Tag: cyber
-
Chinese APT ‘Emperor Dragonfly’ Moonlights With Ransomware
Pivoting from prior cyber espionage, the threat group deployed its backdoor tool set to ultimately push out RA World malware, demanding $2 million from its victim. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/chinese-apt-emperor-dragonfly-ransomware-attack
-
What the EU Cyber Solidarity Act Means for UK MSPs and MSSPs
First seen on scworld.com Jump to article: www.scworld.com/perspective/what-the-eu-cyber-solidarity-act-means-for-uk-msps-and-mssps
-
The blueprint for cyber resilience: How businesses can adapt and thrive
First seen on scworld.com Jump to article: www.scworld.com/resource/the-blueprint-for-cyber-resilience-how-businesses-can-adapt-and-thrive
-
Cyber resilience: A C-suite game plan for balancing innovation, compliance and risk
First seen on scworld.com Jump to article: www.scworld.com/resource/cyber-resilience-a-c-suite-game-plan-for-balancing-innovation-compliance-and-risk
-
Burp Suite Professional / Community 2025.2 Released With New Built-in AI Integration
PortSwigger has announced the release of Burp Suite Professional and Community Edition 2025.2, introducing significant updates that include AI integration into the Montoya API, enhancing the capabilities for building smarter, AI-powered extensions. Bug Fixes and Browser Updates: A notable bug fix corrects the display of source IP addresses for DNS requests over IPv6 in the…
-
The Rise of Cyber Espionage: UAV and C-UAV Technologies as Targets
Researchers at cybersecurity firm Resecurity detected a rise in cyberattacks targeting UAV and counter-UAV technologies. Resecurity identified an increase in malicious cyber activity targeting UAV and counter-UAV (C-UAV/C-UAS) technologies. That was especially notable during active periods of local conflicts, including the escalation of the Russia-Ukraine war and the Israel-Hamas confrontation. The trend of malicious targeting…
-
Unusual attack linked to Chinese APT group combines espionage and ransomware
Tags: apt, attack, breach, china, cloud, country, credentials, crime, crimes, crypto, cyber, cybercrime, cyberespionage, data, encryption, espionage, exploit, finance, firewall, government, group, hacker, infection, insurance, intelligence, korea, microsoft, network, north-korea, ransom, ransomware, russia, software, tactics, technology, threat, veeam, vulnerabilityThe attacker demanded a $2-million ransom: The attack that resulted in the deployment of the RA World ransomware program, as well as data exfiltration, had the same chain: the toshdpdb.exe loading toshdpapi.dll then decrypting toshdp.dat which resulted in the PlugX variant being deployed. The difference is the attacker then chose to deploy the RA World…
-
Unpatched Cisco Devices Still Getting Popped by Salt Typhoon
Telecoms Still Falling to Chinese Nation-State Hacking Group, Researchers Warn. A Chinese cyber espionage group tracked as Salt Typhoon and tied to the mass hacking of telecommunications networks in the U.S. and dozens of other countries has been continuing to seek and hack unpatched equipment, including exploiting two long-patched vulnerabilities in Cisco gear. First seen…
-
Consortium Acquires Cyber Risk Quantification Startup To Become ‘Next-Gen VAR’
Consortium’s acquisition of Metrics That Matter is aimed at providing customers with a more-accurate, continuously updated picture of their cyber risk, CEO Nate Ungerott tells CRN. First seen on crn.com Jump to article: www.crn.com/news/security/2025/consortium-networks-acquires-cyber-risk-quantification-startup-to-become-next-gen-var
-
Munich Cyber Security and Security Conferences 2025 [Live Updates]
Live updates from the Munich Security and Cyber Security Conference from reporters Alexander Martin, Daryna Antoniuk and Dina Temple-Raston. First seen on therecord.media Jump to article: therecord.media/munich-cyber-security-and-security-conference-2025
-
Check Point ‘State of Global Cyber Security 2025″ Report – Zahl der Cyber-Angriffe steigt um 44 Prozent
First seen on security-insider.de Jump to article: www.security-insider.de/bericht-global-cyber-security-2025-zunahme-cyber-angriffe-a-b78634bf546fa4835f6ab35520946e3e/
-
Japan Goes on Offense With New ‘Active Cyber Defense’ Bill
