Tag: malicious
-
Microsoft Entra’s billing roles pose privilege escalation risks in Azure
Potential abuse for persistence, elevated access: Essentially, guest users assigned specific billing roles, such as “Billing Account Contributor”, can create new Azure subscriptions within a host tenant. This action does not require explicit permissions in the target tenant, effectively allowing guests to establish a foothold without direct administrative oversight.Once a subscription is created, the guest…
-
Hackers Exploit Cloudflare Tunnels to Launch Stealthy Cyberattacks
Tags: cyber, cyberattack, cybersecurity, data, endpoint, exploit, group, hacker, international, malicious, network, ransomware, toolThe cybersecurity landscape, malicious actors, including notorious ransomware groups like BlackSuit, Royal, Akira, Scattered Spider, Medusa, and Hunters International, have been exploiting Cloudflared, a legitimate tunneling tool by Cloudflare, to orchestrate stealthy cyberattacks. Originally known as “Argo,” Cloudflared is designed to enable secure communication between remote endpoints over untrusted networks by encapsulating data in proprietary…
-
UTG015 Hackers Launch Massive Brute-Force Attacks on Government Web Servers
The hacker group UTG-Q-015, first identified in December 2024 for mounting attacks on major websites like CSDN, has escalated its malicious activities, targeting government and enterprise web servers with unprecedented aggression. Initially disclosed for their tactics of website manipulation, the group has since pivoted to exploiting 0day and Nday vulnerabilities, launching widespread brute-force scanning and…
-
Critical Dell PowerStore T Vulnerability Allows Full System Compromise
As part of its ongoing commitment to product security, Dell Technologies has released a significant update for the PowerStore T family, remediating a series of vulnerabilities that could be exploited by malicious actors to compromise affected systems. The update, detailed in advisory DSA-2025-223, is rated as high impact and urges immediate attention from all PowerStore…
-
New Research Reveals Key TCP SYN Patterns for Detecting Malicious Activity
A groundbreaking study by NETSCOUT, utilizing data from their honeypot systems designed to capture unsolicited internet traffic, has shed light on the intricate patterns within Transmission Control Protocol (TCP) SYN segments the initial step in the TCP three-way handshake. Published in April 2025, the research meticulously analyzes packet headers to identify trends and anomalies in…
-
Malicious WordPress Plugin Disguised as Java Update Infects Site Visitors
A troubling new cyber threat has emerged targeting WordPress websites, where a malicious plugin masquerading as a legitimate tool tricks visitors into downloading harmful software. Disguised as “Yoast SEO” with convincing metadata, this plugin was recently uncovered in the /wp-content/plugins/contact-form/ directory of an infected site. Rather than providing SEO functionality, it injects a deceptive JavaScript…
-
Critical OneDrive Flaw Lets Malicious Websites Access All Your Files
A newly revealed vulnerability in Microsoft’s OneDrive File Picker has placed millions of users at risk, enabling popular web applications, including ChatGPT, Slack, Trello, and ClickUp, to gain full read access to users’ entire OneDrive accounts. The flaw, uncovered by the Oasis Security Research Team, stems from excessive OAuth permissions and insecure token management, raising…
-
How to threat hunt Living Off The Land binaries
In this Help Net Security video, Lee Archinal, Senior Threat Hunter at Intel 471, walks through practical strategies for detecting malicious activity involving Living Off The … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/05/29/threat-hunt-living-off-the-land-binaries-video/
-
Stealthy Attacks: Silent Werewolf Deploys Custom Loaders in Espionage Operations
BI.ZONE Threat Intelligence has uncovered two new malicious campaigns attributed to the threat actor Silent Werewolf, once again First seen on securityonline.info Jump to article: securityonline.info/stealthy-attacks-silent-werewolf-deploys-custom-loaders-in-espionage-operations/
-
APT41 malware abuses Google Calendar for stealthy C2 communication
The Chinese APT41 hacking group uses a new malware named ‘ToughProgress’ that abuses Google Calendar for command-and-control (C2) operations, hiding malicious activity behind a trusted cloud service. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/apt41-malware-abuses-google-calendar-for-stealthy-c2-communication/
-
Separating hype from reality: How cybercriminals are actually using AI
Tags: ai, attack, automation, cyber, cyberattack, cybercrime, cybersecurity, data, defense, exploit, framework, group, incident response, malicious, mitre, strategy, technology, threat, vulnerability, zero-dayThe evolution of AI: Preparing defenders for tomorrow’s threats: As security professionals chart their defensive strategies, we must consider how AI will reshape cybercrime in the coming years. We also need to anticipate the fundamental pivots attackers will make, and what this evolution means for our entire industry. AI will inevitably impact vulnerability discovery, enable…
-
Malicious PyPI packages exploit ML models to deploy infostealer
First seen on scworld.com Jump to article: www.scworld.com/brief/malicious-pypi-packages-exploit-ml-models-to-deploy-infostealer
-
New PumaBot botnet brute forces SSH credentials to breach devices
A newly discovered Go-based Linux botnet malware named PumaBot is brute-forcing SSH credentials on embedded IoT devices to deploy malicious payloads. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-pumabot-botnet-brute-forces-ssh-credentials-to-breach-devices/
-
Czech Republic Blames China-Linked APT31 Hackers for 2022 Cyberattack
The Czech Republic on Wednesday formally accused a threat actor associated with the People’s Republic of China (PRC) of targeting its Ministry of Foreign Affairs.In a public statement, the government said it identified China as the culprit behind a malicious campaign targeting one of the unclassified networks of the Czech Ministry of Foreign Affairs. The…
