Tag: threat
-
Google says ‘Big Sleep’ AI tool found bug hackers planned to use
On Tuesday, Google said Big Sleep managed to discover CVE-2025-6965, a critical security flaw that Google said was “only known to threat actors and was at risk of being exploited.” First seen on therecord.media Jump to article: therecord.media/google-big-sleep-ai-tool-found-bug
-
North Korean XORIndex malware hidden in 67 malicious npm packages
North Korean threat actors planted 67 malicious packages in the Node Package Manager (npm) online repository to deliver a new malware loader called XORIndex to developer systems. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/north-korean-xorindex-malware-hidden-in-67-malicious-npm-packages/
-
Risk management, legacy tech pose major threats to healthcare firms, report finds
Companies have improved their recovery processes and user controls but still lag in risk preparedness, according to the report. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/healthcare-cybersecurity-risks-report-fortified/753077/
-
Newly Emerged GLOBAL GROUP RaaS Expands Operations with AI-Driven Negotiation Tools
Cybersecurity researchers have shed light on a new ransomware-as-a-service (RaaS) operation called GLOBAL GROUP that has targeted a wide range of sectors in Australia, Brazil, Europe, and the United States since its emergence in early June 2025.GLOBAL GROUP was “promoted on the Ramp4u forum by the threat actor known as ‘$$$,’” EclecticIQ researcher Arda Büyükkaya…
-
Microsoft Explains How Security Copilot in Intune and Entra Supports Security and IT Teams
Microsoft has detailed how its Security Copilot, an AI-powered tool, is transforming security and IT operations by embedding generative AI directly into daily workflows, aligning with Zero Trust principles to enable faster threat response and decision-making. Launched last year, Security Copilot simplifies operations for security and IT teams, reducing friction in tools like Microsoft Intune…
-
Threat Actors Exploit SVG Files in Stealthy JavaScript Redirects
A new phishing campaign uses SVG files for JavaScript redirects, bypassing traditional detection methods First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/hackers-svg-files-javascript/
-
Iranian Threat Actors Target U.S. Critical Infrastructure, Including Water Systems
Iran’s Islamic Revolutionary Guard Corps (IRGC) has increased its asymmetric cyber operations in response to recent U.S. attacks on Iranian nuclear sites. Intelligence Group 13 has emerged as a major aggressor in attacking critical infrastructure in the United States. This elite unit, embedded within the Shahid Kaveh Cyber Group, operates at the nexus of tactical…
-
How phishers are weaponizing SVG images in zero-click, evasive campaigns
Innovative, evasive, and targeted campaigns: Researchers pointed out that traditional endpoint detection, antivirus tools, and even email filters struggle to spot this threat because image files like SVGs are rarely considered dangerous. Compared to previous SVG-based attacks that used hosted payloads, this method keeps everything self-contained, further slipping past defenses.Victims span B2B service providers, utilities,…
-
North Korean Hackers Exploit 67 Malicious npm Packages to Spread XORIndex Malware
Tags: attack, cyber, exploit, hacker, malicious, malware, north-korea, software, supply-chain, threatThe Socket Threat Research Team has discovered a new software supply chain attack that uses a malware loader called XORIndex that had not been previously reported, marking a major uptick in North Korean cyber operations. This activity builds on the Contagious Interview campaign previously detailed in June 2025, which involved the HexEval Loader. The adversaries,…
-
GLOBAL GROUP RaaS Adds AI-Powered Negotiation Feature for Ransom Demands
A newly surfaced Ransomware-as-a-Service operation, dubbed GLOBAL GROUP, has begun deploying an AI”driven negotiation tool that elevates the psychological pressure on victims and streamlines extortion workflows for affiliates. Security researchers at EclecticIQ first identified GLOBAL GROUP’s activity in early June on the Ramp4u underground forum, where the threat actor known as “$$$” shared an onion…
-
Hacktivists Launch Attacks on ICS Systems to Exfiltrate Sensitive Information
Hacktivists’ attacks on Industrial Control Systems (ICS) are becoming more intense in a noticeable evolution of ideologically motivated cyber operations. They have progressed from simple Distributed Denial of Service (DDoS) attacks and website vandalism to more complex intrusions targeted at data exfiltration and disruption of operations. According to Cyble’s Q2 2025 threat landscape assessment Report,…
