Tag: cyber
-
CISA Issues Alert Over Actively Exploited Flaw in Zimbra Collaboration Suite
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert regarding an actively exploited vulnerability in Synacor’s Zimbra Collaboration Suite (ZCS), urging organizations to take immediate action to mitigate the threat. The flaw, tracked as CVE-2019-9621, is a server-side request forgery (SSRF) vulnerability that resides in the ProxyServlet component of ZCS and has…
-
Brazilian police arrest IT worker over $100 million cyber theft
Police in Brazil arrested an employee of C&M Software, who allegedly told them he had sold his login credentials to the hackers behind a massive theft via the PIX instant payment system. First seen on therecord.media Jump to article: therecord.media/brazil-police-arrest-worker-theft
-
Malware Attacks on Android Devices Surge in Q2, Driven by Banking Trojans and Spyware
Dr.Web Security Space for mobile devices reported that malware activity on Android devices increased significantly in the second quarter of 2025. Adware trojans, particularly from the Android.HiddenAds family, remained the most prevalent threat, despite an 8.62% decrease in user encounters. These trojans often disguise themselves as harmless apps or hide within system directories, concealing their…
-
Abusing Trust: Threat Actors Leverage Signed Drivers for Stealthy Windows Kernel Exploits
Cybercriminals continue to use kernel-level malware as a preferred weapon against Windows systems amid a terrifying increase in cyberthreats. Operating at ring 0 the highest privilege level in the operating system such malware grants attackers unparalleled access to disable security defenses, maintain persistence, and operate undetected. Despite Microsoft’s robust countermeasures like PatchGuard, Driver Signature Enforcement…
-
Parrot Security OS 6.4 Released What’s New!
The Parrot Security team has released Parrot Security OS 6.4, a robust update featuring community-driven enhancements and contributions. As the probable final chapter of the 6.x series, this release refines the security-focused OS and sets the stage for the upcoming Parrot 7. Parrot Security OS is an Ethical Hacking and Cybersecurity Professional dedicated Distribution, explicitly…
-
Batavia Spyware Targets Employees via Weaponized Word Documents Delivering Malware Payloads
Batavia, an unidentified spyware, has been using a sophisticated phishing operation to target Russian industrial organizations since July 2024. Kaspersky researchers have identified a sharp rise in detections since early March 2025, with over 100 users across dozens of organizations falling prey to bait emails disguised as contract agreements. These emails, often containing file names…
-
BladedFeline Exploits Whisper and PrimeCache to Breach IIS and Microsoft Exchange Servers
ESET researchers have uncovered a series of malicious tools deployed by BladedFeline, an Iran-aligned advanced persistent threat (APT) group, targeting Kurdish and Iraqi government officials. Active since at least 2017, BladedFeline has been linked with medium confidence to the notorious OilRig APT group, known for cyberespionage across the Middle East. Sophisticated Cyberespionage Campaign The group’s…
-
SEC seeks SolarWinds settlement in reversal for agency under new leadership
The decision by the commission, now under Republican control, could reshape the landscape of corporate accountability for cyber incidents. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/solarwinds-sec-settle-lawsuit/752322/
-
NSB Warns of Cybersecurity Risks Linked to Popular Chinese Apps Like Rednote, Weibo, TikTok, WeChat, and Baidu Cloud
Taiwan’s National Security Bureau (NSB) has issued a stark warning about cybersecurity risks associated with several widely used China-developed mobile applications, including Rednote, Weibo, TikTok, WeChat, and Baidu Cloud. Following an in-depth investigation conducted in collaboration with the Ministry of Justice Investigation Bureau (MJIB) and the Criminal Investigation Bureau (CIB) under the National Police Agency,…
-
Over 1,000 Fake Domains Imitating Amazon Prime Day Created to Target Online Shoppers
Online customers around the world are getting ready for huge discounts and unique offers as July 8, the much-anticipated Amazon Prime Day 2025, draws near. However, this global shopping event has also become a prime target for cybercriminals, with over 1,000 newly registered domains mimicking Amazon’s branding detected in June alone. Surge in Phishing Threats…
-
AiLock Ransomware Emerges with Hybrid Encryption Tactics: ChaCha20 Meets NTRUEncrypt
The AiLock ransomware organization, which Zscaler first discovered in March 2025, has become a powerful force in the ransomware-as-a-service (RaaS) market, which is a frightening trend for cybersecurity professionals. This malicious entity operates with a sophisticated structure, leveraging both a negotiation site to extract ransoms from victims and a Data Leak Site (DLS) to threaten…
-
VenusTech and Salt Typhoon Breach Sheds Light on China’s Covert Cyber Mercenary Networks
The dark web forum DarkForums, which has been a site for data breaches and leaks since BreachForums was shut down in mid-April, was the scene of two major leaks in late May involving Chinese cybersecurity organizations: VenusTech, a well-known IT security vendor, and Salt Typhoon, a state-sponsored advanced persistent threat (APT) organization affiliated with the…
-
Eight Malicious Firefox Extensions Expose Users to Credential Theft and Surveillance
The Socket Threat Research Team recently discovered a troubling network of malicious Firefox browser extensions that pose serious threats to user security and privacy. Initially focusing on a single extension, >>Shell Shockers,>mre1903.
