Tag: network
-
Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack
The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year.According to ESET, the attack involved UAC-0099 (aka Earth Sirrush) obtaining initial access to the target on July 16, 2025, via a spear-phishing email bearing a malware-laced attachment that led…
-
North Korea Hit by Multiple Waves of DDoS Attacks, Knocking Over 40 Websites Offline
Multiple waves of DDoS attacks disrupted North Korea’s internet infrastructure this week, intermittently knocking over 40 official websites offline for about 32 hours. Network monitoring company Kentik linked the outages to synchronized surges of inbound traffic that began on October 20, 2026. Doug Madory, Kentik’s director of internet analysis, noted that aggregate traffic data showed…
-
INTERPOL Operation Serengeti III Nets 1,462 Arrests and Recovers $105 Million in Cybercrime Crackdown
INTERPOL’s Operation Serengeti III led to 1,462 arrests, disrupted 10,909 malicious networks and recovered $105 million across 21 countries. INTERPOL announced the results of Operation Serengeti III, a multinational cybercrime crackdown that led to 1,462 arrests, disrupted 10,909 malicious networks and recovered more than $105 million in illicit funds. The operation brought together law enforcement…
-
Hacker Turned DeepSeek Into an AI Cybercrime Assistant to Attack Universities and Steal Data
A threat actor using the handle BUGSTER configured DeepSeek V4 as the reasoning engine for an AI-assisted cybercrime operation that targeted organizations in India, including universities. Unit 42, Palo Alto Networks’ threat-intelligence team, says the actor used AI-generated reconnaissance and scripts to brute-force a university website and successfully stole a database containing more than 5,200…
-
Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
Attackers are exploiting a zero-day SQL injection flaw in Arista’s VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22.The flaw lets anyone who can log in to the orchestrator, even with a read-only customer account, gain operator privileges, the top level of control over…
-
Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes
Linux servers running KSMBD, the kernel’s built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro’s Zero Day Initiative, with no fix yet in the mainline kernel.One of them, ZDI-CAN-33774, can be triggered before any network authentication. The other, ZDI-CAN-33549, requires the SMB Direct transport and an…
-
Arista patches new VeloCloud Orchestrator zero-day exploited in attacks
Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/arista-patches-new-velocloud-orchestrator-zero-day-exploited-in-attacks/
-
INTERPOL Arrests 1,462 Suspects, Disrupts 10,909 Cybercrime Networks in Global Crackdown
INTERPOL on Thursday announced that a coordinated law enforcement action has disrupted 10,909 malicious networks and recovered more than $105 million in illicit funds.In tandem, the effort saw law enforcement agencies from 21 countries arrest 1,462 suspects. Codenamed Operation Serengeti III, the cybercrime crackdown took place between June 29 and August 31, 2026.”Authorities identified First…
-
K0T Hackers Target FortiGate, FortiWeb and Palo Alto GlobalProtect in Credential Theft Campaign
A widespread campaign targeting FortiGate, FortiWeb, and Palo Alto GlobalProtect appliances to steal credentials, establish persistent access, and exfiltrate corporate data. The investigation associates the activity with an operator known as k0t and identifies more than 70,000 exposed credentials across network-device records, LDAP dumps and other operational artifacts. Researchers identified potential connections to the FortiBleed…
-
What the PHP2Shell vulnerability means for Fortinet, Cisco and Palo Alto customers
Palo Alto Networks confirmed that all versions of PAN-OS and Panorama are affected by PHP2Shell, a pair of critical PHP vulnerabilities that let an attacker run code on a web … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/22/php2shell-vulnerability-fortinet-cisco-palo-alto-networks/
-
Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed
Amazon’s Threat Intelligence team on Wednesday said it detected an attempt to exploit the newly disclosed PHP2Shell vulnerabilities on October 17, 2026, against its MadPot honeypot service, as the flaws come under broad exploitation in the wild following the release of the patches.”The exploit attempt originated from an IP address associated with a commercial anonymization…
-
Africa cybercrime crackdown nets 1,462 arrests and over $105 million
Police in 21 countries arrested 1,462 suspects and took down 10,909 malicious networks in Operation Serengeti III, an INTERPOL-coordinated cybercrime sweep across Africa that … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/22/interpol-africa-cybercrime-crackdown-operation-serengeti-iii/
-
Authorities disrupt nearly 11,000 cybercrime networks in Africa
Law enforcement agencies have disrupted nearly 11,000 cybercriminal networks and arrested more than 1,400 people in Operation Serengeti III, which targeted business email compromise, ransomware, and online scams. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/authorities-disrupt-nearly-11-000-cybercrime-networks-in-africa/
-
Russia-linked hackers broke into NATO shipbuilder in latest espionage campaign
Symantec, which discovered the operation, urged companies to scan their networks for signs of compromise. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/russia-nato-hacking-shipbuilder-critical-infrastructure/833509/
