Collecting Cyber-News from over 60 sources

Tag: infrastructure

US charges Chinese hackers linked to critical infrastructure breaches

Mar 5, 2025 7:34 PM

Tags: breach, china, cyberattack, hacker, infrastructure, network

The US Justice Department has charged Chinese state security officers along with APT27 and i-Soon hackers for network breaches and cyberattacks that have targeted victims globally since 2011. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/us-charges-chinese-hackers-linked-to-critical-infrastructure-breaches/
Broadcom Patches Actively Exploited Zero-Days in VMware ESXi

Mar 5, 2025 6:34 PM

Tags: cloud, exploit, infrastructure, software, update, vmware, vulnerability, zero-day

Vulnerabilities Can Apparently Be Chained Together to Execute a Hypervisor Escape. Broadcom’s VMware cloud infrastructure software division has issued updates to patch three actively exploited zero-day vulnerabilities in all supported versions of its ESXi hypervisor operating system, which can be used to escape from the hypervisor, in what’s also known as a virtual machine escape.…
Critical vulnerabilities expose network security risks in Keysight’s infrastructure

Mar 5, 2025 3:34 PM

Tags: access, advisory, attack, best-practice, cisa, control, cve, cyber, cybersecurity, data, defense, exploit, flaw, infrastructure, Internet, malicious, mitigation, network, risk, service, software, strategy, threat, unauthorized, update, vpn, vulnerability

Potential threats to enterprises: Successful exploitation of these vulnerabilities could have dire consequences, including system crashes, arbitrary file deletions, and unauthorized access to sensitive information. Attackers leveraging these flaws may gain control over affected devices, facilitating further attacks within an enterprise’s network.Furthermore, multiple path traversal vulnerabilities (CVE-2025-21095 and CVE-2025-23416) identified in the affected software versions…
CISA Issues Alert on Actively Exploited VMware Vulnerabilities

Mar 5, 2025 3:34 PM

Tags: cisa, cve, cyber, cybersecurity, exploit, flaw, infrastructure, kev, linux, mitigation, threat, vmware, vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) escalated warnings on March 4, 2025, by adding four severe vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog. Federal agencies and private organizations are urged to prioritize mitigation efforts, as threat actors are actively weaponizing these flaws in VMware ESXi, Workstation, Fusion, and the Linux kernel. CVE-2025-22225:…
CISA Expands Known Exploited Vulnerabilities Catalog with Four Critical Issues

Mar 5, 2025 2:34 PM

Tags: cisa, cyber, cybersecurity, exploit, infrastructure, kev, risk, vulnerability

The Cybersecurity and Infrastructure Security Agency (CISA) has recently updated its Known Exploited Vulnerabilities (KEV) Catalog with four new vulnerabilities, adding to the growing list of cyber risks that have been actively exploited. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/cisa-known-exploited-vulnerabilities-catalog-3/
Tracking Threat Actors: How Infrastructure Analysis Reveals Cyber Attack Patterns

Mar 5, 2025 11:34 AM

Tags: attack, cyber, infrastructure, threat

Unmasking Cyber Threats: How Infrastructure Tracking Aids Attribution The main subject of this article is to present our methods for clustering and identifying the purpose First seen on research.kudelskisecurity.com Jump to article: research.kudelskisecurity.com/2025/03/05/tracking-threat-actors-how-infrastructure-analysis-reveals-cyber-attack-patterns/
Polish Space Agency POLSA disconnected its network following a cyberattack

Mar 5, 2025 11:34 AM

Tags: attack, cyberattack, data, infrastructure, Internet, network

The Polish space agency POLSA announced it has disconnected its network from the internet following a cyberattack. The Polish space agency POLSA was forced to disconnect its network from the internet in response to a cyberattack. The agency revealed that it has disconnected its infrastructure to contain the attack and secure data, a circumstance that…
Telegram EvilVideo Vulnerability Exploited to Run Malicious Code on Victims’ Devices

Mar 5, 2025 11:34 AM

Tags: attack, cyber, cybersecurity, exploit, infrastructure, malicious, vulnerability

