Tag: group
-
Russian threat actors using old Cisco bug to target critical infrastructure orgs
A threat group linked to the Russian Federal Security Service’s (FSB) Center 16 unit has been compromising unpatched and end-of-life Cisco networking devices via an old … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/08/21/cve-2018-0171-cisco-cyber-espionage/
-
MuddyWater APT Targets CFOs via OpenSSH; Enables RDP and Scheduled Tasks
A sophisticated spear-phishing campaign attributed to the Iranian-linked APT group MuddyWater is actively compromising CFOs and finance executives across Europe, North America, South America, Africa, and Asia. The attackers impersonate recruiters from Rothschild & Co, deploying Firebase-hosted phishing pages that incorporate custom math-based CAPTCHA challenges to evade detection and lend legitimacy. These lures lead victims…
-
Russian Espionage Group Static Tundra Targets Legacy Cisco Flaw
Russian state-backed hackers are exploiting a seven-year-old Cisco Smart Install vulnerability (CVE-2018-0171) in end-of-life devices, prompting warnings from the FBI and Cisco Talos First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/russian-espionage-group-targets/
-
Russian hackers exploit old Cisco flaw to target global enterprise networks
Six-year-old vulnerability still wreaking havoc: At the heart of this campaign lies CVE-2018-0171, a critical vulnerability that affected Cisco IOS software’s Smart Install feature and allowed unauthenticated remote attackers to execute arbitrary code or trigger denial-of-service conditions.Despite Cisco patching the flaw in 2018, Static Tundra continued exploiting unpatched devices, particularly those that reached end-of-life status,…
-
New SHAMOS Malware Targets macOS Through Fake Help Sites to Steal Login Credentials
Tags: credentials, crowdstrike, crypto, cyber, cybercrime, cybersecurity, data, group, login, macOS, malware, serviceCybersecurity researchers at CrowdStrike identified and thwarted a sophisticated malware campaign deploying SHAMOS, an advanced variant of the Atomic macOS Stealer (AMOS) malware, orchestrated by the cybercriminal group COOKIE SPIDER. Operating under a malware-as-a-service model, COOKIE SPIDER rents out this information stealer to affiliates who target victims to harvest sensitive data, including login credentials, cryptocurrency…
-
Russian Hackers Exploit 7-Year-Old Cisco Flaw to Steal Industrial System Configs
Static Tundra, a Russian state-sponsored threat actor connected to the FSB’s Center 16 unit, has been responsible for a sustained cyber espionage effort, according to information released by Cisco Talos. Operating for over a decade, this group specializes in compromising network devices to facilitate long-term intelligence gathering, with a focus on extracting configuration data from…
-
Lenovo-Chatbot-Lücke wirft Schlaglicht auf KI-Sicherheitsrisiken
Über eine Schwachstelle in Lenovos Chatbot für den Kundensupport ist es Forschern gelungen, Schadcode einzuschleusen.Der Chatbot ‘Lena” von Lenovo basiert auf GPT-4 von OpenAI und wird für den Kundensupport verwendet. Sicherheitsforscher von Cybernews fanden heraus, dass das KI-Tool anfällig für Cross-Site-Scripting-Angriffe (XSS) war. Die Experten haben eine Schwachstelle entdeckt, über die sie schädliche HTML-Inhalte generieren…
-
UNC5518 Group Hacks Legitimate Sites with Fake Captcha to Deliver Malware
The financially motivated threat group UNC5518 has been infiltrating trustworthy websites to install ClickFix lures, which are misleading phony CAPTCHA pages, as part of a complex cyber campaign that has been monitored since June 2024. These malicious pages trick users into executing downloader scripts that initiate infection chains, often leading to malware deployment by affiliated…
-
FBI: Russia-linked group Static Tundra exploit old Cisco flaw for espionage
FBI warns FSB-linked group Static Tundra is exploiting a 7-year-old Cisco IOS/IOS XE flaw to gain persistent access for cyber espionage. The FBI warns that Russia-linked threat actor Static Tundra exploits Simple Network Management Protocol (SNMP) and end-of-life networking devices running an unpatched vulnerability (CVE-2018-0171) in Cisco Smart Install (SMI) to target organizations in the…
-
Enterprise passwords becoming even easier to steal and abuse
Tags: access, attack, authentication, breach, ceo, ciso, compliance, control, credentials, cyber, cybersecurity, data, detection, encryption, exploit, extortion, group, identity, leak, mfa, monitoring, passkey, password, phishing, ransomware, risk, strategy, threat, tool, zero-trustGrowing threat from stolen credentials: Attackers actively target user credentials because they offer the most direct route or foothold into a targeted organization’s network. Once inside, attackers can move laterally across systems, searching for other user accounts to compromise, or they attempt to escalate their privileges and gain administrative control.This hunt for credentials extends beyond…
-
Orange Belgium discloses data breach impacting 850,000 customers
Orange Belgium, a subsidiary of telecommunications giant Orange Group, disclosed on Wednesday that attackers who breached its systems in July have stolen the data of approximately 850,000 customers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/orange-belgium-discloses-data-breach-impacting-850-000-customers/
-
Hacktivist Tied to Multiple Cyber Groups Sentenced to Jail
At one point, Al-Tahery Al-Mashriky was hacking thousands of websites within the span of three months while stealing personal data and sensitive information. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/hacktivist-sentenced-jail
-
Russian state cyber group Static Tundra exploiting Cisco devices, FBI warns
A Russian cyber-espionage group is increasingly targeting unpatched Cisco networking devices through a vulnerability first discovered in 2018, the FBI warned. First seen on therecord.media Jump to article: therecord.media/russia-cisco-fsb-static-tundra
-
FBI Warns FSB-Linked Hackers Exploiting Unpatched Cisco Devices for Cyber Espionage
