Tag: zero-day
-
Cognitive Threat Analytics: How Seceon Enables Next-Gen SOC Defence
Introduction In the rapidly evolving cyber-threat landscape, traditional signature-based defences are no longer sufficient. Threat actors increasingly use stealth, lateral movement, encrypted channels, zero-day exploits and insider tactics. To keep pace, security operations centres (SOCs) need more than firewalls and rule-sets: they need systems that think, learn and adapt. Enter cognitive threat analytics an First…
-
APT ‘Bronze Butler’ Exploits Zero-Day to Root Japan Orgs
A critical security issue in a popular endpoint manager (CVE-2025-61932) allowed Chinese state-sponsored attackers to backdoor Japanese businesses. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/bronze-butler-apt-exploits-zero-day-vuln-root-japan
-
73 Zero-Days bei Pwn2Own in Irland – Samsung, QNAP, Synology und Sonos erfolgreich gehackt
Tags: zero-dayFirst seen on security-insider.de Jump to article: www.security-insider.de/pwn2own-ireland-2025-sicherheitsluecken-hacking-wettbewerb-a-07db03d75d50ad29bb334d1f17622bc2/
-
Clop Ransomware Group Exploits New 0-Day Vulnerabilities in Active Attacks
The Clop ransomware group continues to pose a significant threat to enterprise organizations worldwide, with recent analysis revealing their exploitation of a critical zero-day vulnerability in Oracle E-Business Suite. Operating since early 2019, Clop has established itself as one of the most prolific and sophisticated ransomware gangs, amassing a victim count exceeding 1,025 organizations and…
-
Clop Ransomware Group Exploits New 0-Day Vulnerabilities in Active Attacks
The Clop ransomware group continues to pose a significant threat to enterprise organizations worldwide, with recent analysis revealing their exploitation of a critical zero-day vulnerability in Oracle E-Business Suite. Operating since early 2019, Clop has established itself as one of the most prolific and sophisticated ransomware gangs, amassing a victim count exceeding 1,025 organizations and…
-
Global Spies Use ZipperDown and Android Zero-Days for 1-Click Email Client RCE and Account Takeover
The post Global Spies Use ZipperDown and Android Zero-Days for 1-Click Email Client RCE and Account Takeover appeared first on Daily CyberSecurity. First seen on securityonline.info Jump to article: securityonline.info/global-spies-use-zipperdown-and-android-zero-days-for-1-click-email-client-rce-and-account-takeover/
-
How an ex-L3Harris Trenchant boss stole and sold cyber exploits to Russia
Peter Williams sold eight exploits to a Russian zero-day broker by smuggling them from his employer’s highly secured air-gapped network. A court document, plus exclusive reporting by TechCrunch and interviews with former Trenchant staff, explains how Williams pulled off the heist of hacking tools. First seen on techcrunch.com Jump to article: techcrunch.com/2025/11/03/how-an-ex-l3-harris-trenchant-boss-stole-and-sold-cyber-exploits-to-russia/
-
How an ex-L3 Harris Trenchant boss stole and sold cyber exploits to Russia
Peter Williams sold eight exploits to a Russian zero-day broker by smuggling them from his employer’s highly secured air-gapped network. A court document, plus exclusive reporting by TechCrunch and interviews with former Trenchant staff, explains how Williams pulled off the heist of hacking tools. First seen on techcrunch.com Jump to article: techcrunch.com/2025/11/03/how-an-ex-l3-harris-trenchant-boss-stole-and-sold-cyber-exploits-to-russia/
-
New Dante Spyware Linked to Rebranded Hacking Team, Now Memento Labs
Kaspersky researchers uncovered Operation ForumTroll, an attack campaign utilising the new ‘Dante’ spyware developed by Memento Labs, the rebranded Hacking Team. The attacks used a Chrome zero-day vulnerability (CVE-2025-2783) and COM hijacking for persistence, confirming the continued deployment of advanced surveillance tools by the controversial Italian firm. First seen on hackread.com Jump to article: hackread.com/dante-spyware-hacking-team-memento-labs/
-
Security Affairs newsletter Round 548 by Pierluigi Paganini INTERNATIONAL EDITION
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. BadCandy Webshell threatens unpatched Cisco IOS XE devices, warns Australian government China-linked UNC6384 exploits Windows zero-day…
-
Security Affairs newsletter Round 548 by Pierluigi Paganini INTERNATIONAL EDITION
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. BadCandy Webshell threatens unpatched Cisco IOS XE devices, warns Australian government China-linked UNC6384 exploits Windows zero-day…
-
China-linked hackers exploited Lanscope flaw as a zero-day in attacks
China-linked cyber-espionage actors tracked as ‘Bronze Butler’ (Tick) exploited a Motex Lanscope Endpoint Manager vulnerability as a zero-day to deploy an updated version of their Gokcpdoor malware. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/china-linked-hackers-exploited-lanscope-flaw-as-a-zero-day-in-attacks/
