Tag: hacker
-
AI-Assisted Hackers Compromise Government Linux Servers to Deploy Backdoors and Steal Credentials
Hackers used AI-assisted scripts to compromise government Linux servers, harvest administrator credentials, and establish persistent backdoors during a campaign observed between October 2025 and April 2026. The cluster remains unattributed. Under Unit 42’s attribution framework, “UNK” indicates that researchers have not determined whether the activity is state-sponsored or financially motivated. Its intelligence-gathering behavior does not…
-
AI-Assisted Hackers Compromise Government Linux Servers to Deploy Backdoors and Steal Credentials
Hackers used AI-assisted scripts to compromise government Linux servers, harvest administrator credentials, and establish persistent backdoors during a campaign observed between October 2025 and April 2026. The cluster remains unattributed. Under Unit 42’s attribution framework, “UNK” indicates that researchers have not determined whether the activity is state-sponsored or financially motivated. Its intelligence-gathering behavior does not…
-
Not cool: who hacked France’s supermarket fridges?
Whether it was youngsters proving their skills or state sabotage, Europe’s most hacked country was left with a mountain of waste after food began cooking in freezersShortly before midnight last Sunday, the digital thermostats controlling hundreds of supermarket cold aisles across France began to flicker and rise.In a <a href=”https://www.theguardian.com/world/2026/oct/12/cyber-attack-defrosts-refrigerators-france-supermarket-chains-intermarche-cooperative-u”>”bizarre and unprecedented” cyber-attack, hackers had…
-
Critical BlockStrap flaw lets hackers run code on Magento servers
Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/critical-blockstrap-flaw-lets-hackers-run-code-on-magento-servers/
-
China-nexus espionage actor targets BeyondTrust support tool in zero-day campaign
Researchers say the hacker is harvesting credentials and stealing sensitive information. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/china-espionage-beyondtrust-zero-day-hacker/833240/
-
Moscow police detain suspected DataSuckers hackers linked to breaches in Ukraine and Russia
Russian authorities have reportedly detained three suspected members of the DataSuckers hacking group following a cyberattack on a popular restaurant chain that exposed vast amounts of customer information. First seen on therecord.media Jump to article: therecord.media/russia-datasuckers-hackers-arrested
-
Moscow police detain suspected DataSuckers hackers linked to breaches in Ukraine and Russia
Russian authorities have reportedly detained three suspected members of the DataSuckers hacking group following a cyberattack on a popular restaurant chain that exposed vast amounts of customer information. First seen on therecord.media Jump to article: therecord.media/russia-datasuckers-hackers-arrested
-
Moscow police detain suspected DataSuckers hackers linked to breaches in Ukraine and Russia
Russian authorities have reportedly detained three suspected members of the DataSuckers hacking group following a cyberattack on a popular restaurant chain that exposed vast amounts of customer information. First seen on therecord.media Jump to article: therecord.media/russia-datasuckers-hackers-arrested
-
Hackers disguise phishing as promising business opportunities
Attackers are breaking into business email accounts with short messages asking whether a company can quote on an upcoming project, the kind of request sales and procurement … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/16/rfq-phishing-emails-sales-procurement-staff/
-
Warnung des BSI: Angriffe auf Zero-Day-Lücke in Cisco Secure Email Gateway
Der Malware-Scanner von Ciscos Secure Email Gateway reagiert fehlerhaft auf speziell gestaltete E-Mails. Hacker erhalten so Root-Rechte. First seen on golem.de Jump to article: www.golem.de/news/warnung-des-bsi-angriffe-auf-zero-day-luecke-in-cisco-secure-email-gateway-2610-214183.html
-
Hackers Exploit BeyondTrust Zero-Day and Erase Security Logs to Hide Their Tracks
