Tag: cyber
-
Scattered Spider retail attacks spreading to US, says Google
Google’s threat intel analysts are aware of a number of in-progress cyber attacks against US retailers linked to the same Scattered Spider gang that supposedly attacked M&S and Co-op in the UK First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366623999/Scattered-Spider-retail-attacks-spreading-to-US-says-Google
-
U.S. Officials Probe Rogue Communication Devices in Solar Power Inverters
U.S. energy officials are intensifying scrutiny of Chinese-manufactured power inverters, critical components in renewable energy systems, after discovering undocumented communication equipment embedded within them. These inverters, predominantly produced in China, are essential for connecting solar panels, wind turbines, batteries, heat pumps, and electric vehicle chargers to electricity grids worldwide. The presence of rogue cellular radios…
-
TransferLoader Malware Enables Attackers to Execute Arbitrary Commands on Infected Systems
A formidable new malware loader, dubbed TransferLoader, has emerged as a significant cybersecurity threat, as detailed in a recent report by Zscaler ThreatLabz. Active since at least February 2025, this sophisticated malware has been observed deploying multiple components, including a downloader, a backdoor, and a specialized loader for the backdoor module. These components collectively enable…
-
DarkCloud Stealer Employs AutoIt to Evade Detection and Steal Login Credentials
Unit 42 researchers from Palo Alto Networks have uncovered a series of attacks in January 2025 involving the DarkCloud Stealer malware. This infostealer, first observed in 2022, has evolved with new tactics to bypass traditional detection mechanisms. By leveraging AutoIt scripting and multi-stage payloads, the latest variants of DarkCloud demonstrate a high level of sophistication,…
-
Using a Calculator to Take Guesswork Out of Measuring Cyber-Risk
Organizations face the complex challenge of accurately measuring their cyber-risk across multiple variables. Resilience’s risk calculator tool can help organizations measure their cyber-risk based on their own factors so that they can make informed decisions about their security posture. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/calculator-guesswork-measure-cyber-risk
-
Critical Infrastructure Under Siege: OT Security Still Lags
With critical infrastructure facing constant cyber threats from the Typhoons and other corners, federal agencies and others are warning security for the OT network, a core technology in many critical sectors, is not powered up enough. First seen on darkreading.com Jump to article: www.darkreading.com/ics-ot-security/critical-infrastructure-ot-security-still-lags
-
Interlock Ransomware Targeting Defense Contractors and Supply Chain Networks
The Interlock Ransomware group has emerged as a significant adversary targeting defense contractors and their intricate supply chain networks. First identified in September 2024, Interlock has rapidly shifted from opportunistic attacks across sectors like healthcare and technology to highly targeted assaults on the defense industrial base. A recent attack on National Defense Corporation (NDC) and…
-
Chihuahua Stealer Exploits Google Drive Document to Harvest Browser Login Credentials
A .NET-based infostealer named >>Chihuahua Stealer
-
Russia-Linked APT28 Exploited MDaemon Zero-Day to Hack Government Webmail Servers
A Russia-linked threat actor has been attributed to a cyber espionage operation targeting webmail servers such as Roundcube, Horde, MDaemon, and Zimbra via cross-site scripting (XSS) vulnerabilities, including a then-zero-day in MDaemon, according to new findings from ESET.The activity, which commenced in 2023, has been codenamed Operation RoundPress by the Slovak cybersecurity company. It has…
-
Google says hackers behind UK retail cyber campaign now also targeting US
“US retailers should take note” of recent cyberattacks on British companies, according to Google’s Threat Intelligence Group, as the financially motivated collective known as Scattered Spider appears to be connected. First seen on therecord.media Jump to article: therecord.media/scattered-spider-suspected-retail-hackers-google-alert
-
Enisa launches European vulnerability database
The EU’s new vulnerability database is designed to offer a broader, more transparent source of information on new cyber vulnerabilities First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366623995/Enisa-launches-European-vulnerability-database
-
Why we must reform the Computer Misuse Act: A cyber pro speaks out
Britain’s outdated hacking laws are leaving the UK’s cyber practitioners hamstrung and afraid. Security professional Simon Whittaker reveals how he nearly ran afoul of the Computer Misuse Act, and why he’s speaking out for reform First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366623789/Why-we-must-reform-the-Computer-Misuse-Act-A-cyber-pro-speaks-out
-
“Dance of the Hillary” and the Expanding Use of Malware in Regional Cyber Conflict
A recent advisory from the Punjab Police’s cybercrime wing warns of a new wave of malware attacks potentially originating from Pakistan, with a tool known as “Dance of the Hillary” at the center of the campaign. Targeting users through phishing links and malicious attachments, this strain of malware is designed to steal sensitive data and…
-
Operation Sindoor Fallout: Lessons from the Mass Website Defacement Campaign
A recent cyber onslaught has drawn global attention: more than 1.5 million Indian websites were defaced or disrupted in retaliation for the alleged “Operation Sindoor,” a reported counterterrorism operation. According to The Times of India, this large-scale campaign has been attributed to at least seven Pakistani hacker groups, including names like Team Insane PK and…
-
Congress faces pressure to renew cyber information-sharing law
The law’s expiration in September could jeopardize a wide range of information-sharing partnerships that have helped catch and thwart cyberattacks in the U.S. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/cisa-reauthorization-congress-industry-letter/748053/
