Tag: attack
-
Sandworm Uses SSH-over-Tor Tunnel for Stealthy Long-Term Persistence
A significant evolution in Sandworm (APT-C-13) tradecraft, revealing the group’s use of SSH-over-Tor tunneling to achieve long-term, covert persistence inside targeted networks. Sandworm, also known as FROZENBARENTS, is a state-sponsored threat group active since 2014. It has consistently targeted government bodies, energy firms, and research institutions, focusing on intelligence collection. The attack begins with spear-phishing…
-
Chinese Silk Typhoon Hacker Extradited to U.S. Over COVID Research Cyberattacks
A Chinese national accused of being a member of the Silk Typhoon hacking group has been extradited to the U.S. from Italy. Xu Zewei, 34, was arrested in July 2025 by Italian authorities for his alleged links to the Chinese state-sponsored threat group and for orchestrating cyber attacks against American organizations and government agencies between…
-
Stopping AiTM attacks: The defenses that actually work after authentication succeeds
Tags: 2fa, access, attack, authentication, awareness, breach, communications, compliance, control, credentials, data, defense, detection, email, finance, framework, identity, incident response, login, mfa, microsoft, monitoring, nist, passkey, phishing, risk, service, threat, tool, trainingThe 3 controls that close the gap: Control #1: Bind sessions to managed devices The most impactful single control for session security is requiring managed, compliant devices as a condition of accessing sensitive resources. When access policies, such as Microsoft Entra Conditional Access, require that the device presenting a session token is enrolled, managed and…
-
Critical LiteLLM Flaw Enables Database Attacks Through SQL Injection
Tags: access, api, attack, authentication, cve, cyber, cybercrime, exploit, flaw, injection, sql, vulnerabilityA critical pre-authentication SQL injection vulnerability, identified as CVE-2026-42208, has been discovered in the popular LiteLLM gateway, allowing attackers to access databases without credentials. Cybercriminals have already been observed exploiting this flaw to target high-value secrets such as API keys and provider credentials. Overview of the Vulnerability CVE-2026-42208 is a critical flaw in LiteLLM, an…
-
OilRig Hides C2 Config in Google Drive Image via LSB Steganography
APT-C-49 (OilRig), an Iranian state-sponsored advanced persistent threat group also known as APT34 and Helix Kitten, has deployed a sophisticated new attack campaign that conceals command-and-control configurations inside Google Drive images using LSB steganography. The group, which has been active since at least 2014, primarily targets government, energy, telecommunications, and financial sectors across the Middle…
-
Microsoft Patches Entra ID Role Flaw That Enabled Service Principal Takeover
An administrative role meant for artificial intelligence (AI) agents within Microsoft Entra ID could enable privilege escalation and identity takeover attacks, according to new findings from Silverfort.Agent ID Administrator is a privileged built-in role introduced by Microsoft as part of its agent identity platform to handle all aspects of an AI agent’s identity lifecycle operations…
-
Diagnostic Fatigue: Why the Visibility Industry Just Hit Its Limit
For more than a decade, cybersecurity has sold one product under a thousand names: visibility. SIEM for events. EDR for endpoints. ASM for the attack surface. CNAPP for the cloud. Exposure management for everything else. Every category promised the same thing: if we could just see enough, we would finally secure enough. The visibility industry…The…
-
Chinese national extradited to US for pandemic-era Silk Typhoon attacks
Xu Zewei was allegedly directed by China’s intelligence services to conduct a sweeping espionage campaign to steal data on COVID-19 research and other U.S. policy interests. First seen on cyberscoop.com Jump to article: cyberscoop.com/xu-zewei-extradited-china-national-silk-typhoon-hafnium/
-
Ongoing supply-chain attack ‘explicitly targeting’ security, dev tools
Vendor confirms repo data exposure after Lapsus$ claims source code, secrets dump First seen on theregister.com Jump to article: www.theregister.com/2026/04/27/supply_chain_campaign_targets_security/
-
Wireless Network Security: WEP, WPA, WPA2 WPA3 Explained in 2026
Wireless security is important for protecting wireless networks and services from unwanted attacks in 2026. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/trends/the-best-security-for-wireless-networks/
