GitOps is a methodology that uses Git (or other version control systems) to store all aspects of a project’s infrastructure, such as infrastructure as code (IaC), application code, and configuration files. Organizations using Kubernetes for container orchestration often use GitOps. …
Category: GBHackers – Latest Cyber Security News | Hacker News
Pro-Russia Hacker Groups Exploiting Winrar Flaw to Steal Login Credentials
A new phishing attack has been discovered, which uses malicious archive files to exploit the recently found WinRAR vulnerability CVE-2023-38831 using a Powershell script that steals credentials from Google Chrome and Microsoft Edge browsers. The archive consists of a PDF…
Phishing-as-a-Service Strox Lets Hackers Phish any Brand by Submitting its Logo
The ever-evolving world of cybercrime has given birth to a disturbing phenomenon – Phishing-as-a-Service (PhaaS), and one name that sends shivers down the spines of cybersecurity experts is Strox. The tale of Strox begins in the first half of 2022…
ToddyCat APT Hackers Exploiting Vulnerable Microsoft Exchange Servers
ToddyCat, a highly skilled advanced persistent threat (APT) actor notorious for launching targeted attacks in Europe and Asia, has recently upgraded its arsenal of tools and methods, signifying an evolution in its modus operandi. Recent findings from the cybersecurity researchers…
Adobe, Cisco IOS, Skype, WordPad, and HTTP/2 Rapid Reset Flaws Actively Exploited
The US cybersecurity organization CISA has updated its Known Exploited Vulnerabilities catalog to include five new security flaws that are currently being actively exploited. This means that attackers are using these vulnerabilities to gain unauthorized access to computer systems, steal…
Adobe, Cisco IOS, Skype, WordPad, and HTTP/2 Rapid Reset Flaws Actively Exploited: CISA Warns
The US cybersecurity organization CISA has updated its Known Exploited Vulnerabilities catalog to include five new security flaws that are currently being actively exploited. This means that attackers are using these vulnerabilities to gain unauthorized access to computer systems, steal…
Stayin’ Alive Hacking Teleco & Government Organizations to Deploy Backdoor
Threat actors target telecoms and government ministries because they house valuable data and infrastructure. Telecoms hold sensitive communication records and can disrupt essential services, while government ministries contain classified information, making them attractive targets for the following illicit purposes:- Cybersecurity…
Junos OS Flaw Allows Attackers to Flood System and Expose Sensitive Data
Three new vulnerabilities have been discovered in Junos OS: password disclosure, MAC address validation bypass, and Time-of-check Time-of-use (TOCTOU) Race Condition. The severity of these vulnerabilities ranges between 5.3 (Medium) to 6.1 (Medium). Juniper Networks has released patches and security…
Google Chrome Use-after-free Flaw Let Attackers Perform Heap Exploitation
The latest stable version of Google Chrome (version 118.0.5993.70) has been released for Mac and Linux. In contrast, the Windows version has been updated to 118.0.5993.70/.71. This update includes patching almost 20 vulnerabilities, ensuring improved user security. In addition to…
North Korean Hackers Continue to Refine Their Arsenal of Tactics & Techniques
The Democratic People’s Republic of Korea continues to advance its offensive cyber program, showcasing its unwavering commitment to using cyber attacks for espionage purposes. According to assessments made by Mandiant, the DPRK’s cyber program has exhibited new activities focusing on…
Multiple Citrix NetScaler Flaw Leads to DoS Attack and Data Exposure
Critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway have exposed sensitive information and a denial of service attack. A malicious cyber actor can exploit one of these vulnerabilities to gain control of an affected machine. Citrix has published security upgrades to…
Air Europa Breached: Customers’ Credit Card Details Exposed
On Tuesday, Air Europa, a Spanish airline, experienced a security breach where cybercriminals gained unauthorized access to the credit card information of the airline’s customers. Following the attack, the airline took the necessary steps to email the impacted customers and…
Video Surveillance Camera Flaw Allows Attackers to Change Passwords & Alarms
Pablo Martínez, a member of the Red Team at cybersecurity firm Entelgy Innotec Security, has uncovered significant vulnerabilities in low-cost video surveillance cameras available for purchase on popular online platforms. His findings shed light on serious security concerns surrounding these…
Maintainers of a Popular Open Source Tool Warns of Critical Curl Vulnerability
