Tag: threat
-
NDSS 2025 The (Un)usual Suspects Studying Reasons For Lacking Updates In WordPress
SESSION Session 2B: Web Security Authors, Creators & Presenters: Maria Hellenthal (CISPA Helmholtz Center for Information Security), Lena Gotsche (CISPA Helmholtz Center for Information Security), Rafael Mrowczynski (CISPA Helmholtz Center for Information Security), Sarah Kugel (Saarland University), Michael Schilling (CISPA Helmholtz Center for Information Security), Ben Stock (CISPA Helmholtz Center for Information Security) PAPER The…
-
NDSS 2025 The (Un)usual Suspects Studying Reasons For Lacking Updates In WordPress
SESSION Session 2B: Web Security Authors, Creators & Presenters: Maria Hellenthal (CISPA Helmholtz Center for Information Security), Lena Gotsche (CISPA Helmholtz Center for Information Security), Rafael Mrowczynski (CISPA Helmholtz Center for Information Security), Sarah Kugel (Saarland University), Michael Schilling (CISPA Helmholtz Center for Information Security), Ben Stock (CISPA Helmholtz Center for Information Security) PAPER The…
-
Trojanized ESET Installers Drop Kalambur Backdoor in Phishing Attacks on Ukraine
A previously unknown threat activity cluster has been observed impersonating Slovak cybersecurity company ESET as part of phishing attacks targeting Ukrainian entities.The campaign, detected in May 2025, is tracked by the security outfit under the moniker InedibleOchotense, describing it as Russia-aligned.”InedibleOchotense sent spear-phishing emails and Signal text messages, containing a link First seen on thehackernews.com…
-
Cisco Warns of New Firewall Attack Exploiting CVE-2025-20333 and CVE-2025-20362
Cisco on Wednesday disclosed that it became aware of a new attack variant that’s designed to target devices running Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software releases that are susceptible to CVE-2025-20333 and CVE-2025-20362.”This attack can cause unpatched devices to unexpectedly reload, leading to denial-of-service First…
-
Cisco Warns of New Firewall Attack Exploiting CVE-2025-20333 and CVE-2025-20362
Cisco on Wednesday disclosed that it became aware of a new attack variant that’s designed to target devices running Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software releases that are susceptible to CVE-2025-20333 and CVE-2025-20362.”This attack can cause unpatched devices to unexpectedly reload, leading to denial-of-service First…
-
HTTP/2 ‘MadeYouReset’ Vulnerability Enable DenialService (DoS) Attacks
A critical vulnerability discovered across numerous HTTP/2 implementations has exposed a dangerous protocol-level vulnerability that enables threat actors to orchestrate potent denial-of-service (DoS) and distributed denial-of-service (DDoS) attacks. Tracked as CVE-2025-8671 and colloquially known as >>MadeYouReset,
-
HTTP/2 ‘MadeYouReset’ Vulnerability Enable DenialService (DoS) Attacks
A critical vulnerability discovered across numerous HTTP/2 implementations has exposed a dangerous protocol-level vulnerability that enables threat actors to orchestrate potent denial-of-service (DoS) and distributed denial-of-service (DDoS) attacks. Tracked as CVE-2025-8671 and colloquially known as >>MadeYouReset,
-
Critical Bug in Midnight Ransomware Tool Unlocks File Recovery
In the ever-evolving landscape of cyber threats, a new ransomware strain, Midnight, has emerged, echoing the notorious tactics of its predecessor, Babuk. First detected by Gen researchers, Midnight blends familiar ransomware mechanics with novel cryptographic modifications”, some of which unintentionally open the door to file recovery. This represents a rare opportunity for victims to reclaim…
-
Cisco Confirms Active Exploitation of Secure ASA and FTD RCE Vulnerability
Cisco has issued a critical warning about ongoing attacks targeting a severe remote code execution vulnerability affecting its Secure Firewall, Adaptive Security Appliance, and Threat Defense Software. The company updated its security advisory on November 5, 2025, revealing that threat actors have discovered a new attack variant capable of fully compromising devices on unpatched systems.…
-
DigiCert veröffentlicht RADAR Threat Intelligence Report für Q3 2025