-
GlassWorm malware attacks return via 73 OpenVSX “sleeper” extensions
A new wave of the Glassworm campaign is targeting the OpenVSX ecosystem with 73 “sleeper” extensions that turn malicious after an update. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/glassworm-malware-attacks-return-via-73-openvsx-sleeper-extensions/
-
ADT Breach Exposes Data of 5.5 Million Customers, ShinyHunters Likely Behind Attack
The ShinyHunters extortion group is claiming responsibility for a breach of home and commercial security vendor ADT that exposed the data of 5.5 million customers. attack appears to be part of a larger and ongoing vishing campaign being run by the prolific threat actors. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/04/adt-breach-exposes-data-of-5-5-million-customers-shinyhunters-likely-behind-attack/
-
AI Red Teaming Is Not Equal to Prompt Injection
Why AI and Traditional Penetration Testing Must Converge As artificial intelligence red teaming evolves beyond prompt injection, security teams must combine data science, model testing and traditional penetration testing to assess risks across the full attack surface. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/blogs/ai-red-teaming-equal-to-prompt-injection-p-4106
-
FIRESIDE CHAT: Leaked secrets are now the go-to attack vector, and AI is accelerating exposures
A consequential shift is underway in how enterprise breaches begin. The leaked credential, once treated as a hygiene problem, has become the primary on-ramp. Related: No easy fixes for AI risk Last August’s Salesloft campaign was the pattern… (more”¦) First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/04/fireside-chat-leaked-secrets-are-now-the-go-to-attack-vector-and-ai-is-accelerating-exposures/
-
Home Security Firm ADT Breach: 5.5M Customers’ Data Exposed
Prolific ShinyHunters Extortion Group Made ‘Pay or Leak’ Threat to Victim. Home security giant ADT has suffered a data breach that appears to have exposed personally identifiable information tied to 5.5 million customers. Prolific extortionist group ShinyHunters claimed credit for the attack, saying it stole Salesforce data after socially engineering an ADT employee. First seen…
-
Checkmarx Confirms GitHub Repository Data Posted on Dark Web After March 23 Attack
Checkmarx has disclosed that its ongoing investigation tied to the supply chain security incident has revealed that a cybercriminal group published data related to the company on the dark web.”Based on current evidence, we believe this data originated from Checkmarx’s GitHub repository, and that access to that repository was facilitated through the initial supply chain…
-
âš¡ Weekly Recap: Fast16 Malware, XChat Launch, Federal Backdoor, AI Employee Tracking & More
Everything is dumb again. This week feels broken in a very familiar way. Old tricks are back. New tools are doing shady crap. Supply chains got hit. Fake help desks worked. Weird research showed how easy some attacks still are.Most of it feels like stuff we should have fixed years ago. Bad extensions. Stolen creds.…
-
âš¡ Weekly Recap: Fast16 Malware, XChat Launch, Federal Backdoor, AI Employee Tracking & More
Everything is dumb again. This week feels broken in a very familiar way. Old tricks are back. New tools are doing shady crap. Supply chains got hit. Fake help desks worked. Weird research showed how easy some attacks still are.Most of it feels like stuff we should have fixed years ago. Bad extensions. Stolen creds.…
-
Webinar: Spotting cyberattacks before they begin
On Thursday, April 30 at 2:00 PM ET, BleepingComputer will host a live webinar with threat intelligence company Flare and threat intelligence researcher Tammy Harper, exploring how security teams can identify early warning signs of attacks before they escalate into incidents. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/webinar-spotting-cyberattacks-before-they-begin/
-
DDoS Testing vs Protection: The Missing Layer in Your Defense
Key takeaways DDoS protection refers to the tools and architecture deployed to stop attacks (CDNs, WAFs, scrubbing centers, firewall rules) operating continuously in the traffic path DDoS testing is a controlled simulation that validates whether those tools actually work under real-world attack conditions 68% of protection faults found in Red Button simulations were rated… First…
-
New Malware Hides Behind Obfuscation and Staged Payloads
