Tag: cyber
-
Scattered Spider Launches Supply Chain Attacks on UK Retail Organizations
Scattered Spider, also known as Roasting 0ktapus and Scatter Swine, has emerged as a formidable threat actor targeting UK retail organizations. Active since May 2022, this financially motivated group has historically focused on telecommunications and business process outsourcing (BPO) sectors but has now shifted its attention to high-leverage industries, including critical infrastructure and retail, particularly…
-
Zoom Workplace Apps Flaws Allow Hackers to Gain Elevated Access
Zoom has released multiple security bulletins addressing seven newly discovered vulnerabilities in Zoom Workplace Apps, with one rated as high severity. All vulnerabilities were disclosed on May 13, 2025, and could potentially allow attackers to escalate privileges through various attack vectors. The most critical flaw involves a Time-of-check Time-of-use (TOCTOU) vulnerability that could lead to…
-
PoC Exploit Published for macOS Sandbox Escape Vulnerability (CVE-2025-31258)
Security researchers have disclosed a new macOS sandbox escape vulnerability tracked as CVE-2025-31258, accompanied by a proof-of-concept (PoC) exploit demonstrating partial sandbox bypass via Apple’s RemoteViewServices framework. The flaw, discovered by researcher wh1te4ever, exposes weaknesses in macOS’s inter-process communication (IPC) mechanisms that could enable attackers to execute arbitrary code outside application sandbox constraints. With the…
-
Four Hackers Caught Exploiting Old Routers as Proxy Servers
U.S. authorities unsealed charges against four foreign nationals accused of operating a global cybercrime scheme that hijacked outdated wireless routers to create malicious proxy networks. Russian nationals Alexey Viktorovich Chertkov (37), Kirill Vladimirovich Morozov (41), Aleksandr Aleksandrovich Shishkin (36), and Kazakhstani Dmitriy Rubtsov (38) face conspiracy and computer crime charges for allegedly profiting from botnets…
-
F5 BIG-IP Vulnerability Allows Remote Command Execution
Critical security vulnerability in F5 BIG-IP systems has been discovered that allows authenticated administrators to execute arbitrary system commands, effectively bypassing security boundaries. Identified as CVE-2025-31644, the command injection flaw affects multiple versions of BIG-IP running in Appliance mode. Security researcher Matei >>Mal
-
India-Pakistan Conflicts Escalating: Military Operations and DDoS Attacks Making Targeted Strikes
Background On May 7, 2025, NSFOCUS Fuying Lab released “Two-Front Confrontation: Parallel Narratives of India-Pakistan Reality Friction and Cyber DDoS Attacks”, which analyzed the DDoS attack activities in the early stage of India-Pakistan friction. This article is the second in this series, mainly analyzing the DDoS attack activities against India after May 7. May 7,…The…
-
CISA’s alert pivot reflects a new era of decentralized cyber threat communication
Tags: access, cisa, ciso, communications, cyber, cybersecurity, email, exploit, incident response, intelligence, kev, monitoring, risk, strategy, threat, tool, update, vulnerabilityFrom centralized alerts to multi-channel intelligence: CISA’s shift means enterprises must now adopt a more proactive approach to gathering threat intelligence. While the agency isn’t reducing the volume of information shared, the distribution model now demands a more decentralized, digitally savvy strategy from recipients.This change empowers organizations to refine how they consume alerts, Varkey said.…
-
Hackers Abuse PyInstaller to Deploy Stealthy macOS Infostealer
Jamf Threat Labs has identified a novel macOS infostealer that exploits PyInstaller, a legitimate open-source tool used to bundle Python scripts into standalone Mach-O executables. This marks the first documented instance of PyInstaller being weaponized to deploy infostealers on macOS, highlighting a sophisticated evolution in the tactics of cybercriminals targeting Apple’s ecosystem. Discovered in April…
-
PupkinStealer Targets Windows Users to Steal Browser Login Credentials
A newly identified information-stealing malware dubbed PupkinStealer has emerged as a significant threat to Windows users, with its first sightings reported in April 2025. Written in C# using the .NET framework, this malicious software is engineered to pilfer sensitive data, including browser credentials, messaging app sessions from platforms like Telegram and Discord, desktop documents, and…
-
Repeated Firmware Key-Management Failures Undermine Intel Boot Guard and UEFI Secure Boot
