update for its Chrome browser, advancing the stable channel to version 134.0.6998.88 for Windows, Mac, and Linux, and 134.0.6998.89 for Windows and Mac on the Extended Stable channel. This update includes several high-priority security fixes…
Apache Tomcat Flaw Could Allow RCE Attacks on Servers
Apache Tomcat, a widely used open-source web server software, has faced numerous security vulnerabilities in recent years. Some critical issues put servers at risk of remote code execution (RCE) and other attacks. These vulnerabilities highlight the importance of keeping software…
Critical Microsoft’s Time Travel Debugging Tool Vulnerability Let Attackers Mask Detection
Microsoft’s Time Travel Debugging (TTD) framework, a powerful tool for recording and replaying Windows program executions, has been found to harbor subtle yet significant bugs in its CPU instruction emulation process, according to a new report from Mandiant. These flaws…
ServiceNow Acquires Moveworks for $2.85 Billion to Boost AI Capabilities
In a landmark move to strengthen its position in the rapidly evolving artificial intelligence landscape, ServiceNow, a leading provider of digital workflow solutions, has announced its acquisition of Moveworks, an AI startup, for $2.85 billion. The deal, revealed on Monday,…
Apple iOS 18.4 Beta 3 Released – What’s New!
Apple has rolled out iOS 18.4 Beta 3, available to developers as of March 10, 2025, with the build number 22E5222f. This release is part of the ongoing beta testing phase, with the final version anticipated in early April 2025.…
Ragnar Loader Used by Multiple Ransomware Groups to Bypass Detection
Ragnar Loader, a sophisticated toolkit associated with the Ragnar Locker ransomware group, has been instrumental in facilitating targeted cyberattacks on organizations since its emergence in 2020. This malware is part of the Monstrous Mantis ransomware ecosystem and is designed to…
North Korean Hackers Use ZIP Files to Deploy Malicious PowerShell Scripts
North Korean state-sponsored hackers, known as APT37 or ScarCruft, have been employing sophisticated tactics to breach systems, leveraging malicious ZIP files containing LNK files to initiate attacks. These LNK files, often disguised as documents related to North Korean affairs or…
Researcher Hacks Embedded Devices to Uncover Firmware Secrets
In a recent exploration of embedded device hacking, a researcher demonstrated how to extract firmware from flash memory using the flashrom tool. This process is crucial for understanding device operation and identifying potential vulnerabilities. However, it involves risks that can…
Android Zygote Injection Flaw Lets Attackers Execute Code & Gain Elevated Privileges
A significant vulnerability in the Android operating system, identified as CVE-2024-31317, has been discovered, allowing attackers to exploit the Zygote process for system-wide code execution and privilege escalation. This flaw affects devices running Android 11 or older, highlighting a critical…
Threat Actors Exploit EncryptHub for Multi-Stage Malware Attacks
EncryptHub, a rising cybercriminal entity, has been under scrutiny by multiple threat intelligence teams, including Outpost24’s KrakenLabs. Recent investigations have uncovered previously unseen aspects of EncryptHub’s infrastructure and tactics, revealing a sophisticated multi-stage malware campaign. The threat actor’s operational security…
New Linux Kernel Code Written in Rust Aims to Eliminate Memory Safety Bugs
The integration of Rust into the Linux kernel is a significant step forward in enhancing memory safety, a critical aspect of kernel development. This effort, known as Rust for Linux, began in 2021 with the publication of an RFC by…
North Korean IT Workers Linked to 2,400 Astrill VPN IP Addresses
new data has emerged linking over 2,400 IP addresses associated with Astrill VPN to individuals believed to be North Korean IT workers. These findings were reported by a cyber security source, who obtained the information from http://Spur.us, a platform known for…
Laravel Framework Flaw Allows Attackers to Execute Malicious JavaScript
A significant vulnerability has been identified in the Laravel framework, specifically affecting versions between 11.9.0 and 11.35.1. The issue revolves around improper encoding of request parameters on the error page when the application is running in debug mode, leading to…
Critical Vulnerabilities in Moxa Switches Enable Unauthorized Access
A critical vulnerability identified as CVE-2024-12297 has been discovered in Moxa’s PT series of network switches, affecting multiple models across different product lines. This security flaw involves an authorization logic disclosure that can be exploited to bypass authentication mechanisms, allowing…
Cobalt Strike Exploitation by Hackers Drops, Report Reveals
A collaborative initiative involving Microsoft’s Digital Crimes Unit (DCU), Fortra, and the Health Information Sharing and Analysis Center (Health-ISAC) has reported a major drop in the use of unauthorized versions of the cyber tool Cobalt Strike by hackers. Since the…
