Tag: cyber
-
How Security Teams Use IP Location and DNS History In Cybercrime Investigation
In many security teams, a cybercrime investigation often begins without a complete picture. It starts with a small signal. A suspicious login. An unexpected outbound connection. A single alert that does not look right. From that moment, investigators need context. Logs alone show what happened, but not who is behind it or why it matters.…
-
From arts degree to cybersecurity: Rona Michele Spiegel brings fresh perspective to cyber leadership
Tags: ai, awareness, business, cisco, ciso, cloud, compliance, computer, cyber, cybersecurity, data, governance, group, hacking, Hardware, intelligence, jobs, network, office, penetration-testing, privacy, psychology, risk, risk-management, skills, software, startup, strategy, supply-chain, technology, tool, vulnerabilityRona Michele Spiegel’s journey to cybersecurity might seem unconventional to some: She studied the arts. But as someone who grew up when computers first appeared and everyone wanted to experiment with them, she did a lot of multimedia work. She was always interested in technology and discussed with art colleagues about where the world was…
-
PDFSIDER Malware Actively Exploited to Evade Antivirus and EDR Defenses
Security researchers have identified a sophisticated backdoor malware variant, PDFSIDER, that leverages DLL side-loading to evade endpoint detection and response (EDR) systems. The threat demonstrates advanced persistent threat (APT) tradecraft, combining evasion mechanisms with encrypted command-and-control capabilities to maintain covert access on compromised systems. PDFSIDER’s infection chain originates through spear-phishing campaigns delivering ZIP archives containing…
-
Mandiant Publishes Rainbow Tables That Crack NTLMv1 Admin Passwords
Mandiant haspublicly releasedcomprehensive rainbow tables designed to crack Net-NTLMv1 authentication hashes, addressing a critical security gap that has persisted for over two decades, despite the protocol being deprecated and widely recognized as fundamentally insecure. The decision to release these tables underscores the urgency of migrating away from this outdated authentication mechanism, whichremainsprevalent in active environments…
-
Argus: Python-Based Recon Toolkit Aims to Boost Security Intelligence
Security researchers and penetration testers gain a comprehensive open-source reconnaissance platform with the release of Argus v2.0, a Python-based information gathering toolkit that consolidates 135 specialised modules into a unified command-line interface. The toolkit addresses the growing complexity of modern attack surface management by providing integrated access to network mapping, web application analysis, and threat…
-
Global tensions are pushing cyber activity toward dangerous territory
Cybersecurity is inseparable from geopolitics. Ongoing conflicts, sanctions, trade wars, geoeconomic rivalry, and technological competition have pushed state competition into … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/01/19/cybersecurity-geopolitical-tensions/
-
New “BodySnatcher” Flaw Allows Full ServiceNow User Impersonation
Security researcher has disclosed a critical vulnerability in ServiceNow’s Virtual Agent API and Now Assist AI Agents application, tracked as CVE-2025-12420. Dubbed >>BodySnatcher,<< this flaw enables unauthenticated attackers to impersonate any ServiceNow user using only their email address, bypassing multi-factor authentication and single sign-on controls to execute privileged AI workflows and create backdoor administrator accounts.…
-
Researchers Hijack Hacker Domain Using Name Server Delegation
Security researchers from Infoblox have successfully intercepted millions of malicious push notification advertisements by exploiting a DNS misconfiguration technique known as >>lame nameserver delegation,<< gaining complete visibility into a large-scale affiliate advertising operation without directly compromising any systems. The researchers claimed to have identified abandoned domains used by threat actors, receiving copies of over 57…
-
Threat Actors Abuse Browser Extensions to Deliver Fake Warning Messages
Threat intelligence researchers at Huntress have uncovered a sophisticated browser extension campaign orchestrated by the KongTuke threat actor group, featuring a malicious ad blocker impersonating the legitimate uBlock Origin Lite extension. The campaign weaponizes fake browser crash warnings to trick users into executing malicious PowerShell commands, ultimately delivering ModeloRAT, a previously undocumented Python-based remote access…
-
Microsoft January 2026 Security Update Triggers Credential Prompt Failures in Remote Desktop
Microsoft’s January 2026 security update has disrupted enterpriseRemote Desktopinfrastructure, triggering widespread credential prompt failures that prevent users from accessingAzure Virtual Desktopand Windows 365 environments. The problematic patch KB5074109, released January 13, 2026, introduced an authentication regression affecting Windows 11 versions 24H2 and 25H2 running builds 26100.7623 and 26200.7623. The issue manifests as immediate sign-in failures when…
