Tag: cyber
-
New Malware Abuses Microsoft Graph API to Communicate via Outlook
A newly discovered malware, named FINALDRAFT, has been identified leveraging Microsoft Outlook as a command-and-control (C2) communication channel through the Microsoft Graph API. This sophisticated malware was uncovered by Elastic Security Labs during an investigation targeting a foreign ministry. The discovery highlights the growing trend of cybercriminals exploiting legitimate cloud services for covert operations, blending…
-
Australia’s New Guidance Aims to Harden IT Network Security
Cybersecurity Officials Launch Major Push for Zero Trust, Secure-By-Design Approach. The Australian Signals Directorate’s Australian Cyber Security Center released guidance on proactive cyber defense strategies to help organizations build a modern, defensible network architecture that’s resilient to cyberattacks and designed to help minimize impact on critical systems and assets. First seen on govinfosecurity.com Jump to…
-
Trump to nominate Sean Cairncross as national cyber director
The president will tap the former RNC insider to lead the White House office that oversees nation’s cybersecurity strategy. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/trump-nominate-cairncross-cyber-director/739940/
-
Microsoft Uncovers Sandworm Subgroup’s Global Cyber Attacks Spanning 15+ Countries
A subgroup within the infamous Russian state-sponsored hacking group known as Sandworm has been attributed to a multi-year initial access operation dubbed BadPilot that stretched across the globe.”This subgroup has conducted globally diverse compromises of Internet-facing infrastructure to enable Seashell Blizzard to persist on high-value targets and support tailored network operations,” the First seen on…
-
Geopolitical Tensions Challenge a Borderless Cyberspace
WEF’s Akshay Joshi on How Global Instability Is Affecting Cyber Resilience. Nearly 60% of all organizations reported prevailing geopolitical instability has had an impact on their cybersecurity strategies, said Akshay Joshi, head of the Center for Cybersecurity at the World Economic Forum. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/geopolitical-tensions-challenge-borderless-cyberspace-a-27500
-
Getting the Most Value out of the OSCP: Pre-Course Prep
Tags: access, antivirus, attack, compliance, control, credentials, cyber, cybersecurity, detection, exploit, finance, framework, guide, hacker, hacking, infosec, infrastructure, jobs, kali, linux, mandiant, metric, microsoft, mitre, network, organized, password, penetration-testing, PurpleTeam, RedTeam, risk, service, skills, software, tactics, technology, tool, training, vulnerability, windowsThe first post in a five-part practical guide series on maximizing the professional, educational, and financial value of the OffSec certification pursuit for a successful career in offensive cybersecurity consulting Disclaimer: All opinions expressed in this article are solely my own. I have reviewed the content to ensure compliance with OffSec’s copyright policies and agreements.…
-
Hackers Exploit Ivanti Connect Secure Vulnerability to Inject SPAWNCHIMERA malware
Tags: cve, cvss, cyber, cybersecurity, exploit, flaw, hacker, ivanti, malware, remote-code-execution, vulnerability, zero-dayIn a concerning development, cybersecurity experts have identified active exploitation of a critical vulnerability in Ivanti Connect Secure (ICS) appliances, tracked as CVE-2025-0282. This zero-day vulnerability, a stack-based buffer overflow with a CVSS score of 9.0, has been leveraged by attackers to deploy the advanced SPAWNCHIMERA malware. The flaw permits unauthenticated remote code execution, enabling…
-
ZeroLogon Ransomware Exploits Windows AD to Hijack Domain Controller Access
A newly intensified wave of ransomware attacks has surfaced, leveraging the infamous ZeroLogon vulnerability (CVE-2020-1472) to compromise Windows Active Directory (AD) domain controllers. This exploit, first identified in 2020, has become a key weapon for ransomware groups like Ryuk and RansomHub, allowing them to hijack entire networks with unprecedented speed and efficiency. How ZeroLogon Works…
-
Cl0p Ransomware Hide Itself on Compromised Networks After Exfiltrate the Data
The Cl0p ransomware group, a prominent player in the cybercrime landscape since 2019, has intensified its operations by employing advanced techniques to remain undetected within compromised networks. Known for its association with the TA505 threat group, Cl0p has shifted its focus from merely encrypting files to leveraging double extortion tactics exfiltrating sensitive data and threatening…
