Tag: infrastructure
-
Drupal Core SQL Injection Bug Actively Exploited, Added to CISA KEV
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a recently patched critical security flaw impacting Drupal Core to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.The vulnerability in question is CVE-2026-9082 (CVSS score: 6.5), an SQL injection vulnerability affecting all supported versions of Drupal Core.”Drupal Core First seen on…
-
Middle East malicious infrastructure report highlights concentration of C2 servers
First seen on scworld.com Jump to article: www.scworld.com/brief/middle-east-malicious-infrastructure-report-highlights-concentration-of-c2-servers
-
Terra Security expands platform to include network infrastructure exploitation validation
First seen on scworld.com Jump to article: www.scworld.com/brief/terra-security-expands-platform-to-include-network-infrastructure-exploitation-validation
-
Water, the Soft Underbelly of Critical Infrastructure
Tags: cyber, cybersecurity, governance, government, infrastructure, service, threat, usa, vulnerabilityFragmented Governance and Scarce Resources Make America’s Water Sector Vulnerable. America’s water utilities are the nation’s most cyber-vulnerable critical service sector, but their cybersecurity is overseen and supported by an ill-fitting patchwork of government agencies and most lack the resources to meet the threat they face. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/water-soft-underbelly-critical-infrastructure-a-31758
-
Operation Saffron Europol zerschlägt kriminellen VPN-Dienst ‘First VPN”
VPN-Dienste gelten für viele Nutzer als Synonym für Datenschutz und Anonymität. Doch dieselbe Infrastruktur wird zunehmend auch von Cyberkriminellen genutzt, um Angriffe zu verschleiern, Ransomware-Kampagnen zu koordinieren und Ermittlungen zu umgehen. Mit der internationalen Operation ‘Saffron” haben Strafverfolger nun erstmals gezielt einen solchen kriminellen VPN-Dienst zerschlagen. Unterstützt wurde die Aktion unter anderem von Bitdefender. Die…
-
Nexus-Days kommen nach Deutschland CPS-Security-Community trifft sich in Frankfurt
Die führende Konferenzreihe für Cybersicherheitsexperten im Bereich der cyberphysischen Systeme (CPS) Nexus macht erstmals in Deutschland Halt: Am 9. Juni treffen sich Sicherheitsverantwortliche aus Industrie, kritischer Infrastruktur und dem Gesundheitswesen in Frankfurt, um gemeinsam drängende Fragen zum Schutz kritischer Systeme zu diskutieren. Die von Claroty organisierte exklusive Veranstaltung ist Teil einer exklusiven Eventreihe, die 2026…
-
Hackers Exploit Middle East Telecoms for Massive C2 Operations
Hackers are increasingly abusing Middle East telecommunications networks and hosting providers to operate large-scale command-and-control (C2) infrastructure. The findings highlight a strategic shift away from disposable indicators toward infrastructure-level tracking, allowing defenders to identify persistent patterns behind cyber operations rather than reacting to constantly changing indicators of compromise. The dataset reveals that C2 infrastructure dominates…
-
CISA Adds Langflow Origin Validation Flaw to Known Exploited Vulnerabilities Catalog
Tags: ai, cisa, cve, cyber, cybersecurity, exploit, flaw, infrastructure, kev, risk, tool, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Langflow vulnerability, tracked as CVE-2025-34291, to its Known Exploited Vulnerabilities (KEV) Catalog, highlighting active exploitation risks and urging immediate remediation. The vulnerability stems from an origin validation flaw in Langflow, a popular tool used for building and orchestrating AI-driven workflows. According to CISA,…
-
U.S. CISA adds Trend Micro Apex One and Langflow to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Trend Micro Apex One and Langflow flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA)added Windows Shell and ConnectWise ScreenConnect flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the flaws added to the catalog: CVE-2025-34291(CVSS score of 9.4) is…
-
Hackers Use Six-Layer Persistence on FreePBX Systems
Hackers are actively exploiting FreePBX systems using a highly resilient six-layer persistence mechanism. The campaign has been attributed with high confidence to the threat actor INJ3CTOR3, known for targeting VoIP infrastructure for financial gain since 2019. The operation deploys a multi-stage Bash dropper that installs a previously undocumented PHP webshell family named JOMANGY, alongside the…
