Tag: threat
-
AI coding assistants amplify deeper cybersecurity risks
Tags: access, ai, api, application-security, attack, authentication, business, ceo, ciso, cloud, compliance, control, cybersecurity, data, data-breach, detection, fintech, flaw, governance, injection, leak, LLM, metric, open-source, programming, radius, risk, risk-management, service, software, startup, strategy, threat, tool, training, vulnerability‘Shadow’ engineers and vibe coding compound risks: Ashwin Mithra, global head of information security at continuous software development firm Cloudbees, notes that part of the problem is that non-technical teams are using AI to build apps, scripts, and dashboards.”These shadow engineers don’t realize they’re part of the software development life cycle, and often bypass critical…
-
LNK Malware Leverages Legit Windows Files to Slip Past Defenses
In a recently observed campaign emerging from Israel, threat actors have revived the use of Windows shortcut (.LNK) files to deliver a potent Remote Access Trojan (RAT). These seemingly innocuous shortcut files exploit Living-off-the-Land Binaries (LOLBins) such as odbcconf.exe to silently register and execute malicious DLLs, evading security tools and complicating detection efforts. The attack…
-
BRICKSTORM Backdoor Hits Tech and Legal Firms with Stealthy New Campaign
Persistent, stealthy, and cross-platform, the BRICKSTORM backdoor has emerged as a significant threat to U.S. technology and legal organizations. Tracked by Google Threat Intelligence Group (GTIG) and investigated by Mandiant Consulting, BRICKSTORM campaigns have maintained undetected access for an average of 393 days, targeting legal services firms, SaaS providers, BPOs, and technology companies to harvest…
-
Hacker umgehen immer häufiger MFA
Der Sicherheitsanbieter Ontinue hat seinen Threat Intelligence Report für die erste Hälfte des Jahres 2025 veröffentlicht. Die Analyse zeigt: Cyberkriminelle nutzen Schwachstellen heute schneller und professioneller aus als je zuvor. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/hacker-umgehen-haeufiger-mfa
-
BRICKSTORM Backdoor Hits Tech and Legal Firms with Stealthy New Campaign
Persistent, stealthy, and cross-platform, the BRICKSTORM backdoor has emerged as a significant threat to U.S. technology and legal organizations. Tracked by Google Threat Intelligence Group (GTIG) and investigated by Mandiant Consulting, BRICKSTORM campaigns have maintained undetected access for an average of 393 days, targeting legal services firms, SaaS providers, BPOs, and technology companies to harvest…
-
NVIDIA Merlin Flaw Enables Remote Code Execution with Root Access
A critical vulnerability in NVIDIA’s Merlin Transformers4Rec library allows attackers to achieve remote code execution with root privileges. Discovered by the Trend Micro Zero Day Initiative (ZDI) Threat Hunting Team, the flaw stems from unsafe deserialization in the model checkpoint loading functionality. Tracked as CVE-2025-23298, this vulnerability underscores the persistent security challenges in machine learning…
-
Cisco IOS 0-Day RCE Vulnerability Actively Targeted
Cisco has disclosed a critical zero-day vulnerability in its IOS and IOS XE software that is being actively exploited by threat actors in real-world attacks. The flaw, tracked as CVE-2025-20352, affects the Simple Network Management Protocol (SNMP) subsystem and allows both denial-of-service attacks and remote code execution depending on the attacker’s privilege level. Critical SNMP Stack…
-
NVIDIA Merlin Flaw Enables Remote Code Execution with Root Access
A critical vulnerability in NVIDIA’s Merlin Transformers4Rec library allows attackers to achieve remote code execution with root privileges. Discovered by the Trend Micro Zero Day Initiative (ZDI) Threat Hunting Team, the flaw stems from unsafe deserialization in the model checkpoint loading functionality. Tracked as CVE-2025-23298, this vulnerability underscores the persistent security challenges in machine learning…
-
Cisco IOS 0-Day RCE Vulnerability Actively Targeted
Cisco has disclosed a critical zero-day vulnerability in its IOS and IOS XE software that is being actively exploited by threat actors in real-world attacks. The flaw, tracked as CVE-2025-20352, affects the Simple Network Management Protocol (SNMP) subsystem and allows both denial-of-service attacks and remote code execution depending on the attacker’s privilege level. Critical SNMP Stack…
