Collecting Cyber-News from over 60 sources

Tag: dns

Authorities disrupt router DNS hijacks used to steal Microsoft 365 logins

Apr 7, 2026 6:51 PM

Tags: dns, international, law, login, microsoft, router

An international operation from law enforcement authorities in partnership with private companies has disrupted FrostArmada, an APT28 campaign hijacking local traffic from MikroTik and TP-Link routers to steal Microsoft account credentials. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/authorities-disrupt-dns-hijacks-used-to-steal-microsoft-365-logins/
Authorities disrupt router DNS hijacks used to steal Microsoft 365 logins

Apr 7, 2026 6:51 PM

Tags: dns, international, law, login, microsoft, router

An international operation from law enforcement authorities in partnership with private companies has disrupted FrostArmada, an APT28 campaign hijacking local traffic from MikroTik and TP-Link routers to steal Microsoft account credentials. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/authorities-disrupt-dns-hijacks-used-to-steal-microsoft-365-logins/
Russian APT28 Hackers Hijack Routers to Steal Credentials, UK Security Agency Warns

Apr 7, 2026 6:51 PM

Tags: credentials, dns, hacker, malicious, router, russia

Newly identified malicious campaigns are linked to virtual private servers modified by APT28 to operate as malicious DNS servers First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/russia-apt28-hijack-routers-uk-ncsc/
Cisco fixes critical IMC auth bypass present in many products

Apr 3, 2026 11:52 PM

Tags: access, ai, api, apt, attack, authentication, cisco, computing, credentials, cybersecurity, dns, email, exploit, firewall, firmware, flaw, group, infrastructure, linux, malicious, monitoring, network, password, ransomware, risk, router, vulnerability, zero-day

[ Related: More Cisco news and insights ] The Cisco IMC is a baseboard management controller (BMC), a dedicated controller embedded into server motherboards with its own RAM and network interface that gives administrators monitoring and management capabilities as if they were physically connected to the server with a keyboard, monitor, and mouse (KVM). Because BMCs run…
7 ways to improve your business resilience with backup and recovery

Apr 3, 2026 10:52 PM

Tags: attack, automation, backup, business, cloud, compliance, control, cyber, data, dns, HIPAA, identity, malware, metric, network, PCI, ransomware, resilience, risk, service, soc, threat, vulnerability

2. Ensure off-site backup copies : Local backups are fast, but they are also vulnerable to the same physical disasters and ransomware attacks that hit your primary servers. If your production environment and your backups are on the same network segment without air-gapping, a single compromise becomes a total extinction event. The Fix: Adopt a 3-2-1 strategy (3 total copies of data, 2 different media…
Check Point Research Reveals ChatGPT Data Exfiltration Flaw

Apr 1, 2026 12:30 AM

Tags: chatgpt, data, dns, flaw

A ChatGPT flaw lets a single prompt silently exfiltrate data via DNS, bypassing safeguards. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/artificial-intelligence/check-point-research-reveals-chatgpt-data-exfiltration-flaw/
ChatGPT Security Issue Enabled Data Theft via Single Prompt

Mar 31, 2026 4:30 PM

Tags: chatgpt, data, dns, openai, theft, vulnerability

OpenAI has patched vulnerability, which Check Point said was because of a DNS loophole First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/chatgpt-security-issue-steal-data/
8 ways to bolster your security posture on the cheap

Mar 31, 2026 12:29 PM

Tags: access, attack, authentication, awareness, breach, ciso, control, credentials, cyber, cyberattack, cybersecurity, data, data-breach, ddos, dkim, dmarc, dns, email, endpoint, exploit, finance, google, identity, Internet, metric, mfa, microsoft, mitigation, okta, passkey, password, phishing, risk, risk-management, service, strategy, technology, tool, training, update, waf, zero-day

2. Take full advantage of your existing tools: A practical way to strengthen enterprise security without incurring additional significant spend is to ensure you’re fully leveraging the capabilities of solutions already present within your organization, says Gary Brickhouse, CISO at security services firm GuidePoint Security.”Most organizations have invested heavily in security solutions, yet most are…
OpenAI patches ChatGPT flaw that smuggled data over DNS

