Tag: cyber
-
TeamViewer for Windows Vulnerability Lets Hackers Delete Files with SYSTEM Rights
A critical security vulnerability has been discovered in TeamViewer Remote Management for Windows, exposing systems to potential privilege escalation attacks. The flaw, tracked as CVE-2025-36537, allows a local unprivileged attacker to delete arbitrary files with SYSTEM-level privileges, posing a significant risk to organizations relying on TeamViewer’s Remote Management features. Vulnerability Overview The vulnerability, assigned a…
-
NVIDIA Megatron LM Flaw Allows Attackers to Inject Malicious Code
NVIDIA has issued an urgent security update for its open-source Megatron-LM framework, following the discovery of two critical vulnerabilities that could allow attackers to inject and execute malicious code on affected systems. The flaws, tracked as CVE-2025-23264 and CVE-2025-23265, impact all platforms running Megatron-LM versions prior to 0.12.0 and have prompted a swift response from…
-
LLMs hype versus reality: What CISOs should focus on
Tags: ai, attack, backdoor, breach, business, chatgpt, ciso, cloud, control, corporate, cyber, cybercrime, cybersecurity, data, finance, governance, LLM, malware, monitoring, network, open-source, risk, risk-management, sans, service, software, supply-chain, technology, threat, tool, vulnerabilitynot using AI even though there is a lot of over-hype and promise about its capability. That said, organizations that don’t use AI will get left behind. The risk of using AI is where all the FUD is.”In terms of applying controls, rinse, wash, and repeat the processes you followed when adopting cloud, BYOD, and…
-
Akamai proposes tool to defang cryptomining botnets
A new way of thinking: As cyber attacks evolve, it’s important for organizations to have a clear approach to how they want to respond, commented Fernando Montenegro, vice-president and cybersecurity practice lead at The Futurum Group. “That response may be different at the individual organization level when compared to the public response at large. I mention…
-
Black Duck Teams with Arm to Boost EU Cyber Resilience Act Compliance
Software security company Black Duck is ramping up efforts to help organizations comply with the European Cyber Resilience Act (CRA), building on a 20-year partnership with British chip design giant Arm. The collaboration focuses on securing software running on Arm64-based systems, now widely used in hyperscaler and enterprise environments. Since 2005, Black Duck has played…
-
What Water Utilities Need to Know About HMI Security and AI Solutions
Water and Wastewater Systems are increasingly becoming soft targets for sophisticated cyber attackers. A new joint fact sheet from the EPA and CISA puts this threat front and center, warning utilities about the growing risk of internet-exposed Human Machine Interfaces (HMIs). These essential components of water system operations are now being exploited”, especially by state-sponsored…
-
Sicherheitsinfos: Insolvenzen durch Ransomware, Schwachstellen und mehr (Juni 2025)
Momentan stehen eine Menge Sicherheitskameras ungeschützt im Netz. Vor einigen Tagen machte eine Meldung über eine Firmeninsolvenz nach einer Ransomware-Infektion die Runde. Es gibt Sicherheitsvorfälle und Schwachstellen. Kleiner Sammelbeitrag rund um das Thema Cyber-Sicherheit. Sicherheitskameras ungeschützt im Internet Es ist … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/06/25/sicherheitsinfos-insolvenzen-durch-ransomware-juni-2025/
-
Key Cyber Law’s Lapse Could Mute Threat Sharing Nationwide
Congress Faces Pressure to Modernize Cyber Definitions, Safeguards Before Deadline. With the Cybersecurity Information Sharing Act of 2015 set to expire this fall, lawmakers face mounting pressure to update its liability protections and outdated definitions, as experts warn that failure to modernize could undermine public-private threat sharing and weaken national cyber defenses. First seen on…
-
Feds Warn Healthcare Sector of Rising Iranian Cyberthreats
