Tag: tool
-
SharpSuccessor PoC Released to Weaponize Windows Server 2025 BadSuccessor Flaw
A critical privilege escalation vulnerability in Windows Server 2025’s delegated Managed Service Account (dMSA) feature enables attackers to compromise Active Directory domains using tools like SharpSuccessor. This attack chain exploits default configurations to transform low-privileged users into Domain Admins through an abusable Kerberos ticket manipulation. Below, we break down the technical mechanics, weaponization process, and…
-
Fake software activation videos on TikTok spread Vidar, StealC
Crooks use TikTok videos with fake tips to trick users into running commands that install Vidar and StealC malware in ClickFix attacks. Cybercriminals leverage AI-generated TikTok videos in ClickFix attacks to spread Vidar and StealC malware, reports Trend Micro. These videos trick users into running PowerShell commands disguised as software activation steps for tools like…
-
The 7 unwritten rules of leading through crisis
Tags: automation, best-practice, business, ceo, cio, cyber, cybersecurity, incident response, intelligence, radius, risk, security-incident, service, software, strategy, tactics, technology, threat, tool, trainingRule 2: A proactive mindset sets the stage for collective learning: Confusion is contagious. “Providing clarity about what’s known, what matters, and what you’re aiming for, stabilizes people and systems,” says Leila Rao, a workplace and executive coaching consultant. “It sets the tone for proactivity instead of reactivity.”Simply treating symptoms will make the problem worse,…
-
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 46
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Sarcoma Ransomware Unveiled: Anatomy of a Double Extortion Gang RVTools Bumblebee Malware Attack How a Trusted IT Tool Became a Malware Delivery Vector Malicious ‘Checker’ Packages on PyPI Probe TikTok and Instagram for Valid Accounts […]…
-
Hackers Use Fake VPN and Browser NSIS Installers to Deliver Winos 4.0 Malware
Cybersecurity researchers have disclosed a malware campaign that uses fake software installers masquerading as popular tools like LetsVPN and QQ Browser to deliver the Winos 4.0 framework.The campaign, first detected by Rapid7 in February 2025, involves the use of a multi-stage, memory-resident loader called Catena.”Catena uses embedded shellcode and configuration switching logic to stage First…
-
How Hunters International Used the Browser to Breach Enterprises”Š”, “ŠAnd Why They Didn’t See It”¦
How Hunters International Used the Browser to Breach Enterprises”Š”, “ŠAnd Why They Didn’t See It Coming At RSAC 2025, Cato Networks delivered a presentation that SOC teams and CISOs will want to pay attention to: “Suspicious Minds”Š”, “ŠHunting Threats That Don’t Trigger Security Alerts.” The session showcased ransomware campaigns that bypassed traditional detection. In some cases,…
-
ConnectWise ScreenConnect Tops List of Abused RATs in 2025 Attacks
Cofense Intelligence’s May 2025 report exposes how cybercriminals are abusing legitimate Remote Access Tools (RATs) like ConnectWise and Splashtop to deliver malware and steal data. Learn about this growing threat. First seen on hackread.com Jump to article: hackread.com/connectwise-screenconnect-tops-abused-rats-2025/
-
A Hyperscaler for Cybersecurity
Tags: access, automation, business, cloud, compliance, computing, control, cybersecurity, data, detection, edr, endpoint, group, infrastructure, intelligence, mssp, network, service, siem, soc, software, threat, tool, updateHyperscalers like AWS and GCP have transformed IT and general tech. Now it’s time for the cybersecurity industry to catch up by shifting to specialized hyperscaler platforms built for security operations (SecOps) at scale. Why the cybersecurity industry needs its own hyperscaler IT hyperscalers evolved to meet the challenges of web-scale computing back in the…
-
At TechCrunch Sessions: AI, Artemis Seaford and Ion Stoica confront the ethical crisis, when AI crosses the line
As generative AI becomes faster, cheaper, and more convincing, the ethical stakes are no longer theoretical. What happens when the tools to deceive become widely accessible? And how do we build systems that are powerful, but safe enough to trust? At TechCrunch Sessions: AI, taking place June 5 at UC Berkeley’s Zellerbach Hall, Artemis […]…
