Tag: cyber
-
Nnice Ransomware Attacking Windows Systems With Advanced Encryption Techniques
CYFIRMA’s Research and Advisory team has identified a new strain of ransomware labeled >>Nnice,
-
Microsoft Unveils New Identity Secure Score Recommendations in General Availability
Microsoft has announced the general availability of 11 new Identity Secure Score recommendations in Microsoft Entra, aimed at bolstering organizational security and providing actionable insights to mitigate risks. The Identity Secure Score recommendations are designed to act as a trusted advisor, offering best practices rooted in industry standards to enhance security posture while improving employee…
-
SonicWall Arbitrary OS Commands Execution Vulnerability Exploited in Attacks
Tags: advisory, attack, cve, cvss, cyber, exploit, incident response, security-incident, threat, update, vulnerabilityA critical vulnerability in SonicWall’s SMA1000 series tracked as CVE-2025-23006, has come under active exploitation by threat actors. SonicWall’s PSIRT (Product Security Incident Response Team) has issued an urgent advisory urging users to update their systems immediately to mitigate risks. Details of CVE-2025-23006 The vulnerability, which scores an alarming9.8/10on the CVSS v3 severity scale, stems from…
-
QakBot-Linked BC Malware Adds Enhanced Remote Access and Data Gathering Features
Cybersecurity researchers have disclosed details of a new BackConnect (BC) malware that has been developed by threat actors linked to the infamous QakBot loader.”BackConnect is a common feature or module utilized by threat actors to maintain persistence and perform tasks,” Walmart’s Cyber Intelligence team told The Hacker News. “The BackConnect(s) in use were ‘DarkVNC’ alongside…
-
Taking a Threat Adapted Approach to Vulnerability Management
As cyberthreats grow in complexity and frequency, vulnerability management requires more than just patching systems; it demands a dynamic, threat-adapted approach. As part of Cyber Rhino Threat Week ( December 9-13, 2024) which aimed to inform, share threat intelligence insights and best practices with our customers, partners and industry ecosystem, we held a session that..…
-
What Makes Bulletproof Hosting Providers a Growing Danger in Australia
The Australian Cyber Security Centre has issued a warning about Bulletproof Hosting Providers (BPH), which play a central role in enabling cybercrime. These providers offer infrastructure that helps cybercriminals carry out attacks such as ransomware campaigns, data theft, and phishing scams, all while remaining largely undetectable. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/acsc-targets-bulletproof-hosting-providers/
-
AI Assistant Jailbreaked to Reveal its System Prompts
Anonymous tinkerer claims to have bypassed an AI assistant’s safeguards to uncover its highly confidential system prompt”, the underlying instructions shaping its behavior. The breach, achieved through creative manipulation rather than brute force, has sparked conversations about the vulnerabilities and ethical considerations of AI security. The Revelation The curious individual began the exploration innocently enough,…
-
QakBot-Linked BC Malware Adds Enhanced DNS Tunneling and Remote Access Features
Cybersecurity researchers have disclosed details of a new BackConnect (BC) malware that has been developed by threat actors linked to the infamous QakBot loader.”BackConnect is a common feature or module utilized by threat actors to maintain persistence and perform tasks,” Walmart’s Cyber Intelligence team told The Hacker News. “The BackConnect(s) in use were ‘DarkVNC’ alongside…
-
Murdoc Botnet Exploiting AVTECH Cameras Huawei Routers to Gain Complete Control
Researchers have identified an active malware campaign involving a Mirai botnet variant, dubbed Murdoc, which has been targeting AVTECH cameras and Huawei HG532 routers since at least July 2024. Mass Campaign Leveraging Two Key Vulnerabilities The campaign exploits two known vulnerabilities: These vulnerabilities enable attackers to co-opt vulnerable devices into a Mirai-based botnet infrastructure. Current…
-
Rails Apps Arbitrary File Write Vulnerability Let Attackers Execute Code Remotely
A newly exposed vulnerability in Ruby on Rails applications allows attackers to achieve Remote Code Execution (RCE) through a flaw that permits arbitrary file writing. This vulnerability, which leverages the Rails libraryBootsnap, underscores the critical importance of secure file handling in web applications. What Happened? A case study, shared by security researchers, demonstrated how an…
-
Open-Source ClamAV Releases Security Update for Buffer Overflow Vulnerability Patch Now
ClamAV, a widely used open-source antivirus software, has released security patch updates to address a critical buffer overflow vulnerability (CVE-2025-20128). The vulnerability, identified in the OLE2 file parser, posed a potential risk of denial-of-service (DoS) attacks. Users are urged to update immediately to the newly-released ClamAV versions 1.4.2 and 1.0.8 to safeguard their systems. Details…
-
New Supply Chain Attack Targeting Chrome Extensions to Inject Malicious Code
A sophisticated supply chain attack targeting Chrome browser extensions has come to light, potentially compromising hundreds of thousands of users. The attack, which unfolded in December 2024, involved phishing campaigns aimed at extension developers and the injection of malicious code into legitimate Chrome extensions. Sensitive user data, including API keys, session cookies, and authentication tokens…