-
How threat actors breached a U.S. federal civilian agency by exploiting a GeoServer flaw
Tags: breach, cisa, cve, cybersecurity, exploit, flaw, infrastructure, remote-code-execution, threat, vulnerabilityUS CISA revealed that threat actors exploited an unpatched vulnerability in GeoServer to breach a U.S. federal civilian agency’s network. Threat actors breached a U.S. federal agency via unpatched GeoServer flaw, tracked as CVE-2024-36401 (CVSS score of 9.8), which is a critical remote code execution (RCE) issue. In mid-July 2024, the U.S. Cybersecurity and Infrastructure…
-
Banking Trojans Targeting Android Users Disguise as Government and Trusted Payment Apps
Since August 2024, a financially motivated threat group has been targeting Android users in Indonesia and Vietnam with banking trojans disguised as official government identity and payment applications. By employing elaborate download mechanisms, reusing infrastructure, and leveraging template-based spoofed sites, the operators have used a coordinated campaign to evade detection and steal user credentials. The…
-
Banking Trojans Targeting Android Users Disguise as Government and Trusted Payment Apps
Since August 2024, a financially motivated threat group has been targeting Android users in Indonesia and Vietnam with banking trojans disguised as official government identity and payment applications. By employing elaborate download mechanisms, reusing infrastructure, and leveraging template-based spoofed sites, the operators have used a coordinated campaign to evade detection and steal user credentials. The…
-
Federal Agency Compromised Via GeoServer Exploit, CISA Reveals
An unnamed federal agency was hacked last year after threat actors exploited a critical GeoServer vulnerability First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/cisa-federal-agency-geoserver/
-
5 questions CISOs should ask vendors
2. Will it reduce my workload, add value or improve operations?: A common starting point is to ask questions about how a new tool will reduce workload, minimize risk, improve resilience or simplify operations.Basu wants to know whether the product can consolidate capabilities instead of adding yet another point solution. “Without that, each tool only…
-
5 questions CISOs should ask vendors
2. Will it reduce my workload, add value or improve operations?: A common starting point is to ask questions about how a new tool will reduce workload, minimize risk, improve resilience or simplify operations.Basu wants to know whether the product can consolidate capabilities instead of adding yet another point solution. “Without that, each tool only…
-
North Korean IT Worker Gains Access to Organization’s Network Through Innocent Job Application
In today’s complex threat landscape, adversaries increasingly favor “malware-less” intrusion methods that slip past traditional defenses. One particularly insidious scheme involves North Korean operatives posing as legitimate remote IT professionals to infiltrate corporate networks. Trellix researchers recently uncovered a campaign in which a fake applicant seamlessly advanced through hiring stages at a major U.S. healthcare…
-
North Korean IT Worker Gains Access to Organization’s Network Through Innocent Job Application
In today’s complex threat landscape, adversaries increasingly favor “malware-less” intrusion methods that slip past traditional defenses. One particularly insidious scheme involves North Korean operatives posing as legitimate remote IT professionals to infiltrate corporate networks. Trellix researchers recently uncovered a campaign in which a fake applicant seamlessly advanced through hiring stages at a major U.S. healthcare…
-
ShadowV2 Botnet Infects AWS Docker Containers to Launch DDoS Campaign
Darktrace’s latest investigation uncovered a novel campaign that blends traditional malware with modern DevOps technology. At the center of this operation lies a Python-based command-and-control (C2) framework hosted on GitHub CodeSpaces. The threat actors leverage a multi-stage Docker deployment initiated by a Python spreader, followed by a Go-based Remote Access Trojan (RAT) that implements a…
-
State-Sponsored Hackers Exploiting Libraesva Email Security Gateway Vulnerability
