Tag: threat
-
Hackers Used Snappybee Malware and Citrix Flaw to Breach European Telecom Network
A European telecommunications organization is said to have been targeted by a threat actor that aligns with a China-nexus cyber espionage group known as Salt Typhoon.The organization, per Darktrace, was targeted in the first week of July 2025, with the attackers exploiting a Citrix NetScaler Gateway appliance to obtain initial access.Salt Typhoon, also known as…
-
CISOs’ security priorities reveal an augmented cyber agenda
Tags: access, ai, attack, authentication, automation, awareness, business, cio, ciso, cyber, cybersecurity, data, deep-fake, detection, edr, email, framework, governance, healthcare, incident response, intelligence, malware, microsoft, mssp, phishing, ransomware, risk, service, siem, soc, software, tactics, technology, threat, tool, training, usa, vulnerability, vulnerability-management, zero-trustCSOConsequently, 41% are planning to leverage AI to detect threats, for anomaly detection, and to automate security responses. Other respondents cited plans to leverage AI for malware detection and real-time risk prediction (39%), as well as DLP and improving enterprise system visibility.Further, 40% expect to see AI enhancements as part of their existing security systems,…
-
Google Identifies Three New Russian Malware Families Created by COLDRIVER Hackers
A new malware attributed to the Russia-linked hacking group known as COLDRIVER has undergone numerous developmental iterations since May 2025, suggesting an increased “operations tempo” from the threat actor.The findings come from Google Threat Intelligence Group (GTIG), which said the state-sponsored hacking crew has rapidly refined and retooled its malware arsenal merely five days following…
-
CISOs’ security priorities reveal an augmented cyber agenda
Tags: access, ai, attack, authentication, automation, awareness, business, cio, ciso, cyber, cybersecurity, data, deep-fake, detection, edr, email, framework, governance, healthcare, incident response, intelligence, malware, microsoft, mssp, phishing, ransomware, risk, service, siem, soc, software, tactics, technology, threat, tool, training, usa, vulnerability, vulnerability-management, zero-trustCSOConsequently, 41% are planning to leverage AI to detect threats, for anomaly detection, and to automate security responses. Other respondents cited plans to leverage AI for malware detection and real-time risk prediction (39%), as well as DLP and improving enterprise system visibility.Further, 40% expect to see AI enhancements as part of their existing security systems,…
-
Hackers Used Snappybee Malware and Citrix Flaw to Breach European Telecom Network
A European telecommunications organization is said to have been targeted by a threat actor that aligns with a China-nexus cyber espionage group known as Salt Typhoon.The organization, per Darktrace, was targeted in the first week of July 2025, with the attackers exploiting a Citrix NetScaler Gateway appliance to obtain initial access.Salt Typhoon, also known as…
-
New cyber resilience centre to help SMEs fend off cyber threats
Spearheaded by the Singapore Business Federation, the cyber resilience centre will equip SMEs in the city-state with cyber security capabilities to mitigate and recover from cyber attacks First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366633233/New-cyber-resilience-centre-to-help-SMEs-fend-off-cyber-threats
-
New cyber resilience centre to help SMEs fend off cyber threats
Spearheaded by the Singapore Business Federation, the cyber resilience centre will equip SMEs in the city-state with cyber security capabilities to mitigate and recover from cyber attacks First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366633233/New-cyber-resilience-centre-to-help-SMEs-fend-off-cyber-threats
-
New GlassWorm Threat Uses Stealthy Code to Target OpenVSX Extensions
GlassWorm is the world’s first self-propagating worm targeting VS Code extensions in the OpenVSX marketplace, unleashing invisible malicious payloads and decentralized command infrastructure that make it nearly impossible to detect or dismantle. First identified on October 17, 2025, GlassWorm hijacks developer machines via invisible Unicode code, harvests credentials, drains cryptocurrency wallets, and transforms infected systems…
-
Cavalry Werewolf APT Targets Multiple Sectors Using FoalShell and StallionRAT
From May to August 2025, an advanced persistent threat group known as Cavalry Werewolf”, also tracked as YoroTrooper and Silent Lynx”, executed a sophisticated attack campaign targeting Russia’s public sector and vital industries such as energy, mining, and manufacturing. The coordinated offensive leveraged trusted relationships for highly targeted spear-phishing and deployed a custom multi-language malware…
-