-
CISA’s new KEV nomination form opens reporting to vendors and researchers
The Cybersecurity and Infrastructure Security Agency launched a new nomination form that lets researchers, vendors, and industry partners report known exploited … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/05/22/cisa-kev-nomination-form/
-
One Telecom Provider Hosted Most of the Middle East ‘s Active C2 Infrastructure
Hunt.io mapped 1,350+ C2 servers across the Middle East, revealing how a small group of providers quietly supports major malware activity. For years, threat intelligence focused mostly on malware families, phishing domains, and individual indicators. But a new report from Hunt.io shows why defenders may need to pay closer attention to something more boring, hosting…
-
CISA Adds Exploited Langflow and Trend Micro Apex One Vulnerabilities to KEV
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Langflow and Trend Micro Apex One to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.The vulnerabilities in question are listed below – CVE-2025-34291 (CVSS score: 9.4) – An origin validation error vulnerability in Langflow that could First…
-
Authorities Take Down “First VPN” Service Used in Ransomware Attacks
Authorities in Europe have dismantled a major criminal VPN service known as “First VPN,” which was widely used by ransomware operators and cybercriminal groups to conceal their activities. The coordinated operation, led by French and Dutch authorities with support from Eurojust and Europol, marks a significant disruption to cybercrime infrastructure across multiple countries. Criminal VPN…
-
CISA to allow researchers to report vulnerabilities to exploited bugs catalog
The Cybersecurity and Infrastructure Security Agency (CISA) announced the creation of a nomination form on Thursday that they said enables “researchers, vendors, and industry partners” to report bugs that need to be added to the Known Exploited Vulnerabilities catalog. First seen on therecord.media Jump to article: therecord.media/cisa-to-allow-researchers-to-report-vulnerabilities-kev
-
U.S. CISA adds Microsoft and Adobe flaws to its Known Exploited Vulnerabilities catalog
Tags: adobe, cisa, cve, cybersecurity, exploit, flaw, infrastructure, kev, microsoft, vulnerability, windowsU.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft and Adobe flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Windows Shell and ConnectWise ScreenConnect flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the flaws added to the catalog: CVE-2008-4250 (CVSS v3.1 score of 9.8) is a…
-
Global law enforcement operation takes First VPN offline
Police seized First VPN in a global crackdown, exposed its cybercrime users, and shut down infrastructure tied to ransomware and data theft. A major international law enforcement operation has taken First VPN offline, a service that had become a quiet staple for ransomware crews, data thieves, and other cybercriminals trying to hide in plain sight. >>The coordinated…
-
OAuth-Token als Einfallstor Was der Vercel-Angriff über moderne Identitätsrisiken lehrt
KI-Tools verändern die Art, wie Unternehmen arbeiten und die Art, wie sie angegriffen werden. In den vergangenen Monaten folgte eine wachsende Zahl von Sicherheitsvorfällen einem Muster, das klassische Identity-Governance-Lösungen schlicht nicht erkennen können: Ein Mitarbeiter verbindet ein KI-Tool eines Drittanbieters mit einem Unternehmenskonto, die Infrastruktur dieses Tools wird kompromittiert, und Angreifer gelangen über die entstandene…
-
Wenn Cyberkriminelle gehackt werden Was die Gentlemen-Leaks verraten
Check Point Research (CPR), die Sicherheitsforschungsabteilung von Check Point Software Technologies hat interne Daten der Ransomware-Gruppe ‘The Gentlemen” (CPR berichtete) analysiert, die nach einer Kompromittierung ihrer Infrastruktur öffentlich wurden. Die Erkenntnisse geben einen seltenen Einblick in die Struktur, Arbeitsweise und Angriffsmethoden einer der derzeit aktivsten Ransomware-Operationen weltweit. Die wichtigsten Ergebnisse im Überblick: Zweite Kraft im…
-
Gremlin Stealer Hides C2 and Exfiltration Paths in Encrypted Resources
