Tag: cyber
-
RansomHub Ransomware Group Hits 84 Organizations as New Threat Actors Emerge
The RansomHub ransomware group has emerged as a significant danger, targeting a wide array of industries across the globe. In March 2025, this group alone managed to compromise 84 organizations, while new groups like Arkana and CrazyHunter have introduced sophisticated tools and strategies to intensify ransomware attacks. Sophistication in Attack Methods Ransomware groups in March…
-
Threat Actors Manipulate Search Results to Lure Users to Malicious Websites
Cybercriminals are increasingly exploiting search engine optimization (SEO) techniques and paid advertisements to manipulate search engine results, pushing malicious websites to the top where unsuspecting users are likely to click. In recent years, this tactic, often known as SEO poisoning or black hat SEO, has seen cybercriminals hijack the reputation of legitimate websites to promote…
-
Hackers Imitate Google Chrome Install Page on Google Play to Distribute Android Malware
Cybersecurity experts have unearthed an intricate cyber campaign that leverages deceptive websites posing as the Google Play Store to distribute Android malware. These websites, hosted on newly registered domains, create a façade of credible application installation pages, enticing victims with downloads that appear legitimate, including apps like Google Chrome. The sites are engineered with features…
-
HelloKitty Ransomware Returns, Launching Attacks on Windows, Linux, and ESXi Environments
Security researchers and cybersecurity experts have recently uncovered new variants of the notorious HelloKitty ransomware, signaling its resurgence with attacks targeting Windows, Linux, and ESXi environments. HelloKitty ransomware, initially appearing in October 2020 as a fork of DeathRansom, has evolved significantly in its encryption methods. The ransomware now embeds an RSA-2048 public key, which is…
-
Ivanti 0-Day RCE Flaw Exploitation Details Revealed
Tags: cyber, cybersecurity, exploit, flaw, ivanti, rce, remote-code-execution, vulnerability, zero-dayA critical unauthenticated Remote Code Execution (RCE) vulnerability, CVE-2025-22457, has been disclosed by Ivanti, sparking concerns across the cybersecurity industry. The flaw, which affects several Ivanti products, allows attackers to execute arbitrary code remotely, potentially compromising sensitive enterprise environments. Researchers, including the Rapid7 vulnerability team, have provided a detailed breakdown of how the flaw was exploited and what…
-
Microsoft Issues Urgent Patch to Fix Office Update Crash
Microsoft has released an urgent patch for Office 2016 to address a critical issue causing key applications like Word, Excel, and Outlook to crash unexpectedly. The new update, KB5002623, was issued on April 10, 2025, following widespread reports of performance disruptions attributed to the earlier KB5002700 update. This latest patch applies exclusively to the Microsoft…
-
Jenkins Docker Vulnerability Allows Hackers to Hijack Network Traffic
A newly disclosed vulnerability affecting Jenkins Docker images has raised serious concerns about network security. The vulnerability, stemming from the reuse of SSH host keys, could allow attackers to impersonate Jenkins build agents and hijack sensitive network traffic. Vulnerability Details The core issue arises from the way SSH host keys are automatically generated during image…
-
Nakasone on Cyber Command, NSA firings and the future of the ‘dual-hat’ relationship
Tags: cyberNakasone said he didn’t know “what really occurred” and has not spoken to either Haugh or Noble since the presidential decisions were made, but he lauded both of them as “extraordinary leaders.” First seen on therecord.media Jump to article: therecord.media/nakasone-cyber-command-nsa-firings-dual-hat-section-702
-
Google bets on unifying security tools to ease CISO pain
At Google Cloud Next in Las Vegas, Google launches its Unified Security platform with the goal of bringing together disparate security solutions to help cyber leaders and practitioners address their most keenly felt pain points First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366622474/Google-bets-on-unifying-security-tools-to-ease-CISO-pain
-
How BluOcean Cyber Revolutionized SaaS Security and Risk Management
Learn how BluOcean overcame its client’s challenges with SaaS misconfigurations and how AppOmni’s SaaS security platform helped build a scalable, proactive SaaS security program. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/04/how-bluocean-cyber-revolutionized-saas-security-and-risk-management/
-
Shuckworm Group Leverages GammaSteel Malware in Targeted PowerShell Attacks
The Russia-linked cyber-espionage group known as Shuckworm (also identified as Gamaredon or Armageddon) has been observed targeting a Western country’s military mission located within Ukraine, employing an updated, PowerShell-based version of its GammaSteel infostealer malware. This campaign, which began in late February 2025 and continued into March, signifies Shuckworm’s persistent focus on Ukrainian entities and…
-
ViperSoftX Malware Spreads Through Cracked Software, Targeting Unsuspecting Users
AhnLab Security Intelligence Center (ASEC) has unearthed a complex cyber campaign in which attackers, suspected to be Arabic speakers, have been distributing ViperSoftX malware to unsuspecting Korean users. This operation has employed cracked software and torrents as vectors for spreading this dangerous malware, which often disguises itself as legitimate programs. The exact method through which…
-
Google Introduces A2A Protocol, Empowering AI Agents to Team Up and Automate Workflows
Google Cloud announced the launch of a pioneering open protocol named Agent2Agent (A2A), aiming to revolutionize how AI agents interact and automate complex enterprise workflows. Developed in collaboration with over 50 technology partners including Atlassian, Box, Cohere, and Salesforce, A2A promises to facilitate seamless agent-to-agent communication, task management, and collaboration. A2A is designed to overcome…
-
GOFFEE Deploys PowerModul in Coordinated Strikes on Government and Energy Networks
The threat actor known as GOFFEE has launched a series of targeted attacks against critical sectors within the Russian Federation, utilizing advanced malware and phishing techniques. The group’s latest campaign involves the deployment of PowerModul, a PowerShell-based implant, to escalate their intrusion capabilities and carry out coordinated strikes effectively. PowerModul and Initial Infection Vectors PowerModul…