-
NightEagle APT Unleashes Custom Malware and Zero-Days to Infiltrate Industrial Systems
The advanced attack campaigns of a top Advanced Persistent Threat (APT) group known as >>NightEagle,
-
Inside the ZIP Trap: How APT36 Targets BOSS Linux to Exfiltrate Critical Data
CYFIRMA has uncovered a highly sophisticated cyber-espionage campaign orchestrated by APT36, also known as Transparent Tribe, a Pakistan-based threat actor with a notorious history of targeting Indian defense and government sectors. This latest operation marks a significant shift in tactics, as APT36 adapts its arsenal to infiltrate Linux-based environments, specifically focusing on BOSS Linux, a…
-
GOP domestic policy bill includes hundreds of millions for military cyber
Democrats have critiqued the bill for not protecting funds for the Cybersecurity and Infrastructure Security Agency. First seen on cyberscoop.com Jump to article: cyberscoop.com/gop-domestic-policy-bill-includes-hundreds-of-millions-for-military-cyber/
-
Ingram Micro Confirms Ransomware Incident Impacting Internal Infrastructure
Ingram Micro Holding Corporation (NYSE: INGM), a global leader in technology distribution and supply chain solutions, has confirmed that it recently experienced a ransomware attack targeting certain internal systems. The company issued a statement today addressing the ongoing system outage and the steps being taken to mitigate the impact. Incident Overview According to Ingram Micro,…
-
Threat Actors Turn Job Offers into Scams, Causing Over $264 Million in Losses in 2024
In an era marked by a persistent cost-of-living crisis and economic uncertainty, many individuals are seeking side hustles or better-paying jobs to make ends meet. However, threat actors are exploiting this desperation with sophisticated employment scams, netting over $264 million in losses as reported to the FBI in 2024 alone. These scams, often under-reported, thrive…
-
New Phishing Attack Impersonates DWP to Steal Credit Card Information from Users
A sophisticated phishing campaign targeting UK residents has been active since late May 2025, with a significant surge in activity during the second half of June. This malicious operation impersonates the Department for Work and Pensions (DWP), a key UK government body responsible for welfare and pension services, by sending fraudulent SMS messages to unsuspecting…
-
XWorm RAT Deploys New Stagers and Loaders to Bypass Defenses
The XWorm Remote Access Trojan (RAT), a longstanding favorite among cybercriminals, has recently showcased a significant evolution in its attack methodology, employing an array of sophisticated stagers and loaders to evade detection and infiltrate systems. Known for its comprehensive malicious capabilities including keylogging, remote desktop access, data exfiltration, and command execution XWorm has become a…
-
Qwizzserial Android Malware Masquerades as Legit Apps to Steal Banking Data and Intercept 2FA SMS
A new and alarming Android malware family, dubbed Qwizzserial, has emerged as a significant threat, particularly targeting users in Uzbekistan. Discovered by Group-IB in March 2024, this SMS stealer is designed to intercept two-factor authentication (2FA) codes and steal sensitive banking information, posing a severe risk to personal and financial security. Disguised as legitimate applications…
-
Windows Update Revamped with Smarter Interface for Security Notifications
Microsoft has announced a significant update to the Windows Update experience, introducing a smarter and more responsive interface designed to keep users better informed about their device’s security status. This latest update, available for Windows 11 version 21H2 and Windows 10 versions 21H2 and 22H2, aims to enhance user awareness regarding critical security updates and…
-
Comodo Internet Security 2025 Flaws Allow Remote Code Execution With SYSTEM Privileges
