Collecting Cyber-News from over 60 sources

Tag: cyber

Gcore Radar Report Reveals 41% Surge in DDoS Attack Volumes

Sep 25, 2025 9:49 AM

Tags: ai, attack, cloud, cyber, ddos, network

Gcore, the global edge AI, cloud, network, and security solutions provider, today announced the findings of its Q1-Q2 2025 Radar report into DDoS attack trends. DDoS attacks have reached unprecedented scale and disruption in 2025, and businesses need to act fast to protect themselves from this evolving threat. The report reveals a significant escalation in…
LNK Malware Leverages Legit Windows Files to Slip Past Defenses

Sep 25, 2025 9:49 AM

Tags: access, attack, cyber, defense, detection, exploit, malicious, malware, threat, tool, windows

In a recently observed campaign emerging from Israel, threat actors have revived the use of Windows shortcut (.LNK) files to deliver a potent Remote Access Trojan (RAT). These seemingly innocuous shortcut files exploit Living-off-the-Land Binaries (LOLBins) such as odbcconf.exe to silently register and execute malicious DLLs, evading security tools and complicating detection efforts. The attack…
Hackers Exploit Hikvision Camera Flaw to Steal Sensitive Data

Sep 25, 2025 9:49 AM

Tags: backdoor, cctv, cyber, data, exploit, firmware, flaw, hacker, unauthorized

Security researchers have observed renewed exploit campaigns targeting an eight-year-old backdoor in Hikvision cameras to harvest configuration files, user lists, and snapshots. Attackers automate scans across IP ranges, appending a base64-encoded “auth” parameter to management URLs. When decoded, the string commonly reveals “admin:11,” enabling unauthorized access. Organizations relying on older camera firmware are at heightened…
BRICKSTORM Backdoor Hits Tech and Legal Firms with Stealthy New Campaign

Sep 25, 2025 9:49 AM

Tags: access, backdoor, cyber, google, group, intelligence, mandiant, saas, service, technology, threat

Persistent, stealthy, and cross-platform, the BRICKSTORM backdoor has emerged as a significant threat to U.S. technology and legal organizations. Tracked by Google Threat Intelligence Group (GTIG) and investigated by Mandiant Consulting, BRICKSTORM campaigns have maintained undetected access for an average of 393 days, targeting legal services firms, SaaS providers, BPOs, and technology companies to harvest…
Linux Kernel ksmbd Flaw Lets Remote Attackers Execute Arbitrary Code

Sep 25, 2025 9:49 AM

Tags: authentication, control, cve, cyber, exploit, flaw, linux, vulnerability

A critical vulnerability in the Linux Kernel’s ksmbd file sharing component allows remote attackers to execute code with kernel privileges. Tracked as CVE-2025-38561, this flaw affects Linux distributions that include the ksmbd SMB server implementation. Authentication is required, but a successful exploit can grant full control of the affected host. Vendors and administrators should apply…
COLDRIVER APT Group Uses ClickFix to Deliver New PowerShell-Based Backdoor BAITSWITCH

Sep 25, 2025 9:49 AM

Tags: apt, backdoor, blizzard, credentials, cyber, group, malware, phishing, powershell, russia, social-engineering, threat, tool

Russia-linked threat actors continue targeting civil society with sophisticated social engineering campaigns and lightweight malware tools in September 2025. The campaign delivers two previously undocumented malware families: a downloader dubbed BAITSWITCH and a PowerShell-based backdoor named SIMPLEFIX. COLDRIVER, also tracked as Star Blizzard, Callisto, and UNC4057, has historically focused on credential phishing campaigns against NGOs, think tanks, journalists,…
BRICKSTORM Backdoor Hits Tech and Legal Firms with Stealthy New Campaign

Sep 25, 2025 8:49 AM

Tags: access, backdoor, cyber, google, group, intelligence, mandiant, saas, service, technology, threat

Persistent, stealthy, and cross-platform, the BRICKSTORM backdoor has emerged as a significant threat to U.S. technology and legal organizations. Tracked by Google Threat Intelligence Group (GTIG) and investigated by Mandiant Consulting, BRICKSTORM campaigns have maintained undetected access for an average of 393 days, targeting legal services firms, SaaS providers, BPOs, and technology companies to harvest…
Linux Kernel ksmbd Flaw Lets Remote Attackers Execute Arbitrary Code

