Tag: cyber
-
Reading the ENISA Threat Landscape 2025 report
ENISA Threat Landscape 2025: Rising ransomware, AI phishing, and state-backed espionage mark a converging, persistent EU cyber threat landscape. ENISA Threat Landscape 2025 report provides a comprehensive analysis of the evolving threat landscape in Europe. The report analyzes the events that occurred between July 2024 and June 2025, including nearly 4,900 verified incidents. This year’s…
-
Redis Server UseFree Vulnerability Allows Remote Code Execution
A critical security vulnerability has been discovered in Redis Server that could allow authenticated attackers to achieve remote code execution through a use-after-free flaw in the Lua scripting engine. The vulnerability, tracked as CVE-2025-49844, affects all versions of Redis that support Lua scripting functionality. Critical Memory Corruption Flaw Discovered Security researchers from Wiz, including Benny…
-
Zimbra Zero-Day Exploited to Target Brazilian Military via Malicious ICS Files
A now patched security vulnerability in Zimbra Collaboration was exploited as a zero-day earlier this year in cyber attacks targeting the Brazilian military.Tracked as CVE-2025-27915 (CVSS score: 5.4), the vulnerability is a stored cross-site scripting (XSS) vulnerability in the Classic Web Client that arises as a result of insufficient sanitization of HTML content in ICS…
-
Asgard Malware Protector Reversed: Researchers Expose Its Antivirus Bypass Methods
SpyCloud Labs analysts have successfully reverse-engineered Asgard Protector, a sophisticated crypter tool prominently used to hide malicious payloads from antivirus detection systems. This crypter has gained particular notoriety for being the preferred choice among sellers of LummaC2, currently the most prevalent commodity infostealer in the cyberthreat landscape. The analysis reveals intricate evasion techniques that demonstrate the evolving…
-
QNAP NetBak Replicator Vulnerability Allow Malicious Code Execution
QNAP Systems has disclosed a critical security vulnerability in its NetBak Replicator software that could enable local attackers to execute malicious code on affected systems. The vulnerability, tracked as CVE-2025-57714, stems from an unquoted search path element flaw that poses significant security risks to organizations using the backup solution. Vulnerability Details and Impact Assessment The…
-
Hackers Turn AWS X-Ray into Command-and-Control Platform
Tags: cloud, control, cyber, framework, hacker, infrastructure, monitoring, network, RedTeam, serviceRed team researchers have unveiled XRayC2, a sophisticated command-and-control framework that weaponizes Amazon Web Services’ X-Ray distributed application tracing service to establish covert communication channels. This innovative technique demonstrates how attackers can abuse legitimate cloud monitoring infrastructure to bypass traditional network security controls. Diagram explaining command and control (C2) servers used by attackers to control…
-
WARMCOOKIE Malware Operators Introduce Advanced Capabilities
The cybersecurity landscape continues to evolve as threat actors behind the WARMCOOKIE backdoor malware have significantly enhanced their capabilities, introducing new features and maintaining active development despite law enforcement disruptions. The latest WARMCOOKIE variants demonstrate the threat actors’ commitment to expanding their operational toolkit. Four new command handlers have been integrated into the malware’s architecture…
-
PoC Released for Remotely Exploitable Oracle E-Business Suite 0-Day
Tags: business, cyber, cybersecurity, detection, hacker, oracle, remote-code-execution, threat, vulnerability, zero-dayOracle has issued an urgent security alert for a critical zero-day vulnerability affecting Oracle E-Business Suite that allows remote code execution without authentication. The vulnerability, tracked as CVE-2025-61882, has now received public proof-of-concept detection capabilities from cybersecurity researcher rxerium. Illustration showing a hacker and icons representing cyber threats with a caption about the $10.5 trillion economic…
-
PoC Published for Sudo Flaw Lets Attackers Escalate to Root
A proof-of-concept exploit has been released for CVE-2025-32463, a critical local privilege escalation vulnerability affecting the Sudo binary that allows attackers to gain root access on Linux systems. The flaw was discovered by security researcher Rich Mirch and has garnered significant attention from the cybersecurity community. Critical Vulnerability in Sudo Binary CVE-2025-32463 represents a serious…
-
CVE-2025-61882: Frequently Asked Questions About Oracle E-Business Suite (EBS) Zero-Day and Associated Vulnerabilities