-
Fake AI Video Tool Ads on Facebook, LinkedIn Spread Infostealers
Mandiant Threat Defense uncovers a campaign where Vietnam-based group UNC6032 tricks users with malicious social media ads for… First seen on hackread.com Jump to article: hackread.com/fake-ai-video-tool-ads-facebook-linkedin-infostealers/
-
Worldwide Operation Shuts Down Hundreds of Ransomware Servers and Domains, Ending Key Attack Infrastructure
Law enforcement and judicial officials, working together with Europol and Eurojust, have dealt a devastating blow to the worldwide ransomware ecosystem in a historic international operation. From May 19 to 22, 2025, Operation Endgame targeted the critical infrastructure behind ransomware attacks, dismantling approximately 300 servers and neutralizing 650 malicious domains worldwide. This operation not only…
-
Apple Blocked 2 million Malicious App $9 Billion in Fraudulent Transactions
Apple has strengthened the App Store as a bulwark of confidence, a remarkable testament to its commitment to customer safety. According to the company’s annual fraud analysis, over the past five years, Apple has thwarted more than $9 billion in fraudulent transactions, with a staggering $2 billion prevented in 2024 alone. This achievement underscores Apple’s…
-
Fake Bitdefender Site Spreads Trio of Malware Tools
A spoofed Bitdefender site has been used in a malicious campaign distributing VenomRAT and other malware, according to DomainTools First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/fake-bitdefender-site-spreads/
-
Threat Actors Weaponize Fake AI-Themed Websites to Deliver Python-based infostealers
Mandiant Threat Defense has uncovered a malicious campaign orchestrated by the threat group UNC6032, which capitalizes on the global fascination with artificial intelligence (AI). Since at least mid-2024, UNC6032 has been deploying fake AI video generator websites to distribute malware, specifically targeting users through deceptive social media ads on platforms like Facebook and LinkedIn. These…
-
251 Malicious IPs Target Cloud-Based Device Exploiting 75 Exposure Points
On May 8, 2025, cybersecurity researchers at GreyNoise detected a highly orchestrated scanning operation targeting 75 known exposure points across the internet in just 24 hours. The campaign, executed by 251 malicious IP addresses”, all geolocated to Japan and hosted on Amazon Web Services (AWS)”, triggered a diverse array of 75 distinct behaviors, including exploitation…
-
VenomRAT Malware Introduces New Tools for Password Theft and Stealthy Access
A malicious cyber campaign leveraging VenomRAT, a potent Remote Access Trojan (RAT), has been uncovered, posing a significant threat to unsuspecting users through a deceptive website mimicking Bitdefender’s Antivirus for Windows download page. The fraudulent domain, “bitdefender-download[.]com,” lures victims with a spoofed interface titled “DOWNLOAD FOR WINDOWS,” closely resembling the legitimate site but with subtle…
-
SilentWerewolf Attack Combines Legitimate Tools with Code Obfuscation for Stealthy Infiltration
The threat actor dubbed SilentWerewolf has employed advanced phishing techniques to infiltrate organizations in Russia and Moldova, focusing on critical sectors such as nuclear energy, aircraft, and mechanical engineering. Starting on March 11, the first campaign used spearphishing emails with malicious links to distribute ZIP archives containing a novel C# loader disguised as legal documents.…
-
Crooks use a fake antivirus site to spread Venom RAT and a mix of malware
Researchers found a fake Bitdefender site spreading the Venom RAT by tricking users into downloading it as antivirus software. DomainTools Intelligence (DTI) researchers warn of a malicious campaign using a fake website (“bitdefender-download[.]com”) spoofing Bitdefender’s Antivirus for Windows download page to trick visitors into downloading a remote access trojan called Venom RAT. >>A malicious campaign…
-
251 Amazon-Hosted IPs Used in Exploit Scan Targeting ColdFusion, Struts, and Elasticsearch
Cybersecurity researchers have disclosed details of a coordinated cloud-based scanning activity that targeted 75 distinct “exposure points” earlier this month.The activity, observed by GreyNoise on May 8, 2025, involved as many as 251 malicious IP addresses that are all geolocated to Japan and hosted by Amazon.”These IPs triggered 75 distinct behaviors, including CVE exploits, First…
-
Patched GitLab Duo Flaws Risked Code Leak, Malicious Content
Prompt Injection, HTML Output Rendering Could Be Used for Exploit. Hackers can exploit vulnerabilities in a generative artificial intelligence assistant integrated across GitLab’s DevSecOps platform to manipulate the model’s output, exfiltrate source code and potentially deliver malicious content through the platform’s user interface. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/patched-gitlab-duo-flaws-risked-code-leak-malicious-content-a-28499
-
Cybercriminals Clone Antivirus Site to Spread Venom RAT and Steal Crypto Wallets
Tags: access, antivirus, credentials, crypto, cybercrime, cybersecurity, finance, malicious, rat, softwareCybersecurity researchers have disclosed a new malicious campaign that uses a fake website advertising antivirus software from Bitdefender to dupe victims into downloading a remote access trojan called Venom RAT.The campaign indicates a “clear intent to target individuals for financial gain by compromising their credentials, crypto wallets, and potentially selling access to their systems,” the…
-
US authorities charge 16 in operation to disrupt DanaBot malware
Authorities said malware linked to Russia-based cybercrime group infected more than 300,000 computers around the world with the malicious code. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/us-authorities-disrupt-danabot-malware/748991/
-
GitLab Vulnerability ‘Highlights the Double-Edged Nature of AI Assistants’
A remote prompt injection flaw in GitLab Duo allowed attackers to steal private source code and inject malicious HTML. GitLab has since patched the issue. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-gitlab-duo-vulnerability-hidden-prompts/