Mar 30, 2026 10:30 PM

Tags: chatgpt, control, data, dns, flaw, openai

Check Point says outbound controls blocked web traffic but overlooked DNS First seen on theregister.com Jump to article: www.theregister.com/2026/03/30/openai_chatgpt_dns_data_snuggling_flaw/
Week in review: NIST updates DNS security guidance, compromised LiteLLM PyPI packages

Mar 29, 2026 10:30 AM

Tags: dns, nist, pypi, update, WeeklyReview

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: NIST updates its DNS security guidance for the first time in over a decade … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/03/29/week-in-review-nist-updates-dns-security-guidance-compromised-litellm-pypi-packages/
BIND 9 Security Flaws Allow Attackers to Bypass Security Controls and Crash Servers

Mar 27, 2026 10:30 PM

Tags: access, control, cyber, dns, exploit, flaw, Internet, network, software, vulnerability

The Internet Systems Consortium (ISC) has released critical security advisories addressing three new vulnerabilities in the widely used BIND 9 Domain Name System (DNS) software suite. If left unpatched, remote attackers could exploit these weaknesses to bypass access control lists, consume excessive system resources, or crash DNS servers entirely. Network administrators must apply the provided…
NIST Updates DNS Security Guidance After 12 Years with SP 800-81r3

Mar 23, 2026 11:47 AM

Tags: dns, Internet, nist, technology, update

The latest update to DNS security guidance from the National Institute of Standards and Technology (NIST) marks a new in how organizations are expected to secure one of the internet’s most critical systems. Published as NIST SP 800-81r3, this revision replaces the previous 2013 version, ending a gap of more than twelve years without major federal updates in this area. First…
NIST updates its DNS security guidance for the first time in over a decade

Mar 23, 2026 7:46 AM

Tags: dns, infrastructure, network, nist, update

DNS infrastructure underpins nearly every network connection an organization makes, yet security configurations for it have gone largely unrevised at the federal guidance … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/03/23/nist-dns-security-guide-sp-800-81r3/
AWS Bedrock AgentCore Sandbox Bypass Enables Stealthy C2 and Data Exfiltration

Mar 18, 2026 7:10 AM

Tags: access, control, cyber, data, dns, network, threat, vulnerability

A newly disclosed vulnerability in AWS Bedrock AgentCore Code Interpreter allows threat actors to bypass network isolation and establish stealthy command-and-control (C2) channels. AWS originally advertised this mode as providing complete isolation without external access, researchers found that it permits outbound DNS queries for A and AAAA records. This structural allowance enables attackers to exfiltrate…
Operation Epic Fury: Why exposure data changes everything about Iran’s cyber-kinetic campaign

Mar 18, 2026 5:10 AM

Tags: access, ai, api, apt, attack, backdoor, breach, cctv, cisa, cloud, country, cve, cvss, cyber, cybersecurity, data, data-breach, ddos, detection, dns, espionage, exploit, firewall, flaw, fortinet, government, group, healthcare, identity, infrastructure, intelligence, Internet, iot, iran, kev, malware, microsoft, military, network, office, phishing, radius, remote-code-execution, risk, strategy, supply-chain, technology, threat, unauthorized, update, vpn, vulnerability, warfare, windows

Iran’s retaliatory campaign following Operation Epic Fury has collapsed the boundary between physical and digital warfare. Tenable’s exposure data analysis across seven target countries reveals that the largest exploitable attack surface isn’t the headline threat, it’s a Microsoft Word N-day affecting nearly 14 million assets. Key takeaways: Exposure data rebalances the threat picture. A Microsoft…
Operation Epic Fury: Why exposure data changes everything about Iran’s cyber-kinetic campaign

Mar 18, 2026 5:10 AM

Tags: access, ai, api, apt, attack, backdoor, breach, cctv, cisa, cloud, country, cve, cvss, cyber, cybersecurity, data, data-breach, ddos, detection, dns, espionage, exploit, firewall, flaw, fortinet, government, group, healthcare, identity, infrastructure, intelligence, Internet, iot, iran, kev, malware, microsoft, military, network, office, phishing, radius, remote-code-execution, risk, strategy, supply-chain, technology, threat, unauthorized, update, vpn, vulnerability, warfare, windows