-
Enhancing Threat Detection With Improved Metadata MITRE ATTCK tags
The cybersecurity landscape continues to evolve rapidly, demanding more sophisticated tools and methodologies to combat emerging threats. In response, Proofpoint’s Emerging Threats (ET) team has implemented significant updates to its ruleset, enhancing metadata coverage and integrating MITRE ATT&CK tags. These advancements aim to provide security teams with actionable intelligence and improved context for detecting and…
-
SonicWall Firewalls Exploit Hijack SSL VPN Sessions to Gain Networks Access
SonicWall firewalls running specific versions of SonicOS are vulnerable to a critical authentication bypass flaw, tracked as CVE-2024-53704, which allows attackers to hijack active SSL VPN sessions. This vulnerability has been classified as high-risk, with a CVSS score of 8.2. It affects SonicOS versions 7.1.x (up to 7.1.1-7058), 7.1.2-7019, and 8.0.0-8035, used in various Gen…
-
Trump plans to nominate GOP insider Sean Cairncross as national cyber director
Sean Cairncross, who has held leadership positions in the Republican National Committee and served in the previous Trump administration, is expected to be the president’s nominee to lead the Office of the National Cyber Director (ONCD). First seen on therecord.media Jump to article: therecord.media/sean-cairncross-trump-national-cyber-director-nominee
-
Researchers Breach Software Supply Chain and Secure $50K Bug Bounty
Tags: breach, bug-bounty, cyber, cybersecurity, data-breach, exploit, flaw, software, supply-chain, vulnerabilityA duo of cybersecurity researchers uncovered a critical vulnerability in a software supply chain, landing them an extraordinary $50,500 bug bounty. The exploit, described as an “Exceptional Vulnerability,” not only exposed systemic flaws in software supply chain security but also demonstrated just how far-reaching the impact of overlooked weak points can be. The researchers, who…
-
Security Detection Tech Failing, Say Cyber Leaders in Regulated Industries
A new Everfox survey shows a growing consensus among regulated organizations in favor of a strategic shift away from detecting cyber threats to preventing them First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/security-detection-tech-failing/
-
Windows Driver Zero-Day Vulnerability Let Hackers Remotely Gain System Access
Microsoft has confirmed the discovery of a significant zero-day vulnerability, tracked as CVE-2025-21418, in the Windows Ancillary Function Driver for WinSock. This flaw, categorized as anElevation of Privilege (EoP)vulnerability, has been exploited in the wild, allowing attackers to remotely gain control of affected systems under certain conditions. Security analysts warn that this flaw is particularly dangerous…
-
Cyber crime meshes with cyber warfare as states enlist gangs
A report from the Google Threat Intelligence Group depicts China, Russia, Iran and North Korea as a bloc using cyber criminal gangs to attack the national security of western countries First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366619194/Google-Cyber-crime-meshes-with-cyber-warfare-as-states-enlist-gangs
-
FortiOS FortiProxy Vulnerability Allows Attackers Firewall Hijacks to Gain Super Admin Access
A critical vulnerability in Fortinet’s FortiOS and FortiProxy products has been identified, enabling attackers to bypass authentication and gain super-admin access. The flaw, classified as an Authentication Bypass Using an Alternate Path or Channel (CWE-288), is actively being exploited in the wild. This vulnerability allows remote attackers to manipulate Node.js WebSocket modules or craft Cross-Site…
-
Fortinet’s FortiOS Vulnerabilities Allow Attackers Trigger RCE and Launch DoS Attack
Fortinet’s FortiOS, the operating system powering its VPN and firewall appliances, has been found vulnerable to multiple security flaws that could allow attackers to execute remote code (RCE) and launch denial-of-service (DoS) attacks. These vulnerabilities, disclosed by Akamai researcher Ben Barnea, were assigned CVE-2024-46666 and CVE-2024-46668. Fortinet released patches on January 14, 2025, to mitigate…
-
West London Council Faces 20,000 Cyberattack Attempts Every Day Amid Growing Threats
A West London council has revealed that it is the target of around 20,000 attempted cyberattacks every day. Hammersmith and Fulham Council, one of the boroughs in the capital, is no stranger to the growing risks of digital security breaches. In response to these frequent cyber threats, the council has ramped up its defense mechanisms,…
