Collecting Cyber-News from over 60 sources

Tag: cyber

Steam Confirms Malware Found in BlockBlasters Game

Sep 25, 2025 10:49 AM

Tags: cyber, malware

Steam has officially confirmed that malware was discovered in the popular indie game BlockBlasters. The announcement follows widespread player reports and security scans that flagged unusual activity in the game’s files. This incident raises concerns about game security and digital storefront safety. Background of the Incident BlockBlasters launched earlier this month and quickly gained attention…
Hackers Deploy Stealthy Malware on WordPress Sites to Gain Admin Access

Sep 25, 2025 10:49 AM

Tags: access, backdoor, cyber, hacker, malware, tactics, wordpress

Attackers have stepped up their tactics by deploying stealthy backdoors disguised as legitimate WordPress components, ensuring persistent administrative access even after other malware is discovered and removed. Their deceptive appearances belied their dangerous functions: one impersonated a plugin, the other camouflaged itself as a core file. Together, they formed a resilient system that gave hackers…
Malware Deployment via Copyright Takedown Claims by Threat Actors

Sep 25, 2025 10:49 AM

Tags: cyber, exploit, group, malware, tactics, threat

Threat actors from the Lone None group are exploiting copyright takedown notices to distribute sophisticated malware, including Pure Logs Stealer and a newly identified information stealer dubbed Lone None Stealer (also known as PXA Stealer). This analysis examines the campaign’s tactics, techniques, and procedures (TTPs), highlights key indicators of compromise (IOCs), and underscores how Lone…
SetupHijack Tool Abuses Race Conditions in Windows Installer to Hijack Setups

Sep 25, 2025 10:49 AM

Tags: cyber, exploit, hacker, malicious, tool, windows

Security researchers at Hacker House have released SetupHijack, a proof-of-concept tool that exploits race conditions and insecure file handling in Windows installers and updaters. The utility demonstrates how attackers can hijack privileged setup processes to run malicious payloads with SYSTEM or Administrator rights. Exploiting Race Conditions in Windows Installers SetupHijack targets installers and updaters that…
Gcore Radar Report Reveals 41% Surge in DDoS Attack Volumes

Sep 25, 2025 9:49 AM

Tags: ai, attack, cloud, cyber, ddos, network

Gcore, the global edge AI, cloud, network, and security solutions provider, today announced the findings of its Q1-Q2 2025 Radar report into DDoS attack trends. DDoS attacks have reached unprecedented scale and disruption in 2025, and businesses need to act fast to protect themselves from this evolving threat. The report reveals a significant escalation in…
LNK Malware Leverages Legit Windows Files to Slip Past Defenses

Sep 25, 2025 9:49 AM

Tags: access, attack, cyber, defense, detection, exploit, malicious, malware, threat, tool, windows

In a recently observed campaign emerging from Israel, threat actors have revived the use of Windows shortcut (.LNK) files to deliver a potent Remote Access Trojan (RAT). These seemingly innocuous shortcut files exploit Living-off-the-Land Binaries (LOLBins) such as odbcconf.exe to silently register and execute malicious DLLs, evading security tools and complicating detection efforts. The attack…
Hackers Exploit Hikvision Camera Flaw to Steal Sensitive Data

Sep 25, 2025 9:49 AM

Tags: backdoor, cctv, cyber, data, exploit, firmware, flaw, hacker, unauthorized

Security researchers have observed renewed exploit campaigns targeting an eight-year-old backdoor in Hikvision cameras to harvest configuration files, user lists, and snapshots. Attackers automate scans across IP ranges, appending a base64-encoded “auth” parameter to management URLs. When decoded, the string commonly reveals “admin:11,” enabling unauthorized access. Organizations relying on older camera firmware are at heightened…
BRICKSTORM Backdoor Hits Tech and Legal Firms with Stealthy New Campaign

Sep 25, 2025 9:49 AM

Tags: access, backdoor, cyber, google, group, intelligence, mandiant, saas, service, technology, threat