A newly identified malware campaign is leveraging advanced obfuscation techniques and multi-stage payload delivery to bypass traditional security defenses, according to recent analysis from Joe Sandbox. The attack begins with a highly targeted spear-phishing email sent to employees of the Punjab Safe Cities Authority (PSCA) and PPIC3 in Pakistan. The email impersonates an internal consultant…
-
Utilities Tech Supplier Itron Discloses Cyber-Attack, Operations Unaffected
Itron confirmed a cyber incident but does not believe it is likely to have a material impact on the company First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/utilities-tech-supplier-itron/
-
Deepfake Voice Attacks are Outpacing Defenses: What Security Leaders Should Know
Three seconds of audio is all it takes to clone a voice for fraud. Adaptive Security shows how deepfake calls trick employees into sending real money”, and why most defenses don’t catch them. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/deepfake-voice-attacks-are-outpacing-defenses-what-security-leaders-should-know/
-
PhantomCore Exploits TrueConf Vulnerabilities to Breach Russian Networks
A pro-Ukrainian hacktivist group called PhantomCore has been attributed to attacks actively targeting servers running TrueConf video conferencing software in Russia since September 2025.That’s according to a report published by Positive Technologies, which found the threat actors to be leveraging an exploit chain comprising three vulnerabilities to execute commands remotely on susceptible First seen on…
-
Researchers Warn macOS textutil, KeePassXC Can Fuel Automation Attacks
Researchers are warning that widely trusted local tools such as macOS’s textutil and KeePassXC can pose unexpected security risks when used within automated workflows. The issue is not traditional vulnerabilities such as memory corruption or code execution, but how normal features behave when exposed to attacker-controlled input. Many engineering teams treat built-in utilities as safe…
-
Vidar Infostealer Spreads via Fake CAPTCHAs, Hides in JPEG and TXT Files
New version of Vidar infostealer spreads via fake CAPTCHAs, hides in JPEG and TXT files, uses fileless attacks and steals browser, crypto wallet data. First seen on hackread.com Jump to article: hackread.com/vidar-infostealer-fake-captchas-jpeg-txt-files/
-
When security becomes the attack surface: Why endpoint protection must evolve
When attackers target security tools, protection must be resilient, self-healing and always on. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/spons/when-security-becomes-the-attack-surface-why-endpoint-protection-must-evol/818265/
-
AI is reshaping DevSecOps to bring security closer to the code
Tags: access, ai, api, application-security, attack, authentication, automation, breach, business, cloud, communications, compliance, container, control, data, data-breach, detection, exploit, governance, infrastructure, injection, least-privilege, risk, service, skills, software, sql, strategy, supply-chain, threat, tool, training, vulnerabilityExplicit security requirements elevate AI benefits: While deploying AI with DevSecOps is helping to shift the emphasis on security to earlier in the development lifecycle, this requires “explicit instruction to do it right,” says Noe Ramos, vice president of AI operations at business software provider Agiloft.”AI coding assistants accelerate development meaningfully, but they optimize for…
-
North Korean Hackers Target Pharma Firms with Malware-Laced Excel Attacks
North Korean state-backed hackers are using weaponized Excel-themed files to infect pharmaceutical and life science companies with malware, abusing Windows shortcut files, PowerShell, and cloud storage for stealthy data theft. The campaign begins with highly tailored spear”‘phishing emails sent to drug manufacturers and related life science organizations. Messages typically reference legitimate”‘sounding topics such as ERP…
-
North Korean Hackers Target Pharma Firms with Malware-Laced Excel Attacks
North Korean state-backed hackers are using weaponized Excel-themed files to infect pharmaceutical and life science companies with malware, abusing Windows shortcut files, PowerShell, and cloud storage for stealthy data theft. The campaign begins with highly tailored spear”‘phishing emails sent to drug manufacturers and related life science organizations. Messages typically reference legitimate”‘sounding topics such as ERP…