Tag: infrastructure
-
Dadsec Hacker Group Uses Tycoon2FA Infrastructure to Steal Office365 Credentials
Tags: credentials, cyber, cybersecurity, group, hacker, infrastructure, intelligence, microsoft, phishing, service, threatCybersecurity researchers from Trustwave’s Threat Intelligence Team have uncovered a large-scale phishing campaign orchestrated by the notorious hacker group Storm-1575, also known as >>Dadsec.
-
FBI Flags Philippines Tech Company Behind Crypto Scam Infrastructure
The FBI provided details of Funnull’s malicious activities, selling infrastructure to criminal groups to facilitate cryptocurrency fraud in the US First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/fbi-philippines-crypto-scam/
-
U.S. Sanctions Funnull for $200M Romance Baiting Scams Tied to Crypto Fraud
The U.S. Department of Treasury’s Office of Foreign Assets Control (OFAC) has levied sanctions against a Philippines-based company named Funnull Technology Inc. and its administrator Liu Lizhi for providing infrastructure to conduct romance baiting scams that led to massive cryptocurrency losses.The Treasury accused the Taguig-headquartered company of enabling thousands of websites involved in First seen…
-
Critical Cisco IOS XE Flaw Permits Arbitrary File Upload, PoC Released
A critical security vulnerability, tracked as CVE-2025-20188, has been discovered in Cisco IOS XE Wireless LAN Controllers (WLCs), threatening enterprise wireless infrastructures worldwide. This flaw, scoring a maximum 10.0 on the CVSS scale, allows unauthenticated remote attackers to upload arbitrary files and potentially execute commands as root, granting full control over affected devices. The vulnerability…
-
Attack Surface Management: Online-Angriffsflächen erkennen, bewerten und minimieren
Ein falsch konfigurierter Cloud-Speicher, eine vergessene Subdomain, ein veralteter Webserver oder eine unentdeckte Drittanbieter-Anwendung manchmal genügt ein einziges übersehenes System, das zum Einfallstor für Angreifer in die IT-Infrastruktur von Unternehmen, Behörden oder öffentlichen Einrichtungen werden kann. Oftmals fehlt jedoch der vollständige Überblick über alle Internet-Assets, Geschäftsprozesse oder Dienstleistungen. Solche blinden Flecken in der eigenen… First…
-
Poisoned models in fake Alibaba SDKs show challenges of securing AI supply chains
Malicious code in ML models is hard to detect: While Hugging Face hosts models directly, PyPI hosts Python software packages, so detection of poisoned models hidden inside Pickle files hidden inside packages could prove even harder for developers and PyPI’s maintainers, given the extra layer of obfuscation.The attack campaign discovered by ReversingLabs involved three packages:…
-
CISA’s New SIEM Guidance Tackles Visibility and Blind Spots
US, Australian Cyber Agencies Say Visibility Gaps Threaten Detection and Response. The Cybersecurity and Infrastructure Security Agency issued new guidance urging organizations to streamline Security Information and Event Management platform integration by prioritizing impactful log data and reducing blind spots that continue to plague even mature security operations centers. First seen on govinfosecurity.com Jump to…
-
APT41 Uses Google Calendar Events for C2
APT41, a Chinese state-sponsored threat actor also known as Double Dragon, used Google Calendar as command-and-control infrastructure during a campaign last fall. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/apt41-uses-google-calendar-events-c2
-
ConnectWise ScreenConnect infrastructure hack confirmed
Tags: infrastructureFirst seen on scworld.com Jump to article: www.scworld.com/brief/connectwise-screenconnect-infrastructure-hack-confirmed
-
Threat Actors Exploit Nifty[.]com Infrastructure in Sophisticated Phishing Attack
Threat actors have orchestrated a multi-wave phishing campaign between April and May 2025, leveraging the legitimate infrastructure of Nifty[.]com, a prominent Japanese Internet Service Provider (ISP), to execute their attacks. Uncovered by Raven, a leading threat detection entity, this operation stands out due to its ability to evade conventional email security systems by abusing trusted…
-
US government sanctions tech company involved in cyber scams
The Treasury said FUNNULL was involved in providing infrastructure for pig butchering crypto scams. First seen on techcrunch.com Jump to article: techcrunch.com/2025/05/29/us-government-sanctions-tech-company-involved-in-cyber-scams/
-
Southeast Asian provider of ‘infrastructure laundering’ for scams is sanctioned by US
Funnull Technology supports “hundreds of thousands of websites” dedicated to the scams, otherwise known as pig butchering, according to the sanctions announcement by the Treasury Department’s Office of Foreign Assets Control. First seen on therecord.media Jump to article: therecord.media/southeast-asian-provider-of-scam-infrastructure-sanctioned
-
Attackers are mapping your attack surface”, are you?
Attackers are mapping your infrastructure before you even realize what’s exposed. Sprocket ASM flips the script, giving you the same recon capabilities they use, plus change detection and actionable insights to close gaps fast. See your attack surface the way hackers do and beat them to it. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/attackers-are-mapping-your-attack-surface-are-you/
-
CISA Issues SOAR, SIEM Implementation Guidance
The Cybersecurity and Infrastructure Security Agency (CISA) and Australian Cyber Security Centre (ACSC) recommend that organizations conduct thorough testing and manage costs, which can be hefty, before implementing the platforms. First seen on darkreading.com Jump to article: www.darkreading.com/cybersecurity-operations/cisa-soar-siem-implementation-guidance
-
Your IT Infrastructure is Hybrid. So Why Not Your Security Model?
