Tag: cyber
-
ResidentBat Android Malware Grants Belarusian KGB Ongoing Mobile Access
ResidentBat is a custom Android spyware implant used by the Belarusian KGB to turn seized smartphones into long”‘lived surveillance platforms against journalists and civil society targets. Operating outside the Play Store ecosystem and requiring hands”‘on installation, it combines deep data collection with remote control features, including the ability to wipe a device on demand. RSF’s…
-
ResidentBat Android Malware Grants Belarusian KGB Ongoing Mobile Access
ResidentBat is a custom Android spyware implant used by the Belarusian KGB to turn seized smartphones into long”‘lived surveillance platforms against journalists and civil society targets. Operating outside the Play Store ecosystem and requiring hands”‘on installation, it combines deep data collection with remote control features, including the ability to wipe a device on demand. RSF’s…
-
Insights into Claude Code Security: A New Pattern of Intelligent Attack and Defense
On February 20, 2026, AI company Anthropic released a new code security tool called Claude Code Security. This release coincided with the highly sensitive period of global capital markets to AI technology subverting the traditional software industry, which quickly triggered violent fluctuations in the capital market and caused the fall of stock prices of major…The…
-
ServiceNow AI Platform Vulnerability Allows Remote Code Execution
ServiceNow has disclosed a critical security vulnerability in its AI Platform that could allow unauthenticated attackers to remotely execute code within the ServiceNow Sandbox environment. Tracked as CVE-2026-0542, the flaw was formally published on February 25, 2026, under security advisory KB2693566. Overview of the Vulnerability The vulnerability exists within the ServiceNow AI Platform and can be exploited…
-
Google GTIG disrupted China-linked APT UNC2814 halting attacks on 53 orgs in 42 countries
Google and partners disrupted UNC2814, a suspected China-linked group that hacked 53 organizations across 42 countries. Google, with industry partners, disrupted the infrastructure of UNC2814, a suspected China-linked cyber espionage group that breached at least 53 organizations in 42 countries. The group has been active since at least 2017, and was spotted targeting governments and…
-
Government Data Stolen After Hacker Jailbreaks Claude AI to Write Malicious Exploit Code
Tags: ai, breach, cyber, cyberattack, cybersecurity, data, exploit, government, hacker, malicious, vulnerabilityA hacker successfully manipulated Anthropic’s Claude AI to launch a sophisticated month-long cyberattack against Mexican government agencies. Between December 2025 and January 2026, the attacker utilized >>jailbreaking<< techniques to bypass safety guardrails, forcing the AI to identify vulnerabilities, generate functional exploit code, and exfiltrate sensitive data. The Jailbreak Method Cybersecurity firm Gambit Security revealed that…
-
New $300 Android RAT Boasts Automated Permission Bypass and Hidden Remote Control
Every so often, a new piece of malware emerges that truly shifts the threat landscape. Oblivion, a newly discovered Android Remote Access Trojan (RAT), appears to be one such moment. Unlike recycled or buggy Remote Access Trojan (RATs) seen across underground markets, Oblivion is promoted as a ground”‘up build, tested for months before public release. The…
-
Hydra Saiga Espionage Campaign Targets Critical Utilities Using Telegram C2 for Data Theft
Hydra Saiga is running a long-running espionage campaign that abuses Telegram as command-and-control (C2) to infiltrate critical utilities in Central Asia and exfiltrate sensitive data from government and infrastructure networks. The first known Hydra Saiga activity dates to December 2024, when an executable named “Letter from the Permanent Representative of Turkmenistan to the UN addressed…
-
Global Cyber Agencies Urge Immediate Patching of Cisco SD-WAN Zero Day
The US and allies are urging Cisco Catalyst SD-WAN customers to hunt for signs of exploitation First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/immediate-patch-cisco-catalyst/
-
New PoC for Windows Exploit Lets Low-Privileged Users Crash Systems with BSOD
Security researchers have released a new Proof of Concept (PoC) for a vulnerability in the Windows Common Log File System (CLFS) driver. The flaw, identified as CVE-2026-2636, allows low-privileged users to force a system into a Blue Screen of Death (BSoD), effectively causing a Denial of Service. Vulnerability Mechanism The discovery occurred while a researcher…
-
5 trends that should top CISO’s RSA 2026 agendas