Tags: advisory, attack, breach, business, cve, cyber, data, email, exploit, extortion, finance, flaw, group, intelligence, mitigation, mobile, oracle, ransomware, remote-code-execution, software, threat, update, vulnerability, zero-dayFollowing reports the Cl0p ransomware group has been extorting Oracle E-Business Suite customers, Oracle released an advisory for a zero-day that was exploited in the wild. Background Tenable’s Research Special Operations (RSO) team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding a newly disclosed Oracle zero-day vulnerability that was exploited in the…
-
CVE-2025-61882: Frequently Asked Questions About Oracle E-Business Suite (EBS) Zero-Day and Associated Vulnerabilities
Tags: advisory, attack, breach, business, cve, cyber, data, email, exploit, extortion, finance, flaw, group, intelligence, mitigation, mobile, oracle, ransomware, remote-code-execution, software, threat, update, vulnerability, zero-dayFollowing reports the Cl0p ransomware group has been extorting Oracle E-Business Suite customers, Oracle released an advisory for a zero-day that was exploited in the wild. Background Tenable’s Research Special Operations (RSO) team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding a newly disclosed Oracle zero-day vulnerability that was exploited in the…
-
Keeping Your Cloud Environment Safe
Why Is Non-Human Identity Management Crucial for Cloud Safety? How can organizations effectively manage Non-Human Identities (NHIs) to maintain cloud safety? For industries that heavily rely on digital infrastructure, such as financial services, healthcare, and even travel, managing NHIs can significantly enhance their cyber protection strategies. The key lies in understanding the role of NHIs……
-
The Emperor’s New Clothes: Why Compulsory CBTs and Phishing Tests Keep Failing
Most phishing training, and indeed most compulsory computer-based training (CBT) modules, are largely ineffective in reducing incidents – and are therefore a waste of time and resources. Finally we have the data we need to challenge this, and find a better path to user awareness that may actually reduce the frequency and impact of cyber…
-
The Guardian view on the Jaguar Land Rover cyber-attack: ministers must pay more attention to this growing risk | Editorial
Tags: attack, business, computer, conference, cyber, cybercrime, finance, government, risk, supply-chain, threatCybercriminals pose a seismic and increasingly sophisticated threat to businesses and national security. Yet Britain seems remarkably ill-preparedThe cause isn’t clear, but the impact has already been devastating. More than a month has passed since Jaguar Land Rover (JLR) was targeted in a cyber-attack that forced the car manufacturer to turn off computers and shut…
-
Six out of 10 UK secondary schools hit by cyber-attack or breach in past year
Hackers are more likely to target educational institutions than private businesses, government survey showsWhen hackers attacked UK nurseries last month and published children’s data online, they were <a href=”https://www.theguardian.com/technology/2025/oct/02/kido-nursery-hackers-say-they-have-deleted-stolen-data”>accused of hitting a new low.But the broader education sector is well used to being a target. <a href=”https://www.theguardian.com/technology/2025/oct/05/uk-secondary-schools-suffered-cyber-attack-or-breach-in-past-year”>Continue reading… First seen on theguardian.com Jump to article:…
-
Pentagon decrees warfighters don’t need ‘frequent’ cybersecurity training
Beards, body fat, and cyber refreshers now frowned upon First seen on theregister.com Jump to article: www.theregister.com/2025/10/02/pentagon_relaxes_military_cybersecurity_training/
-
New XWorm V6 Variant Embeds Malicious Code into Trusted Windows Applications
In the constantly evolving world of cyber threats, staying informed is not just an advantage; it’s a necessity. First observed in 2022, XWorm quickly gained notoriety as a highly effective malware, providing cybercriminals with a versatile toolkit for malicious activities. XWorm’s modular design is built around a core client and an array of specialized components…
-
Despite More CVEs, Cyber Insurers Aren’t Altering Policies
With nearly 47,000 CVEs expected by the end of the year, organizations must balance comprehensive vulnerability management with strategic cyber insurance policy selection to effectively navigate this rapidly evolving threat landscape. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/more-cves-cyber-insurers-arent-altering-policies
-
GhostSocks Malware-as-a-Service Turns Compromised Devices into Proxies for Threat Actors
On October 15, 2023, a threat actor using the handle GhostSocks published a sales post on the Russian cybercrime forum xss[.]is advertising a novel Malware-as-a-Service (MaaS) offering. The post introduced GhostSocks, a service designed to turn compromised Windows machines into residential SOCKS5 proxies, enabling cybercriminals to bypass anti-fraud defenses and monetize infected hosts. The initial…