Iran’s retaliatory campaign following Operation Epic Fury has collapsed the boundary between physical and digital warfare. Tenable’s exposure data analysis across seven target countries reveals that the largest exploitable attack surface isn’t the headline threat, it’s a Microsoft Word N-day affecting nearly 14 million assets. Key takeaways: Exposure data rebalances the threat picture. A Microsoft…
AI Flaws in Amazon Bedrock, LangSmith, and SGLang Enable Data Exfiltration and RCE

Mar 17, 2026 7:10 PM

Tags: ai, cybersecurity, data, dns, exploit, flaw, intelligence, rce, remote-code-execution

Cybersecurity researchers have disclosed details of a new method for exfiltrating sensitive data from artificial intelligence (AI) code execution environments using domain name system (DNS) queries.In a report published Monday, BeyondTrust revealed that Amazon Bedrock AgentCore Code Interpreter’s sandbox mode permits outbound DNS queries that an attacker can exploit to enable interactive shells First seen…
AWS Bedrock’s ‘isolated’ sandbox comes with a DNS escape hatch

Mar 17, 2026 1:09 PM

Tags: access, bug-bounty, credentials, cvss, data, dns, iam, infrastructure, jobs, network, service, strategy, update, vulnerability

AWS allegedly rolled back a fix: BeyondTrust said it discovered and reported the vulnerability to AWS on September 1, 2025, via the bug bounty platform HackerOne. AWS reportedly acknowledged receipt of the report and deployed an initial fix to production in November.However, BeyondTrust was informed a few days later that the initial fix was rolled…
Researchers Find Data Leak Risk in AWS Bedrock AI Code Interpreter

Mar 17, 2026 1:11 AM

Tags: ai, cloud, data, dns, flaw, leak, risk, tool

AWS Bedrock AI tool flaw allows data leaks via DNS queries in AgentCore Code Interpreter sandbox, exposing sensitive cloud data, researchers warn. First seen on hackread.com Jump to article: hackread.com/data-leak-risk-in-aws-bedrock-ai-code-interpreter/
Security Flaw in AWS Bedrock Code Interpreter Raises Alarms

Mar 16, 2026 3:10 PM

Tags: ai, attack, cloud, data, dns, flaw

DNS-based attack in AWS Bedrock AgentCore lets AI sandboxes exfiltrate cloud data First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/security-flaw-aws-bedrock/
Privacy Protection: Encrypted DNS

Mar 14, 2026 1:10 PM

Tags: dns, privacy

Encrypted DNS (Domain Name System) refers to modern protocols that secure DNS queries by encrypting them between a user’s device and the DNS resolver. Instead First seen on hackingarticles.in Jump to article: www.hackingarticles.in/privacy-protection-encrypted-dns/
China-nexus Threat Actor Targets Persian Gulf Region With PlugX

Mar 13, 2026 1:10 AM

Tags: access, api, attack, backdoor, china, cloud, control, data, dns, dos, group, Hardware, injection, iran, malicious, malware, microsoft, middle-east, reverse-engineering, service, social-engineering, software, startup, threat, tool, update, windows

IntroductionOn March 1, 2026, ThreatLabz observed new activity from a China-nexus threat actor targeting countries in the Persian Gulf region. The activity took place within the first 24 hours of the renewed conflict in the Middle East. The threat actor quickly weaponized the theme of the conflict, using an Arabic-language document lure depicting missile attacks for…
Hackers abuse .arpa DNS and ipv6 to evade phishing defenses

Mar 8, 2026 3:47 PM

Tags: defense, dns, email, hacker, phishing, threat

Threat actors are abusing the special-use “.arpa” domain and IPv6 reverse DNS in phishing campaigns that more easily evade domain reputation checks and email security gateways. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-abuse-arpa-dns-and-ipv6-to-evade-phishing-defenses/
Defending Against Iranian Cyber Threats in the Wake of Operation Epic Fury

