Tag: cyber
-
NSA cyber directorate gets new acting leadership
Tags: cyberDavid Imbordino, a NSA senior executive who is currently serving as the directorate’s deputy chief, will take the reins in an acting capacity at the end of the month. First seen on therecord.media Jump to article: therecord.media/nsa-cyber-directorate-new-acting-leadership
-
Six for 2026: The cyber threats you can’t ignore
Cybersecurity threats in 2026 are accelerating, driven by AI, automation, and more effective social engineering. Corelight outlines six emerging attack trends and explains how network visibility can help defenders respond faster. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/six-for-2026-the-cyber-threats-you-cant-ignore/
-
US announces withdrawal from dozens of international treaties
Although the list does not include what are perceived to be the more consequential multilateral bodies shaping global cyber governance and state behaviour in cyberspace, some of the organizations play a role in shaping international law broadly. First seen on therecord.media Jump to article: therecord.media/us-announces-withdrawal-from-dozens-international-orgs
-
NIS2-Umsetzung: Neues BSI-Portal geht an den Start
Tags: bsi, ceo, cloud, cyber, gartner, infrastructure, linkedin, nis-2, resilience, risk-analysis, risk-management, service, vulnerabilityUnternehmen können sich ab sofort über das neue BSI-Portal als NIS2-Einrichtung registrieren und IT-Sicherheitsvorfälle melden.Seit Anfang Dezember gilt die EU-Sicherheitsrichtline NIS2 auch in Deutschland. Rund 29.500 Unternehmen sind dadurch verpflichtet, sich als NIS-2-Einrichtungen zu registrieren und dem Bundesamt für Sicherheit in der Informationstechnik (BSI) erhebliche Sicherheitsvorfälle zu melden. Vor diesem Hintergrund hat das BSI ein…
-
US To Leave Global Forum on Cyber Expertise
The Trump administration decided to leave 66 international organizations, including the GFCE and the European Centre of Excellence for Countering Hybrid Threats First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/us-leave-global-forum-on-cyber/
-
ownCloud Warns Users to Enable MFA After Credential Theft Incident
ownCloud has issued an urgent security advisory urging users to enable Multi-Factor Authentication (MFA) following a credential theft incident reported by threat intelligence firm Hudson Rock. The incident, discovered in January 2026, affected organizations using self-hosted file-sharing platforms, including some ownCloud Community Edition deployments. What Happened The incident did not result from any vulnerability or…
-
Researchers Poison Stolen Data to Sabotage AI Model Accuracy
A groundbreaking cybersecurity research team has developed a novel defensive technique that renders stolen artificial intelligence databases virtually useless to attackers by deliberately poisoning proprietary knowledge graphs with plausible yet false information.”‹ The research, conducted by scientists from the Institute of Information Engineering at the Chinese Academy of Sciences, National University of Singapore, and Nanyang…
-
Global GoBruteforcer Botnet Campaign Threatens 50,000 Linux Servers
A sophisticated modular botnet known as GoBruteforcer is actively targeting Linux servers worldwide, with researchers estimating that more than 50,000 internet-facing servers remain vulnerable to these coordinated attacks. The threat, which has evolved significantly since its initial discovery in 2023, poses a growing danger to organizations that rely on exposed database and file-transfer services.”‹ GoBruteforcer,…
-
Cybercriminals Exploit VMware ESXi Vulnerabilities Using Zero-Day Toolset
Huntress security researchers have uncovered a sophisticated VMware ESXi exploitation campaign using a zero-day toolkit that remained undetected for over a year before VMware’s public disclosure. The December 2025 intrusion, which began through a compromised SonicWall VPN, demonstrates how threat actors are chaining multiple critical vulnerabilities to achieve complete hypervisor compromise. Attack Chain Begins With…
-
Cybercriminals Exploit VMware ESXi Vulnerabilities Using Zero-Day Toolset
Huntress security researchers have uncovered a sophisticated VMware ESXi exploitation campaign using a zero-day toolkit that remained undetected for over a year before VMware’s public disclosure. The December 2025 intrusion, which began through a compromised SonicWall VPN, demonstrates how threat actors are chaining multiple critical vulnerabilities to achieve complete hypervisor compromise. Attack Chain Begins With…
-
Linux Battery Utility Vulnerability Allows Authentication Bypass and System Tampering
Linux laptop users are being urged to update after a flaw in a popular battery optimisation tool was found to allow authentication bypass and system tampering. The vulnerability affects the TLP power profiles daemon introduced in version 1.9.0, which exposes aD-Bus APIfor managing power profiles with root privileges. How the flaw works TLP’s profiles daemon runs as…
-
GitLab Patches Multiple Flaws Allowing Arbitrary Code Execution
Linux administrators are being urged to update promptly after disclosures of multiple vulnerabilities in GitLab, including flaws that could enablecross-site scripting, authorization bypass, and denial of service inselfmanagedinstances. The latest patch releases, GitLab 18.7.1, 18.6.3, and 18.5.5, address these security issues alongside several bug fixes and dependency updates, and are already deployed on GitLab.com. GitLab…
-
BlueDelta Hackers Target Microsoft OWA, Google, and Sophos VPN to Steal Credentials
A sophisticated credential-harvesting operation conducted by BlueDelta, a Russian state-sponsored threat group linked to the GRU’s Main Directorate, targeted critical infrastructure organizations and research institutions throughout 2025, according to a comprehensive investigation by Recorded Future’s Insikt Group. The campaign, spanning February through September 2025, represents a significant evolution in the group’s persistent credential-theft operations, with…
-
Three Malicious NPM Packages Target Developers’ Login Credentials
