Tag: cyber
-
Cyberattacke auf Dienstgeräte des Landratsamt Bodenseekreis
Aufgrund einer Cyberattacke sind aktuell alle Diensthandys und Tablets des Landratsamt Bodenseekreis außer Betrieb.Nach Angaben des Landratsamt Bodenseekreis haben Hacker kürzlich Diensthandys und weitere Mobilgeräte der Verwaltung angegriffen. Demnach sind die Täter über eine Schwachstelle in einem Programm zur Systemverwaltung der Geräte eingedrungen. Nachdem der Angriff entdeckt wurde, habe die IT-Abteilung sofort reagiert und die…
-
NETGEAR Router Flaw Allows Full Admin Access by Attackers
Tags: access, authentication, backdoor, control, cyber, exploit, firmware, flaw, router, vulnerabilityA severe authentication bypass vulnerability (CVE-2025-4978) has been uncovered in NETGEAR’s DGND3700v2 wireless routers, enabling unauthenticated attackers to gain full administrative control over affected devices. The flaw, rated with a critical CVSSv4 score of 9.3, stems from a hidden backdoor mechanism in the router’s firmware and impacts versions V1.1.00.15_1.00.15NA. Security researchers warn that exploitation could…
-
Winos 4.0 Malware Masquerades as VPN and QQBrowser to Target Users
A sophisticated malware campaign deploying Winos 4.0, a memory-resident stager, has been uncovered by Rapid7, targeting users through fake installers of popular software like LetsVPN and QQBrowser. Initially detected during a February 2025 Managed Detection and Response (MDR) investigation, this operation employs a multi-layered infection chain dubbed the Catena loader. It uses trojanized NSIS installers…
-
ViciousTrap Hackers Breaches 5,500+ Edge Devices from 50+ Brands, Turns Them into Honeypots
A sophisticated cyber threat actor, dubbed ViciousTrap by Sekoia.io’s Threat Detection & Research (TDR) team, has compromised over 5,500 edge devices across more than 50 brands, transforming them into a massive honeypot-like network. This alarming operation, detailed in Sekoia.io’s latest investigation, targets a wide array of internet-facing equipment, including Small Office/Home Office (SOHO) routers, SSL…
-
Operation Endgame Crushes DanaBot Malware, Shuts Down 150 C2 Servers and Halts 1,000 Daily Attacks
Operation Endgame II has delivered a devastating strike against DanaBot, a notorious malware that has plagued systems since its emergence in 2018. Initially designed as a banking trojan targeting financial credentials, DanaBot evolved into a multi-purpose threat, facilitating information theft and enabling secondary attacks like ransomware through payloads such as Latrodectus. At its peak in…
-
Inside LockBit: Data Leak Reveals Leading Affiliates and How They Operate
A massive data leak from the LockBit ransomware group, published on its hijacked leak site, has provided an unprecedented glimpse into the inner workings of one of the most notorious Ransomware-as-a-Service (RaaS) operations. The leaked data, spanning from December 19, 2024, to April 29, 2025, primarily pertains to the group’s “LockBit Lite” panel a lower-tier…
-
Apple XNU Kernel Flaw Enables Attackers to Escalate Privileges
Apple has released urgent security patches addressing CVE-2025-31219, a high-severity vulnerability in its XNU kernel that underpins macOS, iOS, iPadOS, tvOS, watchOS, and visionOS. The flaw, which carries a CVSS score of 8.8 (vector: AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), enables local attackers to escalate privileges and potentially execute arbitrary code with kernel-level access. The vulnerability was discovered by Michael…
-
Russian Hacker Indicted Over $24 Million Qakbot Ransomware Operation
The U.S. Department of Justice has unsealed a federal indictment against Rustam Rafailevich Gallyamov, 48, of Moscow, Russia, alleging he led the development and deployment of the notorious Qakbot malware. This action, announced on May 22, 2025, marks a significant milestone in a years-long multinational effort to disrupt cybercriminal networks that have inflicted hundreds of…
-
Critical infrastructure under attack: Flaws becoming weapon of choice
Tags: access, attack, authentication, breach, china, citrix, communications, control, cve, cyber, cybersecurity, dark-web, data-breach, defense, exploit, flaw, fortinet, government, group, hacker, healthcare, ibm, identity, incident, infrastructure, intelligence, iran, kev, login, mfa, monitoring, moveIT, network, ransomware, risk, service, software, strategy, supply-chain, threat, update, vpn, vulnerability, zero-dayTrade in exploit code: IBM’s X-Force found four of the 10 most mentioned common vulnerabilities and exposures (CVEs) on the dark web were linked to sophisticated threat actor groups, including nation-state intelligence agencies.”Exploit codes for these CVEs were openly traded on numerous forums, fueling a growing market for attacks against power grids, health networks, and…