A newly documented exploitation technique targeting Telegram’s file-sharing infrastructure has raised alarms in cybersecurity circles. Dubbed >>EvilVideo,
The dirty dozen: 12 worst ransomware groups active today

Mar 5, 2025 10:34 AM

Tags: access, ai, alphv, apt, attack, backup, breach, cloud, cyber, cybercrime, dark-web, data, detection, email, encryption, endpoint, exploit, extortion, finance, government, group, healthcare, infrastructure, intelligence, korea, law, leak, linux, lockbit, malicious, malware, moveIT, network, north-korea, organized, phishing, ransom, ransomware, russia, service, social-engineering, software, strategy, threat, tool, usa, vmware, vulnerability, windows, zero-day

Black Basta: History: Black Basta appeared on the ransomware scene in early 2022 and is believed to be a spin-off from Conti, a group notorious for attacking major organizations.How it works: Black Basta usually deploys malware through exploitation of known vulnerabilities and social engineering campaigns. “Employees in the target environment are email bombed and then…
CVE-2025-22224, CVE-2025-22225, CVE-2025-22226: Zero-Day Vulnerabilities in VMware ESXi, Workstation and Fusion Exploited

Mar 5, 2025 9:34 AM

Tags: advisory, attack, cloud, cve, exploit, flaw, infrastructure, intelligence, leak, microsoft, threat, update, vmware, vulnerability, zero-day

Broadcom published an advisory for three flaws in several VMware products that were exploited in the wild as zero-days. Organizations are advised to apply the available patches. Background On March 4, Broadcom published an advisory (VMSA-2025-0004) for three zero-day vulnerabilities across multiple VMware products: CVE Description CVSSv3 CVE-2025-22224 VMware ESXi and Workstation Heap-Overflow Vulnerability 9.3…
U.S. CISA adds Linux kernel and VMware ESXi and Workstation flaws to its Known Exploited Vulnerabilities catalog

Mar 5, 2025 8:34 AM

Tags: android, cisa, cve, cybersecurity, exploit, google, infrastructure, kev, linux, vmware, vulnerability

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Linux kernel and VMware ESXi and Workstation flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: The first issue, tracked as CVE-2024-50302, was addressed by Google with the release of the Android…
Fix Inventory: Open-source cloud asset inventory tool

Mar 5, 2025 7:34 AM

Tags: cloud, compliance, infrastructure, open-source, risk, tool

Fix Inventory is an open-source tool for detecting compliance and security risks in cloud infrastructure accounts. It was built from the ground up for cloud-native … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/03/05/fix-inventory-open-source-cloud-asset-inventory-tool/
NVIDIA Issues Warning About Severe Security Flaws Enabling Code Attacks

Mar 5, 2025 7:34 AM

Tags: attack, computing, cyber, firmware, flaw, infrastructure, malicious, nvidia, service, update

NVIDIA has issued an urgent security bulletin urging customers using itsHopper HGX 8-GPU High-Performance Computing (HMC) systemsto immediately install firmware updates addressing two critical vulnerabilities. Released on February 28, 2025, the patches target flaws that could allow attackers to execute malicious code, escalate privileges, or cripple enterprise GPU infrastructure through denial-of-service (DoS) attacks. The advisories…
Polyglot files used to spread new backdoor

Mar 5, 2025 5:34 AM

Tags: access, attack, awareness, backdoor, business, ceo, cio, ciso, computer, control, corporate, cybercrime, data, detection, email, endpoint, espionage, exploit, india, infection, infrastructure, malicious, malware, social-engineering, technology, threat, training

the attackers first compromised the email account of an Indian electronics company, then used that access to send email messages with malicious links;the link led to a ZIP file that includes polyglot files to obfuscate payload content.According to Proofpoint, the use by threat actors of polyglot files, which are files that can be interpreted by…
VMware ESXi gets critical patches for inwild virtual machine escape attack

Mar 4, 2025 9:36 PM

Tags: attack, cloud, infrastructure, update, vmware, vulnerability

Remediation: There are no feasible workarounds for these vulnerabilities except for deploying the released patches. VMware ESXi customers can install VMware ESXi 8.0 Update 3d, VMware ESXi 8.0 Update 2d, or VMware ESXi 7.0 Update 3s, depending on their edition. ESX 6.5 and 6.7 have also released patches, but these are available only to customers…
Suspected Iran-backed hackers target UAE with newly discovered ‘Sosano’ malware