-
Industrial Defender Unifies Endpoint Intelligence and Network Monitoring for CIP-015, Adds Risk Signal
Orlando, Florida, United States, October 20th, 2026, CyberNewswire Industrial Defender Unifies Endpoint Intelligence and Network Monitoring for CIP-015, Adds Risk Signal to Turn Findings into Prioritized Patch Plans New internal network security monitoring correlates every anomaly with deep asset intelligence; Risk Signal converts findings into verified remediation Industrial Defender, an OT cybersecurity leader serving the…
-
Ransomware gangs have been exploiting Palo Alto GlobalProtect VPN flaw since June
Several ransomware groups are exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks’ PAN-OS GlobalProtect patched in May, to break into organizations in … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/21/ransomware-groups-exploit-palo-alto-globalprotect-cve-2026-0257/
-
Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections
Attackers took control of more than 300 Tor exit relays in early October and used them to redirect SSH connections to servers that stole login passwords, a researcher found.Exit relays are the last hop in a Tor circuit, where traffic leaves the network for its destination. Only a password login to an SSH server made…
-
Russian Hackers Steal Credentials and Open Secret SSH Tunnel Into NATO Defense Firm’s Network
Tags: blizzard, credentials, cyber, defense, espionage, government, group, hacker, intelligence, law, military, network, russiaSwallowtail, the Russian espionage group also tracked as APT28, Fancy Bear and Forest Blizzard, targeted organizations in two NATO member states, including a law enforcement agency, a naval shipbuilder and a manufacturer of military aircraft engines. The targets’ roles point to intelligence collection focused on national security and defense. The U.S. government identifies APT28 and…
-
Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion
A Belarus-aligned hacktivist group spent nearly two years within the network of a Russian healthcare organization.According to a report published by Russian cybersecurity firm Solar, the activity has been attributed to a threat cluster dubbed Partisan Zmiy, which is also known as the Cyber Partisans.Known to be active since at least 2020, the group has…
-
Industrial Defender Unifies Endpoint Intelligence and Network Monitoring for CIP-015, Adds Risk Signal
Orlando, Florida, United States, 21st October 2026, CyberNewswire First seen on hackread.com Jump to article: hackread.com/industrial-defender-unifies-endpoint-intelligence-and-network-monitoring-for-cip-015-adds-risk-signal/
-
OpenAI Breach Puts Intent at Center of AI Liability Fight
Researcher Says Prosecutors Have a Credible Case – But Current Law Favors OpenAI. A new legal analysis says prosecutors could pursue hacking charges against AI developers whose agents break into other companies’ networks – but the intent requirement favors defendants, and the researcher behind it says a fix should also reach enterprises that recklessly run…
-
Ransomware groups expand targeting of Palo Alto Networks vulnerability
Multiple threat actors have exploited a high-severity flaw in the company’s GlobalProtect portal. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/ransomware-targeting-palo-alto-networks-vulnerability/833474/
-
Defense contractors in two NATO allies hacked in recent Russia-linked campaign
The Russian group known as APT28 and Fancy Bear used a recently documented backdoor to dwell in the networks of two defense contractors and a law enforcement agency in two NATO allies, researchers said. First seen on therecord.media Jump to article: therecord.media/european-defense-contractors-fancy-bear-espionage
-
US Army is developing AI agents that could strike enemy networks and vanish without a trace
The US Army is looking for AI agents that can slip into an adversary’s network, find their target, copy themselves onto nearby tablets and computers, and then erase … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/20/us-army-ai-agents-echotribble/
-
DHS Bans DeepSeek From Federal Civilian Agencies
Supply-Chain Order Sweeps in Vendor Tools Running on DeepSeek Models. Federal civilian agencies must scrub DeepSeek and any vendor tools running on its models from their networks under a U.S. Department of Homeland Security supply-chain order signed months before it surfaced Monday. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/dhs-bans-deepseek-from-federal-civilian-agencies-a-33146
-
NASA CIO Ties IT Modernization to Mission Goals
Network and Cloud Upgrades Support NASAs Lunar and Science Missions. NASA CIO Sean Gallagher says modernization must follow mission needs, from resilient networks and shared services to cloud and financial system upgrades. He explains how the agency applies engineering review, cybersecurity and human oversight before mission-critical work. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/nasa-cio-ties-modernization-to-mission-goals-a-33145
-
Reply erhält Nvidia-Spezialisierung ‘Physical AI” für den produktiven Einsatz von Robotik und Digital-Twins
Reply gehört zu den weltweit ersten Unternehmen, die mit der Spezialisierung ‘Physical AI” innerhalb des Nvidia-Partner-Network (NPN) ausgezeichnet wurden. Nvidia würdigt damit die Expertise von Reply bei der Entwicklung und Umsetzung KI-gestützter Robotik- und Digital-Twin-Lösungen für den realen Einsatz. Voraussetzung für die Auszeichnung war eine technische Prüfung. Bewertet wurden unter anderem bestehende Kundenprojekte, Lösungsarchitekturen, zertifiziertes…