Tag: cyber
-
Microsoft Publishes Guide for Certificate-Based Authentication in Windows Admin Center
Microsoft has released comprehensive guidance for implementing certificate-based authentication in Windows Admin Center (WAC), providing administrators with enhanced security through smart card integration and Active Directory Certificate Services. This authentication method significantly strengthens access controls by requiring administrators to present valid certificates before accessing the management gateway, effectively adding a strong second authentication factor beyond…
-
New npm Malware Steals Browser Passwords via Steganographic QR Code
A novel npm package named fezbox has been uncovered by the Socket Threat Research Team as a sophisticated malware delivery mechanism that exfiltrates username and password credentials from browser cookies via an embedded QR code. Published under the npm alias janedu (registration email janedu0216@gmail[.]com), the package masquerades as a harmless JavaScript/TypeScript utility library while quietly…
-
A suspected Scattered Spider member suspect detained for casino network attacks
A suspected Scattered Spider member linked to cyber attacks on Las Vegas casinos was arrested on September 17. The Las Vegas Metropolitan Police Department arrested on September 17 a suspected Scattered Spider member linked to attacks on Las Vegas casinos for computer intrusion, extortion, and identity theft. Between August and October 2023, multiple Las Vegas…
-
Klassenzimmer offline Wie Cyber-Kriminelle im Zeitalter der KI das Bildungswesen angreifen
Das moderne Klassenzimmer hat sich zu einem digitalen Schulhof gewandelt, der auf Plattformen wie Microsoft-Teams, Google-Classroom oder Zoom basiert. Diese Tools fördern zwar die Zusammenarbeit und Innovation, sind aber auch bevorzugte Ziele für Cyberangriffe, insbesondere solche, die KI nutzen. Somit sind Schulen und Universitäten Risiken ausgesetzt, die Schüler, Pädagogen und sogar die nationale Innovation direkt…
-
UK chancellor Putin the blame on Russia for cyber chaos, but evidence says otherwise
Reeves points finger at Moscow in interview when authorities reckon it’s local lads First seen on theregister.com Jump to article: www.theregister.com/2025/09/23/reeves_blames_russia_cyberattacks/
-
Klassenzimmer offline Wie Cyber-Kriminelle im Zeitalter der KI das Bildungswesen angreifen
Das moderne Klassenzimmer hat sich zu einem digitalen Schulhof gewandelt, der auf Plattformen wie Microsoft-Teams, Google-Classroom oder Zoom basiert. Diese Tools fördern zwar die Zusammenarbeit und Innovation, sind aber auch bevorzugte Ziele für Cyberangriffe, insbesondere solche, die KI nutzen. Somit sind Schulen und Universitäten Risiken ausgesetzt, die Schüler, Pädagogen und sogar die nationale Innovation direkt…
-
Zloader Malware Used as Gateway for Ransomware Deployment in Corporate Networks
Zloader, a sophisticated Zeus-based modular trojan that first emerged in 2015, has undergone a significant transformation from its original banking-focused purpose to become a dangerous tool for initial access and ransomware deployment in corporate environments. Following an almost two-year hiatus, this malware reemerged in September 2023 with substantial enhancements to its obfuscation techniques, domain generation…
-
Beware of Fake Online Speedtest Apps with Hidden JavaScript Code
These fake online speedtest applications prey on users seeking to measure their internet performance, yet they harbor hidden payloads that compromise system integrity and privacy. Much like the previously analyzed Fake Manual Reader and Finder software, these imposters leverage packers, obfuscated JavaScript, and persistence mechanisms to execute arbitrary code and exfiltrate sensitive data. On September…
-
SolarWinds Web Help Desk Vulnerability Enables Privilege Escalation
A critical vulnerability in SolarWinds Web Help Desk (WHD) could allow attackers to escalate privileges and execute arbitrary code on affected systems. SolarWinds has released Web Help Desk 12.8.7 Hotfix 1 to address CVE-2025-26399, a deserialization flaw in the AjaxProxy component. Administrators are urged to install the hotfix immediately to prevent exploitation and protect management…
-
Hackers Abuse IMDS Service for Cloud Initial Access
