Tag: cyber
-
Check Points CyberReport für September 2025 Leichter Rückgang in der DACH-Region
Check Point Research (CPR), die Sicherheitsforschungsabteilung von Check Point Software Technologies hat seinen Global-Cyber-Threats-Report für September 2025 veröffentlicht. Im vergangenen Monat waren Unternehmen im globalen Vergleich durchschnittlich 1900 Cyber-Angriffen pro Woche ausgesetzt. Das ist ein Rückgang um vier Prozent gegenüber dem Vormonat August, jedoch ein Anstieg von einem Prozent gegenüber dem Vorjahreszeitraum. In Deutschland ist…
-
itSpecial
Agentforce im Privacy Center Salesforce Ivanti hat Connect Secure generalüberholt: Ivanti hat auf der it-sa die Version 25.X von Ivanti Connect Secure (ICS) vorgestellt. Nach den Sicherheitsvorfällen zu Beginn des Jahres wurde die VPN-Software nun laut Hersteller nach dem Prinzip ‘Security by Design” neu entwickelt. Dazu gehören ein moderner Webserver und eine Web Application Firewall…
-
SonicWall SSL VPN Devices Targeted by Threat Actors to Distribute Akira Ransomware
A significant uptick in Akira ransomware attacks has been observed exploiting unpatched SonicWall SSL VPN devices between July and August 2025. Despite a patch release the same day, many organizations remained vulnerable, allowing threat actors to gain initial access and deploy Akira’s double-extortion scheme. On August 20, 2025, Darktrace detected anomalous network scanning and reconnaissance…
-
SonicWall SSL VPN Devices Targeted by Threat Actors to Distribute Akira Ransomware
A significant uptick in Akira ransomware attacks has been observed exploiting unpatched SonicWall SSL VPN devices between July and August 2025. Despite a patch release the same day, many organizations remained vulnerable, allowing threat actors to gain initial access and deploy Akira’s double-extortion scheme. On August 20, 2025, Darktrace detected anomalous network scanning and reconnaissance…
-
SonicWall SSL VPN Devices Targeted by Threat Actors to Distribute Akira Ransomware
A significant uptick in Akira ransomware attacks has been observed exploiting unpatched SonicWall SSL VPN devices between July and August 2025. Despite a patch release the same day, many organizations remained vulnerable, allowing threat actors to gain initial access and deploy Akira’s double-extortion scheme. On August 20, 2025, Darktrace detected anomalous network scanning and reconnaissance…
-
SonicWall SSL VPN Devices Targeted by Threat Actors to Distribute Akira Ransomware
A significant uptick in Akira ransomware attacks has been observed exploiting unpatched SonicWall SSL VPN devices between July and August 2025. Despite a patch release the same day, many organizations remained vulnerable, allowing threat actors to gain initial access and deploy Akira’s double-extortion scheme. On August 20, 2025, Darktrace detected anomalous network scanning and reconnaissance…
-
175 Malicious npm Packages Targeting Tech and Energy Firms, 26,000 Downloads
Socket’s Threat Research Team has uncovered a sprawling phishing campaign”, dubbed “Beamglea””, leveraging 175 malicious npm packages that have amassed over 26,000 downloads. These packages serve solely as hosting infrastructure, redirecting victims to credential-harvesting pages. Though randomly named packages make accidental developer installation unlikely, the download counts reflect security researchers, automated scanners, and CDN providers…
-
175 Malicious npm Packages Targeting Tech and Energy Firms, 26,000 Downloads
Socket’s Threat Research Team has uncovered a sprawling phishing campaign”, dubbed “Beamglea””, leveraging 175 malicious npm packages that have amassed over 26,000 downloads. These packages serve solely as hosting infrastructure, redirecting victims to credential-harvesting pages. Though randomly named packages make accidental developer installation unlikely, the download counts reflect security researchers, automated scanners, and CDN providers…
-
175 Malicious npm Packages Targeting Tech and Energy Firms, 26,000 Downloads
Socket’s Threat Research Team has uncovered a sprawling phishing campaign”, dubbed “Beamglea””, leveraging 175 malicious npm packages that have amassed over 26,000 downloads. These packages serve solely as hosting infrastructure, redirecting victims to credential-harvesting pages. Though randomly named packages make accidental developer installation unlikely, the download counts reflect security researchers, automated scanners, and CDN providers…
-
175 Malicious npm Packages Targeting Tech and Energy Firms, 26,000 Downloads
