Tag: hacker
-
Weak Certificates From Indian CA Cause Cascade of Updates
eMudhra Says It Mistakenly Used Weak Certificates to Sign 8 Intermediary Certs. An Indian certificate authority revoked intermediate certificates after a researcher found it used a private encryption key that was only one byte in length, making it trivial for hackers to recover the key and issue their own fraudulent certs. The issue has the…
-
Lazarus hackers use post-quantum cryptography for malware delivery
North Korean hackers are using a post-quantum cryptographic mechanism to secure malicious payload delivery in new operations that combine old and new malware. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/lazarus-hackers-use-post-quantum-cryptography-for-malware-delivery/
-
Weak encryption certificates could have let hackers easily spoof websites
Major web browsers blocked the eMudhra TLS certificates to prevent them from being weaponized. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/website-encryption-security-certificates-emudhra-incident/833622/
-
Hackers chain Plex flaws in Plex2Shell attacks to breach servers
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are actively exploiting four vulnerabilities in Plex Media Server. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-hackers-chain-plex-flaws-in-plex2shell-attacks-to-breach-servers/
-
Russia-linked hackers broke into NATO shipbuilder in latest espionage campaign
Symantec, which discovered the operation, urged companies to scan their networks for signs of compromise. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/russia-nato-hacking-shipbuilder-critical-infrastructure/833509/
-
AI Guardrails Aren’t Stopping Criminal Hackers
Hackers around the world are all-in on using agentic AI to wage attacks”, and manipulating tools like Anthropic’s Claude to help them carry out their crimes. First seen on wired.com Jump to article: www.wired.com/story/ai-guardrails-arent-stopping-criminal-hackers/
-
Gentlemen Ransomware Hackers Hijack Legitimate Lenovo Drivers to Disable Security Software
The Gentlemen ransomware operation is abusing legitimate Lenovo and Safetica kernel drivers to terminate security software, weakening endpoint defenses before encryption. Acronis Threat Research Unit researchers identified two custom dropper samples during a recent incident, exposing how the group weaponizes vulnerable drivers rather than relying exclusively on conventional process termination commands The technique, known as…
-
BRONZE SANDCASTLE Hackers Steal Active Directory Database Using Hidden Windows Backdoors
BRONZE SANDCASTLE intrusions involving hidden Windows backdoors and the theft of the Active Directory database. The suspected China-based group combines legitimate applications, malicious DLLs, and encrypted payloads to execute code inside trusted processes while limiting artifacts available to conventional file scanning. Investigations covering August 2025 through August 2026 identified victims in the Philippines, Taiwan, Afghanistan,…
-
China-Based BRONZE SANDCASTLE Hackers Abuse Sandboxie to Load Backdoors
Sophos found BRONZE SANDCASTLE abusing legitimate Windows apps to load encrypted backdoors, collect system information and steal Active… First seen on hackread.com Jump to article: hackread.com/china-bronze-sandcastle-hackers-sandboxie-backdoors/
-
Info-stealing malware slipped into OVHcloud CLI releases on GitHub
OVHcloud, the French cloud computing and web hosting company, alerted customers that a hacker tampered with its open-source command-line interface (CLI) tool to spread … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/21/ovhcloud-cli-github-malware/
-
Russian Hackers Steal Credentials and Open Secret SSH Tunnel Into NATO Defense Firm’s Network
Tags: blizzard, credentials, cyber, defense, espionage, government, group, hacker, intelligence, law, military, network, russiaSwallowtail, the Russian espionage group also tracked as APT28, Fancy Bear and Forest Blizzard, targeted organizations in two NATO member states, including a law enforcement agency, a naval shipbuilder and a manufacturer of military aircraft engines. The targets’ roles point to intelligence collection focused on national security and defense. The U.S. government identifies APT28 and…
-
Hackers Compromise 333 Tor Exit Nodes to Steal SSH Credentials and Deploy Ebury Malware
Attackers compromised 333 Tor exit nodes in a coordinated campaign to intercept SSH connections, steal passwords, and deploy the Ebury Linux backdoor, according to a research account published on October 20, 2026. The compromised infrastructure accounted for approximately 10% of Tor’s roughly 3,000 exit relays. The researcher reported that attackers accessed the underlying servers in…
-
Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion
A Belarus-aligned hacktivist group spent nearly two years within the network of a Russian healthcare organization.According to a report published by Russian cybersecurity firm Solar, the activity has been attributed to a threat cluster dubbed Partisan Zmiy, which is also known as the Cyber Partisans.Known to be active since at least 2020, the group has…
-
INC Ransomware Hackers Use Claude AI, Expose 8,257 Messages and 46 Malware Builds
Ransomware affiliates associated with INC and The Gentlemen exposed an intrusion ecosystem after leaving operational servers publicly accessible. The investigation began in late September 2026 with open directories on 45.227.254[.]43. Configuration files and credentials led researchers to six additional adversary servers, exposing development infrastructure, command infrastructure and ransomware staging systems. The findings describe an active…
-
Russian GRU hackers hit NATO shipbuilder, aircraft engine maker, law enforcement agency in espionage campaign
It’s the work of the infamous group behind the attacks on Democrats during the 2016 presidential election, Symantec said. First seen on cyberscoop.com Jump to article: cyberscoop.com/russian-hackers-apt28-target-nato-defense-firms/