Developer Pleads Guilty to Injecting Malware and Crippling Company Systems
In a stunning case of corporate sabotage, a former software developer for Eaton Corp., Davis Lu, 55, of Houston, has been found guilty by a jury of intentionally damaging the company’s internal computer systems. This malicious act occurred after his…
WinDbg Vulnerability Allows Attackers to Execute Remote Code
Microsoft recently disclosed a critical vulnerability impacting its debugging tool, WinDbg, and associated .NET packages. Tracked CVE-2025-24043, this flaw allows remote code execution (RCE) due to improper cryptographic signature verification in the SOS debugging extension. According to Github’s Post, Developers…
Thinkware Dashcam Vulnerability Leaks Credentials to Attackers
A series of significant security vulnerabilities have been discovered in the Thinkware Dashcam, specifically the F800 Pro model, which could pose serious risks to users’ privacy and security. These issues include unauthorized access to sensitive data, denial of service, and…
New Apache Traffic Server Flaws Allow Malformed Request Exploits
The Apache Software Foundation has disclosed several vulnerabilities affecting its Traffic Server software. These vulnerabilities allow malicious actors to exploit malformed requests and access control list (ACL) issues, posing serious security risks to users. The vulnerabilities, identified by CVE numbers CVE-2024-38311, CVE-2024-56195, CVE-2024-56196,…
Over 43 Million Python Installations Vulnerable to Dangerous Code Execution Flaw
A significant vulnerability has been uncovered in the Python JSON Logger package (python-json-logger), affecting versions 3.2.0 and 3.2.1. This flaw, CVE-2025-27607 allows for remote code execution (RCE) due to misusing a missing dependency known as msgspec-python313-pre. The issue gained widespread attention…
Commvault Webserver Flaw Allows Attackers to Gain Full Control
Commvault has revealed a major vulnerability in its software that could allow malicious actors to gain full control of its webservers. The issue, identified as CV_2025_03_1, has been categorized as a high-severity flaw and impacts multiple versions of the Commvault platform…
10 Best Penetration Testing Companies in 2025
Penetration testing companies play a vital role in strengthening the cybersecurity defenses of organizations by identifying vulnerabilities in their systems, applications, and networks. These firms simulate real-world cyberattacks to uncover weaknesses that could be exploited by malicious actors, helping businesses…
10 Best Penetration Testing Companies & Services in 2025
Penetration Testing Companies are pillars of information security; nothing is more important than ensuring your systems and data are safe from unauthorized access. Many organizations have a flawed security culture, with employees motivated to protect their information rather than the…
Lumma Stealer Using Fake Google Meet & Windows Update Sites to Launch “Click Fix” Style Attack
Cybersecurity researchers continue to track sophisticated “Click Fix” style distribution campaigns that deliver the notorious Lumma Stealer malware to unsuspecting victims. These increasingly sophisticated tactics, initially documented by Unit42 researchers Billy Melicher and Nabeel Mohamed, utilize social engineering techniques that…
Threat Actors Exploit PHP-CGI RCE Vulnerability to Attack Windows Machines
A recent cybersecurity threat has emerged where unknown attackers are exploiting a critical remote code execution (RCE) vulnerability in PHP-CGI on Windows systems. This vulnerability, identified as CVE-2024-4577, allows attackers to execute arbitrary PHP code on servers using Apache with…
New PyPI Malware Targets Developers to Steal Ethereum Wallets
A recent discovery by the Socket Research Team has unveiled a malicious PyPI package named set-utils, designed to steal Ethereum private keys by exploiting commonly used account creation functions. This package masquerades as a utility for Python sets, mimicking popular…
Strela Stealer Malware Targets Microsoft Outlook Users for Credential Theft
The cybersecurity landscape has recently been impacted by the emergence of the Strela Stealer malware, a sophisticated infostealer designed to target specific email clients, notably Microsoft Outlook and Mozilla Thunderbird. This malware has been active since late 2022 and has…
Fake BianLian Ransom Demands Sent via Physical Letters to U.S. Firms
In a novel and concerning development, multiple U.S. organizations have reported receiving suspicious physical letters claiming to be from the BianLian ransomware group. These letters, sent via U.S. postal services, threaten recipients with data leaks unless substantial ransoms are paid…
Microsoft Warns: 1 Million Devices Infected by Malware from GitHub
In a recent alert, Microsoft revealed a large-scale malvertising campaign that has compromised nearly one million devices worldwide. This campaign, which began in early December 2024, leverages malicious redirects from illegal streaming websites to deliver malware hosted on platforms like…