-
Threat Actors Leverage Weaponized HTML Files to Deliver Horabot Malware
A recent discovery by FortiGuard Labs has unveiled a cunning phishing campaign orchestrated by threat actors deploying Horabot malware, predominantly targeting Spanish-speaking users in Latin America. This high-severity threat, detailed in the 2025 Global Threat Landscape Report, exploits malicious HTML files embedded in phishing emails to steal sensitive information, including email credentials and banking data,…
-
TA406 Hackers Target Government Entities to Steal Login Credentials
Tags: attack, credentials, cyber, government, hacker, intelligence, login, malware, north-korea, phishing, russia, threat, ukraineThe North Korean state-sponsored threat actor TA406, also tracked as Opal Sleet and Konni, has set its sights on Ukrainian government entities. Proofpoint researchers have uncovered a dual-pronged offensive involving both credential harvesting and malware deployment through highly targeted phishing campaigns. The likely objective of these attacks is to gather strategic intelligence on the Russian…
-
Google Threat Intelligence Releases Actionable Threat Hunting Technique for Malicious .desktop Files
Google Threat Intelligence has unveiled a series of sophisticated threat hunting techniques to detect malicious .desktop files, a novel attack vector leveraged by threat actors to compromise systems. Initially documented by Zscaler researchers in 2023, this technique involves the abuse of .desktop files-plain text configuration files used to define application launch behavior in Linux desktop…
-
New Adobe Photoshop Vulnerability Enables Arbitrary Code Execution
Adobe has released critical security updates addressing three high-severity vulnerabilities (CVE-2025-30324, CVE-2025-30325, CVE-2025-30326) in Photoshop 2024 and 2025 that could enable arbitrary code execution on Windows and macOS systems. The flaws, discovered by external researcher yjdfy through Adobe’s HackerOne bug bounty program, involve memory corruption risks stemming from integer manipulation and uninitialized pointer access. While…
-
Severe Adobe Illustrator Flaw Allows Remote Code Execution
Adobe has issued an urgent security update for its widely used graphic design software, Adobe Illustrator, following the discovery of a critical heap-based buffer overflow vulnerability tracked as CVE-2025-30330. This flaw, which allows arbitrary code execution on affected systems, impacts both Windows and macOS versions of Illustrator 2024 and 2025. Rated with a CVSS score…
-
Congress Should Tackle Cyber Threats, Not Competition
Some members of Congress seem more intent on grabbing headlines than actually working to make America more cyber secure. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/congress-cyber-threats-competition
-
Alabama state government says cyber incident’s effects are limited, but response continues
The state’s Office of Information Technology (OIT) said it has called in two incident response teams for around-the-clock mitigation following a “cybersecurity event” discovered last week. First seen on therecord.media Jump to article: therecord.media/alabama-state-government-cyber-incident
-
New leadership picks for Cyber Command, NSA coming soon amid broader decision on structure
Multiple military, civilian and congressional sources say the Trump administration could move soon to fill the top civilian position at the NSA, setting in motion other decisions about the military leadership for the spy agency and for U.S. Cyber Command. First seen on therecord.media Jump to article: therecord.media/cyber-command-nsa-trump-leadership-picks-dual-hat
-
Researchers Unveil New Mechanism to Track Compartmentalized Cyber Threats
Cisco Talos, in collaboration with The Vertex Project, has introduced an innovative approach to tackle the rising complexity of compartmentalized cyber threats. As modern cyberattacks increasingly involve multiple threat actors executing distinct stages of an attack kill chain-such as initial access, exploitation, and ransomware deployment-traditional threat modeling frameworks like the Diamond Model have struggled to…
-
New HTTPBot Botnet Rapidly Expands to Target Windows Machines
The HTTPBot Botnet, a novel Trojan developed in the Go programming language, has seen a sharp rise in activity since its first detection in August 2024. According to the latest findings from NSFOCUS Fuying Lab’s Global Threat Hunting system, HTTPBot has rapidly expanded its reach, particularly in April 2025, with over 200 attack instructions issued.…
-
Katz Stealer Malware Hits 78+ Chromium and Gecko-Based Browsers
Newly disclosed information-stealing malware dubbed Katz Stealer has emerged as a significant threat to users of Chromium and Gecko-based browsers, with capabilities to extract sensitive data from over 78 browser variants. Developed in C and Assembly (ASM) for lightweight efficiency, the malware targets credentials, cookies (including version 20+), autofill data, CVV2 codes, OAuth tokens, cryptocurrency…
-
Critical Vulnerability in Windows Remote Desktop Gateway Allows DenialService Attacks
Microsoft has disclosed two critical vulnerabilities in its Remote Desktop Gateway (RDG) service, posing significant risks to organizational networks. CVE-2025-26677 and CVE-2025-29831, both rated Important by Microsoft, enable denial-of-service (DoS) attacks and remote code execution (RCE), respectively. These flaws, patched in Microsoft’s May 2025 security update, underscore persistent challenges in securing remote access infrastructure. Security…
-
Critical Microsoft Outlook Flaw Enables Remote Execution of Arbitrary Code
Newly disclosed vulnerability in Microsoft Outlook (CVE-2025-32705) permits attackers to execute arbitrary code on compromised systems through a memory corruption flaw. Rated 7.8 (CVSS v3.1) and classified as Important by Microsoft, this out-of-bounds read vulnerability (CWE-125) exposes email clients to localized attacks requiring minimal user interaction. With over 400 million enterprise users relying on Outlook…