Persistent, stealthy, and cross-platform, the BRICKSTORM backdoor has emerged as a significant threat to U.S. technology and legal organizations. Tracked by Google Threat Intelligence Group (GTIG) and investigated by Mandiant Consulting, BRICKSTORM campaigns have maintained undetected access for an average of 393 days, targeting legal services firms, SaaS providers, BPOs, and technology companies to harvest…
Linux Kernel ksmbd Flaw Lets Remote Attackers Execute Arbitrary Code

Sep 25, 2025 9:49 AM

Tags: authentication, control, cve, cyber, exploit, flaw, linux, vulnerability

A critical vulnerability in the Linux Kernel’s ksmbd file sharing component allows remote attackers to execute code with kernel privileges. Tracked as CVE-2025-38561, this flaw affects Linux distributions that include the ksmbd SMB server implementation. Authentication is required, but a successful exploit can grant full control of the affected host. Vendors and administrators should apply…
COLDRIVER APT Group Uses ClickFix to Deliver New PowerShell-Based Backdoor BAITSWITCH

Sep 25, 2025 9:49 AM

Tags: apt, backdoor, blizzard, credentials, cyber, group, malware, phishing, powershell, russia, social-engineering, threat, tool

Russia-linked threat actors continue targeting civil society with sophisticated social engineering campaigns and lightweight malware tools in September 2025. The campaign delivers two previously undocumented malware families: a downloader dubbed BAITSWITCH and a PowerShell-based backdoor named SIMPLEFIX. COLDRIVER, also tracked as Star Blizzard, Callisto, and UNC4057, has historically focused on credential phishing campaigns against NGOs, think tanks, journalists,…
Co-op says ‘malicious’ cyber-attack has hit profits by £80m

Sep 25, 2025 9:49 AM

Tags: attack, business, cyber, government, group, malicious

Retailer says it needs to focus on weaknesses in food business that led to gaps on shelves in its stores<ul><li><a href=”https://www.theguardian.com/business/live/2025/sep/25/co-op-cyber-attack-cost-it-80m-profits-loss-government-support-jlr-suppliers-business-live-news”>Business live latest updates</li></ul>The Co-op has fallen into the red after it suffered an £80m hit to profits as a result of a “malicious” cyber-attack earlier this year.The group, which owns more than 2,000 grocery…
Cyber-Resilienz stärken – Warum MDR statt XDR für den Mittelstand oft die bessere Wahl ist

Sep 25, 2025 9:49 AM

Tags: cyber, edr, resilience

First seen on security-insider.de Jump to article: www.security-insider.de/mdr-cybersicherheit-kmu-a-628535a4dec4dd8425d8e0d13b3dc896/
BRICKSTORM Backdoor Hits Tech and Legal Firms with Stealthy New Campaign

Sep 25, 2025 8:49 AM

Tags: access, backdoor, cyber, google, group, intelligence, mandiant, saas, service, technology, threat

Persistent, stealthy, and cross-platform, the BRICKSTORM backdoor has emerged as a significant threat to U.S. technology and legal organizations. Tracked by Google Threat Intelligence Group (GTIG) and investigated by Mandiant Consulting, BRICKSTORM campaigns have maintained undetected access for an average of 393 days, targeting legal services firms, SaaS providers, BPOs, and technology companies to harvest…
Linux Kernel ksmbd Flaw Lets Remote Attackers Execute Arbitrary Code

Sep 25, 2025 8:49 AM

Tags: authentication, control, cve, cyber, exploit, flaw, linux, vulnerability

A critical vulnerability in the Linux Kernel’s ksmbd file sharing component allows remote attackers to execute code with kernel privileges. Tracked as CVE-2025-38561, this flaw affects Linux distributions that include the ksmbd SMB server implementation. Authentication is required, but a successful exploit can grant full control of the affected host. Vendors and administrators should apply…
COLDRIVER APT Group Uses ClickFix to Deliver New PowerShell-Based Backdoor BAITSWITCH

Sep 25, 2025 8:49 AM

Tags: apt, backdoor, blizzard, credentials, cyber, group, malware, phishing, powershell, russia, social-engineering, threat, tool

