Tag: cyber
-
Threat Actors Increasingly Leaning on GenAI Tools
From eCrime actors to fake IT tech workers, CrowdStrike researchers found that adversaries are using AI to enhance their offensive cyber operations. First seen on darkreading.com Jump to article: www.darkreading.com/remote-workforce/threat-actors-leaning-genai-tools
-
New Malware Attack Uses LNK Files to Deploy REMCOS Backdoor on Windows Systems
The investigation began with the detection of two scanning IP addresses, 91.238.181[.]225 and 5.188.86[.]169 sharing a common Secure Shell (SSH) fingerprint (b5:4c:ce:68:9e:91:39:e8:24:b6:e5:1a:84:a7:a1:03). Cybersecurity researchers have uncovered a sophisticated multi-stage malware campaign that leverages malicious Windows LNK shortcut files to deploy the REMCOS backdoor, a potent remote access trojan capable of full system compromise. This fingerprint…
-
Surge in Threat Actor Exploitation Attempts Serves as Early Warning of Emerging Cyber Vulnerabilities
Researchers have discovered a continuous relationship between increases in threat actor activity and the eventual disclosure of new Common Vulnerabilities and Exposures (CVEs) in corporate edge technologies, according to a groundbreaking report published by GreyNoise, Inc. The study, spanning data from September 2024 onward, leverages GreyNoise’s Global Observation Grid (GOG) to monitor daily unique IP…
-
Backdoors & Breaches: How Talos is helping humanitarian aid NGOs prepare for cyber attacks
In 2023, Cisco Talos and partners created a special Backdoors & Breaches card deck to help NGOs improve their cybersecurity skills with practical, easy-to-use training tailored to their needs. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/backdoors-breaches-how-talos-is-helping-humanitarian-aid-ngos-prepare-for-cyber-attacks/
-
Agentic AI a target-rich zone for cyber attackers in 2025
At Black Hat USA 2025, CrowdStrike warns that cyber criminals and nation-states are weaponising GenAI to scale attacks and target AI agents, turning autonomous systems against their makers First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366628359/Agentic-AI-a-target-rich-zone-for-cyber-attackers-in-2025
-
AI is helping hackers automate and customize cyberattacks
CrowdStrike’s annual cyber-threat-hunting report reveals the double threat that AI poses to many businesses. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/ai-automate-cyber-threats-crowdstrike/756694/
-
Mozilla Issues Warning on Phishing Campaign Targeting Add-on Developer Accounts
Mozilla has issued an urgent security warning to Firefox add-on developers following the detection of a sophisticated phishing campaign targeting accounts on the Add-ons Mozilla Organization (AMO) platform. The alert, published by Scott DeVaney from Mozilla’s Add-ons Community team on August 1, 2025, warns developers to exercise extreme caution when receiving emails purporting to be…
-
FUJIFILM Printer Flaw Allows Attackers to Trigger DoS Attacks
FUJIFILM Business Innovation has disclosed a critical vulnerability affecting multiple printer models that could allow attackers to launch denial-of-service (DoS) attacks through specially crafted network packets. The vulnerability, tracked as CVE-2025-48499, affects the Internet Printing Protocol (IPP) and Line Printer Daemon (LPD) protocol processing capabilities of affected devices. Vulnerability Details The security flaw stems from…
-
Leaked, Patched, and Still Hacked: The SharePoint Zero-Day Crisis
This week we explore the recent Microsoft SharePoint vulnerability that has led to widespread exploitation by ransomware gangs and Chinese State-sponsored hackers. We also cover the confirmed compromise of multiple US agencies, including the Department of Homeland Security, in a large-scale cyber espionage campaign. Kevin Johnson joins to discuss the implications of these events, the……
-
CISA releases Thorium, an open-source, scalable platform for malware analysis
Tags: access, ceo, cio, cisa, compliance, container, control, cyber, cybersecurity, data, docker, framework, github, governance, incident response, kubernetes, malware, open-source, privacy, risk, skills, toolRethinking malware analysis at scale: Enterprise-grade malware analysis tools and platforms have been widely used in the security community. But many of them require paid licenses, lack orchestration at scale, or are difficult to integrate with enterprise workflows. Experts view Thorium as a significant democratization of advanced malware analysis technology.”It is a big deal as…