Japan is on a mission to catch up to the US standard of national cyber preparedness, and its new legislation is a measure intended to stop escalating Chinese cyber-espionage efforts, experts say. First seen on darkreading.com Jump to article: www.darkreading.com/cybersecurity-operations/japan-offense-new-cyber-defense-bill
-
Consortium Networks Acquires Cyber Risk Quantification Startup To Become ‘Next-Gen VAR’
Consortium Networks’ acquisition of Metrics That Matter is aimed at providing customers with a more-accurate, continuously updated picture of their cyber risk, CEO Nate Ungerott tells CRN. First seen on crn.com Jump to article: www.crn.com/news/security/2025/consortium-networks-acquires-cyber-risk-quantification-startup-to-become-next-gen-var
-
UK government sanctions target Russian cyber crime network Zservers
The UK government has imposed sanctions on a Russian cyber crime syndicate responsible for aiding ransomware attacks, targeting the group and individual members First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366619219/UK-government-sanctions-target-Russian-cyber-crime-network-ZSERVERS
-
Arbitrary File Upload Vulnerability in WordPress Plugin Let Attackers Hack 30,000 Website
A subgroup of the Russian state-sponsored hacking group Seashell Blizzard, also known as Sandworm, has intensified its cyber operations through a campaign dubbed BadPilot. This multi-year initiative has targeted critical infrastructure worldwide, expanding the group’s reach beyond its traditional focus on Ukraine and Eastern Europe to include North America, Europe, and Asia-Pacific regions. Exploiting Vulnerabilities…
-
BadPilot Attacking Network Devices to Expand Russian Seashell Blizzard’s Attacks
A newly uncovered cyber campaign, dubbed >>BadPilot,
-
New Phishing Attacks Abuses Webflow CDN CAPTCHAs to Steal Credit Card details
Tags: attack, captcha, credit-card, cyber, exploit, malicious, network, phishing, technology, threatNetskope Threat Labs has uncovered a sophisticated phishing campaign targeting users across various industries, including technology, manufacturing, and banking. This campaign, active since mid-2024, exploits search engine optimization (SEO) techniques to lure victims into downloading malicious PDFs hosted on the Webflow Content Delivery Network (CDN). These PDFs are embedded with fake CAPTCHA images that redirect…
-
Russia-linked APT Seashell Blizzard is behind the long running global access operation BadPilot campaign
A subgroup of the Russia-linked Seashell Blizzard APT group (aka Sandworm) ran a global multi-year initial access operation called BadPilot. Microsoft shared findings on research on a subgroup of the Russia-linked APT group Seashell Blizzard behind the global BadPilot campaign, which compromises infrastructure to support Russian cyber operations. Seashell Blizzard (aka Sandworm, BlackEnergy and TeleBots) has been…
-
RA World Ransomware Attack in South Asia Links to Chinese Espionage Toolset
An RA World ransomware attack in November 2024 targeting an unnamed Asian software and services company involved the use of a malicious tool exclusively used by China-based cyber espionage groups, raising the possibility that the threat actor may be moonlighting as a ransomware player in an individual capacity.”During the attack in late 2024, the attacker…
-
Palo Alto Firewall Flaw Exploited in RA World Ransomware Attacks
Tags: attack, china, cyber, cybersecurity, espionage, exploit, firewall, flaw, network, ransomware, service, software, tool, vulnerabilityA recent ransomware attack leveraging a vulnerability in Palo Alto Networks’ PAN-OS firewall software (CVE-2024-0012) has raised significant concerns within the cybersecurity community. The attack, which targeted a medium-sized software and services company in South Asia in late 2024, is particularly alarming because it employed tools historically associated with China-based espionage groups. This marks a…
-
30,000 WordPress Sites Exposed to Exploitation via File Upload Vulnerability
A critical security vulnerability in the >>Security & Malware scan by CleanTalk
-
Russian hacking group targets critical infrastructure in the US, the UK, and Canada
