Tag: cyber
-
Building Essentials for a Robust OT Security Strategy
CS4CA Europe London Event Chair Wayne Harrop on OT Risk and Collaboration. Critical infrastructure providers are facing a volatile geopolitical landscape that could lead to cyberattacks and business disruptions. In advance of the CS4CA Europe London Conference (Sept. 30 – Oct. 1, 2025), conference chair Wayne Harrop shares key cyber strategies to counter enterprise threats.…
-
RainyDay, Turian and Naikon Malwares Abuse DLL Search Order to Execute Malicious Loaders
Cisco Talos has uncovered a sophisticated, long-running campaign active since 2022 that leverages DLL search order hijacking to deliver a novel PlugX variant with overlapping characteristics of the RainyDay and Turian backdoors. This operation, targeting telecommunications and manufacturing organizations across Central and South Asia, demonstrates a remarkable convergence of malware functionality and shared infrastructure that…
-
North Korean IT Worker Gains Access to Organization’s Network Through Innocent Job Application
In today’s complex threat landscape, adversaries increasingly favor “malware-less” intrusion methods that slip past traditional defenses. One particularly insidious scheme involves North Korean operatives posing as legitimate remote IT professionals to infiltrate corporate networks. Trellix researchers recently uncovered a campaign in which a fake applicant seamlessly advanced through hiring stages at a major U.S. healthcare…
-
Kali Linux 2025.3 Launches With Fresh Features and 10 New Pentesting Tools
Kali Linux 2025.3 has arrived, bringing a wave of improvements, updated firmware support, and a suite of ten new security tools. This release builds on the June 2025.2 update by refining core workflows, extending wireless capabilities, and preparing the distribution for emerging architectures. Whether you rely on virtual machines, Raspberry Pi devices, or mobile pentesting…
-
CISA Issues Alert on Actively Exploited Google Chrome 0-Day Vulnerability
Tags: browser, chrome, cisa, cve, cyber, cybersecurity, exploit, flaw, google, infrastructure, risk, vulnerability, zero-dayThe Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent security alert regarding an actively exploited zero-day vulnerability in Google Chrome. The vulnerability, designated as CVE-2025-10585, affects the V8 JavaScript and WebAssembly engine within Google Chromium, creating significant security risks for users worldwide. Critical Type Confusion Flaw Discovered The newly identified vulnerability represents a…
-
North Korean IT Worker Gains Access to Organization’s Network Through Innocent Job Application
In today’s complex threat landscape, adversaries increasingly favor “malware-less” intrusion methods that slip past traditional defenses. One particularly insidious scheme involves North Korean operatives posing as legitimate remote IT professionals to infiltrate corporate networks. Trellix researchers recently uncovered a campaign in which a fake applicant seamlessly advanced through hiring stages at a major U.S. healthcare…
-
SonicWall Issues Emergency Patch to Remove ‘OVERSTEP’ Rootkit Malware on SMA Devices
SonicWall has released an urgent software update for its Secure Mobile Access (SMA) 100 Series appliances to remove a dangerous rootkit known as ‘OVERSTEP.’ This backdoor malware was discovered in older SMA firmware versions and can give attackers persistent access to affected devices. The new build, version 10.2.2.2-92sv, adds additional file checking to detect and…
-
ShadowV2 Botnet Infects AWS Docker Containers to Launch DDoS Campaign
Darktrace’s latest investigation uncovered a novel campaign that blends traditional malware with modern DevOps technology. At the center of this operation lies a Python-based command-and-control (C2) framework hosted on GitHub CodeSpaces. The threat actors leverage a multi-stage Docker deployment initiated by a Python spreader, followed by a Go-based Remote Access Trojan (RAT) that implements a…
-
SonicWall Issues Emergency Patch to Remove ‘OVERSTEP’ Rootkit Malware on SMA Devices
SonicWall has released an urgent software update for its Secure Mobile Access (SMA) 100 Series appliances to remove a dangerous rootkit known as ‘OVERSTEP.’ This backdoor malware was discovered in older SMA firmware versions and can give attackers persistent access to affected devices. The new build, version 10.2.2.2-92sv, adds additional file checking to detect and…