-
Leaked, Patched, and Still Hacked: The SharePoint Zero-Day Crisis
This week we explore the recent Microsoft SharePoint vulnerability that has led to widespread exploitation by ransomware gangs and Chinese State-sponsored hackers. We also cover the confirmed compromise of multiple US agencies, including the Department of Homeland Security, in a large-scale cyber espionage campaign. Kevin Johnson joins to discuss the implications of these events, the……
-
Sean Cairncross confirmed as national cyber director
The Senate voted 59-35 to place Republican Party insider Sean Cairncross atop the Office of the National Cyber Director, which plays a pivotal role in dictating policy and bolstering U.S. cybersecurity efforts. First seen on therecord.media Jump to article: therecord.media/sean-cairncross-confirmed-oncd
-
Biggest-Ever Bitcoin Hack Uncovered: $3.5B Stolen in Silent Breach
A massive cryptocurrency theft that remained hidden for over four years has been uncovered, revealing what may be the largest Bitcoin hack in history. LuBian, once one of the world’s most prominent Bitcoin mining pools, lost approximately $3.5 billion in a sophisticated attack that went largely undetected since December 2020. The breach began on December…
-
Hackers Leverage AI to Craft Malicious NPM Package That Drains Crypto Wallets
Security researchers at Safety have uncovered an AI-generated malicious NPM package dubbed @kodane/patch-manager, engineered as an advanced cryptocurrency wallet drainer. This package, posing as a benign >>NPM Registry Cache Manager>Kodane,
-
Researchers Use 0-Day to Exploit Google kernelCTF and Debian 12
Security researchers have uncovered and weaponized a critical Use-After-Free vulnerability (CVE-2025-38001) in the Linux network packet scheduler’s HFSC queuing discipline, successfully compromising Google kernelCTF instances”, LTS, COS, and mitigation”, and fully updated Debian 12. By ingeniously combining HFSC’s real-time scheduling mode, NETEM’s packet duplication feature, and a throttled Token Bucket Filter (TBF) root queue, the…
-
Panel to create roadmap for establishing US Cyber Force
The Commission on Cyber Force Generation will develop potential routes Congress and the White House could follow in creating a separate cyber service and aim to deliver them in time for next year’s must-pass national defense authorization act. First seen on therecord.media Jump to article: therecord.media/panel-to-create-roadmap-cyber-force
-
ShadowSyndicate Infrastructure Used by Multiple Ransomware Groups Including Cl0p, LockBit and RansomHub
Cybersecurity researchers have uncovered significant overlaps between the attack infrastructure of ShadowSyndicate, also known as Infra Storm by Group-IB, and several prominent ransomware-as-a-service (RaaS) operations. Active since July 2022, ShadowSyndicate has been linked to high-profile RaaS brands such as AlphaV/BlackCat, LockBit, Play, Royal, Cl0p, Cactus, and RansomHub. The group, speculated to function more as a…
-
North Korea Hiding Malware Within JPEG Files to Attack Windows Systems Bypassing Detections
Security researchers at Genians Security Center have uncovered a sophisticated new variant of the RoKRAT malware, attributed to the North Korean-linked APT37 threat group, which employs steganography to conceal malicious payloads within seemingly innocuous JPEG image files. This technique allows the malware to evade traditional antivirus detections by embedding encrypted shellcode in image data, which…
-
Interlock Ransomware Uses ClickFix Exploit to Execute Malicious Commands on Windows
The Interlock ransomware group was connected to several sophisticated cyber incidents that targeted firms in North America and Europe, according to a recent report published in July 2025 by eSentire’s Threat Response Unit (TRU). The group, active since September 2024, employs a multi-stage attack chain that begins with the exploitation of compromised websites, such as…
-
MCP: securing the backbone of Agentic AI