-
State-Backed HazyBeacon Malware Uses AWS Lambda to Steal Data from SE Asian Governments
Governmental organizations in Southeast Asia are the target of a new campaign that aims to collect sensitive information by means of a previously undocumented Windows backdoor dubbed HazyBeacon.The activity is being tracked by Palo Alto Networks Unit 42 under the moniker CL-STA-1020, where “CL” stands for “cluster” and “STA” refers to “state-backed motivation.””The threat actors…
-
AsyncRAT’s Open-Source Code Sparks Surge in Dangerous Malware Variants Across the Globe
Cybersecurity researchers have charted the evolution of a widely used remote access trojan called AsyncRAT, which was first released on GitHub in January 2019 and has since served as the foundation for several other variants.”AsyncRAT has cemented its place as a cornerstone of modern malware and as a pervasive threat that has evolved into a…
-
Meme Coins in 2025: High Risk, High Reward, and Rising Security Threats
Meme coins started as internet jokes, but by 2025, they’ve become one of the most volatile and talked-about… First seen on hackread.com Jump to article: hackread.com/meme-coins-2025-high-risk-reward-security-threats/
-
Ransomware Threat Grows as Attackers Move Into VMware and Linux
Linux has been the reliable backbone of business infrastructure for many years; it powers 96% of the top million web servers worldwide and more than 80% of workloads in public clouds. Its reputation for reliability and inherent security has long shielded it from the intense scrutiny faced by Windows environments. However, this era of relative…
-
North Korean Hackers Exploit Zoom Invites in Attacks on Crypto Companies
Tags: attack, blockchain, crypto, cyber, cybersecurity, data-breach, exploit, hacker, jobs, malware, north-korea, phishing, spear-phishing, tactics, threatCybersecurity firm SentinelOne has exposed an ongoing malware campaign orchestrated by North Korean threat actors, known for their persistent >>fake interview
-
North Korea-linked actors spread XORIndex malware via 67 malicious npm packages
North Korea-linked hackers uploaded 67 malicious npm packages with XORIndex malware, hitting 17K+ downloads in ongoing supply chain attacks. North Korea-linked threat actors behind the Contagious Interview campaign have uploaded 67 malicious npm packages with XORIndex malware loader, hitting over 17,000 downloads in ongoing supply chain attacks. XORIndex was built to evade detection and deploy…
-
AI poisoning and the CISO’s crisis of trust
Tags: access, ai, breach, ceo, ciso, compliance, control, cybersecurity, data, defense, detection, disinformation, exploit, framework, healthcare, identity, infosec, injection, LLM, monitoring, network, privacy, RedTeam, resilience, risk, russia, saas, threat, tool, trainingFoundation models began parroting Kremlin-aligned propaganda after ingesting material seeded by a large-scale Russian network known as the “Pravda Network.”A high-profile AI-generated reading list published by two American news outlets included 10 hallucinated book titles mistakenly attributed to real authors.Researchers showed that imperceptible perturbations in training images could trigger misclassification. Researchers in the healthcare domain demonstrated…
-
How defenders use the dark web
Tags: access, antivirus, attack, breach, corporate, credit-card, crypto, cyber, cybercrime, dark-web, data, data-breach, email, extortion, finance, fraud, government, group, hacker, healthcare, identity, incident, insurance, intelligence, Internet, interpol, law, leak, lockbit, mail, malware, monitoring, network, phishing, ransom, ransomware, service, software, theft, threat, tool, usa, vpnAttributing attacks to threat actors: When organizations suffer from data breaches and cyber incidents, the dark web becomes a crucial tool for defenders, including the impacted businesses, their legal teams, and negotiators.Threat actors such as ransomware groups often attack organizations to encrypt and steal their data so they can extort them for money, in exchange…
-
Government Organizations Targeted via AWS Lambda URL Endpoint Exploits
Tags: cyber, data, endpoint, espionage, exploit, government, intelligence, monitoring, network, threatUnit 42 researchers from Palo Alto Networks have been monitoring a sophisticated threat cluster designated CL-STA-1020, which has been systematically targeting governmental entities across Southeast Asia. This operation focuses on extracting sensitive data from government agencies, particularly details surrounding recent tariffs and trade disputes, underscoring a motive rooted in espionage and intelligence gathering. The campaign…