-
New “YiBackdoor” Malware Lets Hackers Run Commands and Steal Data
Cybersecurity researchers at Zscaler ThreatLabz have identified a sophisticated new malware strain dubbed YiBackdoor, first detected in June 2025. This emerging threat represents a significant evolution in backdoor technology, sharing substantial code similarities with established malware families IcedID and Latrodectus. The discovery highlighted the continuous adaptation of cybercriminal tools, as YiBackdoor demonstrates capabilities that enable…
-
Jaguar Land Rover Factory Reopening Delayed After Cyber Attack
Jaguar Land Rover (JLR) has announced a further delay to the reopening of its production lines following a sophisticated cyber attack. The pause in manufacturing has been extended until Wednesday, 1 October 2025, to allow the investigation to progress and to ensure a secure return to operations. Overview of Cyber Attack Earlier this week, JLR…
-
Cyber-Angriffe auf Schulen: Wie KI das Bildungswesen verwundbar macht
Warum ist Bildung so attraktiv für Hacker? Zum einen liegen hier riesige Mengen sensibler Daten von Schülerakten über Finanz- bis hin zu Forschungsdaten. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/cyber-angriffe-auf-schulen-wie-ki-das-bildungswesen-verwundbar-macht/a42098/
-
Cyber Criminals Have A New Best Friend The University of Oregon
The views and opinions expressed in this blog do not necessarily reflect the views and opinions of SecureIQLab, but probably dovetail nicely with the views and opinions of the majority of cybersecurity professionals. This is painful to write. The monumental ignorance demonstrated by the manner in which the University of Oregon handled a recent cybersecurity……
-
Cyber Criminals Have A New Best Friend The University of Oregon
The views and opinions expressed in this blog do not necessarily reflect the views and opinions of SecureIQLab, but probably dovetail nicely with the views and opinions of the majority of cybersecurity professionals. This is painful to write. The monumental ignorance demonstrated by the manner in which the University of Oregon handled a recent cybersecurity……
-
Chrome High-severity Flaws Expose Sensitive Data, Trigger System Crashes
Google has released an urgent security update for its Chrome browser, addressing three high-severity vulnerabilities that could allow attackers to leak sensitive information and cause system instability. The latest Chrome version 140.0.7339.207/.208 for Windows and Mac, and 140.0.7339.207 for Linux, patches critical flaws in the V8 JavaScript engine that powers the browser’s web content processing.…
-
A look inside 1,000 cyber range events and what they reveal about AppSec
Software powers almost every part of business, which means attackers have more chances than ever to exploit insecure code. A new report from CMD+CTRL Security looks at how … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/09/24/appsec-cyber-range-training/
-
Iranian APT >>Nimbus Manticore<< Intensifies Cyber Espionage in Europe
The post Iranian APT >>Nimbus Manticore
-
Dark Reading Confidential: Battle Space: Cyber Pros Land on the Front Lines of Protecting US Critical Infrastructure
Dark Reading Confidential Episode 10: It’s past time for a comprehensive plan to protect vital US systems from nation-state cyberattacks, and increasingly, that responsibility is falling to asset owners across a vast swath of organizations, who likely never bargained for an international cyber conflict playing out in their environments. But here we are. And here’s…
-
Service Accounts in Active Directory: These OG NHIs Could Be Your Weakest Link
While non-human identities (NHIs) in cloud and SaaS operations may be getting lots of attention right now, securing your Active Directory service accounts can go a long way in reducing risk. Here are three steps you can take right now. Key takeaways Expect sprawl: Agentic AI and cloud native development accelerate non-human identity (NHI) growth. …
-
Defy Security Appoints Esteemed Cybersecurity Leader Gary Warzala to Its Board of Directors
Defy Security, a leading provider of cybersecurity solutions and services, today announced the appointment of Gary Warzala to its Board of Directors. Warzala is a highly regarded cybersecurity executive with more than 20 years of leadership experience, having served as Chief Information Security Officer (CISO) at Visa Inc., PNC Bank, Fifth Third Bank, Aon Corporation,…
