Tag: infrastructure
-
Middle Eastern critical infrastructure targeted by long-term Iranian cyberattack
First seen on scworld.com Jump to article: www.scworld.com/brief/middle-eastern-critical-infrastructure-targeted-by-long-term-iranian-cyberattack
-
Iranian Hackers Breach Middle East Infrastructure
Tags: breach, credentials, cyberespionage, fortinet, group, hacker, infrastructure, iran, middle-east, network, technology, theft, threatFortinet Uncovers Long-Term Cyberespionage in Region. An Iranian state-sponsored threat group conducted a years-long cyberespionage campaign targeting a Middle East critical infrastructure provider, with its operational technology network a key target. The attackers focused reconnaissance activity and credential theft on the OT network. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/iranian-hackers-breach-middle-east-infrastructure-a-28284
-
Commvault CVE-2025-34028 Added to CISA KEV After Active Exploitation Confirmed
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a maximum-severity security flaw impacting Commvault Command Center to its Known Exploited Vulnerabilities (KEV) catalog, a little over a week after it was publicly disclosed.The vulnerability in question is CVE-2025-34028 (CVSS score: 10.0), a path traversal bug that affects 11.38 Innovation Release, from versions First…
-
RomCom RAT Targets UK Organizations Through Compromised Customer Feedback Portals
The Russian-based threat group RomCom, also known as Storm-0978, Tropical Scorpius, and Void Rabisu, has been targeting UK companies in the retail, hospitality, and critical national infrastructure (CNI) sectors in a recently discovered cyber espionage and profit-driven operation called >>Operation Deceptive Prospect.
-
Top cybersecurity products showcased at RSA 2025
Tags: access, ai, attack, automation, awareness, breach, cisco, compliance, control, crowdstrike, cyber, cybersecurity, data, defense, detection, edr, email, firewall, fortinet, framework, identity, incident response, infrastructure, injection, intelligence, login, malicious, open-source, phishing, risk, siem, soc, threat, tool, training, update, vulnerability, zero-trustCisco: Foundational AI Security Model: Cisco introduced its Foundation AI Security Model, an open-source framework designed to standardize safety protocols across AI models and applications. This initiative aims to address the growing concerns around AI security and ensure Safer AI deployments. Cisco also unveiled new agentic AI features in its XDR and Splunk platforms, along…
-
Iranian APT Group Breaches Middle Eastern Critical Infrastructure in Stealth Campaign
Recently, the FortiGuard Incident Response (FGIR) team has released an in-depth analysis detailing a prolonged, state-sponsored intrusion into First seen on securityonline.info Jump to article: securityonline.info/iranian-apt-group-breaches-middle-eastern-critical-infrastructure-in-stealth-campaign/
-
Threat Actors Target Critical National Infrastructure with New Malware and Tools
A recent investigation by the FortiGuard Incident Response (FGIR) team has uncovered a sophisticated, long-term cyber intrusion targeting critical national infrastructure (CNI) in the Middle East, attributed to an Iranian state-sponsored threat group. Spanning from at least May 2023 to February 2025, with evidence of compromise dating back to May 2021, this espionage-driven campaign employed…
-
Iranian Hackers Maintain 2-Year Access to Middle East CNI via VPN Flaws and Malware
An Iranian state-sponsored threat group has been attributed to a long-term cyber intrusion aimed at a critical national infrastructure (CNI) in the Middle East that lasted nearly two years.The activity, which lasted from at least May 2023 to February 2025, entailed “extensive espionage operations and suspected network prepositioning a tactic often used to maintain persistent…
-