Security researchers at Zscaler ThreatLabz have uncovered three malicious npm packages designed to install a sophisticated remote access trojan (RAT) targeting JavaScript developers. The packages, named bitcoin-main-lib, bitcoin-lib-js, and bip40, collectively registered over 3,400 downloads before being removed from the npm registry in November 2025. The attack exploits developer trust in the legitimate BitcoinJS project…
-
Cloudflare pours cold water on ‘BGP weirdness preceded US attack on Venezuela’ theory
Suggests rotten routing, not evidence of a cyber-strike before kinetic action First seen on theregister.com Jump to article: www.theregister.com/2026/01/08/cloudflare_venezuela_bgp_attack_theory/
-
Alleged scam kingpin Chen Zhi extradited to China after Cambodia arrest
Chen founded the Prince Group, a multinational conglomerate authorities allege served as a front for ‘one of Asia’s largest transnational criminal organisations'<a href=”https://www.theguardian.com/world/2025/oct/17/chen-zhi-prince-group-cambodia-cyber-crime-sanctioned”>Chinese-born tycoon Chen Zhi, who was indicted by the US on fraud and money-laundering charges for running a multibillion-dollar online scam network from Cambodia, has been arrested there and extradited to China, Phnom…
-
Cyber Flatlines in FY 2026 Justice, Commerce Spending Bill
Congress Holds Cyber Funding at 2024 Levels Across Key Civilian Agencies. The fiscal year 2026 budget deal largely locks in federal cybersecurity funding at 2024 levels, stalling growth across key civilian agencies even as lawmakers call for global technology leadership as the U.S. government faces mounting nation-state cyber threats. First seen on govinfosecurity.com Jump to…
-
Windows Packer pkr_mtsi Powers Widespread Malvertising Campaigns with Multiple Malware
A custom Windows packer dubbed pkr_mtsi is fueling large-scale malvertising and SEO”‘poisoning campaigns that deliver a broad range of information”‘stealing and remote”‘access malware, according to new research. First observed in the wild on April 24, 2025, the packer remains active and has continuously evolved over the past eight months, while retaining a stable behavioral core that makes it…
-
CrazyHunter Ransomware Targets Healthcare Sector Using Sophisticated Evasion Tactics
A sophisticated new ransomware variant, CrazyHunter, has emerged as a critical threat to the healthcare sector, employing advanced anti-malware evasion techniques and rapid network propagation that have security researchers deeply concerned. Trellix, which has been actively tracking this threat since its initial appearance, reports that the ransomware represents a significant evolution in cybercriminal tactics targeting…
-
TOTOLINK EX200 Extender Flaw Allows Attackers Full System Access
A critical security flaw has been discovered in the TOTOLINK EX200 Wi-Fi extender that allows attackers to gain complete control over the device. The vulnerability involves a logic error in how the device handles failedfirmwareupdates, inadvertently opening a backdoor with the highest possible privileges. Because the TOTOLINK EX200 is officially End-of-Life (EoL), the vendor has…
-
Threat Actors Exploit Google Cloud Services to Steal Microsoft 365 Credentials
Tags: cloud, credentials, cyber, cybersecurity, email, exploit, google, infrastructure, malicious, microsoft, phishing, service, threatA sophisticated phishing campaign is exploiting Google Cloud infrastructure to bypass email security filters and steal Microsoft 365 credentials, demonstrating how attackers increasingly abuse trusted cloud platforms to lend legitimacy to their malicious activities. Cybersecurity researchers at Check Point have uncovered a large-scale operation targeting approximately 3,200 organizations, resulting in over 9,300 phishing emails over…
-
ToddyCat Malware Exploits ProxyLogon to Compromise Microsoft Exchange Servers
ToddyCat, a sophisticated cyber-espionage threat group also known as Websiic and Storm-0247, has emerged as a significant risk to organizations across Europe and Asia. The group’s operations, which began in December 2020 by targeting Microsoft Exchange servers in Taiwan and Vietnam, have since evolved into complex, multi-stage campaigns that leverage advanced evasion techniques and specialized…
-
LockBit 5.0 Unveils Advanced Encryption and Enhanced Anti-Analysis Techniques
LockBit has solidified its position as the most prolific ransomware-as-a-service (RaaS) operation globally, accounting for approximately 21% of all documented ransomware attacks in 2023, following its dominance of 30.25% during the 2021-2022 period. The emergence of LockBit 5.0 represents a significant escalation in technical sophistication, introducing enhanced encryption methodologies and anti-analysis mechanisms that fundamentally complicate…
-
Chinese Hackers Launch Ongoing Attacks on Taiwan’s Critical Infrastructure
China’s state-sponsored cyber operations against Taiwan have intensified dramatically, with threat actors launching an average of 2.63 million intrusion attempts daily targeting critical infrastructure across nine primary sectors, according to a newly released report from Taiwan’s National Security Bureau (NSB). The NSB report documents a concerning pattern of synchronized cyber warfare operations that correlate directly…
-
Hackers Using Malicious QR Codes for Phishing via HTML Table
Threat actors are continuing to refine “quishing” phishing delivered through QR codes by shifting from traditional image-based payloads to “imageless” QR codes rendered directly in email HTML, a tactic designed to sidestep security tools that focus on decoding QR images. QR code abuse is not new, but it remains effective because the user experience is…
-
Critical n8n Vulnerability Allows Authenticated Remote Code Execution
A critical security vulnerability has been discovered in n8n, the popular workflow automation tool, potentially allowing authenticated attackers to execute arbitrary code on the host server. Identified as CVE-2026-21877, this high-severity vulnerability affects both self-hosted and n8n Cloud instances, posing a significant risk to organizations relying on the platform for business process automation. The vulnerability has…