Geopolitical Conflict Involving Iran, Israel, US Ripe for Attacks on Sector. Government authorities are warning of increased risk of Iranian cyber and related threats against healthcare and public health sector organizations – including ransomware, distributed denial-of-service and other attacks related to that nation’s escalated conflicts with Israel and the U.S. First seen on govinfosecurity.com Jump…
-
Zero trust, CLM touted for stronger cyber defense
First seen on scworld.com Jump to article: www.scworld.com/brief/zero-trust-clm-touted-for-stronger-cyber-defense
-
China-Nexus ‘LapDogs’ Network Thrives on Backdoored SOHO Devices
The campaign infected devices in the US and Southeast Asia to build an operational relay box (ORB) network for use as an extensive cyber-espionage infrastructure. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/china-lapdogs-network-backdoored-soho-devices
-
FBI cyber leader: US can’t forget about China’s ‘Typhoon’ groups amid Mideast conflict
Brett Leatherman, head of the FBI’s Cyber Division, told Recorded Future News that U.S. organizations should avoid being “complacent” about Chinese cyberthreats as attention turns to Iran in the short term. First seen on therecord.media Jump to article: therecord.media/china-typhoon-groups-espionage-fbi-cyber-brett-leatherman
-
Bank of America, Netflix, and Microsoft Hacked to Inject Fake Phone Numbers
Jérôme Segura, cybercriminals are exploiting search parameter vulnerabilities to inject fake phone numbers into the legitimate websites of major brands like Apple, Bank of America, Facebook, HP, Microsoft, Netflix, and PayPal. This sophisticated attack, technically termed a >>search parameter injection attack,
-
New DRAT V2 Update Enhances C2 Protocol with Shell Command Execution Capabilities
A new variant of the DRAT remote access trojan (RAT), dubbed DRAT V2, has been uncovered as part of a TAG-140 campaign targeting Indian government entities. This threat actor, believed to overlap with SideCopy and linked to Transparent Tribe (aka APT36), demonstrates a consistent pattern of refining its malware arsenal. TAG-140 Evolves Malware Arsenal The…
-
Anton’s Security Blog Quarterly Q2 2025
Tags: ai, automation, breach, ciso, cloud, cyber, defense, detection, google, governance, guide, metric, office, RedTeam, siem, soc, software, supply-chain, threat, vulnerability, vulnerability-management, zero-trustAmazingly, Medium has fixed the stats so my blog/podcast quarterly is back to life. As before, this covers both Anton on Security and my posts from Google Cloud blog, and our Cloud Security Podcast (subscribe). Top 10 posts with the most lifetime views (excluding paper announcement blogs): Anton’s Alert Fatigue: The Study [A.C.”Š”, “Šwow, this…
-
Cyber insurance premiums drop for first time, report finds
Despite a decline in both premiums and prices, the market continues to be profitable. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/cyber-insurance-premiums-decline-am-best-report/751474/
-
Cyber insurance premiums drop for first time, new report finds
Despite a decline in both premiums and prices, the market continues to be profitable. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/cyber-insurance-premiums-decline-am-best-report/751474/
-
Gonjeshke Darande Hackers Pose as Activists to Infiltrate Iranian Crypto Exchange
Gonjeshke Darande, a cyber threat actor widely suspected to be an Israeli state-sponsored group masquerading as an Iranian opposition hacktivist entity, executed a devastating attack on Nobitex, Iran’s largest cryptocurrency exchange. This high-profile breach resulted in the destruction of US$90 million in cryptocurrencies, which were deliberately sent to invalid wallets embedded with the provocative string…
-
Over 2,000 Devices Compromised by Weaponized Social Security Statement Phishing Attacks
CyberArmor analysts have uncovered a meticulously crafted phishing campaign that has already compromised over 2,000 devices by exploiting the trusted theme of Social Security Administration (SSA) statements. Cybercriminals behind this operation deployed a highly convincing email lure masquerading as an official SSA communication, deceiving users into downloading malicious software. The campaign’s technical sophistication, coupled with…
-
