Tag: threat
-
How Cloud Service Disruptions Are Making Resilience Critical for Developers
Outages affecting DevOps tools threaten to leave developers coding like it’s 1999. How serious is the threat and what can companies do? First seen on darkreading.com Jump to article: www.darkreading.com/application-security/cloud-service-disruptions-make-resilience-critical-developers
-
North Korean Hackers Use New AkdoorTea Backdoor to Target Global Crypto Developers
The North Korea-linked threat actors associated with the Contagious Interview campaign have been attributed to a previously undocumented backdoor called AkdoorTea, along with tools like TsunamiKit and Tropidoor.Slovak cybersecurity firm ESET, which is tracking the activity under the name DeceptiveDevelopment, said the campaign targets software developers across all operating systems, Windows, First seen on thehackernews.com…
-
North Korean Hackers Use New AkdoorTea Backdoor to Target Global Crypto Developers
The North Korea-linked threat actors associated with the Contagious Interview campaign have been attributed to a previously undocumented backdoor called AkdoorTea, along with tools like TsunamiKit and Tropidoor.Slovak cybersecurity firm ESET, which is tracking the activity under the name DeceptiveDevelopment, said the campaign targets software developers across all operating systems, Windows, First seen on thehackernews.com…
-
Malicious Rust Crates Steal Solana and Ethereum Keys, 8,424 Downloads Confirmed
Cybersecurity researchers have discovered two malicious Rust crates impersonating a legitimate library called fast_log to steal Solana and Ethereum wallet keys from source code.The crates, named faster_log and async_println, were published by the threat actor under the alias rustguruman and dumbnbased on May 25, 2025, amassing 8,424 downloads in total, according to software supply chain…
-
Phishing Campaign Evolves into PureRAT Deployment, Linked to Vietnamese Threat Actors
Vietnamese phishing campaign evolves from Python infostealer to PureRAT trojan First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/vietnamese-threat-actor-python/
-
Co-op Records £206m Revenue Loss Following Cyber-Attack
The UK retailer estimated the losses from temporarily shutting down some of its systems to contain the threat First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/co-op-206m-revenue-loss-cyber/
-
Malicious Rust Crates Steal Solana and Ethereum Keys, 8,424 Downloads Confirmed
Cybersecurity researchers have discovered two malicious Rust crates impersonating a legitimate library called fast_log to steal Solana and Ethereum wallet keys from source code.The crates, named faster_log and async_println, were published by the threat actor under the alias rustguruman and dumbnbased on May 25, 2025, amassing 8,424 downloads in total, according to software supply chain…
-
Unmasking the Insider Seller: Dark Web Attribution
Nisos Unmasking the Insider Seller: Dark Web Attribution Most insider threat teams know what to watch for inside the network: unusual access requests, suspicious file movement, or behavior changes that trip internal tools… First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/09/unmasking-the-insider-seller-dark-web-attribution/
-
Täuschungsstrategien für mehr Cybersicherheit – Wie Threat Deception Angriffe mit legitimen Tools aufdeckt
First seen on security-insider.de Jump to article: www.security-insider.de/threat-deception-backups-lotl-erkennen-a-44c1df581ded94aadbac9d4d97d372a7/
-
Malware Deployment via Copyright Takedown Claims by Threat Actors
Threat actors from the Lone None group are exploiting copyright takedown notices to distribute sophisticated malware, including Pure Logs Stealer and a newly identified information stealer dubbed Lone None Stealer (also known as PXA Stealer). This analysis examines the campaign’s tactics, techniques, and procedures (TTPs), highlights key indicators of compromise (IOCs), and underscores how Lone…
-
APIs werden zunehmend zum Hauptziel für Cyberkriminelle
Das Threat Research Team von Thales verwendete Verhaltensanalysen, maschinelles Lernen und forensische Analysen, um Angriffe zu kategorisieren, sie den Zielendpunkten zuzuordnen und Trends in verschiedenen Branchen zu identifizieren. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/apis-werden-zunehmend-zum-hauptziel-fuer-cyberkriminelle/a42117/
-
Hacker umgehen immer häufiger MFA
Der Sicherheitsanbieter Ontinue hat seinen Threat Intelligence Report für die erste Hälfte des Jahres 2025 veröffentlicht. Die Analyse zeigt: Cyberkriminelle nutzen Schwachstellen heute schneller und professioneller aus als je zuvor. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/hacker-umgehen-haeufiger-mfa
-
AI coding assistants amplify deeper cybersecurity risks
Tags: access, ai, api, application-security, attack, authentication, business, ceo, ciso, cloud, compliance, control, cybersecurity, data, data-breach, detection, fintech, flaw, governance, injection, leak, LLM, metric, open-source, programming, radius, risk, risk-management, service, software, startup, strategy, threat, tool, training, vulnerability‘Shadow’ engineers and vibe coding compound risks: Ashwin Mithra, global head of information security at continuous software development firm Cloudbees, notes that part of the problem is that non-technical teams are using AI to build apps, scripts, and dashboards.”These shadow engineers don’t realize they’re part of the software development life cycle, and often bypass critical…
-
LNK Malware Leverages Legit Windows Files to Slip Past Defenses
In a recently observed campaign emerging from Israel, threat actors have revived the use of Windows shortcut (.LNK) files to deliver a potent Remote Access Trojan (RAT). These seemingly innocuous shortcut files exploit Living-off-the-Land Binaries (LOLBins) such as odbcconf.exe to silently register and execute malicious DLLs, evading security tools and complicating detection efforts. The attack…
-
BRICKSTORM Backdoor Hits Tech and Legal Firms with Stealthy New Campaign