The security of fundamental technologies like Intel Boot Guard and UEFI Secure Boot has been seriously questioned due to persistent cryptographic key management issues within the UEFI firmware ecosystem, which have been exposed in a number of concerning exposes. These mechanisms, designed to ensure platform integrity by verifying firmware and bootloader signatures, are being critically…
-
INE Security Alert: Top 5 Takeaways from RSAC 2025
Comprehensive Training Platform Delivers Solutions for AI Security, Cloud Management, and Incident Response Readiness. Fresh from a high-impact presence at RSAC 2025, where INE Security welcomed thousands of visitors to its interactive booth at San Francisco’s Moscone Center, the global cybersecurity training and certification provider is addressing some of the top cybersecurity priorities emerging from the industry-leading…
-
CISA Flags Hidden Functionality Flaw in TeleMessage TM SGNL on KEV List
Cybersecurity and Infrastructure Security Agency (CISA) has escalated its advisory for TeleMessage TM SGNL, adding a critical hidden functionality vulnerability (CVE-2025-47729) to its Known Exploited Vulnerabilities (KEV) catalog. This flaw exposes cleartext copies of user messages within the platform’s archiving backend, raising significant concerns for organizations relying on secure communication systems. The disclosure aligns with…
-
Asus One-Click Flaw Exposes Users to Remote Code Execution Attacks
Critical security vulnerability in ASUS DriverHub software has been discovered that allowed attackers to execute arbitrary code with administrator privileges through a simple web visit. Security researcher identified and reported the vulnerability in April 2025, which has since been patched and assigned the CVE identifiers CVE-2025-3462 (8.4) and CVE-2025-3463 (9.4). The exploit chain permitted attackers…
-
M&S Confirms Customer Data Stolen in Cyber-Attack
M&S Chief Executive, Stuart Machin, said that the firm has written to customers to inform them that some personal information was accessed by threat actors First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/ms-customer-data-stolen-attack/
-
CIO des Jahres 2025 jetzt mitmachen und bis Ende Mai bewerben
So sehen Siegerinnen und Sieger aus. Die Gewinnerinnen und Gewinner des vergangenen Jahres jubeln über ihre CIO-des-Jahres-Awards. Machen auch Sie mit und bewerben Sie sich dann stehen Sie vielleicht im Oktober 2025 auf der großen Gala-Bühne und dürfen sich über die renommierteste IT-Auszeichnung Deutschlands freuen. cio.de / Tobias TschepeDie heiße Phase für die Bewerbung um…
-
North Korea Targets Ukraine With Cyberespionage Operations
Tags: cyber, cyberespionage, cybersecurity, hacker, intelligence, korea, north-korea, phishing, risk, ukrainePhishing Campaigns Appear to Be Solely Intelligence-Gathering for DPRK Leadership. North Korea nation-state hackers appear to have entered the Ukrainian cyber operations fray, albeit solely for cyberespionage purposes for gathering intelligence to help North Korean leadership determine the current risk to its forces already in the theater, cybersecurity researchers report. First seen on govinfosecurity.com Jump…
-
Drei Tipps, wie Unternehmen ihre Cyber-Resilienz stärken können
Die überwältigende Mehrheit der Unternehmen (92 Prozent) wird in den kommenden Monaten verstärkt Projekte mit KI oder generativer KI durchführen. Diese Entwicklung bringt einige neue Herausforderungen in der Cyber-Security mit sich First seen on infopoint-security.de Jump to article: www.infopoint-security.de/drei-tipps-wie-unternehmen-ihre-cyber-resilienz-staerken-koennen/a40763/
-
Researchers Uncover Remote IT Job Fraud Scheme Involving North Korean Nationals
The United States indicted fourteen North Korean nationals for orchestrating a sophisticated scheme to secure remote IT jobs at American companies and nonprofits using stolen identities. This operation, which has funneled at least $88 million USD to the North Korean government (DPRK) over the past six years, has raised alarm across industries, with Fortune 500…
-
Attackers Leverage Unpatched Output”¯Messenger 0″‘Day to Deliver Malicious Payloads
A Türkiye-affiliated espionage threat actor, tracked by Microsoft Threat Intelligence as Marbled Dust (also known as Sea Turtle and UNC1326), has been exploiting a zero-day vulnerability in Output Messenger, a popular multiplatform chat software. Identified as CVE-2025-27920, this directory traversal flaw in the Output Messenger Server Manager application allows authenticated attackers to upload malicious files…