DigiCert RADAR, kurz für ‘Risk Analysis, Detection, and Attack Reconnaissance” (Risikoanalyse, Erkennung und Angriffsaufklärung), wird vierteljährlich veröffentlicht und bietet Organisationen handlungsrelevante Bedrohungsinformationen zur Stärkung der Cyber-Resilienz First seen on infopoint-security.de Jump to article: www.infopoint-security.de/digicert-veroeffentlicht-radar-threat-intelligence-report-fuer-q3-2025/a42635/
-
DigiCert veröffentlicht RADAR Threat Intelligence Report für Q3 2025
DigiCert RADAR, kurz für ‘Risk Analysis, Detection, and Attack Reconnaissance” (Risikoanalyse, Erkennung und Angriffsaufklärung), wird vierteljährlich veröffentlicht und bietet Organisationen handlungsrelevante Bedrohungsinformationen zur Stärkung der Cyber-Resilienz First seen on infopoint-security.de Jump to article: www.infopoint-security.de/digicert-veroeffentlicht-radar-threat-intelligence-report-fuer-q3-2025/a42635/
-
Critical Bug in Midnight Ransomware Tool Unlocks File Recovery
In the ever-evolving landscape of cyber threats, a new ransomware strain, Midnight, has emerged, echoing the notorious tactics of its predecessor, Babuk. First detected by Gen researchers, Midnight blends familiar ransomware mechanics with novel cryptographic modifications”, some of which unintentionally open the door to file recovery. This represents a rare opportunity for victims to reclaim…
-
Threat Actors Exploit VS Code Extensions for Ransomware via GitHub C2
Tags: attack, control, cyber, espionage, exploit, github, government, group, infrastructure, malware, north-korea, ransomware, threatSecurity researchers have uncovered a sophisticated attack campaign attributed to Kimsuky, the North Korean-backed threat group known for conducting espionage operations against government entities and think tanks. Recent analysis reveals that threat actors are leveraging Visual Studio Code extensions and GitHub as command-and-control infrastructure to deliver multi-stage malware payloads capable of deploying ransomware and conducting…
-
Threat Actors Exploit VS Code Extensions for Ransomware via GitHub C2
Tags: attack, control, cyber, espionage, exploit, github, government, group, infrastructure, malware, north-korea, ransomware, threatSecurity researchers have uncovered a sophisticated attack campaign attributed to Kimsuky, the North Korean-backed threat group known for conducting espionage operations against government entities and think tanks. Recent analysis reveals that threat actors are leveraging Visual Studio Code extensions and GitHub as command-and-control infrastructure to deliver multi-stage malware payloads capable of deploying ransomware and conducting…
-
Checkpoint Analysis: Dissecting the $128M Balancer Pool Drain in Under 30 Minutes
In the early hours of November 3, 2025, Check Point Research’s blockchain threat monitoring systems flagged a suspicious pattern on the Ethereum mainnet. The alert stemmed from Balancer V2’s Vault contract, which soon revealed one of the most devastating DeFi vulnerabilities to date. Before defenders could intervene, attackers had siphoned $128.64 million from Balancer ComposableStablePool…
-
Checkpoint Analysis: Dissecting the $128M Balancer Pool Drain in Under 30 Minutes
In the early hours of November 3, 2025, Check Point Research’s blockchain threat monitoring systems flagged a suspicious pattern on the Ethereum mainnet. The alert stemmed from Balancer V2’s Vault contract, which soon revealed one of the most devastating DeFi vulnerabilities to date. Before defenders could intervene, attackers had siphoned $128.64 million from Balancer ComposableStablePool…
-
Airstalk Malware Exploits AirWatch MDM for Covert C2 Communication
Security researchers have identified a sophisticated new malware family, Airstalk, that exploits VMware’s AirWatch API”, now known as Workspace ONE Unified Endpoint Management”, to establish covert command-and-control channels. The discovery represents a significant threat to evolution, with both PowerShell and .NET variants discovered in what researchers assess with medium confidence was a nation-state-sponsored supply chain…
-
Airstalk Malware Exploits AirWatch MDM for Covert C2 Communication