North Korean Moonstone Sleet Uses Creative Tactics to Deploy Custom Ransomware
In a recent development, Microsoft has identified a new North Korean threat actor known as Moonstone Sleet, which has been employing a combination of traditional and innovative tactics to achieve its financial and cyberespionage objectives. Moonstone Sleet, formerly tracked as…
Akira Ransomware Targets Windows Servers via RDP and Evades EDR with Webcam Trick
In a recent cybersecurity incident, the Akira ransomware group demonstrated its evolving tactics by exploiting an unsecured webcam to bypass Endpoint Detection and Response (EDR) tools. This novel approach highlights the group’s ability to adapt and evade traditional security measures,…
Fake Tax Claims Scam Stealing Over $10,000 from Victims
Tax season has become a breeding ground for sophisticated AI-powered scams, with nearly half of Americans reporting fraudulent IRS-related communications, according to McAfee’s 2025 survey. Cybercriminals are leveraging deepfake audio, phishing emails, and spoofed websites to steal identities and funds,…
Tails 6.13 Linux Distro Released with Enhanced Wi-Fi Hardware Detection
The Tails Project has launched Tails 6.13, the latest version of its privacy-centric Linux distribution, introducing improved Wi-Fi troubleshooting tools, updated anonymity software, and fixes for persistent storage and installation workflows. Targeted at users prioritizing security and anonymity, this release…
YouTube Alerts Creators About Phishing Emails Targeting Login Credentials
YouTube has issued a critical security advisory following a widespread phishing campaign exploiting private video sharing to distribute AI-generated deepfakes of CEO Neal Mohan. The fraudulent videos falsely claim changes to the platform’s monetization policies, urging creators to click malicious…
Multiple Jenkins Vulnerabilities Allow Attackers to Expose Secrets
Jenkins, the widely-used open-source automation server, issued a high-priority security advisory on March 5, 2025, disclosing four medium-severity vulnerabilities affecting its core platform. The flaws—tracked as CVE-2025-27622 through CVE-2025-27625—impact secrets management, cross-site request forgery (CSRF) protections, and URL validation. Immediate…
Critical DrayTek Router Vulnerabilities Expose Devices to RCE Attacks
A recent security analysis of Draytek Vigor routers has uncovered severe vulnerabilities that could allow attackers to hijack devices, execute arbitrary code, and bypass critical security controls. These findings, disclosed by researchers at DEFCON 32 HHV and Ekoparty 2024, highlight…
Researchers Jailbreak 17 Popular LLM Models to Reveal Sensitive Data
In a recent study published by Palo Alto Networks’ Threat Research Center, researchers successfully jailbroke 17 popular generative AI (GenAI) web products, exposing vulnerabilities in their safety measures. The investigation aimed to assess the effectiveness of jailbreaking techniques in bypassing…
Phantom Goblin Uses Social Engineering Tactics to Deploy Stealer Malware
A sophisticated malware operation, dubbed “Phantom Goblin,” has been identified by cybersecurity researchers, highlighting the increasing use of social engineering tactics to deploy information-stealing malware. This operation leverages deceptive techniques to trick users into executing malicious files, leading to unauthorized…
AMD Microcode Vulnerability Allows Attackers to Load Malicious Patches
A critical vulnerability in AMD’s Zen 1 through Zen 4 processors allows attackers to bypass microcode signature validation, potentially undermining hardware-based security mechanisms. The flaw stems from AMD’s use of AES-CMAC as a hash function during microcode patch verification –…
Microsoft Introduces 365 E5 Security Add-On for Business Premium Customers
Microsoft has launched Microsoft 365 E5 Security as an add-on to its Business Premium suite, providing small and medium-sized businesses (SMBs) with advanced tools to combat escalating cyber threats. The offering integrates enterprise-grade security features at a 57% cost savings…
GitHub Explains How Security Professionals Can Use Copilot for Log Analysis
GitHub Copilot, once a developer-centric tool, is now revolutionizing workflows across technical and non-technical roles. With features like Agent Mode, CLI integration, and Project Padawan, Copilot is emerging as a universal productivity enhancer. This article explores three key developments reshaping…
Peaklight Malware Targets Users to Steal Credentials, Browser History, and Financial Data
Peaklight malware has emerged as a significant threat, designed to steal sensitive information from compromised endpoints. This information stealer is often distributed through underground channels and is sometimes offered as a Malware-as-a-Service (MaaS), making it a continuously evolving and potent…
Medusa Ransomware Attacks Surge 42% with Advanced Tools & Tactics