-
Researchers Uncover Infrastructure and TTPs Behind ALCATRAZ Malware
Elastic Security Labs has recently exposed a sophisticated new malware family dubbed DOUBLELOADER, observed in conjunction with the RHADAMANTHYS infostealer. This discovery sheds light on the evolving tactics, techniques, and procedures (TTPs) of cybercriminals who leverage advanced obfuscation tools to hinder analysis. Notably, DOUBLELOADER is protected by ALCATRAZ, an open-source obfuscator first released in 2023,…
-
Operation Endgame 2.0: DanaBusted
Tags: access, attack, backup, banking, breach, business, cloud, communications, control, crypto, cybercrime, data, defense, detection, email, espionage, firewall, fraud, government, group, Hardware, infection, intelligence, international, law, malicious, malware, middle-east, network, programming, ransomware, russia, service, supply-chain, switch, threat, tool, ukraine, update, windowsIntroductionOn May 22, 2025, international law enforcement agencies released information about additional actions that were taken in conjunction with Operation Endgame, an ongoing, coordinated effort to dismantle and prosecute cybercriminal organizations, including those behind DanaBot. This action mirrors the original Operation Endgame, launched in May 2024, which disrupted SmokeLoader, IcedID, SystemBC, Pikabot, and Bumblebee. Zscaler…
-
Chinese threat actors exploited Trimble Cityworks flaw to breach U.S. local government networks
A Chinese threat actor, tracked as UAT-6382, exploited a patched Trimble Cityworks flaw to deploy Cobalt Strike and VShell. Cisco Talos researchers attribute the exploitation of the CVE-2025-0994 in Trimble Cityworks to Chinese-speaking threat actor UAT-6382, based on tools and TTPs used in the intrusions. The vulnerability CVE-2025-0994 (CVSS v4 score of 8.6) is a…
-
Dell arms partners with resiliency and automation tools
Vendor has used Las Vegas event to make a number of announcements that are designed to improve its security, datacentre management and AI position First seen on computerweekly.com Jump to article: www.computerweekly.com/microscope/news/366624493/Dell-arms-partners-with-resiliency-and-automation-tools
-
Russian APT28 compromised Western logistics and IT firms to track aid to Ukraine
Tags: access, advisory, api, authentication, cctv, cloud, computer, container, credentials, cve, cybersecurity, data, detection, email, exploit, flaw, government, hacker, identity, infrastructure, Internet, login, malicious, malware, mfa, military, network, ntlm, office, open-source, password, phishing, powershell, russia, service, software, threat, tool, ukraine, vulnerabilityCredential guessing and spearphishing: The attackers used brute-force credential guessing techniques, also known as password spraying, to gain initial access to accounts. This was complemented with targeted phishing emails that directed recipients to fake login pages for government entities or Western cloud email providers. These phishing pages were stored on free web hosting services or…
-
Evaluating open-source tools for data masking
Can you use open-source tools to mask sensitive production data for use in testing and development? We explore the available options and weigh the pros and cons of relying on DIY data masking solutions. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/05/evaluating-open-source-tools-for-data-masking/
-
Operant AI Launches Open-Source Red Teaming Tool for AI and Cloud Security
First seen on scworld.com Jump to article: www.scworld.com/brief/operant-ai-launches-open-source-red-teaming-tool-for-ai-and-cloud-security
-
Legitimate tools spoofed by infostealing Chrome extensions
First seen on scworld.com Jump to article: www.scworld.com/brief/legitimate-tools-spoofed-by-infostealing-chrome-extensions
-
CefSharp Enumeration Tool Identifies Critical Security Issues in .NET Desktop Applications
Cybersecurity researchers and red teamers, a newly released tool named CefEnum is shedding light on critical security flaws in .NET-based desktop applications leveraging CefSharp, a lightweight wrapper around the Chromium Embedded Framework (CEF). CefSharp enables developers to embed Chromium browsers within .NET applications, facilitating the creation of web-based thick-clients for Windows environments. However, as detailed…