-
Cyber Safety Review Board axed in DHS cost-cutting move
Benjamine C. Huffman, acting secretary of the Department of Homeland Security under Trump, terminates the memberships for all DHS advisory committees, including the CSRB. First seen on techtarget.com Jump to article: www.techtarget.com/searchsecurity/news/366618188/Cyber-Safety-Review-Board-axed-in-DHS-cost-cutting-move
-
NSFOCUS Licensed for SOC and Pentest Service in Malaysia in Accordance with Cyber Security Act 2024
Santa Clara, Calif. January 23, 2025 NSFOCUS, a global provider of intelligent hybrid security solutions, today announced that it has received two security service licenses from the National Cyber Security Agency (NACSA) of Malaysia, being one of the first licensed companies that can provide two crucial services in Malaysia: Managed SOC (Security Operations Center)…The post…
-
New Cookie Sandwich Technique Allows Stealing of HttpOnly cookies
A new attack technique known as the >>cookie sandwich
-
WordPress Plugin Vulnerability Exposes 23k+ Websites to Hacking
Researchers from Patchstack have warned that over 23,000 real estate websites using the popular RealHomes WordPress theme and its bundled Easy Real Estate plugin are exposed to critical security vulnerabilities. These vulnerabilities allow unauthenticated attackers to escalate privileges, take over administrator accounts, and compromise websites. Let’s dive into the technical details of these vulnerabilities and…
-
Cisco Warns of Meeting Management API Privilege Escalation Vulnerability
Cisco has issued a critical advisory regarding a privilege escalation vulnerability in its Meeting Management REST API. The flaw tracked as CVE-2025-20156, allows a remote, authenticated attacker with low privileges to elevate their access to administrator-level control on affected devices, posing a significant threat to affected systems. Vulnerability Details The vulnerability stems from improper authorization enforcement…
-
Operation (Giỗ Tổ Hùng Vương) Hurricane: New OceanLotus Group Revealed in Espionage Campaigns
A recent report from Qianxin details the sophisticated cyber-espionage tactics employed by the New OceanLotus group. Active intermittently First seen on securityonline.info Jump to article: securityonline.info/operation-gio-to-hung-vuong-hurricane-new-oceanlotus-group-revealed-in-espionage-campaigns/
-
New Bruteforce Campaign Exploits fasthttp Library to Target Azure Environments
On January 13, the SpearTip Security Operations Center, in collaboration with Managed SaaS Alerts, uncovered a sophisticated cyber First seen on securityonline.info Jump to article: securityonline.info/new-bruteforce-campaign-exploits-fasthttp-library-to-target-azure-environments/
-
GamaCopy: A New Cyber Espionage Group Imitating Gamaredon to Target Russia
A recent report from the Knownsec 404 Advanced Threat Intelligence team reveals the emergence of GamaCopy, a cyber First seen on securityonline.info Jump to article: securityonline.info/gamacopy-a-new-cyber-espionage-group-imitating-gamaredon-to-target-russia/
-
Cybercriminals Exploit AnyDesk to Impersonate CERT-UA in Sophisticated Phishing Campaign
In a recent alert, CERT-UA researchers have unveiled a series of cyber-attacks leveraging the legitimate remote access tool First seen on securityonline.info Jump to article: securityonline.info/cybercriminals-exploit-anydesk-to-impersonate-cert-ua-in-sophisticated-phishing-campaign/
-
Trump ‘waved a white flag to Chinese hackers’ as Homeland Security axed cyber advisory boards
And: America ‘has never been less secure,’ retired rear admiral tells Congress First seen on theregister.com Jump to article: www.theregister.com/2025/01/22/dhs_axes_cyber_advisory_boards/
-
UK Mail Check: DMARC Reporting Changes to Know
The UK National Cyber Security Centre (NCSC), the country’s technical authority for cyber security, has announced changes to its Mail Check program. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/01/uk-mail-check-dmarc-reporting-changes-to-know/
-
Removal of Cyber Safety Review Board members sparks alarm from cyber pros, key lawmaker
Tags: cyberNot everyone opposed the move, however, even as the board reviews the major Salt Typhoon telecom breach. First seen on cyberscoop.com Jump to article: cyberscoop.com/removal-cyber-safety-review-board-members/
-
Trump ‘waved a white flag to Chinese hackers’ as DHS axed cyber advisory boards
‘The homeland has never been less secure,’ retired Rear Admiral tells Congress First seen on theregister.com Jump to article: www.theregister.com/2025/01/22/dhs_axes_cyber_advisory_boards/
-
US Congress Hears Calls for Aggressive Anti-China Cyber Ops
House Homeland Security Committee Mulls Response to Volt Typhoon, Future of CISA. The United States needs to respond more aggressively to nation-state hacking, members of Congress heard Wednesday against a backdrop of changes, actual and planned, at the primary federal civilian cyber defense agency. We need to call them out for this, said Rep. Michael…
-
Trump admin fires security board investigating Chinese hack of large ISPs
Dismantled Cyber Safety Review Board was investigating Salt Typhoon telecom hack. First seen on arstechnica.com Jump to article: arstechnica.com/tech-policy/2025/01/trump-admin-fires-homeland-security-advisory-boards-blaming-agendas/