Security researchers have uncovered a series of critical vulnerabilities in Comodo Internet Security 2025, exposing users to remote code execution (RCE) attacks that could grant threat actors SYSTEM-level privileges. These flaws affect Comodo Internet Security Premium version 12.3.4.8162 and potentially other recent releases, putting both individual and enterprise users at risk. CVE ID Vulnerability Type…
-
Threat Actors Use AV/EDR Evasion Framework in the Wild to Deploy Malware Payloads
Elastic Security Labs has uncovered multiple campaigns leveraging SHELLTER, a commercial AV/EDR evasion framework originally designed for offensive security evaluations by red teams. Since late April 2025, threat actors have been using what appears to be Shellter Elite v11.0, released on April 16, 2025, to package and deploy various infostealer malware payloads. SHELLTER Framework Exploited…
-
Microsoft to Remove PowerShell 2.0 from Windows 11 Due to Security Risks
Microsoft has announced a significant change for Windows 11 users: the removal of Windows PowerShell 2.0, a legacy scripting platform, from upcoming builds. This move, first revealed in the Windows 11 Insider Preview Build 27891 released to the Canary Channel, is part of the company’s ongoing efforts to enhance system security and streamline the operating…
-
Qantas contacted by suspected cyber criminal but airline won’t confirm if hacking ransom demanded
Hacked airline says Australian federal police have been engaged but it ‘won’t be commenting any further on the detail of the contact'<ul><li>Get our <a href=”https://www.theguardian.com/email-newsletters?CMP=cvau_sfl”>breaking news email, <a href=”https://app.adjust.com/w4u7jx3″>free app or <a href=”https://www.theguardian.com/australia-news/series/full-story?CMP=cvau_sfl”>daily news podcast</li></ul>A potential cyber criminal has made contact with Qantas, the airline has confirmed, after a <a href=”https://www.theguardian.com/business/2025/jul/02/qantas-confirms-cyber-attack-exposes-records-of-up-to-6-million-customers”>major attack on its network…
-
RingReaper: New Linux EDR Evasion Tool Exploits io_uring Kernel Feature
A new tool named RingReaper is raising eyebrows among defenders and red teamers alike. By leveraging the legitimate, high-performance Linux kernel feature known as io_uring, RingReaper demonstrates how advanced attackers can sidestep even modern Endpoint Detection and Response (EDR) systems. The Rise of io_uring in Offensive Security Introduced in Linux kernel 5.1, io_uring was designed to provide…
-
Linux Boot Vulnerability Lets Attackers Bypass Secure Boot Protections
A newly highlighted vulnerability in the Linux boot process exposes a critical weakness in the security posture of many modern distributions. Despite widespread adoption of Secure Boot, full-disk encryption, and bootloader passwords, attackers can still bypass these defenses by exploiting the Initial RAM Filesystem (initramfs) debug shell”, a loophole often overlooked in hardening guides, as…
-
Skills gaps send CISOs in search of managed security providers
Tags: access, awareness, business, ciso, compliance, control, cyber, cybersecurity, detection, governance, group, infrastructure, intelligence, jobs, monitoring, msp, mssp, network, penetration-testing, risk, risk-assessment, service, skills, strategy, threat, tool, training, update, vulnerabilitySecurity operations centers (SOCs)Cloud platform managementSIEM and log monitoringFramework-based cybersecurity management functionsThreat intelligence feeds and analysisVulnerability scanning and patch managementEndpoint detection and response (EDR)Firewall and network security managementCompliance tracking and audit support”MSPs already have the infrastructure and staff in place to deliver these services efficiently, and at scale,” Richard Tubb, who runs the MSP community…