Socket’s Threat Research Team has uncovered a sprawling phishing campaign”, dubbed “Beamglea””, leveraging 175 malicious npm packages that have amassed over 26,000 downloads. These packages serve solely as hosting infrastructure, redirecting victims to credential-harvesting pages. Though randomly named packages make accidental developer installation unlikely, the download counts reflect security researchers, automated scanners, and CDN providers…
-
UK techies’ union warns members after breach exposes sensitive personal details
Prospect apologizes for cyber gaffe affecting up to 160K members First seen on theregister.com Jump to article: www.theregister.com/2025/10/10/prospect_union_breach/
-
UK techies’ union warns members after breach exposes sensitive personal details
Prospect apologizes for cyber gaffe affecting up to 160K members First seen on theregister.com Jump to article: www.theregister.com/2025/10/10/prospect_union_breach/
-
LLM-Powered MalTerminal Malware Uses OpenAI GPT-4 to Create Ransomware Code
LLM-enabled malware poses new challenges for detection and threat hunting as malicious logic can be generated at runtime rather than embedded in code. Our research discovered hitherto unknown samples, and what may be the earliest example known to date of an LLM-enabled malware we dubbed “MalTerminal.” Our methodology also uncovered other offensive LLM applications, including…
-
GitHub Copilot Flaw Allows Attackers to Steal Source Code from Private Repositories
A critical weakness in GitHub Copilot Chat discovered in June 2025 exposed private source code and secrets to attackers. Rated CVSS 9.6, the vulnerability combined a novel Content Security Policy bypass with remote prompt injection. By embedding hidden prompts in pull requests, attackers could exfiltrate private repository data and control Copilot’s responses, including injecting malicious…
-
UK techies’ union warns members after breach exposes sensitive personal details
Prospect apologizes for cyber gaffe affecting up to 160K members First seen on theregister.com Jump to article: www.theregister.com/2025/10/10/prospect_union_breach/
-
LLM-Powered MalTerminal Malware Uses OpenAI GPT-4 to Create Ransomware Code
LLM-enabled malware poses new challenges for detection and threat hunting as malicious logic can be generated at runtime rather than embedded in code. Our research discovered hitherto unknown samples, and what may be the earliest example known to date of an LLM-enabled malware we dubbed “MalTerminal.” Our methodology also uncovered other offensive LLM applications, including…
-
Check Point Cyber Threat Report September 2025: DACH-Region mit Verschnaufpause
Die Analyse basiert auf Daten aus Check Points ThreatCloud, einer KI-basierten Plattform, die täglich Millionen Indikatoren für Kompromittierungen (IoCs) auswertet. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/check-point-cyber-threat-report-september-2025-dach-region-mit-verschnaufpause/a42314/
-
Check Point Cyber Threat Report September 2025: DACH-Region mit Verschnaufpause
Die Analyse basiert auf Daten aus Check Points ThreatCloud, einer KI-basierten Plattform, die täglich Millionen Indikatoren für Kompromittierungen (IoCs) auswertet. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/check-point-cyber-threat-report-september-2025-dach-region-mit-verschnaufpause/a42314/
-
Troy Hunt darf Quantas-Daten aus Leck nicht in HIBP aufnehmen
Tags: cyberDie australische Fluglinie Quantas wurde Opfer eines Cyber-Vorfalls mit Datenabfluss. Dumm, wenn Juristen sich des Falls annehmen und ein Richter eine Verfügung erlässt. Troy Hunt, der die Seite Have I Been Pwned (HIBP) betreibt, sieht sich durch eine Verfügung nicht … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/10/10/troy-hunt-darf-quantas-daten-aus-leck-nicht-in-hibp-aufnehmen/
-
RondoDox Botnet Targets Over 50 Vulnerabilities to Compromise Routers, CCTV Systems, and Web Servers
The RondoDox campaign’s “exploit shotgun” method leverages over 50 vulnerabilities across more than 30 vendors to infiltrate network devices, highlighting the urgent need for rapid patching and continuous monitoring. The first detected RondoDox intrusion on June 15, 2025, reused a command”injection vulnerability disclosed at Pwn2Own Toronto 2022: CVE-2023-1389, which targets the WAN interface of TP-Link…
-
ClayRat Android Malware Masquerades as WhatsApp Google Photos
