Tag: threat
-
Russian Hackers Exploit Oracle Cloud Infrastructure to Target Scaleway Object Storage
Russian threat actors have been leveraging trusted cloud infrastructure platforms like Oracle Cloud Infrastructure (OCI) Object Storage and Scaleway Object Storage to propagate sophisticated attacks using the Lumma Stealer malware. This malware-as-a-service (MaaS) infostealer, also known as LummaC2 Stealer, targets Windows systems to siphon credentials, system data, and cryptocurrency wallets. Investigations conducted in 2025 reveal…
-
How Identity Plays a Part in 5 Stages of a Cyber Attack
Tags: access, attack, authentication, breach, cloud, computer, container, control, credentials, cyber, data, data-breach, detection, endpoint, exploit, group, iam, identity, intelligence, malicious, malware, mfa, microsoft, monitoring, password, powershell, ransomware, risk, technology, threat, tool, vulnerabilityWhile credential abuse is a primary initial access vector, identity compromise plays a key role in most stages of a cyber attack. Here’s what you need to know, and how Tenable can help. Identity compromise plays a pivotal role in how attackers move laterally through an organization. Credential abuse is the top initial access vector,…
-
Cityworks Zero-Day Vulnerability Used by UAT-638 Hackers to Infect IIS Servers with Shell Malware
Cisco Talos has uncovered active exploitation of a zero-day remote-code-execution vulnerability, identified as CVE-2025-0994, in Cityworks, a widely used asset management system. This critical flaw has been leveraged by a group tracked as UAT-6382, assessed with high confidence to be Chinese-speaking threat actors, to target enterprise networks of local governing bodies in the United States…
-
Researchers Warn of ‘Smiao Network’ Cyber Threat Against Taiwan’s Federal Staff
The Foundation for Defense of Democracies (FDD) and cybersecurity firm TeamT5 has exposed an intricate Chinese intelligence operation, dubbed the ‘Smiao Network,’ targeting federal workers in both the United States and Taiwan. This network, linked to the Chinese technology company Smiao Intelligence, employs deceptive online recruitment schemes to extract sensitive information from high-value professionals. Initially…
-
Hackers Deploy Weaponized npm Packages to Target React and Node.js JavaScript Frameworks
Socket’s Threat Research Team, a series of malicious npm packages have been found lurking in the JavaScript ecosystem for over two years, amassing more than 6,200 downloads. These weaponized packages, targeting popular frameworks like React, Vue.js, Vite, Node.js, and the Quill Editor, were crafted by a threat actor under the npm alias >>xuxingfeng
-
Chinese Hackers Exploit Trimble Cityworks Flaw to Infiltrate U.S. Government Networks
Tags: access, china, cisco, cve, exploit, flaw, government, hacker, malware, network, remote-code-execution, threat, vulnerabilityA Chinese-speaking threat actor tracked as UAT-6382 has been linked to the exploitation of a now-patched remote-code-execution vulnerability in Trimble Cityworks to deliver Cobalt Strike and VShell.”UAT-6382 successfully exploited CVE-2025-0944, conducted reconnaissance, and rapidly deployed a variety of web shells and custom-made malware to maintain long-term access,” Cisco Talos researchers First seen on thehackernews.com Jump…
-
Malicious VS Code Extensions Target Windows Solidity Developers to Steal Login Credentials
Datadog Security Research has uncovered a targeted malware campaign aimed at Solidity developers on Windows systems, using malicious Visual Studio Code (VS Code) extensions as the initial attack vector. Identified as the work of a single threat actor tracked as MUT-9332, this operation deployed three trojanized extensions solaibot, among-eth, and blankebesxstnion disguised as legitimate tools…
-
Security Threats of Open Source AI Exposed by DeepSeek
DeepSeek’s risks must be carefully considered, and ultimately mitigated, in order to enjoy the many benefits of generative AI in a manner that is safe and secure for all organizations and users. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/security-threats-open-source-ai-deepseek
-
Feds and Microsoft crush Lumma Stealer that stole millions of passwords
Tags: access, breach, control, cyber, cybercrime, cybersecurity, infrastructure, malware, microsoft, password, russia, service, software, threat, tool2,300 domains neutralized, command infrastructure seized: As part of the legal action filed in the US District Court for the Northern District of Georgia, Microsoft secured authorization to seize and disrupt a core component of Lumma’s ecosystem: its domain infrastructure. These domains acted as communication nodes between infected devices and the malware’s operators.According to the…
-
Chinese Hackers Exploit Ivanti EPMM Bugs in Global Enterprise Network Attacks
A recently patched pair of security flaws affecting Ivanti Endpoint Manager Mobile (EPMM) software has been exploited by a China-nexus threat actor to target a wide range of sectors across Europe, North America, and the Asia-Pacific region.The vulnerabilities, tracked as CVE-2025-4427 (CVSS score: 5.3) and CVE-2025-4428 (CVSS score: 7.2), could be chained to execute arbitrary…
-
Critical 0-Day: Cityworks Flaw Actively Exploited by Chinese APT UAT-6382
A newly identified Chinese-speaking threat actor cluster, tracked as UAT-6382, is actively exploiting a zero-day vulnerability in Cityworks First seen on securityonline.info Jump to article: securityonline.info/critical-0-day-cityworks-flaw-actively-exploited-by-chinese-apt-uat-6382/
-
UAT-6382 exploits Cityworks zero-day vulnerability to deliver malware
Talos has observed exploitation of CVE-2025-0994 in the wild by UAT-6382, a Chinese-speaking threat actor, who then deployed malware payloads via TetraLoader. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/uat-6382-exploits-cityworks-vulnerability/
-
Several GitLab Vulnerabilities Enable Attackers to Launch DoS Attacks