Cloud environments rely on the Instance Metadata Service (IMDS) to provide virtual machines with temporary credentials and essential configuration data. IMDS allows applications to securely retrieve credentials without embedding secrets in code or configuration files. However, threat actors have found ways to misuse this convenience, turning IMDS into a springboard for stealing credentials, moving laterally,…
-
Hackers Abuse IMDS Service for Cloud Initial Access
Cloud environments rely on the Instance Metadata Service (IMDS) to provide virtual machines with temporary credentials and essential configuration data. IMDS allows applications to securely retrieve credentials without embedding secrets in code or configuration files. However, threat actors have found ways to misuse this convenience, turning IMDS into a springboard for stealing credentials, moving laterally,…
-
H2O-3 JDBC Deserialization Vulnerability (CVE-2025-6544)
Overview Recently, NSFOCUS CERT detected that H2O-3 released a security update to fix the H2O-3 JDBC deserialization vulnerability (CVE-2025-6544); This vulnerability is a bypass of CVE-2025-6507. Due to the system’s flawed handling of JDBC connection parameters, an unauthenticated attacker can bypass existing regular expression checks through double URL encoding, thereby enabling arbitrary file reading and…The…
-
GitHub Introduces npm Security with Stronger Authentication and Trusted Publishing
Open source software powers much of today’s technology, enabling developers around the world to build and share tools, libraries, and applications. However, the same openness that drives innovation also presents serious security challenges. Attackers regularly target package registries like npm to compromise accounts and inject malicious code. In response, GitHub has announced significant updates to…
-
Russia Leveraging Cyber-Attacks as a Strategic Weapon Against Key Industries in Major Nations
In 2024, as the Russia-Ukraine war prolongs and military and economic cooperation between North Korea and Russia deepens, cyberspace has become a central battleground for international conflict. Russia is leveraging cyber-attacks to alleviate economic pressure from international sanctions and to enhance its war-fighting capabilities, targeting key industries in major countries around the globe. In November…
-
Massive 22.2 Tbps DDoS Attack Sets New World Record
Cloudflare announced today that it has successfully mitigated the largest distributed denial-of-service (DDoS) attack ever recorded. The hyper-volumetric assault peaked at a staggering 22.2 terabits per second (Tbps) and 10.6 billion packets per second (Bpps), shattering the previous record of 11.5 Tbps. This new high-water mark highlights a dramatic escalation in the scale and speed…
-
Lectora Desktop and Online XSS Vulnerability Enables JavaScript Injection
A critical cross-site scripting (XSS) vulnerability affecting both Lectora Desktop and Lectora Online has been disclosed, enabling attackers to inject JavaScript through crafted URL parameters. Discovered by security researcher Mohammad Jassim and documented by the CERT® Coordination Center on September 22, 2025, this flaw poses a risk of client-side code execution, session hijacking, and user…
-
Nimbus Manticore Targets Defense and Telecom Industries with New Malware Attack
Check Point Research has identified a long-running campaign by the Iranian-aligned threat actor Nimbus Manticore”, also known as UNC1549, Smoke Sandstorm, and the “Iranian Dream Job” operation”, targeting defense manufacturers, telecommunications, and aviation entities aligned with IRGC priorities. Recent activity demonstrates a sharpened focus on Western Europe, notably Denmark, Sweden, and Portugal, with spear-phishing lures…
-
Neuerungen im PowerProtect-Portfolio – Dell Technologies will Cyber-Resilienz von Unternehmen verbessern
First seen on security-insider.de Jump to article: www.security-insider.de/dell-technologies-will-cyber-resilienz-von-unternehmen-verbessern-a-d1585f8addef03785cf54b79c3afd61f/
-
Nimbus Manticore Targets Defense and Telecom Industries with New Malware Attack
Check Point Research has identified a long-running campaign by the Iranian-aligned threat actor Nimbus Manticore”, also known as UNC1549, Smoke Sandstorm, and the “Iranian Dream Job” operation”, targeting defense manufacturers, telecommunications, and aviation entities aligned with IRGC priorities. Recent activity demonstrates a sharpened focus on Western Europe, notably Denmark, Sweden, and Portugal, with spear-phishing lures…