Mar 4, 2025 5:34 PM

Tags: backdoor, communications, hacker, infrastructure, iran, malware

Researchers say they spotted new backdoor malware that suspected Iranian regime-backed hackers have aimed at sectors such as aviation, satellite communications and critical transportation infrastructure in the United Arab Emirates. First seen on therecord.media Jump to article: therecord.media/sosano-malware-targets-uae-iran-suspected
Creating Elegant Azure Custom Roles: Putting NotActions into Action!

Mar 4, 2025 5:34 PM

Tags: access, business, cloud, control, data, group, identity, infrastructure, least-privilege, microsoft, service

Creating custom Roles in Azure can be a complex process that may yield long and unwieldy Role definitions that are difficult to manage. However, it doesn’t have to be that way. Read on to learn how you can simplify this process using the Azure “NotActions” and “NotDataActions” attributes, and create custom Azure Roles that are…
Hackers Exploiting Business Relationships to Attack Arab Emirates Aviation Sector

Mar 4, 2025 5:34 PM

Tags: attack, business, communications, cyber, espionage, exploit, hacker, infrastructure, malware, threat

A sophisticated cyber espionage campaign targeting the aviation and satellite communications sectors in the United Arab Emirates has been uncovered by Proofpoint researchers. The operation, attributed to a threat cluster dubbed >>UNK_CraftyCamel,
Veriti Research Uncovers Malware Exploiting Cloud Services

Mar 4, 2025 1:34 PM

Tags: cloud, control, detection, exploit, infrastructure, malware

Veriti Research has identified a growing trend attackers leveraging cloud infrastructure to facilitate malware distribution and command-and-control (C2) operations. This evolving tactic not only makes detection more challenging but also exposes organizations to significant security risks. Malware Hosted on Cloud Services One of the most alarming findings from our research is that over 40%… First…
CISA Warns of Active Exploitation of Microsoft Windows Win32k Vulnerability

Mar 4, 2025 12:34 PM

Tags: cisa, control, cyber, cybersecurity, exploit, flaw, infrastructure, kev, microsoft, vulnerability, windows

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2018-8639, a decade-old Microsoft Windows privilege escalation flaw, to its Known Exploited Vulnerabilities (KEV) catalog amid confirmed active attacks. First patched by Microsoft in December 2018, this Win32k kernel-mode driver vulnerability enables authenticated local attackers to execute arbitrary code with SYSTEM privileges, granting unfettered control over…
Newly Exploited Vulnerabilities Target Cisco, Microsoft, and More CISA Warns

Mar 4, 2025 10:34 AM

Tags: cisa, cisco, cybersecurity, exploit, infrastructure, kev, microsoft, vulnerability

The Cybersecurity and Infrastructure Security Agency (CISA) recently updated its Known Exploited Vulnerabilities (KEV) Catalog by adding five vulnerabilities that have been actively exploited in the wild. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/new-known-exploited-vulnerabilities-to-catalog/
Cisco, Hitachi, Microsoft, and Progress Flaws Actively Exploited”, CISA Sounds Alarm

Mar 4, 2025 7:34 AM

Tags: cisa, cisco, cve, cybersecurity, exploit, flaw, infrastructure, injection, kev, microsoft, software, vulnerability, windows

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added five security flaws impacting software from Cisco, Hitachi Vantara, Microsoft Windows, and Progress WhatsUp Gold to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.The list of vulnerabilities is as follows -CVE-2023-20118 (CVSS score: 6.5) – A command injection First seen…
SIEM-Kaufratgeber

Mar 4, 2025 6:34 AM

Tags: access, ai, api, business, cloud, compliance, container, cyberattack, data, detection, DSGVO, encryption, framework, HIPAA, infrastructure, least-privilege, mail, microsoft, mitre, ml, monitoring, open-source, saas, service, siem, skills, soar, software, threat, tool