Medusa ransomware attacks have seen a significant increase, rising by 42% between 2023 and 2024, with a further escalation in early 2025. This surge is attributed to the group Spearwing, which operates Medusa as a ransomware-as-a-service (RaaS) model. Spearwing and…
Activating Incognito Mode in RDP to Erase All Traces
The Remote Desktop Protocol (RDP) is a widely used tool for remote access, but it often leaves behind traces of user activity, which can be a concern for privacy and security. Recently, the use of the “/public” command-line option in…
FBI Warns: Threat Actors Impersonating BianLian Group to Target Corporate Executives
The Federal Bureau of Investigation (FBI) issued a critical alert through its Internet Crime Complaint Center (IC3) warning of a novel cyber extortion campaign targeting corporate executives. Criminal actors impersonating the notorious BianLian ransomware group are leveraging physical mail to…
Apache Pinot Vulnerability Allows Remote Attackers to Bypass Authentication
A critical security flaw (CVE-2024-56325) in Apache Pinot, a real-time distributed OLAP datastore, has been disclosed, allowing unauthenticated attackers to bypass authentication controls and gain unauthorized access to sensitive systems. Rated 9.8 on the CVSS scale, this vulnerability exposes organizations…
Implementing Identity First Security for Zero Trust Architectures
Zero Trust is a security framework that operates under the assumption that no implicit trust exists within a network. Every request for access must be verified, regardless of whether it comes from within or outside the organization. Identity First Security…
Identifying Cyber Attack Patterns Through Threat Actor Infrastructure Analysis
Kudelski Security Research recently published an article detailing advanced methods for tracking and analyzing threat actor infrastructure, providing valuable insights into cyber attack patterns and attribution techniques. Decoding Threat Actor Infrastructure: A Case Study The research team demonstrated their approach…
Cybercriminals Exploit Compromised Email Servers for Fraudulent Campaigns
Trend Micro’s Managed XDR team has recently investigated a sophisticated Business Email Compromise (BEC) attack that targeted multiple business partners. The incident, which occurred over several days, involved the exploitation of a compromised email server to orchestrate a complex fraud…
Hackers Deploy Advanced Social Engineering Tactics in Phishing Attacks
Cybercriminals are evolving their phishing methods, employing more sophisticated social engineering tactics to deceive their targets. Recent findings from ESET’s APT Activity Report highlight a concerning trend where threat actors are establishing relationships with potential victims before deploying malicious content.…
Detecting Malicious Activities With Traffic Distribution Systems
Traffic Distribution Systems (TDS) have emerged as critical tools for both legitimate and malicious purposes, serving as sophisticated redirection networks that manage traffic flow across multiple endpoints. While businesses use TDS to optimize marketing campaigns and improve service reliability, cybercriminals…
InvokeADCheck – New Powershell Module for Active Directory Assessment
Orange Cyberdefense has announced the development of InvokeADCheck, a new PowerShell module designed to streamline Active Directory (AD) assessments. Created by Niels Hofland and colleague Justin, this tool aims to address the challenges faced by IT administrators and security professionals…
Sitecore Zero-Day Flaw Allows Remote Code Execution
A critical zero-day vulnerability in Sitecore’s enterprise content management system (CMS) has been uncovered, enabling unauthenticated attackers to execute arbitrary code on affected servers. Designated CVE-2025-27218, this pre-authentication remote code execution (RCE) flaw resides in Sitecore versions up to 10.4 and…
Apache Airflow Misconfigurations Leak Login Credentials to Hackers
A recent investigation into misconfigured Apache Airflow instances has uncovered critical vulnerabilities exposing login credentials, API keys, and cloud service access tokens to potential attackers. These workflow platform misconfigurations—primarily caused by insecure coding practices and outdated deployments—have compromised data security…
Two Cybercriminals Arrested for ATM Jackpotting Scheme
Federal authorities have unveiled details of a sophisticated cybercrime operation targeting financial institutions across four states, resulting in the arrests of two Venezuelan nationals linked to the violent Tren de Aragua criminal organization. David Jose Gomez Cegarra, 24, and Jesus…
Case Study: Gaining Internal Network Access Through Physical Penetration Testing
A recent physical penetration test conducted by cybersecurity firm Hackmosphere, revealed critical security flaws in a furniture company’s retail store. The test, which simulated real-world attack scenarios, exposed four major vulnerabilities that could potentially lead to unauthorized access to sensitive…
Cybercriminals Exploit YouTubers to Spread SilentCryptoMiner on Windows Systems