-
European Airport Operations Disrupted by Ransomware
Passengers across Europe are facing another day of flight delays after a cyber-attack struck the company behind the check-in and boarding software used at many airports. London Heathrow, Brussels, Dublin and Berlin have been worst hit since Friday, when the attack first took hold. Automatic kiosks and bag-drop machines went offline, forcing airline staff to…
-
European Airport Operations Disrupted by Ransomware
Passengers across Europe are facing another day of flight delays after a cyber-attack struck the company behind the check-in and boarding software used at many airports. London Heathrow, Brussels, Dublin and Berlin have been worst hit since Friday, when the attack first took hold. Automatic kiosks and bag-drop machines went offline, forcing airline staff to…
-
Libraesva ESG Vulnerability Allows Attackers to Execute Malicious Commands
A critical command injection vulnerability in Libraesva ESG email security gateways has been discovered, allowing attackers to execute arbitrary commands through specially crafted compressed email attachments. The vulnerability, designated CVE-2025-59689, affects versions starting from 4.5 and has already been exploited by what appears to be a foreign state actor. Diagram showing how command injection attacks…
-
Windows 11 24H2 KB5064081 Update Causes Video Playback Issues
Microsoft’s latest Windows 11 update is causing significant problems for users trying to play protected video content. The KB5064081 update, released on August 29, 2025, has disrupted video playback functionality across multiple applications, leaving users frustrated with black screens and frozen content. Windows 11 24H2 update in progress showing copy dialog and progress bar at…
-
Fake Job Offers Used to Deliver Advanced Malware Targeting Job Seekers
Iranian threat actors are exploiting job seekers’ aspirations through sophisticated fake recruitment campaigns designed to deploy advanced malware across Europe’s critical infrastructure sectors. The attack methodology demonstrates remarkable operational security and state-sponsored tradecraft characteristics. Nimbus Manticore, also known as UNC1549 or Smoke Sandstorm, constructs elaborate fake recruitment websites that impersonate major aerospace companies including Boeing, Airbus, Rheinmetall,…
-
Neuer Ansatz für Cyber-Risikomanagement – Warum Exposure Management das Schwachstellen-Management ablöst
First seen on security-insider.de Jump to article: www.security-insider.de/posure-management-vs-vulnerability-management-a-f2e53703d4ab18232d4e404a6c4c7314/
-
Microsoft DCU’s Takedown of RaccoonO365
When I saw the name of the Microsoft Digital Crime Unit’s latest target, “RaccoonO365” I probably reacted to it differently than most. With the help of a friend in Lagos, we’ve been watching the money launderers and things have reached a point that they now refer to what we previously called “Business Email Compromise” or…
-
Anton’s Security Blog Quarterly Q3 2025
Tags: ai, automation, breach, ciso, cloud, cyber, defense, detection, edr, google, governance, guide, metric, office, RedTeam, risk, siem, soc, software, supply-chain, threat, vulnerability, vulnerability-management, zero-trustAmazingly, Medium has fixed the stats so my blog / podcast quarterly is back to life. As before, this covers both Anton on Security and my posts from Google Cloud blog, Google Cloud community blog, and our Cloud Security Podcast (subscribe on Spotify). Gemini for docs based on this blog Top 10 posts with the most…
-
TDL 005 – A Defender’s Journey: From Passion Project to Protecting Children Online
Tags: access, business, control, corporate, country, cyber, cybersecurity, data-breach, defense, dns, encryption, endpoint, finance, github, government, group, guide, identity, Internet, jobs, microsoft, network, open-source, privacy, risk, service, technology, tool, zero-trustSummary A Defender’s Journey: From Passion Project to Protecting Children Online In a recent episode of “The Defender’s Log,” host David Redekop sat down with cybersecurity expert Will Earp to discuss his unconventional path into the industry and his current mission-driven career. Earp, a self-proclaimed “tinkerer” from a young age, shared how his early fascination…