GitLab has issued critical security patches addressing 11 vulnerabilities across its Community Edition (CE) and Enterprise Edition (EE) platforms, with three high-risk flaws enabling denial-of-service (DoS) attacks dominating the threat landscape. The coordinated release of versions 18.0.1, 17.11.3, and 17.10.7 comes as the DevOps platform confronts multiple attack vectors that could destabilize systems through resource…
-
Western Logistics and Tech Firms Targeted by Russia’s APT28
NSA, NCSC and allies warn Western tech and logistics firms of Russian APT28 cyber-espionage threat First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/western-logistics-tech-firms/
-
Russia-linked APT28 targets western logistics entities and technology firms
CISA warns Russia-linked group APT28 is targeting Western logistics and tech firms aiding Ukraine, posing an elevated threat to supply chains Russia-linked cyberespionage group APT28 intensifies its operations against Western logistics and technology companies moving supplies into Ukraine, US CISA warns. TheAPT28group (akaFancy Bear,Pawn Storm,Sofacy Group,Sednit,BlueDelta, andSTRONTIUM)has been active since at least 2007 and it…
-
ThreatBook Recognized as a Notable Vendor in Global Network Analysis and Visibility (NAV) Report
ThreatBook, a global leader cyber threat and response solutions backed by threat intelligence and AI, has been recognized as a notable vendor in Forrester’s Network Analysis And Visibility Solutions Landscape, Q2 2025 report. This marks a major milestone in ThreatBook’s growing international presence and continued innovation in the NAV (Network Analysis and Visibility) space. For…
-
AI Chatbot Jailbreaking Security Threat is ‘Immediate, Tangible, and Deeply Concerning’
Dark LLMs like WormGPT bypass safety limits to aid scams and hacking. Researchers warn AI jailbreaks remain active, with weak response from tech firms. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-ai-chatbot-jailbreak-vulnerabilities/
-
Securing Open Banking: How Fintechs Can Defend Against Automated Fraud API Abuse
Open Banking is accelerating innovation, and fraud”, with API abuse, credential stuffing, and fake account creation now among the top threats fintechs must defend against in real time. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/05/securing-open-banking-how-fintechs-can-defend-against-automated-fraud-api-abuse/
-
Threat Actor Selling 1.2 Billion Facebook Records, But Details Don’t Add Up
Threat actor ‘ByteBreaker’ claims to sell 1.2B Facebook records scraped via API abuse, but inconsistencies in data size and identity raise doubts. First seen on hackread.com Jump to article: hackread.com/threat-actor-selling-1-2-billion-facebook-records/
-
Ivanti EPMM Exploitation Tied to Previous Zero-Day Attacks
Wiz researchers found an opportunistic threat actor has been targeting vulnerable edge devices, including Ivanti VPNs and Palo Alto firewalls. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/ivanti-epmm-exploitation-previous-zero-day-attacks
-
Pandas Galore: Chinese Hackers Boost Attacks in Latin America
Vixen Panda, Aquatic Panda, both Beijing-sponsored APTs and financially motivated criminal groups continued to pose the biggest threat to organizations in Central and South America last year, says CrowdStrike. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/pandas-galore-chinese-hackers-attacks-latin-america
-
Unimicron, Presto Attacks Mark Industrial Ransomware Surge
A number of major industrial organizations suffered ransomware attacks last quarter, such as PCB manufacturer Unimicron, appliance maker Presto, and more, a harbinger of a rapidly developing and diversifying threat landscape. First seen on darkreading.com Jump to article: www.darkreading.com/ics-ot-security/unimicron-presto-attacks-industrial-ransomware-surge
-
Fight AI-based Threats with AI-based Security
First seen on scworld.com Jump to article: www.scworld.com/native/fight-ai-based-threats-with-ai-based-security
-
Strider launches real-time threat detection upgrades
First seen on scworld.com Jump to article: www.scworld.com/brief/strider-launches-real-time-threat-detection-upgrades
-
Survey finds gaps in cyber threat intel sharing
First seen on scworld.com Jump to article: www.scworld.com/brief/survey-finds-gaps-in-cyber-threat-intel-sharing
-
Cynet Updates CyAI Engine to Improve Threat Detection Accuracy and Reduce False Positives
First seen on scworld.com Jump to article: www.scworld.com/news/cynet-updates-cyai-engine-to-improve-threat-detection-accuracy-and-reduce-false-positives
-
Russian Hackers Exploit Email and VPN Vulnerabilities to Spy on Ukraine Aid Logistics
Tags: cyber, email, exploit, hacker, intelligence, military, russia, service, spy, technology, threat, ukraine, vpn, vulnerabilityRussian cyber threat actors have been attributed to a state-sponsored campaign targeting Western logistics entities and technology companies since 2022.The activity has been assessed to be orchestrated by APT28 (aka BlueDelta, Fancy Bear, or Forest Blizzard), which is linked to the Russian General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center, Military Unit…
-
Dark Reading Confidential: The Day I Found an APT Group in the Most Unlikely Place
Dark Reading Confidential Episode 6: Threat hunters Ismael Valenzuela and Vitor Ventura share stories about the tricks they used to track down advanced persistent threat groups, and the surprises they discovered along the way. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/the-day-i-found-an-apt-group-in-the-most-unlikely-place
-
PupkinStealer Exploits Web Browser Passwords and App Tokens to Exfiltrate Data Through Telegram
A newly identified .NET-based information-stealing malware, dubbed PupkinStealer (also known as PumpkinStealer in some reports), has surfaced as a significant cyber threat, targeting sensitive data such as web browser passwords and application session tokens. First observed in the wild around April 2025, this malware is believed to have roots in Russian-speaking cybercrime communities, with indicators…