Tags: access, ai, attack, authentication, business, ciso, control, credentials, cyber, data, detection, injection, least-privilege, mfa, monitoring, RedTeam, risk, security-incident, service, supply-chain, trainingFour cornerstones for securing MCP servers: CISOs can largely rely on the proven basic principles of cyber security for MCP they just need to adapt them in a few places. Pure checklists fall short here. Instead, a clear, principles-based approach is required. Four central pillars have proven themselves in practice: Strong authentication and clean credential…
-
Nation-state group CL-STA-0969 targeted Southeast Asian telecoms in 2024
State-backed group CL-STA-0969 hit Southeast Asian telecoms in 2024, targeting critical infrastructure, says Palo Alto Networks’ Unit 42. Palo Alto Networks reported that a nation-state actor, tracked as CL-STA-0969, targeted telecom firms in Southeast Asia, with attacks on critical infrastructure from February to November 2024. Threat actor CL-STA-0969 overlaps with the China-linked cyber espionage group…
-
Vulnerabilities in Government-Linked Partner Software Allow Remote Code Attacks
Multiple serious security vulnerabilities have been discovered in Partner Software and Partner Web applications widely used by government agencies and contractors, potentially exposing sensitive systems to remote code execution attacks and data breaches. The vulnerabilities, tracked as CVE-2025-6076, CVE-2025-6077, and CVE-2025-6078, were disclosed in a CERT vulnerability note on August 2, 2025, highlighting significant security…
-
6 things keeping CISOs up at night
Tags: access, ai, attack, breach, business, cio, ciso, cloud, compliance, control, cyber, data-breach, deep-fake, email, exploit, infrastructure, jobs, metric, password, phishing, regulation, risk, service, technology, threat, tool, training, vulnerabilityAI’s potential to create a competency crisis: At mental health organization Headspace CISO Jameeka Aaron sees many potential applications for AI but she is balancing enablement with caution. However, Aaron is particularly concerned about the impact of generative AI on the hiring process.While strong developers can leverage AI to their advantage, weaker developers may appear…
-
Critical Squid Flaw Allows Remote Code Execution by Attackers
A severe security vulnerability in the widely-used Squid HTTP proxy has been disclosed, potentially exposing millions of systems to remote code execution attacks. The flaw, designated as CVE-2025-54574 and SQUID-2025:1, represents a critical buffer overflow vulnerability in the software’s URN handling mechanism that could allow attackers to execute arbitrary code on affected systems. Vulnerability Details…
-
AIBOMs are the new SBOMs: The missing link in AI risk management
In this Help Net Security interview, Marc Frankel, CEO at Manifest Cyber, discusses how overlooked AI-specific risks, like poisoned training data and shadow AI, can lead to … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/08/04/marc-frankel-manifest-cyber-aiboms-sboms/
-
Critical HashiCorp Vulnerability Allows Attackers to Run Code on Host Machine
HashiCorp has disclosed a critical security vulnerability affecting its Vault products that could allow privileged operators to execute arbitrary code on the underlying host machine. The flaw, designated CVE-2025-6000 and tracked as HCSEC-2025-14, impacts both Community and Enterprise editions of Vault across multiple versions spanning several years of releases. Vulnerability Details and Impact The security…
-
AI-Powered Cursor IDE Exposes Users to Silent Remote Code Execution
Cybersecurity researchers at Aim Labs have discovered a critical vulnerability in the popular AI-powered Cursor IDE that enables attackers to achieve silent remote code execution on developer machines. The vulnerability, dubbed >>CurXecute,
-
NestJS Vulnerability Allows Code Execution on Developer Machines
A critical remote code execution vulnerability has been discovered in the popular NestJS framework that could allow attackers to execute arbitrary code on developer machines. The vulnerability, tracked as CVE-2025-54782, affects the @nestjs/devtools-integration package and has been assigned the highest severity rating due to its potential for complete system compromise through simple web-based attacks. Vulnerability…