Tags: access, attack, blizzard, computer, control, cyber, cyberattack, cybersecurity, data, espionage, exploit, fortinet, group, hacker, hacking, infrastructure, intelligence, international, microsoft, military, network, ransomware, russia, software, strategy, supply-chain, threat, tool, ukraine, update, vulnerability, zero-trustWeaponizing IT software against global enterprises: Since early 2024, the hackers have exploited vulnerabilities in widely used IT management tools, including ConnectWise ScreenConnect (CVE-2024-1709) and Fortinet FortiClient EMS (CVE-2023-48788). By compromising these critical enterprise systems, the group has gained undetected access to networks, Microsoft warned.”Seashell Blizzard’s specialized operations have ranged from espionage to information operations…
-
Innovations in Machine Identity Management
Are You Ready to Revolutionize Your Approach to Machine Identity Management? We understand the challenges you face in streamlining the complexities of managing Non-Human Identities (NHIs) and their secrets. These machine identities are the unsung heroes of your cyber ecosystem, silently powering your operations while shielding your valuable data assets from threats. What are Non-Human……
-
Cybercriminals Exploit Pyramid Pentesting Tool for Covert C2 Communications
Cybersecurity analysts have identified that hackers are leveraging the open-source Pyramid pentesting tool to establish stealthy command-and-control (C2) communications. Originally designed as a post-exploitation framework for penetration testers, Pyramid has become an attractive option for malicious actors due to its ability to evade detection by endpoint security tools. The tool, first released on GitHub in…
-
Threat Actors in Russia, China, and Iran Targeting Local communities in the U.S
Foreign adversaries, including Russia, China, and Iran, are intensifying their efforts to manipulate public opinion and destabilize local communities across the United States. These campaigns, once primarily focused on national-level politics, have increasingly targeted state and local governments, community groups, and individuals. Leveraging advanced technologies such as generative artificial intelligence (AI), these actors aim to…
-
Widespread Exploitation of ThinkPHP and OwnCloud Flaws by Cybercriminals
Tags: attack, cve, cyber, cybercrime, exploit, flaw, update, vulnerability, vulnerability-managementGreyNoise has detected a significant surge in exploitation activity targeting two vulnerabilities, CVE-2022-47945 and CVE-2023-49103. The alarming uptick in attacks underscores critical issues in vulnerability management and patch prioritization. Cybercriminals are actively scanning and exploiting both vulnerabilities, though they are being perceived differently in terms of risk. GreyNoise observed a substantial increase in exploitation […]…
-
Windows 11 Compression Features Pose libarchive Security Threats
Microsoft’s ongoing efforts to enhance user experience in Windows 11 have introduced native support for a variety of new archive formats via the KB5031455 update. While these changes have streamlined user workflows, they have also inadvertently opened Pandora’s box in the realm of cybersecurity, linking the operating system to potential vulnerabilities stemming from its reliance…
-
Breaking macOS Apple Silicon Kernel Hardening: KASLR Exploited
Security researchers from Korea University have successfully demonstrated a groundbreaking attack, dubbed SysBumps, which bypasses Kernel Address Space Layout Randomization (KASLR) in macOS systems powered by Apple Silicon processors. This marks the first successful breach of KASLR on Apple’s proprietary ARM-based architecture, revealing significant vulnerabilities in the kernel hardening mechanisms of modern macOS systems. KASLR…
-
New Malware Abuses Microsoft Graph API to Communicate via Outlook
A newly discovered malware, named FINALDRAFT, has been identified leveraging Microsoft Outlook as a command-and-control (C2) communication channel through the Microsoft Graph API. This sophisticated malware was uncovered by Elastic Security Labs during an investigation targeting a foreign ministry. The discovery highlights the growing trend of cybercriminals exploiting legitimate cloud services for covert operations, blending…
-
RedNote App Security Flaw Exposes User Files on iOS and Android Devices
Serious security vulnerabilities have been uncovered in the popular social media and content-sharing app, RedNote, compromising the privacy and security of millions of users globally. Researchers revealed critical flaws allowing attackers to intercept sensitive user data, access device files, and exploit insecure encryption mechanisms on iOS and Android platforms. The app’s use of inadequate cryptographic…