-
RansomHub RaaS in Disarray After Affiliate Chat Access Suddenly Revoked
RansomHub, a leading Ransomware-as-a-Service (RaaS) group that emerged in early 2024, has found itself grappling with internal turmoil. The instability came to light on April 1st, 2025, when several of its client chat portals, critical for ransomware negotiations, went offline, signaling potential internal strife. Affiliate Confusion and Infrastructure Breakdown RansomHub’s affiliates, who had been promised…
-
The State of AI Malware and Defenses Against It
AI has recently been added to the list of things that keep cybersecurity leaders awake. The increasing popularity of and easy access to large language models (LLMs), such as ChatGPT, DeepSeek, and Gemini, have enabled threat actors to scale and personalize their attacks. Organizations need to adapt their cyber defenses based on this trend. But…
-
Sapphire Werewolf Upgrades Arsenal With Amethyst Stealer Targeting Energy Firms
Sapphire Werewolf has introduced a potent new weapon into its cyber arsenal, unveiling the latest iteration of the Amethyst stealer in a calculated phishing attack against an energy firm. According to the Report, the operation cunningly disguises a malicious payload as a mundane HR memo. The threat actor begins its attack with a fraudulent email,…
-
Malicious ‘mParivahan’ App Circulates on WhatsApp, Skimming Sensitive Mobile Data
A new variant of the fake NextGen mParivahan app has emerged, exploiting the trust users place in official government notifications to distribute malware. This malicious software is distributed through seemingly legitimate traffic violation alerts via WhatsApp, luring victims into installing what they believe is the official app. Infection Vector and Deceptive Tactics The malware spreads…
-
Rogue Account”‘Creation Flaw Leaves 100″¯K WordPress Sites Exposed
A severe vulnerability has been uncovered in the SureTriggers WordPress plugin, which could leave over 100,000 websites at risk. The issue, discovered by security researcher mikemyers, allows attackers to create rogue administrative users on sites where the plugin is not properly configured. Vulnerability Details This critical flaw, registered as CVE-2025-3102, is rooted in the plugin’s…
-
A Seven”‘Year”‘Old Cisco Flaw Now Lets Hackers Execute Code Remotely on Network Gear
Tags: cisco, credentials, cyber, data-breach, exploit, firmware, flaw, hacker, infrastructure, network, router, service, theft, threatA Cisco’s Smart Install protocol (CVE-2018-0171), first patched in 2018, remains a pervasive threat to global network infrastructure due to widespread misconfigurations and exploitation by state-sponsored threat actors. The flaw allows unauthenticated attackers to execute arbitrary code on Cisco switches and routers via exposed Smart Install Client services, enabling configuration theft, credential harvesting, and firmware…
-
Cyber experts offer lukewarm praise for voluntary code governing use of commercial hacking tools
The Pall Mall Process guidelines for nations could be useful, they said, but have obvious limitations. First seen on cyberscoop.com Jump to article: cyberscoop.com/pall-mall-process-global-cybersecurity-code-conduct-commercial-hacking-tools/
-
SonicWall Patches Multiple Vulnerabilities in NetExtender Windows Client
SonicWall has issued a critical alert concerning multiple vulnerabilities discovered in its NetExtender Windows client. These vulnerabilities, identified via several Common Vulnerabilities and Exposures (CVEs), could allow malicious actors to exploit privilege management flaws, trigger local privilege escalation, or manipulate file paths. Users are urged to update their software immediately to mitigate potential risks. Overview…
-
Dell Alerts Users to Critical PowerScale OneFS Flaws Enabling Account Takeover
Dell Technologies has issued an urgent security advisory to its users, warning of several critical vulnerabilities in its PowerScale OneFS operating system. These flaws, if exploited, could allow attackers to take over high-privileged user accounts, bypass authorization controls, and disrupt system operations. The vulnerabilities, tracked under multiple CVEs, range in severity and attack vectors. They…
-
Over 40% of UK Businesses Faced Cybersecurity Breaches in 2024
The Cyber Security Breaches Survey 2025 has been released by the UK Home Office and DSIT today, reporting a slight decline in incidents compared to 2024 report First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/40-uk-businesses-face-breaches/
-
CISA under review: Trump memo spurs scrutiny and uncertainty
Risks public-private collaboration: The directive is likely to have ripple effects on the cybersecurity community as well.CISA has, over the past few years, carved out a critical role as the convening point for public-private cyber collaboration. The agency has been central to fostering trust between federal authorities and private sector entities, especially in areas like…
-
Cable: Powerful Post-Exploitation Toolkit for Active Directory Attacks
Cybersecurity researchers are raising alarms about Cable, a potent open-source post-exploitation toolkit designed to exploit Active Directory (AD) vulnerabilities. With 298 GitHub stars and 33 forks since its release, this .NET-based tool is rapidly gaining traction among threat actors for its precision in reconnaissance and privilege escalation. Overview of Cable’s Capabilities Developed as a learning project…
-
US Comptroller Cyber ‘Incident’ Compromises Org’s Emails
A review of the emails involved in the breach is still ongoing, but what has been discovered is enough for the Treasury Department to label it a major cyber incident. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/occ-major-cyber-incident-executive-employee-emails
-
Langflow AI Builder Vulnerability Allows Remote Server Takeover by Attackers
A critical security vulnerability has been discovered in the Langflow AI Builder, a popular tool for creating agentic AI workflows. The flaw, tracked as CVE-2025-3248, enables unauthenticated remote attackers to compromise servers running Langflow, potentially leading to full server control. Security researchers have issued a warning about the severity of the issue, urging users to upgrade…