A newly identified variant of the Gremlin stealer malware is leveraging advanced obfuscation techniques to conceal its command-and-control (C2) infrastructure and data exfiltration logic within encrypted .NET resource sections. This evolution highlights a significant shift toward stealth, modularity, and anti-analysis sophistication in modern infostealer campaigns. Its targets include browser-stored credentials, session tokens, cryptocurrency wallets, clipboard…
-
Senator presses CISA for answers about alleged GitHub repository leak
U.S. Senator Maggie Hassan (D-NH) sent a letter to the acting director of the Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday demanding answers about an alleged breach uncovered by cybersecurity reporter Brian Krebs involving government contractor Nightwing. First seen on therecord.media Jump to article: therecord.media/hassan-presses-cisa-github-leak
-
Certes Research Warns Legacy Systems Are Biggest Barrier to Quantum Security Readiness
Certes has released new research showing that many organizations remain unprepared for the security risks posed by quantum computing, despite growing awareness of the threat. According to the company’s Emerging PQC Imperative report, 78% of organizations believe legacy systems represent their biggest quantum security risk. The findings highlight growing concerns that outdated infrastructure and applications…
-
Void Botnet Leverages Ethereum for Resilient C2
A newly identified botnet, named Void, is leveraging Ethereum smart contracts to build a resilient, hard-to-disrupt command-and-control (C2) infrastructure, marking a continued evolution in blockchain-enabled cybercrime. Discovered in March 2026 and advertised on a Russian-language cybercrime forum, Void Botnet follows closely behind the earlier Aeternum C2 campaign documented by Qrator Labs, but introduces notable differences…
-
As AI costs spiral, Dell pitches return to on-premise datacentres
With agentic AI driving up public cloud consumption, Dell Technologies is pitching local and hybrid infrastructure to shield enterprises from soaring token costs First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366643353/As-AI-costs-spiral-Dell-pitches-return-to-on-premise-datacentres
-
Trapdoor Android Ad Fraud Scheme Hit 659 Million Daily Bid Requests Using 455 Apps
Tags: android, control, cybersecurity, fraud, infrastructure, intelligence, malicious, malware, threatCybersecurity researchers have disclosed details of a new ad fraud and malvertising operation dubbed Trapdoor targeting Android device users.The activity, per HUMAN’s Satori Threat Intelligence and Research Team, encompassed 455 malicious Android apps and 183 threat actor-owned command-and-control (C2) domains, turning the infrastructure into a pipeline for multi-stage fraud.”Users First seen on thehackernews.com Jump to…
-
Microsoft Takes Down Fox Tempest for Providing Ransomware-Enabling Signing Tool
Microsoft’s Digital Crimes Unit has taken down the infrastructure of Fox Tempest, a prolific cybercrime-enabling threat group First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/microsoft-takes-down-fox-tempest/
-
Massive MENA cybercrime Operation Ramz disrupts infrastructure and arrests 201 suspects
INTERPOL led Operation Ramz in MENA, resulting in 201 arrests and 382 suspects tied to cybercrime networks. INTERPOL coordinated Operation Ramz across the Middle East and North Africa, leading to 201 arrests and identifying 382 additional suspects. << A first-of-its-kind cybercrime operation in the MENA region has led to the arrest of 201 individuals, with a…
-
Chinese APT FamousSparrow Weaponizes Evolved Deed RAT Against Azerbaijani Energy Infrastructure
The post Chinese APT FamousSparrow Weaponizes Evolved Deed RAT Against Azerbaijani Energy Infrastructure appeared first on Daily CyberSecurity. First seen on securityonline.info Jump to article: securityonline.info/famoussparrow-deed-rat-azerbaijan-energy-exchange-vulnerability/
-
Microsoft Details Storm-2949 Cloud Attack on Azure and Microsoft 365
Tags: attack, breach, cloud, cyberattack, data, identity, infrastructure, intelligence, microsoft, service, theft, threatMicrosoft Threat Intelligence has disclosed details of a cyberattack carried out by a threat actor tracked as Storm-2949, which escalated from a targeted identity compromise into a large-scale breach of cloud infrastructure and sensitive enterprise systems. The campaign focused heavily on data theft from Microsoft 365 services, Azure-hosted production environments, and cloud storage resources, demonstrating how compromised identities can…