Russia-linked threat actors continue targeting civil society with sophisticated social engineering campaigns and lightweight malware tools in September 2025. The campaign delivers two previously undocumented malware families: a downloader dubbed BAITSWITCH and a PowerShell-based backdoor named SIMPLEFIX. COLDRIVER, also tracked as Star Blizzard, Callisto, and UNC4057, has historically focused on credential phishing campaigns against NGOs, think tanks, journalists,…
Cyber-Resilienz stärken – Warum MDR statt XDR für den Mittelstand oft die bessere Wahl ist

Sep 25, 2025 8:49 AM

Tags: cyber, edr, resilience

First seen on security-insider.de Jump to article: www.security-insider.de/mdr-cybersicherheit-kmu-a-628535a4dec4dd8425d8e0d13b3dc896/
NVIDIA Merlin Flaw Enables Remote Code Execution with Root Access

Sep 25, 2025 7:25 AM

Tags: access, cve, cyber, flaw, nvidia, remote-code-execution, threat, vulnerability, zero-day

A critical vulnerability in NVIDIA’s Merlin Transformers4Rec library allows attackers to achieve remote code execution with root privileges. Discovered by the Trend Micro Zero Day Initiative (ZDI) Threat Hunting Team, the flaw stems from unsafe deserialization in the model checkpoint loading functionality. Tracked as CVE-2025-23298, this vulnerability underscores the persistent security challenges in machine learning…
Cisco IOS 0-Day RCE Vulnerability Actively Targeted

Sep 25, 2025 7:25 AM

Tags: attack, cisco, cyber, exploit, flaw, network, rce, remote-code-execution, service, software, threat, vulnerability, zero-day

Cisco has disclosed a critical zero-day vulnerability in its IOS and IOS XE software that is being actively exploited by threat actors in real-world attacks. The flaw, tracked as CVE-2025-20352, affects the Simple Network Management Protocol (SNMP) subsystem and allows both denial-of-service attacks and remote code execution depending on the attacker’s privilege level. Critical SNMP Stack…
NVIDIA Merlin Flaw Enables Remote Code Execution with Root Access

Sep 25, 2025 7:25 AM

Tags: access, cve, cyber, flaw, nvidia, remote-code-execution, threat, vulnerability, zero-day

A critical vulnerability in NVIDIA’s Merlin Transformers4Rec library allows attackers to achieve remote code execution with root privileges. Discovered by the Trend Micro Zero Day Initiative (ZDI) Threat Hunting Team, the flaw stems from unsafe deserialization in the model checkpoint loading functionality. Tracked as CVE-2025-23298, this vulnerability underscores the persistent security challenges in machine learning…
Cisco IOS 0-Day RCE Vulnerability Actively Targeted

Sep 25, 2025 7:25 AM

Tags: attack, cisco, cyber, exploit, flaw, network, rce, remote-code-execution, service, software, threat, vulnerability, zero-day

Cisco has disclosed a critical zero-day vulnerability in its IOS and IOS XE software that is being actively exploited by threat actors in real-world attacks. The flaw, tracked as CVE-2025-20352, affects the Simple Network Management Protocol (SNMP) subsystem and allows both denial-of-service attacks and remote code execution depending on the attacker’s privilege level. Critical SNMP Stack…
Salesforce CLI Installer Flaw Lets Attackers Run Code and Gain SYSTEM-Level Access

Sep 24, 2025 1:16 PM

Tags: access, cve, cyber, flaw, vulnerability, windows

A serious security flaw in the Salesforce CLI installer (sf-x64.exe) has been assigned CVE-2025-9844. This weakness allows attackers to execute arbitrary code with SYSTEM-level privileges on Windows machines. Users who installed Salesforce CLI from untrusted sources may be at risk. The vulnerability stems from improper handling of file paths during installation, which can be abused…
Banking Trojans Targeting Android Users Disguise as Government and Trusted Payment Apps

Sep 24, 2025 1:16 PM

Tags: android, banking, cyber, detection, government, group, identity, infrastructure, threat

Since August 2024, a financially motivated threat group has been targeting Android users in Indonesia and Vietnam with banking trojans disguised as official government identity and payment applications. By employing elaborate download mechanisms, reusing infrastructure, and leveraging template-based spoofed sites, the operators have used a coordinated campaign to evade detection and steal user credentials. The…
CISA Reveals Hackers Breached U.S. Federal Agency via GeoServer RCE Flaw