A sophisticated malware campaign has been uncovered, exploiting the growing popularity of Windows Packet Divert drivers for bypassing internet restrictions. Cybercriminals are distributing the SilentCryptoMiner malware disguised as legitimate tools, affecting over 2,000 victims in Russia alone. The attack vector…
7 Malicious Go Packages Target Linux & macOS to Deploy Stealthy Malware Loader
Security researchers at Socket have uncovered a sophisticated malware campaign targeting the Go ecosystem. The threat actor has published at least seven malicious packages on the Go Module Mirror, impersonating widely-used Go libraries to install hidden loader malware on Linux…
Black Basta’s Notorious Tactics and Techniques Exposed in Leaked Intel
A significant leak of internal chat logs from the Black Basta ransomware group has provided cybersecurity researchers with unprecedented insight into their operations, capabilities, and motivations. The leak, released on February 11, 2024, by a Telegram user named ExploitWhispers, contained…
New Malware ‘Desert Dexter’ Hits Over 900 Victims Worldwide
A newly discovered malicious campaign dubbed “Desert Dexter” has infected approximately 900 victims across multiple countries, primarily in the Middle East and North Africa. The Positive Technologies Expert Security Center (PT ESC) uncovered the operation, which has been active since…
SecP0 Ransomware Gang Threatens to Expose Critical Vulnerabilities
A new ransomware collective dubbed SecP0 has emerged with a disruptive strategy that diverges sharply from conventional cybercriminal playbooks. Unlike traditional ransomware groups that focus on encrypting data or threatening to leak stolen information, SecP0 is now demanding ransoms in exchange for withholding…
LibreOffice Flaw Allows Attackers to Run Arbitrary Scripts via Macro URL
A significant security vulnerability in LibreOffice, designated as CVE-2025-1080, has been patched in versions 24.8.5 and 25.2.1, released on March 4, 2025. The flaw, which allowed attackers to execute arbitrary scripts through manipulated macro URLs, posed a severe risk to…
Critical IDOR Vulnerabilities in ZITADEL Let Hackers Modify Key Settings
Security researchers have disclosed critical Insecure Direct Object Reference (IDOR) vulnerabilities in ZITADEL’s administration interface that expose organizations to account takeover risks and unauthorized configuration changes. Tracked as CVE-2025-27507 with a CVSS v3.1 score of 9.1/10, these flaws allow authenticated users without proper permissions…
Malicious Android App on Google Play Compromises 220,000+ Devices
Security researchers at ThreatLabz recently uncovered a sophisticated malware campaign operating through the Google Play Store, leveraging a seemingly benign application to distribute the Anatsa banking trojan (also known as TeaBot). The malicious app, disguised as a file manager and…
Technical Analysis Released on Bybit Hot Wallet Exploit
Cryptocurrency exchange Bybit suffered a sophisticated smart contract exploit on February 21, 2025, resulting in the theft of 401,346.76 ETH (approximately $1.2 billion at the time of the incident). The attack vector leveraged advanced proxy contract manipulation through malicious delegatecall…
Google Unveils GoStringUngarbler to Crack Go-Based Malware Encryption
Google’s FLARE team has released GoStringUngarbler, an open-source tool designed to dismantle string obfuscation in Go binaries protected by the garble compiler. This innovation addresses growing concerns over malware authors exploiting garble’s advanced literal transformations, which render traditional static analysis ineffective.…
CISA Issues Alert on Actively Exploited VMware Vulnerabilities
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) escalated warnings on March 4, 2025, by adding four severe vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog. Federal agencies and private organizations are urged to prioritize mitigation efforts, as threat actors…
Cisco Webex for BroadWorks Flaw Opens Door for Attackers to Access Credentials
Cisco Systems has disclosed a security vulnerability in its Webex for BroadWorks unified communications platform that could allow attackers to intercept sensitive credentials and user data under specific configurations. The flaw, tracked as CSCwo20742 and classified as a low-severity issue, impacts organizations…
North Korean IT Workers Exploit GitHub to Launch Global Cyber Attacks
A network of suspected North Korean IT workers is using GitHub to create and backstop fake personas, aiming to infiltrate companies globally, particularly in Japan and the United States. DPRK-Linked Network Targets Companies in Japan and US Cybersecurity firm Nisos…
Operation Sea Elephant Targets Organizations to Steal Research Data
A sophisticated Advanced Persistent Threat (APT) group, known as CNC, has been conducting a cyber espionage campaign dubbed “Operation Sea Elephant” targeting scientific research institutions and universities in South Asia. The operation, which aims to steal research data related to…