Persistent, stealthy, and cross-platform, the BRICKSTORM backdoor has emerged as a significant threat to U.S. technology and legal organizations. Tracked by Google Threat Intelligence Group (GTIG) and investigated by Mandiant Consulting, BRICKSTORM campaigns have maintained undetected access for an average of 393 days, targeting legal services firms, SaaS providers, BPOs, and technology companies to harvest…
-
Hacker umgehen immer häufiger MFA
Der Sicherheitsanbieter Ontinue hat seinen Threat Intelligence Report für die erste Hälfte des Jahres 2025 veröffentlicht. Die Analyse zeigt: Cyberkriminelle nutzen Schwachstellen heute schneller und professioneller aus als je zuvor. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/hacker-umgehen-haeufiger-mfa
-
BRICKSTORM Backdoor Hits Tech and Legal Firms with Stealthy New Campaign
Persistent, stealthy, and cross-platform, the BRICKSTORM backdoor has emerged as a significant threat to U.S. technology and legal organizations. Tracked by Google Threat Intelligence Group (GTIG) and investigated by Mandiant Consulting, BRICKSTORM campaigns have maintained undetected access for an average of 393 days, targeting legal services firms, SaaS providers, BPOs, and technology companies to harvest…
-
NVIDIA Merlin Flaw Enables Remote Code Execution with Root Access
A critical vulnerability in NVIDIA’s Merlin Transformers4Rec library allows attackers to achieve remote code execution with root privileges. Discovered by the Trend Micro Zero Day Initiative (ZDI) Threat Hunting Team, the flaw stems from unsafe deserialization in the model checkpoint loading functionality. Tracked as CVE-2025-23298, this vulnerability underscores the persistent security challenges in machine learning…
-
Cisco IOS 0-Day RCE Vulnerability Actively Targeted
Cisco has disclosed a critical zero-day vulnerability in its IOS and IOS XE software that is being actively exploited by threat actors in real-world attacks. The flaw, tracked as CVE-2025-20352, affects the Simple Network Management Protocol (SNMP) subsystem and allows both denial-of-service attacks and remote code execution depending on the attacker’s privilege level. Critical SNMP Stack…
-
NVIDIA Merlin Flaw Enables Remote Code Execution with Root Access
A critical vulnerability in NVIDIA’s Merlin Transformers4Rec library allows attackers to achieve remote code execution with root privileges. Discovered by the Trend Micro Zero Day Initiative (ZDI) Threat Hunting Team, the flaw stems from unsafe deserialization in the model checkpoint loading functionality. Tracked as CVE-2025-23298, this vulnerability underscores the persistent security challenges in machine learning…
-
Cisco IOS 0-Day RCE Vulnerability Actively Targeted
Cisco has disclosed a critical zero-day vulnerability in its IOS and IOS XE software that is being actively exploited by threat actors in real-world attacks. The flaw, tracked as CVE-2025-20352, affects the Simple Network Management Protocol (SNMP) subsystem and allows both denial-of-service attacks and remote code execution depending on the attacker’s privilege level. Critical SNMP Stack…
-
Banking Trojans Targeting Android Users Disguise as Government and Trusted Payment Apps
Since August 2024, a financially motivated threat group has been targeting Android users in Indonesia and Vietnam with banking trojans disguised as official government identity and payment applications. By employing elaborate download mechanisms, reusing infrastructure, and leveraging template-based spoofed sites, the operators have used a coordinated campaign to evade detection and steal user credentials. The…
-
How threat actors breached a U.S. federal civilian agency by exploiting a GeoServer flaw
Tags: breach, cisa, cve, cybersecurity, exploit, flaw, infrastructure, remote-code-execution, threat, vulnerabilityUS CISA revealed that threat actors exploited an unpatched vulnerability in GeoServer to breach a U.S. federal civilian agency’s network. Threat actors breached a U.S. federal agency via unpatched GeoServer flaw, tracked as CVE-2024-36401 (CVSS score of 9.8), which is a critical remote code execution (RCE) issue. In mid-July 2024, the U.S. Cybersecurity and Infrastructure…
-
Banking Trojans Targeting Android Users Disguise as Government and Trusted Payment Apps
Since August 2024, a financially motivated threat group has been targeting Android users in Indonesia and Vietnam with banking trojans disguised as official government identity and payment applications. By employing elaborate download mechanisms, reusing infrastructure, and leveraging template-based spoofed sites, the operators have used a coordinated campaign to evade detection and steal user credentials. The…
-
Federal Agency Compromised Via GeoServer Exploit, CISA Reveals
An unnamed federal agency was hacked last year after threat actors exploited a critical GeoServer vulnerability First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/cisa-federal-agency-geoserver/
-
5 questions CISOs should ask vendors
2. Will it reduce my workload, add value or improve operations?: A common starting point is to ask questions about how a new tool will reduce workload, minimize risk, improve resilience or simplify operations.Basu wants to know whether the product can consolidate capabilities instead of adding yet another point solution. “Without that, each tool only…
-
5 questions CISOs should ask vendors
2. Will it reduce my workload, add value or improve operations?: A common starting point is to ask questions about how a new tool will reduce workload, minimize risk, improve resilience or simplify operations.Basu wants to know whether the product can consolidate capabilities instead of adding yet another point solution. “Without that, each tool only…
-
North Korean IT Worker Gains Access to Organization’s Network Through Innocent Job Application
In today’s complex threat landscape, adversaries increasingly favor “malware-less” intrusion methods that slip past traditional defenses. One particularly insidious scheme involves North Korean operatives posing as legitimate remote IT professionals to infiltrate corporate networks. Trellix researchers recently uncovered a campaign in which a fake applicant seamlessly advanced through hiring stages at a major U.S. healthcare…