Tag: cyber
-
Chinese APT Hackers Target Organizations Using Korplug Loaders and Malicious USB Drives
Advanced persistent threat (APT) groups with ties to China have become persistent players in the cyber espionage landscape, with a special emphasis on European governmental and industrial entities, according to a thorough disclosure from ESET’s APT Activity Report for Q4 2024 to Q1 2025. The report, covering activities from October 2024 to March 2025, highlights…
-
Cache Timing Techniques Used to Bypass Windows 11 KASLR and Reveal Kernel Base
Cache timing side-channel attacks have been used to circumvent Kernel Address Space Layout Randomization (KASLR) on fully updated Windows 11 PCs, which is a startling discovery for cybersecurity aficionados and Windows kernel developers. KASLR, a critical security mechanism, randomizes the memory location of the kernel base to thwart exploitation attempts. However, as detailed in a…
-
New Feature: CIS IG Level Controls – Kovrr Blog
Articles related to cyber risk quantification, cyber risk management, and cyber resilience. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/05/new-feature-cis-ig-level-controls-kovrr-blog/
-
S. Dakota CIO Gottumukkala Signs on as CISA Deputy Director
The addition is an important hire for the No. 2 position at the cyber agency. The main director role remains unfilled post-Easterly, with Bridget Bean taking over acting duties for now. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/gottumukkala-cisa-deputy-director
-
Hackers Exploit AutoIT Scripts to Deploy Malware Targeting Windows Systems
Cybersecurity researchers have unearthed a sophisticated attack leveraging AutoIT, a long-standing scripting language known for its deep integration with Windows operating systems. Often compared to .NET for its persistence in malicious campaigns, AutoIT’s simplicity and ability to interact with Windows components make it a favored tool among cybercriminals. This weekend, a particularly intricate malware delivery…
-
Legal Aid Agency breach may encompass millions of people
Legal Aid Agency says the data of anybody who applied for legal aid over the past 15 years has been compromised in a cyber attack First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366623844/Legal-Aid-Agency-breach-may-encompass-millions-of-people
-
New Report Finds 67% of Organizations Experienced Cyber Attacks in the Last Year
A disturbing 67% of businesses in eight worldwide markets”, the US, UK, Spain, the Netherlands, Germany, France, Belgium, and Ireland”, reported having experienced cyberattacks in the previous 12 months, according to the 2024 Hiscox Cyber Readiness Report. This marks the fourth consecutive year of rising attack prevalence, up from 53% in prior reports, aligning with…
-
How to protect your data after a cyber-attack
What to do you if you’re worried your information may have fallen into the wrong handsAnother cyber-attack has hit the headlines this one involving the personal data of <a href=”https://www.theguardian.com/law/2025/may/19/significant-amount-of-personal-data-accessed-in-legal-aid-agency-data-breach-says-moj”>hundreds of thousands of legal aid applicants in England and Wales.It comes hard on the heels of recent cyber-attacks that caused huge disruption at <a href=”https://www.theguardian.com/business/marksspencer”>Marks…
-
Federal cyber workforce training institute eyed in bipartisan House bill
The legislation comes amid DOGE-fueled cuts to CISA and warnings from lawmakers that Trump administration policies will cripple federal cyber recruiting. First seen on cyberscoop.com Jump to article: cyberscoop.com/federal-cyber-workforce-training-house-bill/
-
Active Exploitation of Ivanti EPMM Zero-Day Vulnerability in the Wild
Tags: cve, cyber, exploit, ivanti, monitoring, remote-code-execution, threat, vulnerability, zero-daySecurity researchers at The Shadowserver Foundation have identified active exploitation attempts targeting a critical zero-day vulnerability in Ivanti’s Enterprise Mobility Management (EPMM) platform. The vulnerability, tracked as CVE-2025-4427, can be chained with CVE-2025-4428 to achieve remote code execution (RCE), posing a significant threat to unpatched systems. Recent monitoring shows a concerning number of vulnerable instances…
-
Investigating Cobalt Strike Beacons Using Shodan: A Researcher’s Guide
Security researcher has revealed a robust method for gathering threat intelligence on Cobalt Strike beacons using Shodan and PowerShell, filling the gap left by the popular @cobaltstrikebot Twitter account that went offline in June 2023. The technique allows security professionals to independently collect valuable configuration data from active Cobalt Strike servers, specifically focusing on beacon…
-
Volkswagen Car Hack Exposes Owner’s Personal Data and Service Records
Tech-savvy Volkswagen owner has uncovered critical security flaws in the My Volkswagen app that potentially exposed sensitive personal data and vehicle information of thousands of customers. The vulnerabilities, which have since been patched, allowed anyone with access to a vehicle’s VIN number to retrieve comprehensive owner data, service records, and potentially control connected features without…
-
Hearing shows broad support for extension of cyber info-sharing law
With bipartisan support and backing from the private sector, the 2015 law appears to be on a glide path to reauthorization. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/cisa-cyber-information-sharing-hearing-congress-industry-privacy/748361/
-
Ekco bolsters cyber testing with Predatech buy
Managed security services provider hits the M&A trail to extend its options and UK coverage First seen on computerweekly.com Jump to article: www.computerweekly.com/microscope/news/366624132/Ekco-bolsters-cyber-testing-with-Predatech-buy
-
Google Reveals Hackers Targeting US Following UK Retailer Attacks