AdaptixC2 Emerges in npm Supply-Chain Exploit Against Developers
Tags: attack, cyber, cybersecurity, exploit, framework, kaspersky, malicious, open-source, risk, software, supply-chain, threatCybersecurity researchers at Kaspersky have uncovered a sophisticated supply chain attack targeting the npm ecosystem, where threat actors distributed the AdaptixC2 post-exploitation framework through a malicious package disguised as a legitimate proxy utility. The discovery highlights the growing risk of open-source software repositories as attack vectors for delivering advanced malware. In October 2025, Kaspersky experts…
-
New GlassWorm Threat Uses Stealthy Code to Target OpenVSX Extensions
GlassWorm is the world’s first self-propagating worm targeting VS Code extensions in the OpenVSX marketplace, unleashing invisible malicious payloads and decentralized command infrastructure that make it nearly impossible to detect or dismantle. First identified on October 17, 2025, GlassWorm hijacks developer machines via invisible Unicode code, harvests credentials, drains cryptocurrency wallets, and transforms infected systems…
-
Pakistani Cyber Actors Impersonating ‘NIC eEmail Services’ to Target Indian Government
Tags: attack, credentials, cyber, email, government, group, india, infrastructure, phishing, service, spear-phishing, threatPakistan-based advanced persistent threat group APT36, also known as TransparentTribe, is actively targeting Indian government entities with a sophisticated spear-phishing campaign using email lures themed as “NIC eEmail Services.” This campaign leverages lookalike domains and weaponized infrastructure to steal credentials and enable long-term espionage. The attack begins with email messages that convincingly mimic official notifications…
-
CISA Warns of Actively Exploited Windows SMB Vulnerability
Tags: cisa, cve, cyber, cybersecurity, exploit, flaw, infrastructure, kev, microsoft, threat, vulnerability, windowsThe Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Microsoft Windows Server Message Block (SMB) vulnerability to its Known Exploited Vulnerabilities catalog, warning that threat actors are actively exploiting the security flaw in the wild. The vulnerability, tracked as CVE-2025-33073, affects the Windows SMB Client and could allow attackers to escalate privileges on…
-
New LOSTKEYS Malware Tied to Russian State-Sponsored Hacker Group COLDRIVER
Russian state-sponsored threat actor COLDRIVER, long known for targeting high-profile NGOs, policy advisors, and dissidents, has been linked to a rapidly evolving malware campaign following the public disclosure of its LOSTKEYS malware in May 2025. After details of LOSTKEYS surfaced, COLDRIVER (also tracked as UNC4057, Star Blizzard, and Callisto) pivoted away from the compromised malware.…
-
Pakistani Cyber Actors Impersonating ‘NIC eEmail Services’ to Target Indian Government
Tags: attack, credentials, cyber, email, government, group, india, infrastructure, phishing, service, spear-phishing, threatPakistan-based advanced persistent threat group APT36, also known as TransparentTribe, is actively targeting Indian government entities with a sophisticated spear-phishing campaign using email lures themed as “NIC eEmail Services.” This campaign leverages lookalike domains and weaponized infrastructure to steal credentials and enable long-term espionage. The attack begins with email messages that convincingly mimic official notifications…
-
CISA Warns of Actively Exploited Windows SMB Vulnerability
Tags: cisa, cve, cyber, cybersecurity, exploit, flaw, infrastructure, kev, microsoft, threat, vulnerability, windowsThe Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Microsoft Windows Server Message Block (SMB) vulnerability to its Known Exploited Vulnerabilities catalog, warning that threat actors are actively exploiting the security flaw in the wild. The vulnerability, tracked as CVE-2025-33073, affects the Windows SMB Client and could allow attackers to escalate privileges on…
-
Pakistani Cyber Actors Impersonating ‘NIC eEmail Services’ to Target Indian Government
Tags: attack, credentials, cyber, email, government, group, india, infrastructure, phishing, service, spear-phishing, threatPakistan-based advanced persistent threat group APT36, also known as TransparentTribe, is actively targeting Indian government entities with a sophisticated spear-phishing campaign using email lures themed as “NIC eEmail Services.” This campaign leverages lookalike domains and weaponized infrastructure to steal credentials and enable long-term espionage. The attack begins with email messages that convincingly mimic official notifications…
-
ColdRiver Drops Fresh Malware on Targets
The Russia-backed threat actor’s latest cyber spying campaign is a classic example of how quickly sophisticated hacking groups can pivot when exposed. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/coldriver-drops-fresh-malware-targets