U.S. CISA adds Yii Framework and Commvault Command Center flaws to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Yii Framework and Commvault Command Center flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Qualitia Active! Mail, Broadcom Brocade Fabric OS, and Commvault Web Server flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the descriptions for these flaws:…
-
Hundreds of Fortune 500 Companies Have Unknowingly Employed North Korean IT Operatives
North Korean nationals have successfully infiltrated the employee ranks of major global corporations at a scale previously underestimated, creating a pervasive threat to IT infrastructure and sensitive data worldwide. Security experts revealed at the RSAC 2025 Conference that the infiltration extends across virtually every major corporation, with hundreds of Fortune 500 companies unknowingly employing North…
-
State-Sponsored Hacktivism on the Rise, Transforming the Cyber Threat Landscape
Tags: attack, cyber, cybersecurity, government, group, india, infrastructure, military, russia, threat, ukraineGlobal cybersecurity landscape is undergoing a significant transformation, as state-sponsored hacktivism gains traction amid ongoing conflicts. In 2024, Forescout Technologies Inc. documented 780 hacktivist attacks, predominantly conducted by four groups operating on opposite sides of the Russia-Ukraine and Israel-Palestine conflicts: BlackJack, Handala Group, Indian Cyber Force, and NoName057(16). Critical infrastructure, including government, military, transportation, logistics,…
-
Geschlossene ePA 3.0-Sicherheitslücke: Das BSI hatte wohl gewarnt
Einen Tag nach dem Deutschlandstart der elektronischen Patientenakte (ePA 3.0) musste die Betreiberin der Infrastruktur, die gematik, bereits eingestehen, dass man eine weitere Sicherheitslücke, die der CCC gemeldet hatte, kurzfristig beseitigt habe. Jetzt wurde bekannt, dass das Bundesamt für Sicherheit … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/05/02/geschlossene-epa-3-0-sicherheitsluecke-das-bsi-hatte-wohl-gewarnt/
-
White House Cyber Chief Urges Offensive Response to Threats
National Security Council’s Bulazel to Reset Cyber Norms With Offensive Strategy. National Security Council’s Alexei Bulazel told RSA attendees that offensive cyber tools must play a bigger role in U.S. defense. He called for a streamlined regulatory approach, more robust interagency coordination and a narrower role for CISA focused on critical infrastructure and civilian agencies.…
-
Hackers Exploit New Eye Pyramid Offensive Tool With Python to Launch Cyber Attacks
Tags: attack, backdoor, control, cyber, exploit, group, hacker, infrastructure, network, open-source, ransomware, toolSecurity researchers from Intrinsec have published a comprehensive analysis revealing significant overlaps in infrastructure between multiple ransomware operations and the open-source offensive tool, Eye Pyramid. Their investigation, which began by examining a Python backdoor used by the RansomHub ransomware group, uncovered a network of interconnected command-and-control (C2) servers, bulletproof hosting providers, and shared toolsets fueling…
-
Hackers Exploit Critical NodeJS Vulnerabilities to Hijack Jenkins Agents for RCE
Tags: cyber, exploit, flaw, github, hacker, infrastructure, rce, remote-code-execution, risk, supply-chain, vulnerabilitySecurity researchers have identified critical vulnerabilities in the Node.js CI/CD infrastructure, exposing internal Jenkins agents to remote code execution and raising the risk of supply chain attacks. These flaws stemmed from the integration and communication gaps between multiple DevOps platforms-specifically GitHub Apps, GitHub Actions workflows, and Jenkins pipelines-that collectively manage Node.js’ continuous integration processes. Exploiting…
-
Nebulous Mantis hackers have Deployed the RomCom RAT globally, Targeting organizations.