-
SideWinder Hacker Group Targets Users with Fake Outlook/Zimbra Portals to Steal Login Credentials
Tags: apt, credentials, cyber, defense, government, group, hacker, infrastructure, login, malicious, phishingThe notorious SideWinder APT group has intensified its credential harvesting operations across South Asia, deploying sophisticated phishing campaigns that target government, defense, and critical infrastructure organizations through fake webmail portals. The campaign represents a significant escalation from the group’s August 2024 activities, which initially focused on 14 malicious webpages hosted on Netlify and pages.dev platforms.…
-
Hackers Exploit Grafana Vulnerability Allowing Arbitrary File Reads
Researchers at GreyNoise observed a sudden spike in attempts to exploit a well-known Grafana flaw. This vulnerability, tracked as CVE-2021-43798, allows attackers to traverse paths on a server and read any file they choose. Over the course of a single day, 110 unique IP addresses scanned GreyNoise’s Global Observation Grid for vulnerable Grafana instances. All…
-
Endspurt für den Cyber Resilience Act
First seen on security-insider.de Jump to article: www.security-insider.de/der-countdown-laeuft-endspurt-fuer-den-cyber-resilience-act-a-f926290a20e6c2a2d3689200fb9ed65d/
-
Criminals take Renault UK customer data for a joyride
Names, numbers, and reg plates exposed in latest auto industry cyber-shunt First seen on theregister.com Jump to article: www.theregister.com/2025/10/03/renault_uk_customer_data_breach/
-
WhatsApp Exploited to Spread SORVEPOTEL Malware on Windows Systems
An aggressive malware campaign dubbed SORVEPOTEL is exploiting WhatsApp messages to infiltrate Windows systems, with its epicenter in Brazil. Rather than pursuing data theft or ransomware extortion, this self-propagating malware is engineered for rapid spread, leveraging social trust and automation to reach new victims. Trend Research telemetry shows that 457 of the 477 detected infections…
-
New ‘PointClick’ Phishing Kit Evades Security Filters to Deliver Malicious Payloads
A new toolkit named Impact Solutions has emerged on cybercrime forums, offering a comprehensive, user-friendly framework for crafting advanced phishing campaigns. By democratizing malware delivery, Impact Solutions empowers even low-skill threat actors to bypass both end users and conventional security filters, delivering malicious payloads via seemingly innocuous attachments. This article explores the mechanics of Impact…
-
Threat Actors Imitate Popular Brands in New Malware Distribution Campaigns
In a sophisticated resurgence of smishing campaigns, cybercriminals have begun embedding trusted brand names into deceptive URLs and group messaging threads to lure unsuspecting users into downloading malware. By inserting a familiar company name before the “@” symbol in links, attackers exploit users’ trust in established entities such as FedEx and Microsoft. Coupled with deceptively…
-
IIS Servers Compromised by Chinese Hackers for SEO Manipulation
Cisco Talos has revealed that UAT-8099, a Chinese-speaking cybercrime group, has been exploiting vulnerable Internet Information Services (IIS) servers across multiple countries to conduct search engine optimization (SEO) fraud and steal high-value data. Identified in April 2025, this group targets reputable IIS servers in India, Thailand, Vietnam, Canada, and Brazil, focusing on organizations such as…
-
IIS Servers Compromised by Chinese Hackers for SEO Manipulation
Cisco Talos has revealed that UAT-8099, a Chinese-speaking cybercrime group, has been exploiting vulnerable Internet Information Services (IIS) servers across multiple countries to conduct search engine optimization (SEO) fraud and steal high-value data. Identified in April 2025, this group targets reputable IIS servers in India, Thailand, Vietnam, Canada, and Brazil, focusing on organizations such as…
-
Threat Actors Imitate Popular Brands in New Malware Distribution Campaigns
In a sophisticated resurgence of smishing campaigns, cybercriminals have begun embedding trusted brand names into deceptive URLs and group messaging threads to lure unsuspecting users into downloading malware. By inserting a familiar company name before the “@” symbol in links, attackers exploit users’ trust in established entities such as FedEx and Microsoft. Coupled with deceptively…
-
Oracle Confirms Hackers Target E-Business Suite Data in Extortion Campaigns
Oracle has confirmed that a group of hackers stole data from its E-Business Suite (EBS) applications and is using the information in extortion campaigns. The company warns that these attackers exploited vulnerabilities already fixed in the July 2025 Critical Patch Update (CPU). Oracle strongly urges all customers to apply the latest CPU immediately to defend…