-
Cobalt Strike 4.11.1 Released With SSL Checkbox Fix
Cobalt Strike has announced the release of version 4.11.1, an out-of-band update addressing several critical issues discovered in the previous 4.11 release. The update primarily fixes a module stomping issue that could cause system crashes in specific circumstances, resolves problems with the >>Enable SSL
-
M&S says some personal data was taken in cyber-attack
Details taken are names, addresses and Marks & Spencer order histories, the Guardian understands<ul><li><a href=”https://www.theguardian.com/business/live/2025/may/13/uk-wage-growth-slows-payrolls-vacancies-drop-thames-water-mps-us-inflation-business-live-news”>Business live latest updates</li></ul>Marks & Spencer has said for the first time that some personal customer information was taken in the <a href=”https://www.theguardian.com/business/marksspencer”>cyber-attack that has crippled its online operation for more than three weeks.Since the retailer’s IT systems were hit by…
-
Türkiye-Linked Hackers Exploit Output Messenger Zero-Day (CVE-2025-27920) in Espionage Campaign
Microsoft Threat Intelligence has linked a regional cyber-espionage campaign exploiting a zero-day vulnerability in Output Messenger to the First seen on securityonline.info Jump to article: securityonline.info/turkiye-linked-hackers-exploit-output-messenger-zero-day-cve-2025-27920-in-espionage-campaign/
-
Open Source Linux Firewall IPFire 2.29 Core Update 194 Released: What’s New!
IPFire, the powerful open-source firewall, has unveiled its latest release, IPFire 2.29 Core Update 194, packed with security enhancements, performance improvements, and new features to safeguard networks of all sizes. Renowned for its robust feature set, IPFire continues to deliver a secure, high-performance platform focused on usability and reliability. It’s been a month since […]…
-
Can Cybersecurity Keep Up In the AI Arms Race?
New research shows China is quickly catching up with the US in AI innovation. Experts weigh in on what it means for cyber defenders. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/can-cybersecurity-keep-up-ai-arms-race
-
ADN Microsoft CSP Security Week: KI gegen Cyberkriminalität
ADN und Microsoft vermitteln während der ADN Microsoft CSP Security Week von 23. bis 27. Juni 2025 in insgesamt 16 Sessions das notwendige Knowhow, mit dem Partner ihre Kunden gegen Cyber-Risiken absichern können. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/adn-microsoft-csp-security-week-ki-gegen-cyberkriminalitaet/a40735/
-
Ransomware Reloaded Warum 2025 das bisher gefährlichste Jahr werden wird
Am 12. Mai findet der Anti-Ransomware-Tag statt, eine von Interpol und Kaspersky ins Leben gerufene globale Sensibilisierungsinitiative, die an eine der erfolgreichsten Cyber-Attacken der Geschichte erinnert: die WannaCry-Attacke im Jahr 2017. Innerhalb weniger Stunden fegte die Ransomware-Kampagne über den Globus, legte Krankenhäuser in Großbritannien lahm, stoppte Produktionsstraßen und unterbrach wichtige Dienste auf fast allen Kontinenten.…
-
Threat Actors Leverage DDoS Attacks as Smokescreens for Data Theft
Distributed Denial of Service (DDoS) attacks, once seen as crude tools for disruption wielded by script kiddies and hacktivists, have undergone a sophisticated transformation in today’s complex, hybrid-cloud environments. No longer just blunt instruments aimed at overwhelming systems, DDoS attacks are increasingly being deployed as strategic smokescreens to mask more insidious breaches. Recent data indicates…
-
20-Year-Old Proxy Botnet Network Dismantled After Exploiting 1,000 Unpatched Devices Each Week
A 20-year-old criminal proxy network has been disrupted through a joint operation involving Lumen’s Black Lotus Labs, the U.S. Department of Justice, the Federal Bureau of Investigation (FBI), and the Dutch National Police. This botnet, operational since 2004 according to its own claims, exploited an average of 1,000 unique Internet of Things (IoT) and end-of-life…
-
“PupkinStealer” .NET Malware Steals Browser Data and Exfiltrates via Telegram
A new information-stealing malware dubbed “PupkinStealer” has emerged as a significant threat to individuals and enterprises. Developed in C# using the .NET framework, this 32-bit GUI-based Windows executable targets sensitive user data with a focused and efficient approach. First observed in April 2025, PupkinStealer is designed to harvest a specific range of data, including browser…