A suspected China-nexus espionage group exploited a critical zero-day in BeyondTrust Remote Support, tracked as CVE-2026-102764. It then deleted logs to hide its activity. BeyondTrust patched the flaw in advisory BT26-05 and disclosed it on October 15, 2026, alongside a Mandiant analysis. BeyondTrust zero-day According to research published by BeyondTrust, the actor exploited the vulnerability…
-
Hackers Use Hundreds of AI Agents to Exploit PaperCut Servers and Steal Windows Credentials
A likely Russian-speaking threat actor used hundreds of AI agents to exploit PaperCut NG/MF servers, steal Windows credentials and establish reusable access to internal networks. GreyNoise identified at least 440 compromised instances belonging to 395 organizations across 48 countries, demonstrating how agent-assisted workflows can accelerate exploitation of enterprise infrastructure. The operator combined OpenAI’s Codex harness…
-
China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026.The vulnerability, tracked as CVE-2026-102764 (CVSS score: 9.3), is a case of improper origin validation in an internal messaging component that could be…
-
Hackers Target Claude, ChatGPT and Cursor Credentials Using Aoki Infostealer
The Aoki infostealer, also known as Aokigahara, has expanded its collection capabilities to steal credentials and session files from AI coding assistants, putting developer identities and connected infrastructure at risk. First observed earlier in 2026, Aoki previously lacked collection routines for AI applications. Their appearance in recent samples indicates active development, with attackers broadening their…
-
Vom Fernzugriff zum Warenschaden: Warum vernetzte Kühltechnik besser geschützt werden muss
Wenn Hacker die Kühlkette kappen Lehren aus den Angriffen auf französische Supermärkte. Cyberangriffe auf vernetzte Kühlanlagen machen aus einer digitalen Schwachstelle binnen Stunden ein reales Geschäftsrisiko: Waren verderben, Filialen geraten unter Druck und physische Schäden werden möglich. Die Vorfälle in französischen Supermärkten zeigen, warum Unternehmen ihre Betriebstechnik systematisch erfassen, Fernzugänge absichern, Altsysteme isolieren und… First…
-
Stolen AI API keys are paying for hackers’ autonomous scans
A seller on a restricted criminal forum is marketing an autonomous hacking tool that runs on stolen OpenAI, Anthropic and Google API keys, so the key’s owner pays for … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/16/stolen-ai-api-keys-autonomous-scans/
-
Google Warns Chinese Hackers Exploited Critical BeyondTrust Zero-Day to Gain Root Access
A suspected China-linked espionage group exploited a critical BeyondTrust Remote Support vulnerability as a zero-day in late August 2026 weeks before BeyondTrust disclosed it on October 15. Mandiant, which investigated the incident, found the attackers used the flaw to upload a file, then built a path from an unprivileged web service account to root access,…
-
Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers
Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online – Built-in CODE Server app (richdocumentscode) for Nextcloud. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/
-
Silent Lynx: Kazakhstan-Linked Hackers Target Russian Refinery and Government
Silent Lynx, a group likely based in Kazakhstan, targets Russian energy and government entities in espionage campaigns across Central Asia. Researchers from Cisco Talos and Recorded Future published a detailed paper on a threat actor they call Silent Lynx (aka UAT-6275, TAG-193), a Kazakhstan nexus group conducting espionage across Central Asia. The targets include the…
-
Cryptohack Roundup: Ledger Halts Sales Amid $86M Theft Probe
Also: UK Sanctions Crypto Exchanges Over Russian Sanctions Evasion. This week, Ledger halted wallet sales across Asia, the United Kingdom sanctioned a crypto exchange for evading sanctions on Russia, hackers deployed cryptocurrency miners through AhsayCBS flaws, a British court ruled on a $5 billion bitcoin ownership dispute and XRP Ledger fixed a token-creation bug. First…
-
Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth
A proxyjacking campaign has impacted devices in 34 countries, monetizing victims’ internet connections through a commercial residential proxy network. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-hijack-d-link-ubiquiti-devices-to-resell-your-stolen-bandwidth/