-
North Korean Hackers Flood npm Registry with XORIndex Malware in Ongoing Attack Campaign
The North Korean threat actors linked to the Contagious Interview campaign have been observed publishing another set of 67 malicious packages to the npm registry, underscoring ongoing attempts to poison the open-source ecosystem via software supply chain attacks.The packages, per Socket, have attracted more than 17,000 downloads, and incorporate a previously undocumented version of a…
-
CISA Issues Alert on Actively Exploited Wing FTP Server Vulnerability
The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Wing FTP Server vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, warning that threat actors are actively exploiting the security flaw in the wild. Critical Security Flaw Enables System Takeover The vulnerability, tracked as CVE-2025-47812, affects Wing FTP Server and involves improper neutralization of null…
-
Versuchter Cyberangriff auf eine Gemeinde in Pennsylvania, USA
Millcreek Township Prevents Cybersecurity Threat with Swift Action First seen on millcreektownship.com Jump to article: www.millcreektownship.com/CivicAlerts.aspx
-
Wing FTP Vulnerability Actively Exploited Globally
Remote Code Execution Flaw Affects More Than 5,000 Servers. Threat actors are actively exploiting a critical vulnerability in a server file transfer solution. Researchers say the flaw in Wing FTP Server could allow threat actors to execute system-level commands remotely, using null byte and Lua injection without authentication. First seen on govinfosecurity.com Jump to article:…
-
How Trump’s Cyber Cuts Dismantle Federal Information Sharing
Experts Warn Federal Cyber Cuts Are Hindering Public-Private Threat Sharing Efforts. The White House has continued to sharply reduce the size of cybersecurity teams across the federal government while cutting information technology budgets and funding for key programs. Experts warn public-private information sharing around critical cyberthreats has slowed. First seen on govinfosecurity.com Jump to article:…
-
Web-Inject Campaign Debuts Fresh Interlock RAT Variant
A cyber-threat campaign is using legitimate websites to inject victims with remote access Trojans belonging to the Interlock ransomware group, in order to gain control of devices. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/web-inject-campaign-interlock-rat-variant
-
‘Treacherous Territory’: Cyber Experts Warn of Unprecedented Threats
Cyberattacks are surging in 2025, targeting airlines and insurers. Experts warn businesses and consumers to brace for a more dangerous digital landscape. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/news/cyber-experts-warn-of-unprecedented-threats/
-
New PHP-Based Interlock RAT Variant Uses FileFix Delivery Mechanism to Target Multiple Industries
Threat actors behind the Interlock ransomware group have unleashed a new PHP variant of its bespoke remote access trojan (RAT) as part of a widespread campaign using a variant of ClickFix called FileFix.”Since May 2025, activity related to the Interlock RAT has been observed in connection with the LandUpdate808 (aka KongTuke) web-inject threat clusters,” The…
-
Nation-State Threats Push Claroty to Take on Risk Reduction
Claroty’s Yaniv Vardi: AI-Enabled Attackers Push Cyber-Physical Systems to the Edge. Claroty is strengthening its public sector offerings as hostile nation-state actors adopt sabotage tactics. CEO Yaniv Vardi says AI is accelerating adversary capabilities, requiring defenders to shift from visibility to action and reduce risks across connected cyber-physical systems. First seen on govinfosecurity.com Jump to…
-
The 10 most common IT security mistakes
Tags: access, attack, backup, best-practice, bsi, business, control, cyber, cyberattack, cybercrime, data, detection, group, incident response, infrastructure, Internet, login, mfa, microsoft, monitoring, network, office, password, ransomware, risk, security-incident, service, skills, strategy, technology, threat, tool, vpn2. Gateway: Weak passwords: The problem: Weak passwords repeatedly make it easier for cybercriminals to gain access to a company network. A domain administrator password with six characters or a local administrator password with only two characters is no obstacle for perpetrators. It is more than clear that this issue is often neglected in practice,…