Tags: infrastructureA hybrid security model provides the ability to deploy a variety of rule sets for specific applications while providing a single, centralized way to manage it all. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/05/your-it-infrastructure-is-hybrid-so-why-not-your-security-model/
-
‘Haozi’ Gang Sells Turnkey Phishing Tools to Amateurs
The phishing operation is using Telegram groups to sell a phishing-as-a-service kit with customer service, a mascot, and infrastructure that requires little technical knowledge to install. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/haozi-gang-sells-turnkey-phishing-tools-amateurs
-
Nvidia CEO Huang Warns Export Bans Empower Chinese AI Firms
Huang Says Rules Shut Nvidia Out of $50B China Market, Gives Rivals Long-Term Edge. CEO Jensen Huang says new U.S. chip restrictions on China forced Nvidia to write down $4.5 billion in AI inventory and will hurt American leadership in global infrastructure as Chinese firms gain momentum. The rules fuel China’s rise and jeopardize U.S.…
-
CISA’s Leadership Exodus Continues, Shaking Local Offices
‘It’s Just Totally Destabilizing,’ Staffers Say Amid CISA’s Leadership Exodus. An ongoing exodus of top officials and senior leadership at the Cybersecurity and Infrastructure Security Agency’s regional offices has left staffers increasingly worried about a potential major shift in mission and continued cuts to staff and spending. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/cisas-leadership-exodus-continues-shaking-local-offices-a-28527
-
Microsoft, Dutch government discover new Russian hacking group
The findings highlight the vulnerability of all critical infrastructure firms to similar attack methods. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/russia-ukraine-logistics-laundry-bear-microsoft-netherlands/749143/
-
Zscaler Buys Red Canary to Elevate AI-Driven Threat Response
Red Canary Purchase Aims to Deliver Agentic AI-Powered Security Operations at Scale. Zscaler’s buy of Red Canary will unify its cloud-based security infrastructure with Red Canary’s MDR insights, giving rise to a next-gen SOC built on automation, AI, and rapid detection expertise. The integration will support a proactive SOC experience powered by AI workflows and…
-
Worldwide Operation Shuts Down Hundreds of Ransomware Servers and Domains, Ending Key Attack Infrastructure
Law enforcement and judicial officials, working together with Europol and Eurojust, have dealt a devastating blow to the worldwide ransomware ecosystem in a historic international operation. From May 19 to 22, 2025, Operation Endgame targeted the critical infrastructure behind ransomware attacks, dismantling approximately 300 servers and neutralizing 650 malicious domains worldwide. This operation not only…
-
Evertz SDN Vulnerabilities Enable Unauthenticated Arbitrary Command Execution
A newly disclosed critical vulnerability (CVE-2025-4009) in Evertz’s Software Defined Video Network (SDVN) product line exposes a wide range of broadcasting infrastructure to unauthenticated remote code execution. The flaw, uncovered by ONEKEY Research Labs, affects the core web administration interface shared by multiple Evertz devices, putting global media operations at risk. Unauthenticated Arbitrary Command Injection…
-
Russian APT28 Hackers Attacking NATO-aligned Organizations to Steal Sensitive Data
Russia’s GRU-backed APT28, widely known as Fancy Bear, has intensified its cyber espionage campaign against NATO-aligned organizations. Active since at least 2007, this notorious threat actor has been attributed to a series of sophisticated attacks targeting critical infrastructure, government entities, and logistics firms across the United States, United Kingdom, Germany, Canada, Poland, Ukraine, and other…
-
Microsoft, Dutch government spot new Russian hacking group targeting critical infrastructure
The findings highlight the vulnerability of all critical infrastructure firms to similar attack methods. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/russia-ukraine-logistics-laundry-bear-microsoft-netherlands/749143/
-
Czechia blames China for Ministry of Foreign Affairs cyberattack
The Czech Republic says the Chinese-backed APT31 hacking group was behind cyberattacks targeting the country’s Ministry of Foreign Affairs and critical infrastructure organizations. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/czechia-blames-china-for-ministry-of-foreign-affairs-cyberattack/
-
The hidden risk lurking in your infrastructure: mismanaged certificates
Mismanaged certificates in hybrid environments pose a critical but often invisible risk to enterprise operations. Expired internal PKI certificates can lead to costly outages, compliance failures, and long-term damage especially in regulated industries. As digital transformation accelerates certificate use, fragmented tools fail to keep pace. Automation and centralized internal PKI systems reduce risk, ensure operational…
-
Microsoft wants Windows to update all software on your PC
Microsoft has introduced a new update orchestration platform built on the existing Windows Update infrastructure, which aims to unify the updating system for all apps, drivers, and system components on Windows systems. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-wants-windows-to-update-all-software-on-your-pc/
-
CISA Publishes ICS Advisories Highlighting New Vulnerabilities and Exploits
Tags: access, cisa, control, cyber, cybersecurity, exploit, government, infrastructure, service, tool, vulnerabilityOn May 27, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) released a new Industrial Control Systems (ICS) advisory”, ICSA-25-146-01″, highlighting a significant security vulnerability in the Johnson Controls iSTAR Configuration Utility (ICU) Tool. This tool is widely deployed for configuring and managing access control systems across critical infrastructure sectors, including commercial facilities, energy, government…
-
Salt Typhoon Believed to Be Behind Commvault Data Breach
Tags: advisory, backup, breach, china, cisa, cloud, credentials, data, data-breach, group, hacking, infrastructure, microsoft, threat, vulnerabilityCISA Advisory Says Threat Actors Stole App Secrets in Azure-Hosted Backup Platform. A suspected Chinese state hacking group linked to last year’s telecom intrusions breached Commvault’s Microsoft Azure environment, exposing sensitive Microsoft 365 credentials and reigniting fears over U.S. cloud infrastructure vulnerabilities and default security settings. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/salt-typhoon-believed-to-be-behind-commvault-data-breach-a-28496