-
0-Day Vulnerability in Windows Storage Allow Hackers to Delete the Target Files Remotely
A newly discovered 0-day vulnerability in Windows Storage has sent shockwaves through the cybersecurity community. Identified as CVE-2025-21391, this critical flaw allows attackers to elevate privilege and remotely delete targeted files on a victim’s system without their interaction. Microsoft officially confirmed the issue on February 11, 2025. According to the advisory, this vulnerability stems from a…
-
Sandworm APT Hackers Weaponize Microsoft KMS Activation Tools To Compromise Windows
In a sophisticated cyber-espionage operation, the Russian state-sponsored hacking group Sandworm (APT44), linked to the GRU (Russia’s Main Intelligence Directorate), has been exploiting pirated Microsoft Key Management Service (KMS) activation tools to target Ukrainian Windows users. The campaign, which began in late 2023, leverages trojanized KMS activators and fake Windows updates to deploy malware, including…
-
Ratatouille Malware Bypass UAC Control Exploits I2P Network to Launch Cyber Attacks
A newly discovered malware, dubbed >>Ratatouille
-
Beyond the paycheck: What cybersecurity professionals really want
Tags: business, ceo, corporate, cyber, cybersecurity, data, india, jobs, regulation, risk, risk-management, service, skills, strategy, trainingInvest in skills and allow room for growth: Upskilling also remains a powerful retention tool. As Huber points out, Tenable invests in training entire teams on emerging technologies and capabilities, ensuring that employees feel equipped and valued.Similarly, KPMG has implemented targeted programs to support diversity and career progression within cybersecurity. The firm’s Cyber Women Leads…
-
Hackers Can Exploit >>Wormable<< Windows LDAP RCE Vulnerability for Remote Attacks
Tags: access, attack, cve, cyber, cybersecurity, exploit, flaw, hacker, microsoft, network, rce, remote-code-execution, vulnerability, windowsA critical new vulnerability in Microsoft’s Windows Lightweight Directory Access Protocol (LDAP), tagged as CVE-2025-21376, has recently come to light, raising alarms across global cybersecurity circles. The flaw, which has been classified as >>critical,>wormable>Wormable
-
Google Chrome’s Safe Browsing Now Protects 1 Billion Users Worldwide
Google’s Safe Browsing technology now ensures enhanced protection for over 1 billion Chrome users worldwide. Launched in 2005, Safe Browsing is a robust system designed to safeguard users from phishing, malware, scams, and other cyber threats. By leveraging advanced artificial intelligence (AI) and machine learning, this cutting-edge technology has become a cornerstone of web security,…
-
UK monitoring group to classify cyber incidents on earthquake-like scale
Risk management: The CMC hopes this increased understanding will spur the development of improved incident response planning. Experts quizzed by CSO on CMC welcomed its launch.Ivan Milenkovich, vice president of cyber risk technology in EMEA at Qualys, said data from the CMC has the potential to allow IT security professionals to make better risk assessments,…
-
Critical Ivanti CSA Vulnerability Allows Attackers Remote Code Execution to Gain Restricted Access
A critical vulnerability has been discovered in the Ivanti Cloud Services Application (CSA), potentially allowing attackers to execute remote code and access restricted functionality. Ivanti has released an urgent security update to address the issues, tracked as CVE-2024-47908 and CVE-2024-11771, urging customers to upgrade to version 5.0.5 to mitigate the threat. The two vulnerabilities affect…
-
Trump picks Sean Cairncross for national cyber director
Tags: cyberCairncross doesn’t have any obvious major cyber experience, but has served at the RNC and White House. First seen on cyberscoop.com Jump to article: cyberscoop.com/sean-cairncross-national-cyber-director-nomination-donald-trump/
-
Critical OpenSSL Vulnerability Let Attackers Launch Manthe-Middle Attacks
A high-severity security vulnerability (CVE-2024-12797) has been identified in OpenSSL, one of the most widely used cryptographic libraries. The flaw allows attackers to exploit a loophole in TLS and DTLS handshakes, potentially enabling man-in-the-middle (MITM) attacks on vulnerable connections. OpenSSL has issued a security advisory urging affected users to upgrade immediately to mitigate the risk.…