Sep 24, 2025 1:16 PM

Tags: access, breach, cisa, cyber, cybersecurity, detection, endpoint, exploit, flaw, hacker, incident response, Intruder, rce, remote-code-execution, vulnerability

Federal cybersecurity agency CISA has disclosed that attackers exploited a remote code execution vulnerability in GeoServer to breach a U.S. federal civilian executive branch agency. The incident response began after endpoint detection alerts sounded at the agency. Over three weeks, cyber intruders used the flaw to gain initial access, move laterally, and establish persistence across…
Critical DNN Platform Vulnerability Let Attackers Execute Malicious Scripts

Sep 24, 2025 1:16 PM

Tags: cvss, cyber, malicious, vulnerability

A severe Stored Cross-Site Scripting (XSS) vulnerability in the Prompt module of the DNN Platform enables low-privilege attackers to inject and execute arbitrary scripts in the context of privileged users. Published as GHSA-2qxc-mf4x-wr29 by Daniel Valadas yesterday, this vulnerability affects all versions of the DotNetNuke.Core package prior to 10.1.0 and carries a CVSS v3.1 base…
Salesforce CLI Installer Flaw Lets Attackers Run Code and Gain SYSTEM-Level Access

Sep 24, 2025 1:16 PM

Tags: access, cve, cyber, flaw, vulnerability, windows

A serious security flaw in the Salesforce CLI installer (sf-x64.exe) has been assigned CVE-2025-9844. This weakness allows attackers to execute arbitrary code with SYSTEM-level privileges on Windows machines. Users who installed Salesforce CLI from untrusted sources may be at risk. The vulnerability stems from improper handling of file paths during installation, which can be abused…
Vegas Gambling Giant Hit by Cyber Incident, Employee Data Exposed

Sep 24, 2025 1:16 PM

Tags: cyber, data, data-breach, incident, unauthorized

Boyd Gaming Corporation has disclosed that an unauthorized actor removed data from its systems, including information about employees and other individuals First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/vegas-gambling-cyber-incident/
Banking Trojans Targeting Android Users Disguise as Government and Trusted Payment Apps

Sep 24, 2025 1:16 PM

Tags: android, banking, cyber, detection, government, group, identity, infrastructure, threat

Since August 2024, a financially motivated threat group has been targeting Android users in Indonesia and Vietnam with banking trojans disguised as official government identity and payment applications. By employing elaborate download mechanisms, reusing infrastructure, and leveraging template-based spoofed sites, the operators have used a coordinated campaign to evade detection and steal user credentials. The…
MCTTP 2025 – Drei Tage voller Insights, Networking und Cyber-Know-how

Sep 24, 2025 1:16 PM

Tags: cyber

First seen on security-insider.de Jump to article: www.security-insider.de/mcttp-2025-internationale-keynotes-security-tipps-networking-a-6bf5e19a6ab953854920ad2e20d113af/
Moderne Zero-Trust-Architekturen sind die zentralen Säulen eine Cyber-Resilienz

Sep 24, 2025 12:16 PM

Tags: cyber, resilience, zero-trust

Um Zero-Trust-Initiativen zur Reife zu bringen, muss man sich in einer Landschaft voller Teil-Lösungen, architektonischer Kompromisse und leerer Versprechungen zurechtfinden. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/moderne-zero-trust-architekturen-sind-die-zentralen-saeulen-eine-cyber-resilienz/a42102/
Moderne Zero-Trust-Architekturen sind die zentralen Säulen eine Cyber-Resilienz

Sep 24, 2025 12:16 PM

Tags: cyber, resilience, zero-trust

Um Zero-Trust-Initiativen zur Reife zu bringen, muss man sich in einer Landschaft voller Teil-Lösungen, architektonischer Kompromisse und leerer Versprechungen zurechtfinden. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/moderne-zero-trust-architekturen-sind-die-zentralen-saeulen-eine-cyber-resilienz/a42102/