A Russian state-sponsored cyber espionage group known as Static Tundra has been observed actively exploiting a seven-year-old security flaw in Cisco IOS and Cisco IOS XE software as a means to establish persistent access to target networks.Cisco Talos, which disclosed details of the activity, said the attacks single out organizations in telecommunications, higher education and…
-
Russian cyber group exploits seven-year-old network vulnerabilities for long-term espionage
The group, linked to FSB Center 16, has been scanning the internet for end-of-life software, which it has found in droves. First seen on cyberscoop.com Jump to article: cyberscoop.com/russian-static-tundra-hacks-cisco-network-devices-cve-2018-0171/
-
Scaly Wolf Unleashing Attacks to Expose Organizations’ Hidden Secrets
The Scaly Wolf advanced persistent threat (APT) gang has once again targeted a Russian engineering company in a sophisticated targeted attack that was discovered by Doctor Web’s analysts. This shows that the group is determined to obtain corporate secrets. This incident, occurring in mid-2025, echoes a similar assault in 2023, where the group employed modular…
-
Scaly Wolf Unleashing Attacks to Expose Organizations’ Hidden Secrets
The Scaly Wolf advanced persistent threat (APT) gang has once again targeted a Russian engineering company in a sophisticated targeted attack that was discovered by Doctor Web’s analysts. This shows that the group is determined to obtain corporate secrets. This incident, occurring in mid-2025, echoes a similar assault in 2023, where the group employed modular…
-
Scaly Wolf Unleashing Attacks to Expose Organizations’ Hidden Secrets
The Scaly Wolf advanced persistent threat (APT) gang has once again targeted a Russian engineering company in a sophisticated targeted attack that was discovered by Doctor Web’s analysts. This shows that the group is determined to obtain corporate secrets. This incident, occurring in mid-2025, echoes a similar assault in 2023, where the group employed modular…
-
Survey: Enterprise IT Teams Spend 11 Hours Investigating Identity Incidents
A survey of 370 IT and cybersecurity decision makers in organizations with at least 100 employees published today finds, on average, enterprise IT organizations are spending 11 person-hours investigating and remediating each critical identity-related security alert. Conducted by Enterprise Strategy Group (ESG) on behalf of Teleport, a provider of a platform for securing access to..…
-
Lenovo chatbot breach highlights AI security blind spots in customer-facing systems
Enterprise-wide implications: While the immediate impact involved session cookie theft, the vulnerability’s implications extended far beyond data exfiltration.The researchers warned that the same vulnerability could enable attackers to alter support interfaces, deploy keyloggers, launch phishing attacks, and execute system commands that could install backdoors and enable lateral movement across network infrastructure.”Using the stolen support agent’s…
-
Russian investment platform confirms cyberattack by pro-Ukraine hackers
The Russian platform Investment Projects said it is working to restore its infrastructure following a cyberattack claimed by the pro-Ukraine group Cyber Anarchy Squad. First seen on therecord.media Jump to article: therecord.media/russia-cyberattack-investment-platform-ukraine
-
Russian state-sponsored espionage group Static Tundra compromises unpatched end-of-life network devices
A Russian state-sponsored group, Static Tundra, is exploiting an old Cisco IOS vulnerability to compromise unpatched network devices worldwide, targeting key sectors for intelligence gathering. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/static-tundra/
-
Russian state-sponsored espionage group Static Tundra compromises unpatched end-of-life network devices
A Russian state-sponsored group, Static Tundra, is exploiting an old Cisco IOS vulnerability to compromise unpatched network devices worldwide, targeting key sectors for intelligence gathering. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/static-tundra/
-
Enrollment Policies for Passwordless Authentication
Learn how to create effective enrollment policies for passwordless authentication, covering user groups, risk assessment, conditional access, and best practices for a secure transition. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/08/enrollment-policies-for-passwordless-authentication/
-
The U.S. should bolster investment reviews to combat China
The Committee on Foreign Investment in the United States just published its 2024 report, revealing once again that shielding U.S. tech from risky foreign investments was a critical focus for the interagency group that reviews investments in the United States for national security risks. But as U.S.-China tensions further intensify, bolstering these reviews is even…
-
Pharmaceutical firm Inotiv discloses ransomware attack. Qilin group claims responsibility for the hack
Pharmaceutical firm Inotiv says a ransomware attack encrypted systems and data, disrupting operations, according to its SEC filing. U.S. pharmaceutical firm Inotiv reported a ransomware attack that encrypted some systems and data, disrupting business operations. Inotiv is a U.S.-based pharmaceutical research and contract research organization (CRO). It provides nonclinical and analytical drug discovery and development…
-
NIST’s attempts to secure AI yield many questions, no answers
Challenges to consider: The NIST report talked about various categories of AI integration that forced serious cybersecurity considerations, including: using genAI to create new content; fine-tuning predictive AI; using single AI agents as well multiple agents; and security controls for AI developers. The potentially most challenging element of securing AI in enterprises is visibility. But the…
-
Surprise departure of Oracle security chief as company shifts focus to AI
Full disclosure: In fairness, Oracle was far from alone in being slow to adopt the idea that software vendors needed to turn patching into a core security function while acknowledging that vulnerability hunters were allies in disguise rather than enemies.Nevertheless, occasional missteps have continued up to the present, most recently in the evasive and confused…