Security researchers have identified a sophisticated new malware family, Airstalk, that exploits VMware’s AirWatch API”, now known as Workspace ONE Unified Endpoint Management”, to establish covert command-and-control channels. The discovery represents a significant threat to evolution, with both PowerShell and .NET variants discovered in what researchers assess with medium confidence was a nation-state-sponsored supply chain…
-
Do robots dream of secure networking? Teaching cybersecurity to AI systems
This blog demonstrates a proof of concept using LangChain and OpenAI, integrated with Cisco Umbrella API, to provide AI agents with real-time threat intelligence for evaluating domain dispositions. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/do-robots-dream-of-secure-networking/
-
Alleged Russia-linked Curly COMrades exploit Windows Hyper-V to evade EDRs
Curly COMrades threat actors exploit Windows Hyper-V to hide Linux VMs, evade EDR tools, and deploy custom malware undetected. Bitdefender researchers, aided by Georgia’s CERT, uncovered that Curly COMrades, a group linked to Russian interests, abused Windows Hyper-V to gain covert, long-term access to victims. Threat actors created hidden Alpine Linux VMs (120MB/256MB) hosting custom…
-
Do robots dream of secure networking? Teaching cybersecurity to AI systems
This blog demonstrates a proof of concept using LangChain and OpenAI, integrated with Cisco Umbrella API, to provide AI agents with real-time threat intelligence for evaluating domain dispositions. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/do-robots-dream-of-secure-networking/
-
Keeper Security launches Forcefield to defend against memory-based attacks on Windows devices
Keeper Security has unveiled Keeper Forcefield, a new kernel-level endpoint security product designed to stop one of the fastest-growing cyber threats: memory-based attacks. The company, known for its zero-trust and zero-knowledge Privileged Access Management (PAM) platform, says Forcefield is the first solution to deliver real-time memory protection at both the user and kernel levels, offering…
-
Your AI-driven threat hunting is only as good as your data platform and pipeline
The data-centric foundation for modern threat hunting. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/spons/your-ai-driven-threat-hunting-is-only-as-good-as-your-data-platform-and-pip/804789/
-
Your AI-driven threat hunting is only as good as your data platform and pipeline
The data-centric foundation for modern threat hunting. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/spons/your-ai-driven-threat-hunting-is-only-as-good-as-your-data-platform-and-pip/804789/
-
Hackers Weaponize Windows Hyper-V to Hide Linux VM and Evade EDR Detection
The threat actor known as Curly COMrades has been observed exploiting virtualization technologies as a way to bypass security solutions and execute custom malware.According to a new report from Bitdefender, the adversary is said to have enabled the Hyper-V role on selected victim systems to deploy a minimalistic, Alpine Linux-based virtual machine.”This hidden environment, with…
-
EndClient RAT Leverages Compromised Code-Signing to Slip Past Antivirus
A sophisticated Remote Access Trojan (RAT) is actively targeting North Korean Human Rights Defenders (HRDs) through a campaign leveraging stolen code-signing certificates to evade antivirus detection. The newly discovered >>EndClient RAT,>StressClear.msi,
-
EndClient RAT Leverages Compromised Code-Signing to Slip Past Antivirus
A sophisticated Remote Access Trojan (RAT) is actively targeting North Korean Human Rights Defenders (HRDs) through a campaign leveraging stolen code-signing certificates to evade antivirus detection. The newly discovered >>EndClient RAT,>StressClear.msi,
-
Google Warns of PROMPTFLUX Malware That Uses Gemini API for Self-Rewriting Attacks
Cybersecurity researchers at Google Threat Intelligence Group (GTIG) have identified a significant shift in how threat actors are leveraging artificial intelligence in their operations. The discovery of experimental malware called PROMPTFLUX marks a watershed moment in cyber threats, demonstrating that attackers are no longer using AI merely to boost productivity they are now deploying AI-enabled…