-
Chinese-speaking hackers targeting US municipalities with Cityworks bug
Since January, cybersecurity experts have seen Chinese-speaking hackers exploiting a bug impacting a tool used by local governments to manage critical infrastructure assets and other services. First seen on therecord.media Jump to article: therecord.media/chinese-speaking-hackers-target-municipalities-cityworks
-
How Identity Plays a Part in 5 Stages of a Cyber Attack
Tags: access, attack, authentication, breach, cloud, computer, container, control, credentials, cyber, data, data-breach, detection, endpoint, exploit, group, iam, identity, intelligence, malicious, malware, mfa, microsoft, monitoring, password, powershell, ransomware, risk, technology, threat, tool, vulnerabilityWhile credential abuse is a primary initial access vector, identity compromise plays a key role in most stages of a cyber attack. Here’s what you need to know, and how Tenable can help. Identity compromise plays a pivotal role in how attackers move laterally through an organization. Credential abuse is the top initial access vector,…
-
Malicious VS Code Extensions Target Windows Solidity Developers to Steal Login Credentials
Datadog Security Research has uncovered a targeted malware campaign aimed at Solidity developers on Windows systems, using malicious Visual Studio Code (VS Code) extensions as the initial attack vector. Identified as the work of a single threat actor tracked as MUT-9332, this operation deployed three trojanized extensions solaibot, among-eth, and blankebesxstnion disguised as legitimate tools…
-
Attackers Abuse TikTok and Instagram APIs
It must be the season for API security incidents. Hot on the heels of a developer leaking an API key for private Tesla and SpaceX LLMs, researchers have now discovered a set of tools for validating account information via API abuse, leveraging undocumented TikTok and Instagram APIs. The tools, and assumed exploitation, involve malicious Python…
-
Feds and Microsoft crush Lumma Stealer that stole millions of passwords
Tags: access, breach, control, cyber, cybercrime, cybersecurity, infrastructure, malware, microsoft, password, russia, service, software, threat, tool2,300 domains neutralized, command infrastructure seized: As part of the legal action filed in the US District Court for the Northern District of Georgia, Microsoft secured authorization to seize and disrupt a core component of Lumma’s ecosystem: its domain infrastructure. These domains acted as communication nodes between infected devices and the malware’s operators.According to the…
-
Red Hat, HashiCorp reveal Ansible, Terraform and Vault plans
Red Hat Ansible and HashiCorp reps filled in the blanks about how infrastructure automation tools will more deeply integrate, news welcomed by financial services customers. First seen on techtarget.com Jump to article: www.techtarget.com/searchitoperations/news/366624292/Red-Hat-HashiCorp-reveal-Ansible-Terraform-and-Vault-plans
-
Nach Zero Day in Sysinternals-Tools – Auch Microsoft PowerToy von DLL Hijacking betroffen
First seen on security-insider.de Jump to article: www.security-insider.de/dll-hijacking-microsoft-sysinternals-tools-powertoys-a-2507a24d8a4af1be37682bdb710bae7b/
-
AI Governance So gestalten Sie die KI-Revolution sicher
Unternehmen müssen ein Governance-, Risiko- und Compliance-Rahmenwerk (GRC) speziell für KI einführen, wenn sie nicht den Risiken Künstlicher Intelligenz zum Opfer fallen wollen.Der Einsatz von Künstlicher Intelligenz (KI) in Unternehmen birgt vielfältige Risiken in den Bereichen Cybersicherheit, Datenschutz, Voreingenommenheit, Ethik und Compliance.Nur 24 Prozent der IT- und Business-Entscheidungsträger, hat allerdings bereits umfassende KI-GRC-Richtlinien implementiert, um…
-
Be careful what you share with GenAI tools at work
We use GenAI at work to make tasks easier, but are we aware of the risks? According to Netskope, the average organization now shares more than 7.7GB of data with AI tools per … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/05/22/genai-workplace-risks/