-
Frustrated Ransomware Gangs Turn to Real World Threats
Tags: business, cyber, cybersecurity, defense, extortion, hacker, identity, ransomware, resilience, threatRansomware Hackers Discover Violence as Digital Defenses Stymie Extortion. Ransomware gangs are turning to real world threats against business executives and even their families, to gain an edge in negotiations as enterprises boost their cyber resilience and become less willing to pay extortion, finds a survey commissioned by identity-centered cybersecurity firm Semperis First seen on…
-
The Guardian view on food security: we have justtime, we need justcase | Editorial
Experts are warning that the UK is unprepared for crises. A refrigerator cyber-attack scare in France is the latest reminder of the risksWhat’s worrying French supermarket bosses should be prompting British ministers to action. On Sunday, hackers <a href=”https://www.theguardian.com/world/2026/oct/12/cyber-attack-defrosts-refrigerators-france-supermarket-chains-intermarche-cooperative-u”>forced up the temperatures of refrigerators in hundreds of food stores across France to as high as…
-
Suspected Kazakhstan-linked hackers target governments across former Soviet states
A roughly 2-year-old cyber-espionage campaign against Central Asian states appears to originate in Kazakhstan, researchers said. First seen on therecord.media Jump to article: therecord.media/suspected-kazakhstan-phishing-central-asia-espionage
-
Hackers Use Online Ads to Infect Devices With Spyware Without a Single Click
Citizen Lab has confirmed the first public case of zero-click mercenary spyware delivered through targeted online ads. It calls the technique >>AdFection<<. The attack hit devices at Al Jazeera with Candiru spyware, and the ads were bought by an Israeli ad-tech firm called Discover-Tech. zero-click spyware attacks Online ads are sold in real-time auctions that…
-
Hackers Steal UK Legal Aid Records Dating Back to 1978 in Major Cyberattack
The UK’s Legal Aid Agency (LAA) now says the 2025 data breach exposed far older data than first reported. About 250,000 stolen records predate 2007, and the earliest verified record is from 1978. UK legal aid cyberattack The LAA identified a cyber-attack on its online digital services on Wednesday 23 April 2025. It secured its…
-
(g+) Organisierte Cyberkriminalität: Wie Hacker Mitarbeiter für ihre Angriffe kaufen
Im Untergrund werden Mitarbeiter für Cyberangriffe angeworben. Ein Forscher erklärt das Geschäft mit bestechlichen Insidern und wie Firmen sich schützen können. First seen on golem.de Jump to article: www.golem.de/news/organisierte-cyberkriminalitaet-wie-hacker-mitarbeiter-fuer-ihre-angriffe-kaufen-2610-214141.html
-
UK Legal Aid Agency: Hackers stole records dating back to 1978
The Legal Aid Agency (LAA), an executive agency of the UK’s Ministry of Justice that manages the country’s Public Defender Service, says attackers who breached its IT systems in April 2025 stole records dating back to 1978. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/uk-legal-aid-agency-hackers-stole-records-dating-back-to-1978/
-
UAT-6275 Hackers Use WinRAR Exploit and GitHub PowerShell to Target CIS Governments
An espionage campaign targeting government organizations across the Commonwealth of Independent States (CIS), with additional interest in water, environmental, and energy sectors. The investigation found four infection chains active from June 2025 through 2026. The attackers used macro-enabled Word documents, PS2EXE-built executables, malicious shortcuts that launched GitHub-hosted PowerShell, and a crafted WinRAR archive that exploited…
-
Pathology Lab Confirms Hack, But Disputes Data Theft Claims
South African Ampath Laboratories Doubts Hackers Stole 80 Million Patient Records. A major South African pathology laboratory confirmed on Wednesday that it’s responding to a recent cyber incident, but the company disputes claims by cybercriminals of a data theft affecting 80 million patients. The Ampath Laboratories hack is among the latest involving a medical testing…