-
Microsoft January 2026 Security Update Triggers Credential Prompt Failures in Remote Desktop
Microsoft’s January 2026 security update has disrupted enterpriseRemote Desktopinfrastructure, triggering widespread credential prompt failures that prevent users from accessingAzure Virtual Desktopand Windows 365 environments. The problematic patch KB5074109, released January 13, 2026, introduced an authentication regression affecting Windows 11 versions 24H2 and 25H2 running builds 26100.7623 and 26200.7623. The issue manifests as immediate sign-in failures when…
-
When the Olympics connect everything, attackers pay attention
Global sporting events bring a surge of network traffic, new systems, and short term partnerships. That mix draws attention from cyber threat actors who see opportunity in … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/01/19/palo-alto-networks-olympic-cybersecurity-risks-report/
-
Cyber risk keeps winning, even as AI takes over
Cyber risk continues to dominate global business concerns, with AI rising quickly alongside it. According to a new risk survey from Allianz, both are influencing how … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/01/19/allianz-ai-cyber-risk-report/
-
New Kerberos Relay Technique Exploits DNS CNAMEs to Bypass Existing Defenses
Tags: attack, authentication, credentials, cve, cyber, defense, dns, exploit, flaw, ntlm, service, threat, vulnerability, windowsA critical vulnerability in Windows Kerberos authentication that enables attackers to conduct credential-relay attacks by exploiting DNS CNAME records. Tracked as CVE-2026-20929, this flaw allows threat actors to force victims into requesting Kerberos service tickets for attacker-controlled systems, facilitating lateral movement and privilege escalation even when NTLM authentication is entirely disabled. CVE ID Vulnerability Name…
-
GhostPoster Malware Targets Chrome Users via 17 Rogue Extensions
A sophisticated malware campaign has compromised users of Chrome, Firefox, and Edge by deploying 17 malicious extensions that employ advanced steganography techniques to evade detection. Collectively downloaded more than 840,000 times, the GhostPoster operation represents one of the most technically mature and persistent browser extension threats documented to date. The GhostPoster campaign leverages an uncommon…
-
Southeast Asia CISOs Top 13 Predictions for 2026: Securing AI, Centering Identity, and Making Resilience Strategic
Innovation and technology, Hand of robot touching a padlock of security on network connection of business, Data exchange, Financial and banking, AI, Cyber crime and internet security. iStock/ipopba First seen on csoonline.com Jump to article: www.csoonline.com/article/4117844/southeast-asia-cisos-13-top-predictions-for-2026-securing-ai-centering-identity-and-making-resilience-strategic.html
-
Studie: Wirtschaft braucht mehr Schulung in Sachen Hackerabwehr
»Kaum ein Drittel der Unternehmen führt mindestens einmal im Jahr eine Schulung zum Cyber Resilience Act durch.« Die deutsche Wirtschaft sollte in diesem Jahr einen stärkeren Fokus auf das Cybersicherheits-Training ihrer Belegschaften legen. Zu diesem Schluss kommt der aktuelle »IoT & OT Cybersecurity Report 2025« des Düsseldorfer Cybersicherheitsunternehmens ONEKEY [1]. Ab Herbst dieses Jahres… First…
-
Google Vertex AI Flaw Lets Low-Privilege Users Escalate to Service Agent Roles
Security researchers have discovered critical privilege escalation vulnerabilities in Google’s Vertex AI platform that allow attackers with minimal permissions to hijack high-privileged Service Agent accounts. The flaws affect the Vertex AI Agent Engine and Ray on Vertex AI, where default configurations enable low-privileged users to access powerful managed identities with project-wide permissions. As enterprises rapidly…
-
Microsoft’s January Security Update of High-Risk Vulnerability Notice for Multiple Products
Overview On January 14, NSFOCUS CERT detected that Microsoft released the January Security Update patch, which fixed 112 security issues involving widely used products such as Windows, Microsoft Office, Microsoft SQL Server, Azure, etc., including high-risk vulnerability types such as privilege escalation and remote code execution. Among the vulnerabilities fixed by Microsoft’s monthly update this…The…
-
AWS Console Supply Chain Breach Enables GitHub Repository Hijacking
Tags: attack, breach, credentials, cyber, cybersecurity, exploit, github, malicious, open-source, service, supply-chain, threatA newly reported supply chain attack targeting the Amazon Web Services (AWS) management console has raised alarms across the developer community. Cybersecurity researchers have discovered that threat actors are exploiting misconfigured AWS credentials and integrated GitHub actions tohijack repositoriesand inject malicious code into open-source projects. According to the security firm that uncovered the incident, attackersexploitcompromised…