Sep 25, 2025 8:49 AM

Tags: authentication, control, cve, cyber, exploit, flaw, linux, vulnerability

A critical vulnerability in the Linux Kernel’s ksmbd file sharing component allows remote attackers to execute code with kernel privileges. Tracked as CVE-2025-38561, this flaw affects Linux distributions that include the ksmbd SMB server implementation. Authentication is required, but a successful exploit can grant full control of the affected host. Vendors and administrators should apply…
COLDRIVER APT Group Uses ClickFix to Deliver New PowerShell-Based Backdoor BAITSWITCH

Sep 25, 2025 8:49 AM

Tags: apt, backdoor, blizzard, credentials, cyber, group, malware, phishing, powershell, russia, social-engineering, threat, tool

Russia-linked threat actors continue targeting civil society with sophisticated social engineering campaigns and lightweight malware tools in September 2025. The campaign delivers two previously undocumented malware families: a downloader dubbed BAITSWITCH and a PowerShell-based backdoor named SIMPLEFIX. COLDRIVER, also tracked as Star Blizzard, Callisto, and UNC4057, has historically focused on credential phishing campaigns against NGOs, think tanks, journalists,…
Cyber-Resilienz stärken – Warum MDR statt XDR für den Mittelstand oft die bessere Wahl ist

Sep 25, 2025 8:49 AM

Tags: cyber, edr, resilience

First seen on security-insider.de Jump to article: www.security-insider.de/mdr-cybersicherheit-kmu-a-628535a4dec4dd8425d8e0d13b3dc896/
NVIDIA Merlin Flaw Enables Remote Code Execution with Root Access

Sep 25, 2025 7:25 AM

Tags: access, cve, cyber, flaw, nvidia, remote-code-execution, threat, vulnerability, zero-day

A critical vulnerability in NVIDIA’s Merlin Transformers4Rec library allows attackers to achieve remote code execution with root privileges. Discovered by the Trend Micro Zero Day Initiative (ZDI) Threat Hunting Team, the flaw stems from unsafe deserialization in the model checkpoint loading functionality. Tracked as CVE-2025-23298, this vulnerability underscores the persistent security challenges in machine learning…
Cisco IOS 0-Day RCE Vulnerability Actively Targeted

Sep 25, 2025 7:25 AM

Tags: attack, cisco, cyber, exploit, flaw, network, rce, remote-code-execution, service, software, threat, vulnerability, zero-day

Cisco has disclosed a critical zero-day vulnerability in its IOS and IOS XE software that is being actively exploited by threat actors in real-world attacks. The flaw, tracked as CVE-2025-20352, affects the Simple Network Management Protocol (SNMP) subsystem and allows both denial-of-service attacks and remote code execution depending on the attacker’s privilege level. Critical SNMP Stack…
NVIDIA Merlin Flaw Enables Remote Code Execution with Root Access

Sep 25, 2025 7:25 AM

Tags: access, cve, cyber, flaw, nvidia, remote-code-execution, threat, vulnerability, zero-day

A critical vulnerability in NVIDIA’s Merlin Transformers4Rec library allows attackers to achieve remote code execution with root privileges. Discovered by the Trend Micro Zero Day Initiative (ZDI) Threat Hunting Team, the flaw stems from unsafe deserialization in the model checkpoint loading functionality. Tracked as CVE-2025-23298, this vulnerability underscores the persistent security challenges in machine learning…
Cisco IOS 0-Day RCE Vulnerability Actively Targeted

Sep 25, 2025 7:25 AM

Tags: attack, cisco, cyber, exploit, flaw, network, rce, remote-code-execution, service, software, threat, vulnerability, zero-day

Cisco has disclosed a critical zero-day vulnerability in its IOS and IOS XE software that is being actively exploited by threat actors in real-world attacks. The flaw, tracked as CVE-2025-20352, affects the Simple Network Management Protocol (SNMP) subsystem and allows both denial-of-service attacks and remote code execution depending on the attacker’s privilege level. Critical SNMP Stack…
Banking Trojans Targeting Android Users Disguise as Government and Trusted Payment Apps