Libraesva has released a security update to address a vulnerability in its Email Security Gateway (ESG) solution that it said has been exploited by state-sponsored threat actors.The vulnerability, tracked as CVE-2025-59689, carries a CVSS score of 6.1, indicating medium severity.”Libraesva ESG is affected by a command injection flaw that can be triggered by a malicious…
-
Building a stronger SOC through AI augmentation
In this Help Net Security interview, Tim Bramble, Director of Threat Detection and Response at OpenText, discusses how SOC teams are gaining value from AI in detecting and … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/09/24/tim-bramble-opentext-ai-soc-value/
-
New “YiBackdoor” Malware Lets Hackers Run Commands and Steal Data
Cybersecurity researchers at Zscaler ThreatLabz have identified a sophisticated new malware strain dubbed YiBackdoor, first detected in June 2025. This emerging threat represents a significant evolution in backdoor technology, sharing substantial code similarities with established malware families IcedID and Latrodectus. The discovery highlighted the continuous adaptation of cybercriminal tools, as YiBackdoor demonstrates capabilities that enable…
-
Über 40.000 neue IT-Schwachstellen Unternehmen müssen in der Sicherheitslückenflut Prioritäten setzen
Rekordwerte bei veröffentlichten Schwachstellen, aber nur wenige werden aktiv ausgenutzt. Im Jahr 2024 wurden weltweit 40.291 neue IT-Schwachstellen veröffentlicht ein Anstieg um 38,6 Prozent gegenüber dem Vorjahr. Das zeigt der aktuelle aDvens Threat Report 2025. Gleichzeitig nutzten Angreifer nur 244 dieser Schwachstellen aktiv aus [1]. Die Diskrepanz zwischen der schieren Masse an gemeldeten… First seen…
-
Feel Relieved with Autonomous Secrets Rotation
How Can Autonomous Secrets Rotation Alleviate Security Concerns? Imagine where security breaches are no longer a looming threat to your organization’s sensitive data. For many cybersecurity professionals, this dream scenario is becoming a reality with the implementation of autonomous secrets rotation. But what exactly is this process, and how can it bring peace of mind……
-
Boyd Gaming discloses data breach after suffering a cyberattack
US gaming and casino operator Boyd Gaming Corporation disclosed it suffered a breach after threat actors gained access to its systems and stole data, including employee information and data belonging to a limited number of other individuals. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/boyd-gaming-discloses-data-breach-after-suffering-a-cyberattack/
-
GitHub Aims to Secure Supply Chain as NPM Hacks Ramp Up
GitHub will address weak authentication and overly permissive tokens in the NPM ecosystem, following high-profile threat campaigns like those involving Shai-Hulud malware. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/github-secure-supply-chain-npm-hacks-ramp-up
-
Iran Targets Job-Seeking European Aerospace Engineers
Iranian Hackers Impersonate Online Recruiters. Western Europeans working in aerospace, defense manufacturing or telecoms are receiving waves of emails from putative job recruiters who actually are Iranian state hackers ready to unleash a backdoor and an infostealer. Check Point tracks the threat actor as Nimbus Manticore. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/iran-targets-job-seeking-european-aerospace-engineers-a-29517
-
Secret Service Dismantles NY Telecom Threat Amid UN Meeting
Secret Service Disrupts Network of Telecom Devices Targeting Government Officials. The Secret Service announced Tuesday a major takedown of a telecommunications threat targeting senior U.S. government officials in New York just as President Donald Trump was delivering remarks to global leaders at the United Nations General Assembly. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/secret-service-dismantles-ny-telecom-threat-amid-un-meeting-a-29516
-
News alert: SpyCloud report finds security teams overconfident as identity exposures fuel ransomware
Austin, Texas, September 23rd, 2025, CyberNewsWire, SpyCloud, the leader in identity threat protection, today released the 2025 SpyCloud Identity Threat Report, revealing that while 86% of security leaders report confidence in their ability to prevent identity-based attacks,… (more”¦) First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/09/news-alert-spycloud-report-finds-security-teams-overconfident-as-identity-exposures-fuel-ransomware/