Mar 6, 2026 12:47 AM

Tags: attack, cyber, cyberattack, dns, government, infrastructure, Internet, iran, military, threat

On February 28, 2026, the United States and Israel launched Operation Epic Fury (U.S.) and Operation Roaring Lion (Israel), a coordinated military and cyber campaign targeting Iranian military installations, IRGC leadership, and government infrastructure. U.S. Cyber Command was designated the “first mover,” with cyber operations beginning before any kinetic weapons were deployed. In the first…
14 old software bugs that took way too long to squash

Mar 5, 2026 8:46 AM

Tags: access, api, attack, authentication, automation, bug-bounty, communications, computer, control, credentials, cve, cvss, cyber, data, data-breach, dns, dos, encryption, exploit, flaw, hacker, Hardware, infosec, infrastructure, Internet, kaspersky, linux, malicious, malware, microsoft, mitigation, network, nist, open-source, password, programming, remote-code-execution, risk, service, software, stuxnet, supply-chain, technology, theft, threat, tool, update, usa, vulnerability, windows, zero-day

Age: 30 yearsDate introduced: 1995Date fixed: February 2026Researchers unearthed a legacy flaw in the widely used libpng open-source library that had existed since the technology was first released more than 30 years ago.The heap buffer overflow vulnerability (CVE-2026-25646) meant that applications using the flawed software would crash when presented with a maliciously constructed PNG raster…
14 old software bugs that took way too long to squash

Mar 5, 2026 8:46 AM

Tags: access, api, attack, authentication, automation, bug-bounty, communications, computer, control, credentials, cve, cvss, cyber, data, data-breach, dns, dos, encryption, exploit, flaw, hacker, Hardware, infosec, infrastructure, Internet, kaspersky, linux, malicious, malware, microsoft, mitigation, network, nist, open-source, password, programming, remote-code-execution, risk, service, software, stuxnet, supply-chain, technology, theft, threat, tool, update, usa, vulnerability, windows, zero-day

Age: 30 yearsDate introduced: 1995Date fixed: February 2026Researchers unearthed a legacy flaw in the widely used libpng open-source library that had existed since the technology was first released more than 30 years ago.The heap buffer overflow vulnerability (CVE-2026-25646) meant that applications using the flawed software would crash when presented with a maliciously constructed PNG raster…
Hackers Abuse .arpa Top-Level Domain to Host Phishing Scams

Mar 3, 2026 3:47 PM

Tags: dns, hacker, phishing, scam

Hackers abuse the .arpa Top-Level Domain to host phishing scams, using IPv6 tunnels, reverse DNS tricks, and shadow domains to bypass security checks. First seen on hackread.com Jump to article: hackread.com/hackers-arpa-top-level-domain-phishing-scams/
Vulnerability monitoring service secures public-sector websites faster

Mar 2, 2026 9:48 PM

Tags: business, ceo, cyber, dns, government, Internet, monitoring, office, resilience, risk, service, skills, technology, threat, tool, update, vulnerability

Tools good, talk better: The UK government’s VMS uses a combination of commercial and proprietary scanning tools to detect vulnerabilities in internet-facing assets.But McKay cautions against drawing the wrong conclusion from the results.”Process, accountability and taking ownership for explaining why this matters to the resilience of the business is far more important than the technical…
A fake FileZilla site hosts a malicious download

Mar 2, 2026 5:47 PM

Tags: dns, malicious

A tampered copy of FileZilla quietly contacts attacker-controlled servers using encrypted DNS traffic that can slip past traditional monitoring. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/a-fake-filezilla-site-hosts-a-malicious-download/
UAT-10027 Targets U.S. Education and Healthcare with Dohdoor Backdoor

Feb 26, 2026 5:37 PM

Tags: attack, backdoor, cisco, dns, healthcare, malicious, threat

A previously undocumented threat activity cluster has been attributed to an ongoing malicious campaign targeting education and healthcare sectors in the U.S. since at least December 2025.The campaign is being tracked by Cisco Talos under the moniker UAT-10027. The end goal of the attacks is to deliver a never-before-seen backdoor codenamed Dohdoor.”Dohdoor utilizes the DNS-over-HTTPS…