-
Zero-Click Exploit Chain Discovered Targeting Google Pixel 9 Devices
Security researchers at Google Project Zero have disclosed a complete zero-click exploit chain affecting Google Pixel 9 smartphones, chaining vulnerabilities in the Dolby audio decoder and kernel driver to achieve code execution and privilege escalation without any user interaction. The exploit leverages three distinct vulnerabilities: CVE-2025-54957 in the Dolby Unified Decoder, CVE-2025-36934 in a kernel…
-
Azure Identity Token Flaw Exposes Windows Admin Center to Tenant-Wide Breaches
Cymulate Research Labs discovered a high-severity authentication bypass vulnerability in Microsoft Windows Admin Centre’s Azure AD Single Sign-On implementation that enables attackers with local administrator access on a single machine to compromise any other Windows Admin Center-managed system within the same Azure tenant. The flaw, tracked as CVE-2026-20965, stems from improper validation of Proof-of-Possession (PoP) tokens…
-
Azure Identity Token Flaw Exposes Windows Admin Center to Tenant-Wide Breaches
Cymulate Research Labs discovered a high-severity authentication bypass vulnerability in Microsoft Windows Admin Centre’s Azure AD Single Sign-On implementation that enables attackers with local administrator access on a single machine to compromise any other Windows Admin Center-managed system within the same Azure tenant. The flaw, tracked as CVE-2026-20965, stems from improper validation of Proof-of-Possession (PoP) tokens…
-
Germany and Israel Deepen Cybersecurity Ties With New Security Pact
Germany and Israel have taken an important step toward deepening their long-standing security partnership by expanding cooperation in the field of cybersecurity. During a weekend visit to Jerusalem, German Interior Minister Alexander Dobrindt and Israeli Prime Minister Benjamin Netanyahu signed a new cyber and security pact aimed at reinforcing existing frameworks and addressing growing digital threats facing both countries. …
-
Insider risk in an age of workforce volatility
Tags: access, ai, api, authentication, automation, backdoor, backup, china, ciso, control, credentials, cyber, cybersecurity, data, data-breach, exploit, framework, governance, government, identity, jobs, least-privilege, malicious, mitigation, monitoring, network, risk, strategy, supply-chain, threat, zero-trustEarly warnings: The machine as insider risk/threat: These dynamics are not emerging in a vacuum. They represent the culmination of warnings that have been building for years.As early as 2021, in my CSO opinion piece “Device identity: The overlooked insider threat,” Rajan Koo (then chief customer officer at DTEX Systems, now CTO) observed: “There needs…
-
Confidential Supply Chains: Wie Unternehmen ihre Softwarelieferkette strategisch absichern
In den letzten Jahren haben Supply-Chain-Angriffe zeitweise ganze Branchen lahmgelegt oder massenhaften Datendiebstahl ermöglicht. Vor dem Hintergrund des EU-Cyber-Resilience-Acts wird von Softwareherstellern daher künftig nicht nur Transparenz, sondern auch nachweisbare Integrität ihrer Komponenten verlangt. Kryptografisch gesicherte Pipelines und Confidential Computing ermöglichen hier eine belastbare, auditfähige Lieferkette. Aber wie sieht eine solche »Confidential Supply Chain« in……
-
Trump’s cyber chief pick tells lawmakers he’ll assess efficacy of Cybercom-NSA dual-hat role, if confirmed
Tags: cyber“If I’m confirmed for this, I think my role is to be objective about that as that comes up, or if it continues to come up as a topic,” Rudd said. First seen on defensescoop.com Jump to article: defensescoop.com/2026/01/15/gen-rudd-cybercom-nsa-dual-hat-cyber-force/
-
CISA, Allies Sound Alarm on OT Network Exposure
Joint US, UK and Five Eyes Guidance Flags OT Exposure as National Risk. U.S. and allied cyber agencies issued new guidance warning that insecure operational technology connectivity – driven by remote access, third-party vendors and IT integration – remains a major threat vector, enabling cyber intrusions to escalate into physical disruptions. First seen on govinfosecurity.com…
-
Cyber body ISC2 signs on as UK software security ambassador
Professional cyber association ISC2 pledges support to UK government’s Software Security Ambassador scheme, part of the recently unveiled Cyber Action Plan First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366637377/Cyber-body-ISC2-signs-on-as-UK-software-security-ambassador
-
Why I’m withholding certainty that “precise” US cyber-op disrupted Venezuelan electricity
NYT says US hackers were able to turn off power and then quickly turn it back on. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/01/unnamed-officials-tell-nyt-precise-cyber-op-took-out-venezuelas-power-grid/