Sep 24, 2025 1:16 PM

Tags: android, banking, cyber, detection, government, group, identity, infrastructure, threat

Since August 2024, a financially motivated threat group has been targeting Android users in Indonesia and Vietnam with banking trojans disguised as official government identity and payment applications. By employing elaborate download mechanisms, reusing infrastructure, and leveraging template-based spoofed sites, the operators have used a coordinated campaign to evade detection and steal user credentials. The…
MCTTP 2025 – Drei Tage voller Insights, Networking und Cyber-Know-how

Sep 24, 2025 1:16 PM

Tags: cyber

First seen on security-insider.de Jump to article: www.security-insider.de/mcttp-2025-internationale-keynotes-security-tipps-networking-a-6bf5e19a6ab953854920ad2e20d113af/
Salesforce CLI Installer Flaw Lets Attackers Run Code and Gain SYSTEM-Level Access

Sep 24, 2025 1:16 PM

Tags: access, cve, cyber, flaw, vulnerability, windows

A serious security flaw in the Salesforce CLI installer (sf-x64.exe) has been assigned CVE-2025-9844. This weakness allows attackers to execute arbitrary code with SYSTEM-level privileges on Windows machines. Users who installed Salesforce CLI from untrusted sources may be at risk. The vulnerability stems from improper handling of file paths during installation, which can be abused…
Banking Trojans Targeting Android Users Disguise as Government and Trusted Payment Apps

Sep 24, 2025 1:16 PM

Tags: android, banking, cyber, detection, government, group, identity, infrastructure, threat

Since August 2024, a financially motivated threat group has been targeting Android users in Indonesia and Vietnam with banking trojans disguised as official government identity and payment applications. By employing elaborate download mechanisms, reusing infrastructure, and leveraging template-based spoofed sites, the operators have used a coordinated campaign to evade detection and steal user credentials. The…
CISA Reveals Hackers Breached U.S. Federal Agency via GeoServer RCE Flaw

Sep 24, 2025 1:16 PM

Tags: access, breach, cisa, cyber, cybersecurity, detection, endpoint, exploit, flaw, hacker, incident response, Intruder, rce, remote-code-execution, vulnerability

Federal cybersecurity agency CISA has disclosed that attackers exploited a remote code execution vulnerability in GeoServer to breach a U.S. federal civilian executive branch agency. The incident response began after endpoint detection alerts sounded at the agency. Over three weeks, cyber intruders used the flaw to gain initial access, move laterally, and establish persistence across…
Critical DNN Platform Vulnerability Let Attackers Execute Malicious Scripts

Sep 24, 2025 1:16 PM

Tags: cvss, cyber, malicious, vulnerability

A severe Stored Cross-Site Scripting (XSS) vulnerability in the Prompt module of the DNN Platform enables low-privilege attackers to inject and execute arbitrary scripts in the context of privileged users. Published as GHSA-2qxc-mf4x-wr29 by Daniel Valadas yesterday, this vulnerability affects all versions of the DotNetNuke.Core package prior to 10.1.0 and carries a CVSS v3.1 base…
Salesforce CLI Installer Flaw Lets Attackers Run Code and Gain SYSTEM-Level Access

Sep 24, 2025 1:16 PM

Tags: access, cve, cyber, flaw, vulnerability, windows

A serious security flaw in the Salesforce CLI installer (sf-x64.exe) has been assigned CVE-2025-9844. This weakness allows attackers to execute arbitrary code with SYSTEM-level privileges on Windows machines. Users who installed Salesforce CLI from untrusted sources may be at risk. The vulnerability stems from improper handling of file paths during installation, which can be abused…
Vegas Gambling Giant Hit by Cyber Incident, Employee Data Exposed

Sep 24, 2025 1:16 PM

Tags: cyber, data, data-breach, incident, unauthorized

Boyd Gaming Corporation has disclosed that an unauthorized actor removed data from its systems, including information about employees and other individuals First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/vegas-gambling-cyber-incident/
Moderne Zero-Trust-Architekturen sind die zentralen Säulen eine Cyber-Resilienz

