Tag: cyber
-
Ukrainian Hackers Claim Cyberattack on Major Russian Drone Supplier
A Ukrainian woman who survived a catastrophic cluster munition attack in 2014 continues to navigate the complex aftermath of severe combat-related injuries, highlighting the long-term humanitarian consequences of explosive ordnance use in populated areas. Nelya Leonidova, 34 at the time of the incident, sustained life-threatening polytrauma when submunitions detonated near a recreational area in Zugres,…
-
H2Miner Targets Linux, Windows, and Containers to Illicitly Mine Monero
FortiGuard Labs researchers have uncovered a sophisticated cryptomining campaign where the H2Miner botnet, active since late 2019, has expanded its operations to target Linux, Windows, and containerized environments simultaneously. The campaign represents a significant evolution in cross-platform cryptocurrency mining attacks, with threat actors leveraging updated scripts and infrastructure to maximize financial gains from compromised systems.…
-
Massistant: Chinese Mobile Forensic Tool Accesses SMS, Images, Audio, and GPS Data
Cybersecurity researchers at Lookout Threat Lab have uncovered a sophisticated mobile forensics application called Massistant, deployed by Chinese law enforcement to extract comprehensive data from confiscated mobile devices. The tool represents a significant evolution from its predecessor MFSocket, incorporating advanced capabilities to bypass device security measures and collect sensitive information including SMS messages, images, audio…
-
SquareX Collaborates With Top Fortune 500 CISOs To Launch The Browser Security Field Manual At Black Hat
Palo Alto, California, July 17th, 2025, CyberNewsWire SquareX announced the official launch of The Browser Security Field Manual at Black Hat USA 2025. In addition to a comprehensive practical guide to the latest TTPs attackers are using to target employees in the browser, this comprehensive manual features industry perspectives from leading CISOs from multiple Fortune…
-
Chinese State-Sponsored Hackers Target Semiconductor Industry with Weaponized Cobalt Strike
Proofpoint Threat Research has identified a sophisticated multi-pronged cyberespionage campaign targeting Taiwan’s semiconductor industry between March and June 2025. Three distinct Chinese state-sponsored threat actors, designated as UNK_FistBump, UNK_DropPitch, and UNK_SparkyCarp, conducted coordinated phishing operations against organizations spanning semiconductor manufacturing, design, testing, supply chain entities, and financial investment analysts specializing in the Taiwanese semiconductor market.…
-
It’s Time to Include Geopolitical Risk in Defense Planning
CyXcel’s Megha Kumar on Aligning Enterprise Strategy With Geopolitical Realities. Geopolitical tensions are no longer limited to headlines or high-level diplomacy. They drive cyber risk, supply chain disruption and regulatory fragmentation. CyXcel’s Megha Kumar makes the case for why companies need to take notice and embed geopolitical risks in ongoing security planning. First seen on…
-
Over 4 Million Exposed Devices Used in Two New DoS Attack Campaigns
Security researchers have discovered over 4 million vulnerable Internet hosts that can be weaponized for devastating new denial-of-service attacks, marking one of the largest infrastructure vulnerabilities uncovered in recent years. The groundbreaking research, conducted by Angelos Beitis and Mathy Vanhoef from DistriNet at KU Leuven, reveals that millions of devices worldwide accept unauthenticated tunneling traffic…
-
AI Cloaking Tools Enable HarderDetect Cyber-Attacks
Cybercriminals are using AI cloaking tools to evade detection, disguising phishing and malware sites First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/ai-cloaking-tools-enable-complex/
-
China-linked hackers target Taiwan chip firms in a coordinated espionage campaign
Tags: access, ai, attack, china, compliance, control, credentials, cyber, cybersecurity, detection, email, espionage, exploit, finance, framework, government, group, hacker, intelligence, international, login, monitoring, network, phishing, software, supply-chain, technology, threat, warfareInvestment banks in the crosshairs: A second group, UNK_DropPitch, targeted the financial ecosystem surrounding Taiwan’s semiconductor industry. This group conducted phishing campaigns against investment banks, focusing on individuals specializing in Taiwanese semiconductor analysis. The phishing emails purported to come from fictitious financial firms seeking collaboration opportunities.The third group, UNK_SparkyCarp, focused on credential harvesting through sophisticated…
-
Cyberrisiken 2025 Mehr Investitionen, aber fehlender Geschäftskontext bremst Risikomanagement