-
China-linked UNC6384 exploits Windows zero-day to spy on European diplomats
A China-linked APT group UNC6384 exploits a Windows zero-day in an active cyber espionage targeting European diplomats. Arctic Wolf Labs researchers uncovered a cyber espionage campaign by China-linked APT UNC6384 targeting diplomatic entities in Hungary, Belgium, and other EU nations. UNC6384 is a China-nexus actor recently detailed by Google TAG, has expanded from targeting Southeast…
-
Two Windows vulnerabilities, one a 0-day, are under active exploitation
Both vulnerabilities are being exploited in broad, wide-scale operations. First seen on arstechnica.com Jump to article: arstechnica.com/security/2025/10/two-windows-vulnerabilities-one-a-0-day-are-under-active-exploitation/
-
UNC6384 Exploits Zero-Day to Target European Diplomats
Chinese-linked group UNC6384 targets European diplomats with a Windows shortcut exploit to deploy PlugX malware. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/news-unc6384-attack/
-
China-Linked Tick Group Exploits Lanscope Zero-Day to Hijack Corporate Systems
The exploitation of a recently disclosed critical security flaw in Motex Lanscope Endpoint Manager has been attributed to a cyber espionage group known as Tick.The vulnerability, tracked as CVE-2025-61932 (CVSS score: 9.3), allows remote attackers to execute arbitrary commands with SYSTEM privileges on on-premise versions of the program. JPCERT/CC, in an alert issued this month,…
-
Windows zero-day actively exploited to spy on European diplomats
A China-linked hacking group is exploiting a Windows zero-day in attacks targeting European diplomats in Hungary, Belgium, and other European nations. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/chinese-hackers-exploit-windows-zero-day-to-spy-on-european-diplomats/
-
Windows zero-day actively exploited to spy on European diplomats
A China-linked hacking group is exploiting a Windows zero-day in attacks targeting European diplomats in Hungary, Belgium, and other European nations. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/chinese-hackers-exploit-windows-zero-day-to-spy-on-european-diplomats/
-
An 18-Year-Old Codebase Left Smart Buildings Wide Open
Researcher Gjoko Krstic’s Project Brainfog exposed hundreds of zero-day vulnerabilities in building-automation systems still running hospitals, schools, and offices worldwide. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/18-year-old-codebase-left-smart-buildings-wide-open
-
An 18-Year-Old Codebase Left Smart Buildings Wide Open
Researcher Gjoko Krstic’s Project Brainfog exposed hundreds of zero-day vulnerabilities in building-automation systems still running hospitals, schools, and offices worldwide. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/18-year-old-codebase-left-smart-buildings-wide-open
-
The unified linkage model: A new lens for understanding cyber risk
Tags: access, api, attack, breach, ciso, cloud, compliance, credentials, cve, cyber, cybersecurity, data, defense, exploit, flaw, framework, identity, incident response, infrastructure, intelligence, malicious, mitre, network, nist, okta, open-source, radius, resilience, risk, risk-analysis, saas, sbom, software, supply-chain, threat, update, vpn, vulnerability, zero-day, zero-trustMissed systemic risk: Organizations secure individual components but miss how vulnerabilities propagate through dependencies (e.g., Log4j embedded in third-party apps).Ineffective prioritization: Without a linkage structure, teams patch high-severity CVEs on isolated systems while leaving lower-scored flaws on critical trust pathways.Slow incident response: When a zero-day emerges, teams scramble to locate vulnerable components. Without pre-existing linkage…
-
CISA Alerts on Active Exploitation of VMware Tools and Aria Operations 0-Day
Tags: access, cisa, cve, cyber, cybersecurity, exploit, flaw, infrastructure, risk, tool, vmware, vulnerability, zero-dayThe Cybersecurity and Infrastructure Security Agency (CISA) has raised alarm over active exploitation of a critical privilege escalation vulnerability affecting Broadcom’s VMware Tools and VMware Aria Operations. Tracked as CVE-2025-41244, this 0-day flaw poses significant risk to organizations managing virtualized infrastructure, potentially allowing attackers to gain root-level access to compromised systems. CVE ID Vendor Affected…
-
CISA Flags VMware Zero-Day Exploited by China-Linked Hackers in Active Attacks
Tags: attack, china, cisa, cve, cybersecurity, exploit, flaw, hacker, infrastructure, kev, tool, vmware, vulnerability, zero-dayThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a high-severity security flaw impacting Broadcom VMware Tools and VMware Aria Operations to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation in the wild.The vulnerability in question is CVE-2025-41244 (CVSS score: 7.8), which could be exploited by an attacker to attain…