Oh! Canada Added to List of Nations Targeted in Salt Typhoon Telecom Spree
The Canadian Center for Cybersecurity has confirmed that the Chinese state-sponsored cyber-threat actor targeted one of its telecommunications companies in February via a Cisco flaw, as part of global attack wave. First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/canada-targeted-salt-typhoon-telecom
-
Threat Actors Exploit ConnectWise Configuration to Create Signed Malware
Threat actors have increasingly exploited vulnerabilities and configurations in ConnectWise software to distribute signed malware, masquerading as legitimate applications. Initially observed in February 2024 with ransomware attacks linked to vulnerabilities CVE-2024-1708 and CVE-2024-1709, the abuse escalated by March 2025 under the moniker “EvilConwi”. This new wave of attacks leverages ConnectWise’s ScreenConnect tool, manipulating its certificate…
-
Weaponized DMV-Themed Phishing Scam Targets U.S. Citizens to Steal Personal and Financial Data
A highly coordinated phishing campaign impersonating various U.S. state Departments of Motor Vehicles (DMVs) has emerged as a significant threat, targeting citizens across multiple states with the intent to harvest personal and financial data. This sophisticated operation employs SMS phishing, commonly known as smishing, by sending alarming text messages from spoofed numbers that often appear…
-
EagleSpy v5 RAT Promoted by Hacker for Stealthy Android Access
A notorious threat actor known as >>xperttechy
-
Zimbra Classic Web Client Vulnerability Allows Arbitrary JavaScript Execution
A critical security flaw has been discovered and patched in the Zimbra Collaboration Suite (ZCS) Classic Web Client, exposing millions of business users to the risk of arbitrary JavaScript execution through stored cross-site scripting (XSS). Tracked as CVE-2025-27915, this vulnerability affects ZCS versions 9.0, 10.0, and 10.1 prior to the latest patch releases, and is…
-
Critical Convoy Flaw Allows Remote Code Execution on Servers
A critical vulnerability (CVE-2025-52562) in Performave Convoy”, a KVM server management panel widely used by hosting providers”, enables unauthenticated attackers to execute arbitrary code on affected systems. Rated the maximum CVSS score of 10.0, this flaw exposes servers to complete compromise without requiring authentication. Vulnerability Summary According to the Github report, the flaw resides in…
-
NCSC Warns of SHOE RACK Malware Targeting Fortinet Firewalls via DOH SSH Protocols
The National Cyber Security Centre (NCSC) has issued a critical alert regarding a newly identified malware, dubbed SHOE RACK, which has been observed targeting Fortinet firewalls and other perimeter devices. Developed using the Go 1.18 programming language, this malicious software demonstrates a high level of sophistication by leveraging DNS-over-HTTPS (DoH) for command and control (C2)…
-
Cybercriminals left hanging as Victoria’s Secret bounces back
Lingerie giant Victoria’s Secret says that it has restored all of its critical systems and is fully operational again, three weeks after revealing it had been hit by a cyber attack. First seen on grahamcluley.com Jump to article: grahamcluley.com/cybercriminals-left-hanging-as-victorias-secret-bounces-back/
-
Google Cloud Donates A2A Protocol to Linux Foundation for Smarter, Secure Communication
In a landmark move for the artificial intelligence industry, Google Cloud has donated its Agent2Agent (A2A) protocol to the Linux Foundation, marking a significant step toward open, secure, and interoperable communication between AI agents. The announcement was made at the Open Source Summit North America, where the Linux Foundation unveiled the formation of the Agent2Agent…
-
OPPO Clone Phone Vulnerability Leaks Sensitive Data via Weak WiFi Hotspot
A newly disclosed security vulnerability in OPPO’s widely used Clone Phone app has raised significant concerns over user privacy, as it exposes sensitive data through a weakly secured WiFi hotspot. The flaw, cataloged as CVE-2025-27387, has been rated as high severity and was published in the National Vulnerability Database and GitHub Advisory Database within the…