Tags: access, ai, attack, authentication, backup, business, cio, ciso, cloud, conference, control, corporate, cryptography, cyber, cybersecurity, data, defense, detection, edr, finance, framework, governance, group, healthcare, identity, incident response, intelligence, network, okta, resilience, risk, saas, service, skills, software, strategy, tactics, technology, threat, tool, training, update, vulnerability, zero-trustCTEM in the spotlight: In another evolutionary trend, most organizations are moving beyond scanning for software snafus to continuous threat exposure management (CTEM). By doing so, security teams hope to get a full picture of all assets, as well as their configurations, locations, software vulnerabilities, ownership, and business criticality.Armed with this data, CTEM platforms look…
-
Claude Code Lets Users Control Terminal Sessions Remotely from Their Phones
Anthropic has unveiled a significant update to its Claude Code platform, introducing a new >>Remote Control<< feature. This capability allows developers to manage terminal sessions directly from their smartphones or remote web browsers, bridging the gap between desktop development and mobile accessibility. The feature is currently available in a Research Preview phase for Claude Max…
-
DarkCloud Infostealer Escalates as Major Enterprise Threat with Scalable Credential Theft
Infostealers continue to dominate the initial access landscape in 2026, driving breaches through scalable credential theft. Among these, DarkCloud has emerged as a major threat, illustrating how low-cost, commercialized malware is reshaping enterprise compromise dynamics worldwide. Despite being promoted as “surveillance software,” its real function is unmistakable highvolume credential harvesting across browsers, email clients, file transfer tools, and…
-
Firefox 148 Unveils New Sanitizer API to Mitigate XSS Attacks in Web Applications
Firefox has launched a major update to help protect web applications from Cross-Site Scripting (XSS) attacks. With the release of Firefox 148, Mozilla introduces the new standardized Sanitizer API, making it the first browser to ship this built-in security tool. This new feature gives web developers an easy way to clean up untrusted code before…
-
Steaelite RAT Drives Surge in Double Extortion Attacks on Enterprises
A newly surfaced Remote Access Trojan (RAT) named Stealer is rapidly gaining traction across cybercrime networks, fueling a fresh wave of double-extortion incidents against enterprise targets. It offers features such as HVNC (Hidden Virtual Network Computing) monitoring and banking application bypass capabilities once reserved for advanced, custom-built malware teams. Steaelite’s marketing strategy mirrors that of commercial malware projects. The developer has actively…
-
Kali Linux Introduces Claude AI for Automated Penetration Testing Using Model Context Protocol
Offensive security operations are evolving with a new method for running Kali Linux. By combining Kali with Anthropic’s Claude AI via the Model Context Protocol (MCP), security analysts can now execute penetration testing tools using simple natural language. This moves operations beyond traditional terminal commands into an AI-assisted graphical interface. While command-line execution remains standard,…
-
Google Disrupts Chinese Hacker Network Behind 53 Telecom, Gov’t Breaches
Tags: breach, china, cyber, espionage, google, government, group, hacker, infrastructure, intelligence, mandiant, network, threatGoogle and its partners have disrupted a major Chinese state-linked cyber espionage campaign that breached at least 53 telecommunications and government entities across 42 countries on four continents. The operation, led by Google Threat Intelligence Group (GTIG) alongside Mandiant and industry partners, dismantled the infrastructure of a suspected People’s Republic of China (PRC) nexus group…
-
Critical Cisco SD-WAN 0-Day Exploited for Root Access in Active Cyberattacks
Tags: access, authentication, cisco, cvss, cyber, cyberattack, exploit, flaw, network, threat, update, vulnerability, zero-dayCisco has released urgent updates to patch a critical zero-day vulnerability in its Catalyst SD-WAN products. A highly sophisticated threat actor, known as UAT-8616, is actively exploiting this flaw in the wild to gain deep access to enterprise network edges.”‹ Vulnerability Overview Vulnerability Details Information Vulnerability Cisco Catalyst SD-WAN Controller Authentication Bypass Severity Critical CVSS…
-
Critical Cisco SD-WAN 0-Day Exploited for Root Access in Active Cyberattacks
Tags: access, authentication, cisco, cvss, cyber, cyberattack, exploit, flaw, network, threat, update, vulnerability, zero-dayCisco has released urgent updates to patch a critical zero-day vulnerability in its Catalyst SD-WAN products. A highly sophisticated threat actor, known as UAT-8616, is actively exploiting this flaw in the wild to gain deep access to enterprise network edges.”‹ Vulnerability Overview Vulnerability Details Information Vulnerability Cisco Catalyst SD-WAN Controller Authentication Bypass Severity Critical CVSS…
-
How does Agentic AI help you stay ahead in cybersecurity