The Google Threat Intelligence Group (GTIG) recently revealed that the well-known hacker collective UNC3944, which also overlaps with the widely publicized Scattered Spider, is a persistent and dynamic cyberthreat. Initially focused on telecommunications for SIM swap operations, UNC3944 has since pivoted to ransomware and data theft extortion tactics since early 2023, casting a wider net…
-
Skitnet Malware Employs Stealth Techniques to Execute Payload and Maintain Persistence Techniques
A new and highly sophisticated multi-stage malware, known as Skitnet (or Bossnet), has been uncovered, showcasing advanced stealth techniques to execute its malicious payload and maintain persistent access on infected systems. Developed by the threat group LARVA-306, Skitnet has been actively sold on underground forums like RAMP since April 19, 2024, with its creators offering…
-
We’re Answering Your Exposure Management Questions
Each Monday, the Tenable Exposure Management Academy provides the practical, real-world guidance you need to shift from vulnerability management to exposure management. In this Exposure Management Academy FAQ, we help CISOs understand exposure management, look at how advanced you might be and outline how to structure a program. You can read the entire Exposure Management…
-
Japan passed a law allowing preemptive offensive cyber actions
Japan passed a law allowing preemptive offensive cyber actions, shifting from its pacifist stance to bolster defenses like major Western powers. Japan has enacted the Active Cyberdefense Law, allowing preemptive offensive cyber operations to counter threats before damage occurs. This marks a shift from Japan’s pacifist stance under Article 9, aiming to elevate its cyber…
-
SolarWinds security chief on the risks and rewards of being a CISO
At the RSA Conference in San Francisco this year, Tim Brown talked about the protection CISOs need, Russia’s continued attempts to launch attacks and how companies can navigate the treacherous waters of cyber incidents. First seen on therecord.media Jump to article: therecord.media/solarwinds-security-chief-tim-brown-interview
-
CISA Defends Critical Infrastructure With Early Cyber Alerts
Executive Director Bridget Bean on How Proactive Alerts Prevented $8.7B in Damages. As state-sponsored threats become increasingly aggressive, CISA is scaling its proactive cyber defense efforts. Through real-time threat intelligence, joint task forces and pre-emptive alerts, it is shielding critical infrastructure from state-sponsored and ransomware-driven attacks. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/cisa-defends-critical-infrastructure-early-cyber-alerts-a-28426
-
Hackers Exploit RVTools to Deploy Bumblebee Malware on Windows Systems
A reliable VMware environment reporting tool, RVTools, was momentarily infiltrated earlier this week on May 13, 2025, to disseminate the sneaky Bumblebee loader virus, serving as a sobering reminder of the vulnerabilities present in software supply chains. This incident, detected by a security operations team through a high-confidence alert from Microsoft Defender for Endpoint, revealed…
-
Confluence Servers Under Attack: Hackers Leverage Vulnerability for RDP Access and Remote Code Execution
Tags: access, attack, breach, cve, cyber, data-breach, exploit, flaw, hacker, injection, network, remote-code-execution, threat, vulnerabilityThreat actors exploited a known vulnerability, CVE-2023-22527, a template injection flaw in Atlassian Confluence servers exposed to the internet. This exploit facilitated remote code execution (RCE), enabling attackers to gain initial access and establish a foothold within targeted networks. The breach, first detected through network traffic from IP address 45.227.254.124 running a >>whoami
-
New ModiLoader Malware Campaign Targets Windows PCs, Harvesting User Credentials
AhnLab Security Intelligence Center (ASEC) has recently uncovered a malicious campaign distributing ModiLoader (also known as DBatLoader) malware through phishing emails. These emails, crafted in Turkish and impersonating a Turkish bank, urge recipients to open a malicious attachment under the guise of checking their transaction history. Inside the compressed RAR file lies a BAT script…
-
Health Care Data Breach Costs BreachForums Admin $700,000 Fine
Conor Brian Fitzpatrick, the 22-year-old former administrator of cybercrime forum Breachforums, will forfeit approximately $700,000 to settle a civil lawsuit stemming from a healthcare data breach. The settlement marks a rare instance where a cybercriminal’s assets will directly compensate victims of a data breach. Fitzpatrick, known online as >>Pompompurin,
-
Critical Firefox 0-Day Flaws Allow Remote Code Execution
Mozilla has urgently patched two critical 0-day vulnerabilities in its popular web browser Firefox, both of which could allow remote attackers to execute malicious code on user systems. The flaws, tracked as CVE-2025-4918 and CVE-2025-4919, were disclosed on May 17, 2025, and are addressed in Firefox version 138.0.4. Security experts are strongly advising all users…
-
CISA to Stop Publishing Cybersecurity Alerts and Advisories on Webpages
Cybersecurity and Infrastructure Security Agency (CISA) has announced significant changes to how it communicates cybersecurity updates and guidance to stakeholders. In a recent announcement, CISA revealed plans to shift away from listing advisories on its webpage to focus on more direct communication channels. However, following community feedback, the agency has temporarily paused these changes while…
-
Pwn2Own Day 3: Zero-Day Exploits Windows 11, VMware ESXi, and Firefox
The Pwn2Own Berlin 2025 last day ended with impressive technological accomplishments, bringing the total prize money over one million dollars. Security researchers demonstrated sophisticated exploitation techniques against high-profile targets including Windows 11, VMware ESXi, and Mozilla Firefox, revealing critical zero-day vulnerabilities that vendors must now address. The three-day hacking competition showcased 28 unique zero-day vulnerabilities,…