ClayRat, a rapidly evolving Android spyware campaign, has surged in activity over the past three months, with zLabs researchers observing more than 600 unique samples and 50 distinct droppers. Primarily targeting Russian users, the malware masquerades as popular applications such as WhatsApp, Google Photos, TikTok, and YouTube, luring victims into installing malicious APKs via deceptive…
-
The CIA triad is dead, stop using a Cold War relic to fight 21st century threats
Tags: ai, backup, breach, business, ceo, ciso, compliance, csf, cyber, cybersecurity, data, data-breach, deep-fake, firewall, framework, fraud, GDPR, governance, infrastructure, ISO-27001, nist, privacy, ransomware, regulation, resilience, sbom, software, supply-chain, technology, threat, zero-trustRansomware is not just an availability problem. Treating ransomware as a simple “availability” failure misses the point. Being “up” or “down” is irrelevant when your systems are locked and business halted. What matters is resilience: the engineered ability to absorb damage, fail gracefully, and restore from immutable backups. Availability is binary; resilience is survival. Without…
-
Gladinet CentreStack and Triofox 0-Day Flaw Under Active Attack
Gladinet CentreStack and Triofox have come under active attack as threat actors exploit an unauthenticated local file inclusion flaw (CVE-2025-11371). The flaw lets attackers read sensitive files without logging in. Once they grab the machine key, they can trigger a view state deserialization bug to run code on the server. There is no official patch…
-
Snake Keylogger Uses Weaponized Emails and PowerShell to Steal Sensitive Data
A newly observed information”stealing campaign is deploying a stealthy variant of the SnakeKeylogger malware via weaponized e-mails that masquerade as legitimate remittance advice from CPA Global and Clarivate. Researchers first identified the infection vector on October 7, 2025, when recipients received messages titled “remittance advice for the payment dated 07″Oct”2025,” urging them to download an…
-
Authorities Dismantle BreachForums’ Reemerged Clearnet Marketplace
In a coordinated effort, international law enforcement agencies seized the clearnet domain breachforums[.]hn, shutting down yet another incarnation of the notorious cybercrime marketplace BreachForums. The domain now displays a joint seizure notice from the U.S. Department of Justice (DOJ) and the Federal Bureau of Investigation (FBI), alongside French authorities, including the Brigade de Lutte Contre…
-
Hackers Exploit Microsoft Employee Accounts in Salary Theft Scheme
Tags: attack, authentication, credentials, cyber, exploit, finance, hacker, intelligence, microsoft, phishing, theft, threatMicrosoft Threat Intelligence is sounding the alarm on a surge of sophisticated “payroll pirate” attacks, in which financially motivated adversaries hijack employee accounts to reroute salary payments to attacker-controlled bank accounts. In the first half of 2025, Storm-2657 launched a widespread phishing campaign against university staff, harvesting credentials and multifactor authentication (MFA) codes. Attackers deployed…
-
Authorities Dismantle BreachForums’ Reemerged Clearnet Marketplace
In a coordinated effort, international law enforcement agencies seized the clearnet domain breachforums[.]hn, shutting down yet another incarnation of the notorious cybercrime marketplace BreachForums. The domain now displays a joint seizure notice from the U.S. Department of Justice (DOJ) and the Federal Bureau of Investigation (FBI), alongside French authorities, including the Brigade de Lutte Contre…
-
Authorities Dismantle BreachForums’ Reemerged Clearnet Marketplace
In a coordinated effort, international law enforcement agencies seized the clearnet domain breachforums[.]hn, shutting down yet another incarnation of the notorious cybercrime marketplace BreachForums. The domain now displays a joint seizure notice from the U.S. Department of Justice (DOJ) and the Federal Bureau of Investigation (FBI), alongside French authorities, including the Brigade de Lutte Contre…
-
Hackers Exploit Microsoft Employee Accounts in Salary Theft Scheme
Tags: attack, authentication, credentials, cyber, exploit, finance, hacker, intelligence, microsoft, phishing, theft, threatMicrosoft Threat Intelligence is sounding the alarm on a surge of sophisticated “payroll pirate” attacks, in which financially motivated adversaries hijack employee accounts to reroute salary payments to attacker-controlled bank accounts. In the first half of 2025, Storm-2657 launched a widespread phishing campaign against university staff, harvesting credentials and multifactor authentication (MFA) codes. Attackers deployed…