Eine aktuelle Studie von Qualys in Zusammenarbeit mit Dark Reading zeigt: Trotz wachsender Ausgaben und zunehmender Relevanz in Vorstandsetagen bleibt das Cyber-Risikomanagement vieler Unternehmen unausgereift. Der Grund: Der geschäftliche Kontext fehlt. Zentrale Erkenntnisse der Umfrage unter über 100 IT- und Security-Verantwortlichen: Cyberrisiken nehmen zu: 71″¯Prozent der Befragten sehen steigende oder gleichbleibende Risiken trotz steigender […]…
-
United Natural Foods Expects $400M revenue impact from June cyber attack
United Natural Foods Projects (UNFI) expects a $350$400M sales hit from a June cyberattack, with $50$60M in net income impact. United Natural Foods, Inc. (UNFI), the main distributor for Amazon’s Whole Foods, said the June 2025 cyberattack will slash its fiscal 2025 sales by $350 to $400 million. United Natural Foods, Inc.(UNFI) is aProvidence, Rhode…
-
Researchers Reveal How Hacktivist Groups Gain Attention and Choose Their Targets
Cybersecurity researchers at Graphika have unveiled comprehensive findings on the operational dynamics of hacktivist organizations, revealing sophisticated attention-seeking behaviors and strategic target selection methodologies. Through their ATLAS intelligence reporting platform, analysts have systematically monitored approximately 700 active and inactive hacktivist entities since 2022, encompassing state-sponsored personas, geopolitically aligned collectives supporting Russia and Ukraine, and regionally-focused…
-
UK’s Co-op Retailer Hit by Cyberattack, 6.5 Million Members’ Data Exposed
The UK’s Co-op retailer has disclosed that all 6.5 million of its members had their personal data stolen during a devastating cyberattack in April 2024. Chief Executive Shirine Khoury-Haq confirmed the full extent of the breach in her first public interview since the incident, expressing her devastation over the attack’s impact on both members and…
-
NVIDIA Container Toolkit Vulnerability Allows Privileged Code Execution by Attackers
NVIDIA has released critical security updates addressing two significant vulnerabilities in its Container Toolkit and GPU Operator that could allow attackers to execute arbitrary code with elevated privileges. The vulnerabilities, discovered in July 2025, affect all versions of the Container Toolkit up to 1.17.7 and GPU Operator up to 25.3.0, prompting immediate security patches and…
-
1-Click Oracle Cloud Code Editor RCE Flaw Allows Malicious File Upload to Shell
Tags: cloud, cyber, flaw, infrastructure, malicious, oracle, rce, remote-code-execution, service, threat, vulnerabilityTenable Research has disclosed a critical Remote Code Execution (RCE) vulnerability in Oracle Cloud Infrastructure’s Code Editor that enabled attackers to silently hijack victim Cloud Shell environments through a single malicious link. The vulnerability, which has since been remediated by Oracle, could have allowed threat actors to pivot across multiple OCI services and compromise integrated…
-
Iranian Threat Actors Use AI-Generated Emails to Target Cybersecurity Researchers and Academics
Iranian state-backed Advanced Persistent Threat (APT) groups and their hacktivist allies have stepped up operations that could spark worldwide cyber retaliation in the wake of Israeli and American strikes on Iranian nuclear and military facilities in June 2025. While kinetic conflicts remain contained, the cyber domain has seen a surge in preparatory activities targeting U.S.…
-
Hackers Use DNS Queries to Evade Defenses and Exfiltrate Data
Cybercriminals are increasingly exploiting the Domain Name System (DNS) to bypass corporate security measures and steal sensitive data, according to new research from cybersecurity experts. This sophisticated technique, known as DNS tunneling, transforms the internet’s essential >>phonebook
-
Threat Actors Deploy 28+ Malicious Packages to Spread Protestware Scripts
Socket’s Threat Research Team has discovered a network of at least 28 malicious packages including protestware scripts, totaling approximately 2,000 copies, in a major escalation within the npm supply chain. These packages, initially flagged in two instances for hidden functionality targeting Russian-language users on Russian or Belarusian domains, have proliferated across the ecosystem. The protestware,…
-
PyPI Blocks Inbox.ru Domains After 1,500+ Fake Package Uploads
The Python Package Index (PyPI) has implemented an administrative block on the inbox.ru email domain, prohibiting its use for new user registrations and as additional verification addresses. This action stems from a recent campaign that exploited the domain to create over 250 fraudulent accounts, which in turn uploaded more than 1,500 empty projects. These bogus…
-
Critical SharePoint RCE Vulnerability Exploited via Malicious XML in Web Part