Nebulous Mantis, also known as Cuba, STORM-0978, Tropical Scorpius, and UNC2596, is a Russian-speaking cyber espionage group that has been actively deploying the RomCom remote access trojan (RAT) in targeted campaigns since mid-2019. The group primarily focuses on critical infrastructure, government agencies, political leaders, and organizations related to NATO. Their operations are characterized by the…
-
White House Proposes $500 Million Cut to CISA
Administration’s Budget Proposals Would Slash Cyber Defense Agency Spending by 16%. President Donald Trump proposed a series of budget cuts Friday that would in part reduce the Cybersecurity and Infrastructure Security Agency’s spending for fiscal year 2026 by nearly $500 million – a 16% reduction the administration said was aimed at realigning the agency with…
-
CISA Adds Two New Exploited Vulnerabilities to Its Catalog: CVE-2024-38475 and CVE-2023-44221
The Cybersecurity and Infrastructure Security Agency (CISA) recently updated its Known Exploited Vulnerabilities (KEV) Catalog, adding two vulnerabilities, CVE-2024-38475 and CVE-2023-44221, that are currently being actively exploited. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/cisa-adds-cve-2024-38475-and-cve-2023-44221/
-
CISA Confirms Exploitation of SonicWall Vulnerabilities
The US Cybersecurity and Infrastructure Security Agency has added two flaws affecting SonicWall products to its catalog of Known Exploited Vulnerabilities First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/cisa-exploitation-sonicwall/
-
White House Warns China of Cyber Retaliation Over Infrastructure Hacks
NSC’s Alexei Bulazel said that failing to robustly respond to constant Chinese intrusions into critical infrastructure is in itself “escalatory” First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/white-house-china-cyber-retaliation/
-
Mehr Assets mehr Angriffsfläche mehr Risiko
Unternehmen sollten ihre Angriffsflächen genau kennen.Nur wer seine Angriffsflächen kennt, kann diese wirksam verteidigen. Was eine Binsenweisheit scheint, scheint vielen Unternehmen jedoch Probleme zu bereiten. Laut einer Umfrage des Security-Anbieters Trend Micro unter mehr als 2.000 Cybersecurity-Führungskräften mussten knapp drei Viertel (73 Prozent) von ihnen einräumen, schon einmal einen Sicherheitsvorfall erlebt zu haben, weil Assets…
-
What is EDR? An analytical approach to endpoint security
Tags: access, android, antivirus, api, attack, automation, breach, cloud, corporate, data, defense, detection, edr, email, endpoint, firewall, incident response, infection, infosec, infrastructure, intelligence, Intruder, linux, macOS, malicious, malware, network, service, siem, soar, software, threat, tool, trainingEDR vs. antivirus: What’s the difference?: Antivirus software has similar goals to EDR, in that it aims to block malware from installing on and infecting endpoints (usually user PCs). The difference is that antivirus spots malicious activity by trying to match it to signatures, known patterns of code execution or behavior that the security community…
-
U.S. CISA adds SonicWall SMA100 and Apache HTTP Server flaws to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds SonicWall SMA100 and Apache HTTP Server flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Qualitia Active! Mail, Broadcom Brocade Fabric OS, and Commvault Web Server flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the descriptions for these flaws:…
-
CISA Issues New ICS Advisories Addressing Critical Vulnerabilities and Exploits
The Cybersecurity and Infrastructure Security Agency (CISA) has issued two new advisories revealing critical vulnerabilities found in widely used Industrial Control Systems (ICS). Released on May 1, 2025, the advisories spotlight severe security risks affecting KUNBUS GmbH’s Revolution Pi devices and the MicroDicom DICOM Viewer, with some vulnerabilities scoring the highest possible rating for risk…
-
CISA Issues Alert on Actively Exploited Apache HTTP Server Escape Vulnerability
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert regarding a newly discovered and actively exploited vulnerability in the widely used Apache HTTP Server. The flaw, catalogued as CVE-2024-38475, affects the server’s mod_rewrite module and poses significant risks to organizations worldwide. Details of the Vulnerability CVE-2024-38475 is classified as an >>improper escaping…
-
Google pours billions into AI, cyber and infrastructure expansion
The tech giant’s cloud profits more than doubled year over year as it invested more than $17 billion, primarily in servers and data centers. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/google-cloud-ai-infrastructure-cybersecurity-spend/746861/
-
Preparing for Cyber Warfare CISO’s Defense Resource Guide
In the digital age, preparing for cyber warfare is essential as organizations face unprecedented threats beyond traditional hacking and data breaches. Cyber warfare-where attacks are orchestrated by nation-states or highly organized groups-can cripple critical infrastructure, disrupt business operations, and erode trust in institutions. As these threats become more sophisticated and persistent, the Chief Information Security…
-
Salt Security Launches the First MCP Server to Revolutionise API Security in the Age of AI
API security pros Salt Security have announced the launch of the Salt Model Context Protocol (MCP) Server at RSAC 2025, giving enterprise teams a novel access point of interaction with their API infrastructure, leveraging natural language and artificial intelligence (AI). Built on the open MCP standard, Salt’s MCP Server enables AI agents to discover, understand, and analyse…