Die kontextuellen Daten, die SIEM-Lösungen liefern, sind eine grundlegende Komponente moderner Security-Stacks.Protokoll-Daten zu auditieren, zu überprüfen und zu managen, ist alles andere als eine glamouröse Aufgabe aber ein entscheidender Aspekt, um ein sicheres Unternehmensnetzwerk aufzubauen. Schließlich schaffen Event Logs oft eine sekundäre Angriffsfläche für Cyberkriminelle, die damit ihre Aktivitäten verschleiern wollen.Vorgängen wie diesen treten Netzwerksicherheitsexperten…
CISA Alerts on Active Exploitation of Cisco Small Business Router Flaw

Mar 4, 2025 6:34 AM

Tags: business, cisa, cisco, cyber, cybersecurity, exploit, flaw, infrastructure, injection, router, vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent warning on March 3, 2025, about actively exploiting a critical command injection vulnerability (CVE-2023-20118) affecting end-of-life Cisco Small Business RV Series Routers. The flaw, which carries a CVSSv3.1 score of 6.5, enables authenticated attackers to execute arbitrary commands with root privileges, potentially compromising entire…
UK Lawmakers Don’t Hear Fervor for Ransomware Payment Ban

Mar 4, 2025 1:34 AM

Tags: government, infrastructure, ransom, ransomware, resilience

Committee Witnesses Favor Resilience Over Bans. The British government should focus on building operational resilience rather than imposing ransom payment bans, security experts told a parliamentary committee. The British government in January floated a ban on public sector and critical infrastructure owners paying digital extortion. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/uk-lawmakers-dont-hear-fervor-for-ransomware-payment-ban-a-27636
U.S. CISA adds Multiple Cisco Small Business RV Series Routers, Hitachi Vantara Pentaho BA Server, Microsoft Windows Win32k, and Progress WhatsUp Gold flaws to its Known Exploited Vulnerabilities catalog

Mar 3, 2025 10:34 PM

Tags: business, cisa, cisco, cybersecurity, exploit, infrastructure, kev, microsoft, router, vulnerability, windows

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Cisco Small Business RV Series Routers, Hitachi Vantara Pentaho BA Server, Microsoft Windows Win32k, and Progress WhatsUp Goldflaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA)added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: Below are the descriptions for…
CISA says it will continue to monitor Russian cyber threats

Mar 3, 2025 9:34 PM

Tags: cisa, cyber, cybersecurity, infrastructure, russia, threat

The Cybersecurity and Infrastructure Security Agency (CISA) shot down reports that changes are being made to how they approach cyber threats from Russia following a report by The Guardian last week. First seen on therecord.media Jump to article: therecord.media/cisa-says-it-will-continue-to-monitor-russian-cyber-threats
DHS says CISA will not stop monitoring Russian cyber threats

Mar 3, 2025 9:34 PM

Tags: cisa, cyber, cybersecurity, infrastructure, monitoring, russia, threat

The US Cybersecurity and Infrastructure Security Agency says that media reports about it being directed to no longer follow or report on Russian cyber activity are untrue, and its mission remains unchanged. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/dhs-says-cisa-will-not-stop-monitoring-russian-cyber-threats/
US Cybercom, CISA retreat in fight against Russian cyber threats: reports

Mar 3, 2025 7:34 PM

Tags: apt, blizzard, china, cisa, cyber, cybersecurity, data, government, group, hacker, infrastructure, international, iran, lockbit, microsoft, ransomware, risk, risk-management, russia, threat

Purported shift at CISA away from reporting on Russian threats: Shortly after The Record issued its report, The Guardian reported that the US Cybersecurity and Infrastructure Security Agency (CISA) sent an internal memo setting out new priorities for the agency, including China but excluding Russia. One source said analysts at the agency were verbally informed…
Polish space agency investigates cyberattack on its systems

Mar 3, 2025 4:34 PM

Tags: access, cyberattack, cybersecurity, infrastructure, service, unauthorized

Poland confirmed that state cybersecurity services had detected unauthorized access to the space agency’s IT infrastructure and had secured the affected systems. First seen on therecord.media Jump to article: therecord.media/poland-space-cyberattack-agency-investigate