The Role of Agentic AI in Modern Cybersecurity Are you exploring the future trends making waves in cybersecurity today? One transformative technology, Agentic AI, is reshaping how organizations manage Non-Human Identities (NHI) and Secrets Security Management, allowing businesses to stay ahead of potential cyber threats. Understanding Non-Human Identities Machine identities, also known as Non-Human Identities……
-
Feds Scramble Amid Shutdown to Secure Cisco SD-WAN Systems
Emergency CISA Directive Lands as DHS Shutdown Strains Cyber Operations. The Cybersecurity and Infrastructure Security Agency issued a directive Wednesday ordering civilian agencies to secure and hunt for compromise in vulnerable Cisco SD-WAN systems after officials observed active exploitation – while warning that shutdown-related disruptions heighten operational risk. First seen on govinfosecurity.com Jump to article:…
-
CVE-2026-20127: Cisco Catalyst SD-WAN Controller/Manager Zero-Day Authentication Bypass Vulnerability Exploited in the Wild
Tags: access, advisory, attack, authentication, cisa, cisco, cve, cyber, cybersecurity, exploit, flaw, government, infrastructure, intelligence, mitigation, network, risk, software, threat, update, vulnerability, zero-dayExploitation of a maximum severity authentication bypass zero-day vulnerability affecting Cisco Catalyst SD-WAN Controller and Manager has been reported. Immediate patching is recommended to thwart ongoing attacks. Key takeaways: CVE-2026-20127 is an Authentication Bypass Vulnerability affecting Cisco Catalyst SD-WAN Controller and Manager. Patches have been released and no workarounds are currently available. Exploitation in the…
-
US cybersecurity agency CISA reportedly in dire shape amid Trump cuts and layoffs
Under the first year of the Trump administration, the U.S. cyber agency CISA has faced cuts, layoffs, and furloughs, as bipartisan lawmakers and cybersecurity industry sources say the agency is unprepared to handle a crisis. First seen on techcrunch.com Jump to article: techcrunch.com/2026/02/25/us-cybersecurity-agency-cisa-reportedly-in-dire-shape-amid-trump-cuts-and-layoffs/
-
Medical Device Maker Reports Data Theft Hack to SEC
Attack Spotlights Threats, Risks Facing Healthcare Supply Chain. UFP Technologies, a Massachusetts-based maker of single-use medical devices and other healthcare supplies, has notified the U.S. Securities and Exchange Commission of a cyber incident discovered on Valentine’s Day that involved the theft or destruction of company data. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/medical-device-maker-reports-data-theft-hack-to-sec-a-30847
-
US Sanctions Russian Exploit Broker Over Stolen US Cyber Tools
The US Treasury targets Sergey Zelenyuk and his firm Operation Zero for the illegal trade of stolen government cyber tools following the sentencing of Peter Williams. First seen on hackread.com Jump to article: hackread.com/us-sanctions-russian-exploit-broker-us-cyber-tools/
-
Google Disrupts UNC2814 GRIDTIDE Campaign After 53 Breaches Across 42 Countries
Tags: breach, china, cyber, espionage, google, government, group, infrastructure, international, usaGoogle on Wednesday disclosed that it worked with industry partners to disrupt the infrastructure of a suspected China-nexus cyber espionage group tracked as UNC2814 that breached at least 53 organizations across 42 countries.”This prolific, elusive actor has a long history of targeting international governments and global telecommunications organizations across Africa, Asia, and the Americas,” First…
-
Cisco Catalyst SD-WAN users targeted in series of cyber attacks
The NCSC, Cisa, and other Five Eyes agencies have warned of mass exploitation of vulnerabilities in Cisco Catalyst SD-WAN, which Cisco is attributing to an unknown threat actor called UAT-8616. First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366639459/Cisco-Catalyst-SD-WAN-users-targeted-in-series-of-cyber-attacks
-
Application exploitation back in vogue, says IBM cyber unit
IBM’s X-Force unit observes an uptick in the exploitation of vulnerable public-facing software applications First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366639365/Application-exploitation-back-in-vogue-says-IBM-cyber-unit
-
Threat actor leveraged Cisco SD-WAN zero-day since 2023 (CVE-2026-20127)
A >>highly sophisticated<< cyber threat actor has been exploiting a zero-day authentication bypass vulnerability (CVE-2026-20127) in Cisco Catalyst SD-WAN Controller … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/02/25/cisco-sd-wan-zero-day-cve-2026-20127/
-
One Identity Appoints Michael Henricks as Chief Financial and Operating Officer
Alisa Viejo, CA, United States, February 25th, 2026, CyberNewswire One Identity, a trusted leader in identity security, today announced the appointment of Michael Henricks as Chief Financial and Operating Officer. This decision reflects the continued growth of the business and a focus on aligning financial leadership with operational objectives as One Identity scales. “As One…