-
Iranian Hackers Use Fake Job Lures to Breach Europe’s Critical Industries
New research from Check Point Research reveals the Iranian cyber group Nimbus Manticore is targeting defence, telecom, and aerospace companies in Europe with fake job offers. Learn how they use advanced malware to steal sensitive data. First seen on hackread.com Jump to article: hackread.com/iranian-hackers-fake-job-breach-europe-industries/
-
From Visibility to Context in Cybersecurity
Illumio’s Raghu Nandakumara on Seeing the Broader Implications of Cyber Incidents. Seeing risk is not the same as understanding it. Raghu Nandakumara, vice president of industry strategy at Illumio, explains how organizations can move beyond mere visibility to actionable context for building stronger resilience. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/from-visibility-to-context-in-cybersecurity-a-29502
-
Ransomware Attack Disrupted Airports Across Europe, Cyber Agency Confirms
London Heathrow, Berlin Airport, and Brussels Airport faced significant delays, cancellations, and manual processing. The post Ransomware Attack Disrupted Airports Across Europe, Cyber Agency Confirms appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-eu-airport-ransomware/
-
Jaguar Land Rover extends cyber attack-induced shutdown to October
Jaguar Land Rover is extending its production shutdown caused by the 31 August cyber attack into next month, as government ministers drop by and supply chain workers lose wages First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366631527/Jaguar-Land-Rover-extends-cyber-attack-induced-shutdown-to-October
-
Iranian Hacking Group Nimbus Manticore Expands European Targeting
Nimbus Manticore intensified European cyber-espionage, targeting aerospace, telecom, defense sectors First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/iran-nimbus-manticore-european/
-
Threat Actors Breach Enterprise Infrastructure Within 18 Minutes of Initial Access
Attackers are accelerating their foothold in corporate networks: over the past three months (June 1 to August 31, 2025), the average time from initial breach to lateral movement”, called “breakout time””, fell to just 18 minutes. In one striking incident, “Akira” ransomware operators moved laterally in only six minutes after compromising a SonicWall VPN. This…
-
U.S. Secret Service Shuts Down 300 SIM Servers and 100K SIM Cards Disabling Cell Towers
The U.S. Secret Service has dismantled a sophisticated network of electronic devices scattered across the New York tri-state area. These devices posed an imminent threat to protective operations for senior government officials. During a protective intelligence investigation, agents identified over 300 co-located SIM servers and 100,000 SIM cards deployed at multiple locations. The servers and…
-
‘Our worst day’: The untold story of the Electoral Commission cyber attack
As head of digital at The Electoral Commission, Andrew Simpson’s mettle was tested when threat actors gained access to the regulator’s email systems and accessed sensitive voter data. Three years on, he tells his story to Computer Weekly First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366631525/Our-worst-day-The-untold-story-of-the-Electoral-Commission-cyber-attack
-
SpyCloud Report: 2/3 Orgs Extremely Concerned About Identity Attacks Yet Major Blind Spots Persist
Austin, Texas, USA, September 23rd, 2025, CyberNewsWire New SpyCloud 2025 Identity Threat Report reveals dangerous disconnect between perceived security readiness and operational reality. SpyCloud, the leader in identity threat protection, today released the 2025 SpyCloud Identity Threat Report, revealing that while 86% of security leaders report confidence in their ability to prevent identity-based attacks, 85%…
-
Hackers Hijacking IIS Servers Using Malicious BadIIS Module to Serve Malicious Content
Leveraging a native IIS module named BadIIS, attackers manipulated search engine crawler traffic to poison search results and redirect legitimate users to scam or adult-oriented websites. Infrastructure overlaps link this activity to ESET’s “Group 9” cluster and share functional similarities with Cisco Talos’s “DragonRank” campaign. In March 2025, Unit 42 researchers uncovered an advanced SEO…