A severe remote code execution (RCE) vulnerability has been discovered in Microsoft SharePoint that allows attackers to execute arbitrary code through malicious XML content embedded within web parts. According to the recent report, the vulnerability, which affects the deserialization process of webpart properties, represents a significant security risk for organizations running vulnerable SharePoint installations. Technical…
-
Hackers Actively Exploited CitrixBleed 2 Flaw Ahead of PoC Disclosure
Cybersecurity researchers have discovered that threat actors began exploiting the critical CitrixBleed 2 vulnerability nearly two weeks before a public proof-of-concept was released, highlighting the sophisticated nature of modern attack campaigns. The vulnerability, tracked as CVE-2025-5777, represents a significant security risk for organizations running Citrix NetScaler appliances. Early Exploitation Timeline GreyNoise security researchers observed the…
-
Cisco Unified Intelligence Center Flaw Lets Remote Attackers Upload Arbitrary Files
A critical security vulnerability has been discovered in Cisco’s Unified Intelligence Center that allows authenticated remote attackers to upload arbitrary files to affected systems, potentially enabling complete system compromise. The flaw, tracked as CVE-2025-20274, carries a CVSS score of 6.3 and has been assigned a High security impact rating by Cisco due to the potential…
-
Weaponizing SVG: How Threat Actors Embed Malicious JavaScript in Vector Files
Cybersecurity researchers have identified an emerging attack campaign where threat actors are weaponizing Scalable Vector Graphics (SVG) files to deliver sophisticated JavaScript-based redirect attacks. This technique exploits the inherent trust placed in image formats, allowing malicious actors to embed obfuscated JavaScript within seemingly harmless vector graphics files that execute automatically when opened in web browsers.…
-
0-Day RCE Flaw in SonicWall SMA Devices Exploited to Launch OVERSTEP Ransomware
Tags: access, breach, credentials, cyber, cyberattack, exploit, flaw, google, group, intelligence, mobile, ransomware, rce, remote-code-execution, threat, zero-dayGoogle’s Threat Intelligence Group (GTIG) has uncovered a sophisticated cyberattack campaign targeting end-of-life SonicWall Secure Mobile Access (SMA) 100 series appliances, where threat actors are exploiting previously stolen credentials and deploying a new rootkit called OVERSTEP. The financially motivated group, tracked as UNC6148, has been operating since at least October 2024 and is suspected of…
-
Cloudflare Confirms BGP Hijack Behind 1.1.1.1 DNS Disruption
Cloudflare has revealed that a 62-minute global outage of its popular 1.1.1.1 DNS resolver service on July 14, 2025, was caused by an internal configuration error rather than an external attack, though the incident coincided with an unrelated BGP hijack that complicated the situation. The outage, which lasted from 21:52 UTC to 22:54 UTC, affected…
-
Europol Takes Down NoName057(16)’s Global Network of Over 100 Servers
Operation Eastwood, coordinated by Europol and Eurojust, successfully dismantled the hacktivist collective’s global infrastructure consisting of over 100 servers worldwide. The joint action involved authorities from 12 core countries including Germany, France, Spain, the Netherlands, United States, and others, with additional support from eight nations. The takedown yielded significant enforcement outcomes:two arrestsin France and Spain,seven…
-
Hackbots biggest cloud security risk, slashing attack times to minutes
With cyber criminals using automated tools to steal data in minutes, organisations must focus on runtime protection and automated responses to combat the rising threat from AI and misconfigured cloud assets First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366627892/Hackbots-biggest-cloud-security-risk-slashing-attack-times-to-minutes
-
FortiWeb Systems Compromised via Webshells After Public PoC Release
A widespread cyberattack campaign has successfully compromised dozens of Fortinet FortiWeb instances through webshell deployment, exploiting a critical vulnerability for which proof-of-concept code became publicly available just days ago. The rapid weaponization of the exploit demonstrates the immediate risks organizations face when security flaws become public knowledge. Critical Vulnerability Details and Impact The attacks center…
-
Microsoft Honors Top Contributors to MSRC’s Security Research Program
Microsoft has announced its 2025 Most Valuable Researchers (MVRs), recognizing 100 security researchers who made significant contributions to protecting the company’s customers through the Microsoft Security Response Center’s vulnerability disclosure program. The annual recognition celebrates researchers who discovered and responsibly reported security vulnerabilities between July 1, 2024, and June 30, 2025. The Microsoft Researcher Recognition…