-
Salt Typhoon Targets European Telecom
Attack Began With Citrix NetScaler Gateway Compromise, Darktrace Said. The Chinese cyberespionage hackers commonly tracked as Salt Typhoon haven’t stopped their campaign against global telecoms, says managed threat detection firm Darktrace. The group has made telecoms and other digital infrastructure a primary target. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/salt-typhoon-targets-european-telecom-a-29766
-
Securonix: Adding Threat Intelligence to the Mix
The concept of having a single suite of interconnected products, which come without the headache of installations and with optimal performance from each facet, is sometimes the best option. The other consideration is to go for a ‘best of breed’ selection of products, which may not work together and leave you with vulnerable spots even…
-
Winos 4.0 Malware Uses Weaponized PDFs Posing as Government Departments to Infect Windows Machines
Security researchers are tracking a high-severity malware campaign that uses weaponized PDF files to distribute the Winos 4.0 malware. The threat actors impersonate government departments to trick users into opening malicious documents that infect Microsoft Windows machines. The campaign, first observed in early 2025, has since expanded its operations from Taiwan to Japan and Malaysia,…
-
High-severity Windows SMB flaw now exploited in attacks
CISA says threat actors are now actively exploiting a high-severity Windows SMB privilege escalation vulnerability that can let them gain SYSTEM privileges on unpatched systems. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-high-severity-windows-smb-flaw-now-exploited-in-attacks/
-
131 Malicious Chrome Extensions Discovered Targeting WhatsApp Users
A new wave of spamware targeting WhatsApp Web users has emerged, as the Socket Threat Research Team revealed the discovery of 131 malicious Chrome extensions actively flooding the Chrome Web Store. These extensions are not conventional malware, but function as high-risk automation tools, systematically violating platform policies to facilitate large-scale spam campaigns, primarily targeting Brazilian…
-
âš¡ Weekly Recap: F5 Breached, Linux Rootkits, Pixnapping Attack, EtherHiding & More
It’s easy to think your defenses are solid, until you realize attackers have been inside them the whole time. The latest incidents show that long-term, silent breaches are becoming the norm. The best defense now isn’t just patching fast, but watching smarter and staying alert for what you don’t expect.Here’s a quick look at this…
-
Suspected Chinese Hackers Spent a Year-Plus Inside F5 Systems: Report
The suspected Chinese-backed threat actors that hacked into F5’s systems and stole data from the security vendor’s BIG-IP application suite spent more than a year inside the networks dtbefore being in detected in August, according to a Bloomberg report that cited unnamed sources familiar with the investigation. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/10/suspected-chinese-hackers-spent-a-year-plus-inside-f5-systems-report/
-
Threat actors are spreading malicious extensions via VS marketplaces
What are VS extensions: Extensions and themes can be added to Visual Studio code to make life easier for developers, as well as to enhance functionality. An extension can add features like debuggers, new languages, or other development tools, while a theme is a type of extension that changes the appearance of the editor, controlling things like colors…
-
Evilginx’s creator reckons with the dark side of red-team tools
Polish developer Kuba Gretzky wanted to prove that multi-factor authentication wasn’t foolproof. He succeeded, maybe too well. What happens when a cybersecurity warning becomes the threat itself? First seen on therecord.media Jump to article: therecord.media/evilginx-kuba-gretzky-interview-click-here-podcast
-
Suspected Chinese Hackers Spent a Year-Plus Inside F5 Systems: Report
The suspected Chinese-backed threat actors that hacked into F5’s systems and stole data from the security vendor’s BIG-IP application suite spent more than a year inside the networks dtbefore being in detected in August, according to a Bloomberg report that cited unnamed sources familiar with the investigation. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/10/suspected-chinese-hackers-spent-a-year-plus-inside-f5-systems-report/
-
Threat actors are spreading malicious extensions via VS marketplaces
What are VS extensions: Extensions and themes can be added to Visual Studio code to make life easier for developers, as well as to enhance functionality. An extension can add features like debuggers, new languages, or other development tools, while a theme is a type of extension that changes the appearance of the editor, controlling things like colors…