-
Fortinet Zero-Day Under Attack: PoC Now Publicly Available
Tags: advisory, api, attack, cve, cyber, flaw, fortinet, remote-code-execution, vulnerability, zero-dayFortiGuard Labs released an urgent advisory detailing a critical vulnerability, CVE-2025-32756, affecting several Fortinet products, including FortiCamera, FortiMail, FortiNDR, FortiRecorder, and FortiVoice. The vulnerability is a stack-based buffer overflow located within the administrative API, specifically in the handling of session cookies. This flaw allows for unauthenticated remote code execution, making it a prime target for…
-
Optimistic Security: A New Era for Cyber Defense
Why Optimistic Cybersecurity? Ever wondered how evolving technology could help fortify your entity against cyber threats? Well, this might be the perfect time to introduce the concept of Optimistic Cybersecurity, an innovative approach that’s transforming the perspective of many industries, especially those that operate. Implementing high security standards is no longer an afterthought but a……
-
Global Crackdown Nets 270 Dark Web Vendors in Major Arrests
A sweeping international crackdown, codenamed Operation RapTor, has dealt a significant blow to the criminal underworld operating on the dark web. Coordinated by Europol and involving agencies across four continents, the operation resulted in the arrest of 270 individuals involved in trafficking drugs, weapons, counterfeit goods, and illicit services. This marks one of the largest…
-
CISA Alerts on Threat Actors Targeting Commvault Azure App to Steal Secrets
Tags: advisory, backup, cisa, cloud, cyber, cybersecurity, data, exploit, infrastructure, microsoft, service, software, threat, vulnerability, zero-dayOn May 22, 2025, Commvault, a leading enterprise data backup provider, issued an urgent advisory regarding active cyber threat activity targeting its Metallic software-as-a-service (SaaS) application, which is hosted in the Microsoft Azure cloud environment. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed that threat actors exploited a zero-day vulnerability (CVE-2025-3928) in Commvault’s web…
-
Recalibrating Risk in the Age of AI
Gigamon 2025 Survey: 17% Increase in Attacks as Public Cloud Vulnerabilities Mount AI is transforming enterprise landscape, organizations report a 17% jump in cyber breaches over the past year. Security teams struggle with visibility gaps while adversaries weaponize AI to strike harder and faster, according to the Gigamon 2025 Hybrid Cloud Security Survey. First seen…
-
CISA Warns of Suspected Broader SaaS Attacks Exploiting App Secrets and Cloud Misconfigs
Tags: attack, backup, cisa, cloud, cyber, cybersecurity, exploit, infrastructure, microsoft, monitoring, saas, service, software, threatThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday revealed that Commvault is monitoring cyber threat activity targeting applications hosted in their Microsoft Azure cloud environment.”Threat actors may have accessed client secrets for Commvault’s (Metallic) Microsoft 365 (M365) backup software-as-a-service (SaaS) solution, hosted in Azure,” the agency said.”This First seen on thehackernews.com Jump to…
-
Coca-Cola, Bottling Partner Named in Separate Ransomware and Data Breach Claims
Coca-Cola and its bottling partner CCEP targeted in separate cyber incidents, with the Everest ransomware gang and the Gehenna hacking group claiming data breaches involving sensitive employee and CRM data. First seen on hackread.com Jump to article: hackread.com/coca-cola-bottling-partner-ransomware-data-breach/
-
Rackspace and Rubrik Roll Out Managed Cyber Recovery Service for Public Cloud Environments
First seen on scworld.com Jump to article: www.scworld.com/news/rackspace-and-rubrik-roll-out-managed-cyber-recovery-service-for-public-cloud-environments
-
Live Network Traffic Analysis: The Shockwave That Warns Before the Cyber Tsunami
First seen on scworld.com Jump to article: www.scworld.com/native/live-network-traffic-analysis-the-shockwave-that-warns-before-the-cyber-tsunami
-
German Cyber Agency Sounds Warning on Grid Vulnerabilities
BSI Cites New Technologies, Geopolitical Tensions as Key Risk Factors. Mounting decentralization and digitization put electricity grids at risk of hacking that could cause power outages, the German cybersecurity agency warned Wednesday. Technologies such as internet-connected solar power inverters and a tense geopolitical situation sparks increased concern. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/german-cyber-agency-sounds-warning-on-grid-vulnerabilities-a-28461
-