Sep 24, 2025 12:16 PM

Tags: cyber, resilience, zero-trust

Um Zero-Trust-Initiativen zur Reife zu bringen, muss man sich in einer Landschaft voller Teil-Lösungen, architektonischer Kompromisse und leerer Versprechungen zurechtfinden. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/moderne-zero-trust-architekturen-sind-die-zentralen-saeulen-eine-cyber-resilienz/a42102/
Moderne Zero-Trust-Architekturen sind die zentralen Säulen eine Cyber-Resilienz

Sep 24, 2025 12:16 PM

Tags: cyber, resilience, zero-trust

Um Zero-Trust-Initiativen zur Reife zu bringen, muss man sich in einer Landschaft voller Teil-Lösungen, architektonischer Kompromisse und leerer Versprechungen zurechtfinden. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/moderne-zero-trust-architekturen-sind-die-zentralen-saeulen-eine-cyber-resilienz/a42102/
Building Essentials for a Robust OT Security Strategy

Sep 24, 2025 11:16 AM

Tags: business, conference, cyber, cyberattack, infrastructure, risk, strategy

CS4CA Europe London Event Chair Wayne Harrop on OT Risk and Collaboration. Critical infrastructure providers are facing a volatile geopolitical landscape that could lead to cyberattacks and business disruptions. In advance of the CS4CA Europe London Conference (Sept. 30 – Oct. 1, 2025), conference chair Wayne Harrop shares key cyber strategies to counter enterprise threats.…
RainyDay, Turian and Naikon Malwares Abuse DLL Search Order to Execute Malicious Loaders

Sep 24, 2025 11:16 AM

Tags: cisco, cyber, infrastructure, malicious, malware

Cisco Talos has uncovered a sophisticated, long-running campaign active since 2022 that leverages DLL search order hijacking to deliver a novel PlugX variant with overlapping characteristics of the RainyDay and Turian backdoors. This operation, targeting telecommunications and manufacturing organizations across Central and South Asia, demonstrates a remarkable convergence of malware functionality and shared infrastructure that…
North Korean IT Worker Gains Access to Organization’s Network Through Innocent Job Application

Sep 24, 2025 10:15 AM

Tags: access, corporate, cyber, healthcare, jobs, network, north-korea, threat

In today’s complex threat landscape, adversaries increasingly favor “malware-less” intrusion methods that slip past traditional defenses. One particularly insidious scheme involves North Korean operatives posing as legitimate remote IT professionals to infiltrate corporate networks. Trellix researchers recently uncovered a campaign in which a fake applicant seamlessly advanced through hiring stages at a major U.S. healthcare…
Kali Linux 2025.3 Launches With Fresh Features and 10 New Pentesting Tools

Sep 24, 2025 10:15 AM

Tags: cyber, firmware, Hardware, kali, linux, mobile, penetration-testing, tool, update

Kali Linux 2025.3 has arrived, bringing a wave of improvements, updated firmware support, and a suite of ten new security tools. This release builds on the June 2025.2 update by refining core workflows, extending wireless capabilities, and preparing the distribution for emerging architectures. Whether you rely on virtual machines, Raspberry Pi devices, or mobile pentesting…
CISA Issues Alert on Actively Exploited Google Chrome 0-Day Vulnerability

Sep 24, 2025 10:15 AM

Tags: browser, chrome, cisa, cve, cyber, cybersecurity, exploit, flaw, google, infrastructure, risk, vulnerability, zero-day

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent security alert regarding an actively exploited zero-day vulnerability in Google Chrome. The vulnerability, designated as CVE-2025-10585, affects the V8 JavaScript and WebAssembly engine within Google Chromium, creating significant security risks for users worldwide. Critical Type Confusion Flaw Discovered The newly identified vulnerability represents a…
North Korean IT Worker Gains Access to Organization’s Network Through Innocent Job Application

Sep 24, 2025 10:15 AM

Tags: access, corporate, cyber, healthcare, jobs, network, north-korea, threat

In today’s complex threat landscape, adversaries increasingly favor “malware-less” intrusion methods that slip past traditional defenses. One particularly insidious scheme involves North Korean operatives posing as legitimate remote IT professionals to infiltrate corporate networks. Trellix researchers recently uncovered a campaign in which a fake applicant seamlessly advanced through hiring stages at a major U.S. healthcare…