A newly discovered ransomware-as-a-service platform called Gentlemen’s RaaS has recently emerged on underground hacking forums, offering threat actors a sophisticated cross-platform attack capability. The service, advertised by the threat actor known as zeta88, represents a significant expansion in ransomware delivery…
Category: Cyber Security News
Emerging Cyber Threats Featuring QR Codes ClickFix and LOLBins Challenging SOC Defenses
Cybersecurity experts at ANY.RUN recently unveiled alarming trends in how attackers are exploiting everyday technologies to bypass security operations centers (SOCs). They dissected tactics like QR code phishing, ClickFix social engineering, and Living Off the Land Binaries (LOLBins), showing how…
Threat Actors Weaponizes Judicial Documents to Deliver PureHVNC RAT
Between August and October 2025, a sophisticated phishing campaign has emerged targeting Colombian and Spanish-speaking users through deceptive emails masquerading as official communications from Colombia’s Attorney General’s office. The campaign employs a carefully crafted social engineering strategy, luring victims with…
Russian Hackers Attacking Government Entity Using Stealthy Living-Off-the-Land Tactics
Ukrainian government organizations continue facing relentless cyber threats from Russian-backed threat actors employing sophisticated evasion techniques to maintain persistent network access. Recent investigations have uncovered coordinated campaigns targeting critical infrastructure and government entities, with attackers deploying advanced tactics that circumvent…
New TEE.fail Attack Breaks Trusted Environments to Exfiltrate Secrets from Intel and AMD DDR5 Environments
A groundbreaking security vulnerability has emerged that fundamentally challenges the integrity of modern trusted execution environments across Intel and AMD server platforms. Researchers from Georgia Tech, Purdue University, and van Schaik LLC have unveiled TEE.fail, a sophisticated attack methodology that…
Microsoft DNS Outage Disrupts Azure and Microsoft 365 Services Worldwide
Microsoft reported a DNS-related outage on October 29, 2025, affecting access to key services, including Microsoft Azure and Microsoft 365. The issue surfaced around 9:37 PM GMT+5:30, leaving users unable to reach the Microsoft 365 admin center and experiencing widespread…
Google Unveils Guide for Defenders to Monitor Privileged User Accounts
In response to escalating threats of credential theft, Google, through its Mandiant cybersecurity division, has unveiled a detailed guide to help defenders monitor and secure privileged accounts across modern IT environments. This resource emphasizes practical strategies to mitigate risks posed…
Gunra Ransomware Leveraging Attacking Windows and Linux Systems with Two Encryption Methods
The threat landscape continues to evolve as Gunra ransomware emerged in April 2025, establishing itself as a significant threat to organizations worldwide. This dual-platform attack group has demonstrated a systematic approach to compromising both Windows and Linux environments, making their…
Thousands of Exchange Servers in Germany Still Running with Out-of-Support Versions
Microsoft Exchange servers in Germany are still running without security updates, just weeks after the official end of support for key versions. The Federal Office for Information Security (BSI) issued a stark warning on October 28, 2025, revealing that 92%…
PoC Exploit Released for BIND 9 Vulnerability that Let Attackers Forge DNS Records
A public exploit code demonstrating how attackers could exploit CVE-2025-40778, a critical vulnerability in BIND 9 that enables DNS cache poisoning. The Internet Systems Consortium (ISC) initially disclosed this flaw on October 22, revealing a dangerous weakness in the world’s…
10 Malicious npm Packages with Auto-Run Feature on Install Deploys Multi-Stage Credential Harvester
The npm ecosystem faces a sophisticated new threat as ten malicious packages have emerged, each designed to automatically execute during installation and deploy a comprehensive credential harvesting operation. This attack campaign represents a significant evolution in supply chain compromises, combining…
Hackers Allegedly Claim Breach Of HSBC USA Customers’ Records Including Financial Details
A threat actor has claimed responsibility for breaching HSBC USA, alleging possession of a vast database containing sensitive customer personal identifiable information (PII) and financial details. The hacker posted screenshots and data samples on a dark web leak forum, asserting…
CISA Warns of Dassault Systèmes Vulnerabilities Actively Exploited in Attacks
CISA has added two critical vulnerabilities affecting Dassault Systèmes DELMIA Apriso to its Known Exploited Vulnerabilities catalog, warning that threat actors are actively exploiting these security flaws in real-world attacks. The alert, issued on October 28, 2025, requires federal agencies…
Windows Accessibility Flaw Allows Stealthy Persistence and Lateral Movement via Narrator DLL Hijack
A persistent vulnerability related to DLL hijacking has been identified in the Narrator accessibility tool, which has been a significant concern over time. This flaw allows malicious actors to exploit the tool, potentially compromising the security of systems that rely…
Magento Input Validation Vulnerability Exploited In Wild To Hijack Session And Execute Malicious Codes
A critical vulnerability in Magento, the popular e-commerce platform, is now rebranded as Adobe Commerce. Dubbed SessionReaper and tracked as CVE-2025-54236, this improper input validation flaw allows attackers to hijack user sessions and, in some cases, execute malicious code remotely.…
Microsoft Sued for Allegedly Misleading Millions to Subscribe for Microsoft 365 Subscriptions
Australia’s competition regulator has filed legal proceedings against Microsoft for allegedly misleading approximately 2.7 million Australian consumers regarding subscription options and pricing for Microsoft 365 plans. The Australian Competition and Consumer Commission claims that Microsoft deliberately concealed the availability of…
New Beast Ransomware Actively Scans for Active SMB Port from Breached System to Spread Across Network
The Beast ransomware group has emerged as a significant threat in the cybersecurity landscape, evolving from the Monster ransomware strain to establish itself as a formidable Ransomware-as-a-Service operation. Officially launched in February 2025, the group rapidly expanded their infrastructure by…
Google Wear OS Message App Vulnerability Let Any Installed App To Send SMS Behalf Of User
A vulnerability in Google Messages on Wear OS devices allows any installed app to silently send SMS, MMS, or RCS messages on behalf of the user. Dubbed CVE-2025-12080, the issue stems from improper handling of ACTION_SENDTO intents using URI schemes…
Docker Compose Vulnerability Allow Attacks To Overwrite Arbitrary Files
Docker Compose, a cornerstone tool for developers managing containerized application harbors a high-severity vulnerability that lets attackers overwrite files anywhere on a host system. Discovered in early October 2025 by Imperva, the issue stems from improper handling of remote artifacts…
Microsoft Details ASP.NET Vulnerability That Enables Attackers To Smuggle HTTP Requests
Microsoft has issued a critical security update for ASP.NET Core to address CVE-2025-55315, a high-severity flaw that enables HTTP request smuggling and could allow attackers to bypass key security controls. Disclosed on October 14, 2025, this vulnerability has a CVSS…