CefSharp Enumeration Tool Identifies Critical Security Issues in .NET Desktop Applications
Cybersecurity researchers and red teamers, a newly released tool named CefEnum is shedding light on critical security flaws in .NET-based desktop applications leveraging CefSharp, a lightweight wrapper around the Chromium Embedded Framework (CEF). CefSharp enables developers to embed Chromium browsers within .NET applications, facilitating the creation of web-based thick-clients for Windows environments. However, as detailed…
-
Russian Hackers Exploit Oracle Cloud Infrastructure to Target Scaleway Object Storage
Russian threat actors have been leveraging trusted cloud infrastructure platforms like Oracle Cloud Infrastructure (OCI) Object Storage and Scaleway Object Storage to propagate sophisticated attacks using the Lumma Stealer malware. This malware-as-a-service (MaaS) infostealer, also known as LummaC2 Stealer, targets Windows systems to siphon credentials, system data, and cryptocurrency wallets. Investigations conducted in 2025 reveal…
-
How Identity Plays a Part in 5 Stages of a Cyber Attack
Tags: access, attack, authentication, breach, cloud, computer, container, control, credentials, cyber, data, data-breach, detection, endpoint, exploit, group, iam, identity, intelligence, malicious, malware, mfa, microsoft, monitoring, password, powershell, ransomware, risk, technology, threat, tool, vulnerabilityWhile credential abuse is a primary initial access vector, identity compromise plays a key role in most stages of a cyber attack. Here’s what you need to know, and how Tenable can help. Identity compromise plays a pivotal role in how attackers move laterally through an organization. Credential abuse is the top initial access vector,…
-
Critical Vulnerability in Netwrix Password Manager Enables Authenticated Remote Code Execution
A critical security vulnerability has been discovered in Netwrix Password Secure, a widely used enterprise password management solution, potentially allowing authenticated attackers to execute remote code on other users’ systems. Identified in versions up to 9.2.2, including the specific build 9.2.0.32454 for both client (PSC) and server (PSS) components, this flaw poses a significant risk…
-
Halo Security Achieves SOC 2 Type 1 Compliance, Validating Security Controls for Its Attack Surface Management Platform
Halo Security, a leading provider of attack surface management and penetration testing services, today announced it has successfully achieved SOC 2 Type 1 compliance following a comprehensive audit by Insight Assurance. This certification validates that Halo Security’s security controls and practices are properly designed and implemented to meet the SOC 2 trust principles. >>Security isn’t a destination; it’s…
-
Cityworks Zero-Day Vulnerability Used by UAT-638 Hackers to Infect IIS Servers with Shell Malware
Cisco Talos has uncovered active exploitation of a zero-day remote-code-execution vulnerability, identified as CVE-2025-0994, in Cityworks, a widely used asset management system. This critical flaw has been leveraged by a group tracked as UAT-6382, assessed with high confidence to be Chinese-speaking threat actors, to target enterprise networks of local governing bodies in the United States…
-
Researchers Warn of ‘Smiao Network’ Cyber Threat Against Taiwan’s Federal Staff
The Foundation for Defense of Democracies (FDD) and cybersecurity firm TeamT5 has exposed an intricate Chinese intelligence operation, dubbed the ‘Smiao Network,’ targeting federal workers in both the United States and Taiwan. This network, linked to the Chinese technology company Smiao Intelligence, employs deceptive online recruitment schemes to extract sensitive information from high-value professionals. Initially…
-
Hackers Deploy Weaponized npm Packages to Target React and Node.js JavaScript Frameworks
Socket’s Threat Research Team, a series of malicious npm packages have been found lurking in the JavaScript ecosystem for over two years, amassing more than 6,200 downloads. These weaponized packages, targeting popular frameworks like React, Vue.js, Vite, Node.js, and the Quill Editor, were crafted by a threat actor under the npm alias >>xuxingfeng
-
Kettering Health Cyber-Attack Disrupts Services
Kettering Health is facing significant disruptions from a cyber-attack that impacted patient care First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/kettering-health-cyber-attack/
-
Senators revive bill to harmonize conflicting cybersecurity regulations
The legislation Sens. Gary Peters and James Lankford would create an executive branch panel to align federal cyber rules. First seen on cyberscoop.com Jump to article: cyberscoop.com/senators-revive-bill-to-harmonize-conflicting-cybersecurity-regulations/