-
Nikkei data breach affected over 1.8 million records
Nikkei disclosed a data breach affecting over 1.8 million records after hackers used stolen credentials to access a cloud service for system development. Japanese media company Nikkei has disclosed a data breach affecting more than 1.8 million records. The company, known for its financial news publications, including The Nikkei and the Financial Times, said attackers…
-
Nikkei data breach affected over 1.8 million records
Nikkei disclosed a data breach affecting over 1.8 million records after hackers used stolen credentials to access a cloud service for system development. Japanese media company Nikkei has disclosed a data breach affecting more than 1.8 million records. The company, known for its financial news publications, including The Nikkei and the Financial Times, said attackers…
-
Hackers Abuse AI Pen-Test Tool Cairn to Automate Massive Attack Spree
A Chinese-speaking attacker has compromised hundreds of websites across the globe, looting from big fish like John Deere, SharkNinja, and engine manufacturer Cummins. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/hackers-abuse-ai-pen-test-tool-cairn
-
Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites
A Chinese-speaking criminal pointed autonomous AI agents at company websites and let them break in with almost no help, and a security researcher watched it happen because the operators left their control panels open on the internet.The agents tried more than 1,200 sites and reached websites belonging to more than 100 companies, including farm-equipment maker…
-
AOMEI yet to notify customers after hackers hijacked its software updates
In an email, the Hong Kong-registered company confirmed to Recorded Future News that hackers repeatedly altered configuration files on its update servers between April and July, redirecting the software to download malware for minutes at a time. First seen on therecord.media Jump to article: therecord.media/aomei-yet-to-notify-customers-hijack-software
-
Incomplete security patches show hackers where to look next
Tags: hackerSecurity patches are turning into roadmaps for attackers, with a growing share of fixes later found incomplete or open to bypass. Oren Yomtov, a security researcher at Terra … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/20/ncomplete-security-patches-broken-fixes-rise/
-
Hacker gets 8 years for stealing $3.3 million from taxpayers
A Nigerian national was sentenced to eight years in prison for his involvement in a series of spearphishing attacks targeting US tax preparation businesses since 2019. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hacker-gets-8-years-for-stealing-33-million-from-taxpayers/
-
Hackers Compromise OVHcloud GitHub Repository to Distribute Secret-Stealing Malware
OVHcloud has reported a supply-chain attack involving its command-line interface (CLI) repository. An attacker exploited a developer’s GitHub account to distribute a malicious binary designed to steal sensitive information from users’ disks. CEO Octave Klaba confirmed the incident on October 19, 2026, after a customer reported it. The company identified the compromised release at 14:47…
-
Hackers Can Take Over WordPress Websites Without a Password Using Two Security Flaws
Hackers can compromise vulnerable WordPress websites without stealing passwords by chaining two security flaws in the platform’s core. Disclosed in July 2026, the chain involves CVE-2026-63030 and CVE-2026-60137. Unlike attacks dependent on vulnerable extensions, WP2Shell affects default WordPress installations without requiring a third-party plugin. Public exploit code and observed exploitation have made unpatched deployments an…
-
Hackers Exploit Zimbra Zero-Click Flaw to Take Control of Email Servers
Tags: authentication, control, cyber, data, email, exploit, flaw, hacker, injection, intelligence, Internet, microsoft, threat, vulnerabilityHackers are exploiting a command injection vulnerability (CVE-2026-73570) in the Zimbra Collaboration Suite. This vulnerability allows attackers to compromise internet-facing email servers without any user interaction. Microsoft Threat Intelligence has observed attackers deploying webshells, escalating privileges, collecting authentication secrets, and staging mailbox data across organizations in various regions and industries. Zimbra Zero-Click Flaw The >>zero-click<<…
-
Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware
An attacker used a contributor’s GitHub account to replace the download archives on five existing releases of OVHcloud’s command-line tool on Monday, October 19. The account had been hijacked, and the new files were a build designed to steal secrets stored on the disk of any machine that runs it, the cloud provider says.They were…
-
GhostAction Hackers Inject Malicious Security Workflows Into 790 GitHub Repositories
GhostAction has returned with an expanded credential-theft operation, injecting malicious GitHub Actions workflows into 790 repositories by October 9, 2026. GitGuardian first documented GhostAction in 2025, when it reported 817 affected repositories and 3,325 stolen secrets. The latest wave builds on the same account-takeover approach: attackers enumerate repositories a compromised maintainer can write to, then…
-
Hackers Turn Low-Cost Android Phones Into Hidden Proxy Botnets Through Preinstalled Malware
Midnight Mimosa, a widespread Android malware campaign, is turning inexpensive smartphones into advertising fraud engines and potential residential proxy nodes by embedding malicious apps in device firmware before purchase. Bitdefender observed thousands of infected devices across more than 150 countries over approximately two years, exposing a persistent compromise that ordinary application removal cannot resolve. The…