Two new vulnerabilities have been discovered in the widely used Curl tool. These two vulnerabilities are identified as CVE-2023-38545 and CVE-2023-38546. One of these vulnerabilities has a high severity, while the other has a low severity. However, the Curl team…
Lazarus APT Laundered Over $900 Million Worth of Cryptocurrency
Threat actors have been laundering currencies with multiple methods. One of the most predominant ways they have been using lately was the Cross-chain crime. In a cross-chain crime, threat actors swap their Cryptocurrency between different blockchains and tokens that help…
Chinese Android-based Devices It Comes Pre-installed With a Firmware Backdoor
The Trojan War’s famous horse trick inspired the term for cyberattacks, where a user unwittingly downloads a file that causes harm when opened. HUMAN’s Satori Team unveils BADBOX, a cryptic and intricate network of fraud schemes, mirroring the Trojan Horse’s…
Qakbot Threat Actors Deliver Knight Ransomware & Remcos Via LNK Files
Qakbot’s infrastructure and cryptocurrency assets were seized by government authorities in an operation in August 2023 with the assistance of international allies, raising concerns about the affiliates of Qakbot. Talos researchers moderately believe Qakbot threat actors remain active, launching a…
Chinese Hackers Attacking Semiconductor Industries using Cobalt Strike beacon
A cyber espionage campaign has been discovered in which threat actors use a variant of the HyperBro loader along with a Taiwan Semiconductor Manufacturing (TSMC) lure in order to target semiconductor industries in regions like Taiwan, Hong Kong, and Singapore.…
Storm-0324 Abusing Microsoft Teams To Gain Initial Access And Deploy Ransomware
Storm-0324, a financially driven threat actor group, was detected delivering phishing messages using Microsoft Teams. In the past, it has been accused of disseminating phishing emails to employ remote code execution to acquire initial access to infected systems. After establishing the…
Top 10 Cybersecurity Misconfigurations for Red and Blue Team Assessments
In a recent joint effort to bolster national cybersecurity, the National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA) have unveiled their findings on the “Top Ten Cyber Security Misconfigurations.” This comprehensive report, released on October 5,…
Top 7 REST API Security Strategies to Secure Your Endpoints
In today’s REST API-driven landscape, most APIs are REST-based and widely utilized by web applications. These APIs are like versatile tools for sending and receiving information online. However, their widespread use exposes them to various security threats and challenges. What…
Microsoft Office XSS Flaw Let Attackers Execute Arbitrary Code
A recently discovered vulnerability in Microsoft Office Word has raised concerns over the security of the popular productivity suite. This security flaw, classified as a Cross-Site Scripting (XSS) vulnerability, allows attackers to execute arbitrary JavaScript code within a Word document.…
Hackers Exploit Atlassian Confluence Zero-day Flaw to Create Admin Account
The widely adopted Atlassian Confluence has been discovered with a zero-day vulnerability, which could allow threat actors to create an admin account on the Confluence servers and perform malicious activities. This particular issue has been reported by a lot of…
Wireshark 4.0.10 Released: What’s New!
Wireshark, formerly known as Ethereal, is a widely used, free, and open-source network protocol analyzer that allows users to capture and inspect data packets on a computer network. This network analyzer tool is primarily used for the following purposes:- The…
ShellTorch Flaw Exposes Thousands of AI Servers to RCE Attacks
ShellTorch Serve is an open-source model-serving library developed by PyTorch that simplifies the deployment of machine learning models for inference in production environments. It provides a scalable and efficient way to serve PyTorch models, making integrating them into applications and…
Looney Tunables: Linux Vulnerability Lets Attackers Gain Root Privileges
A buffer overflow issue has been disclosed in the GNU C Library’s dynamic loader ld.so, which might allow local attackers to acquire root privileges on vulnerable Linux systems. The Linux vulnerability is identified as “Looney Tunables” and tagged as CVE-2023-4911. The…
Hackers are Abusing Dropbox to Steal Microsoft SharePoint Credentials
A growing cyber threat involving Dropbox has emerged, and it’s raising concerns across the cybersecurity landscape. In the initial two weeks of September, a staggering 5,440 of these attacks were detected, highlighting the alarming scale of this threat. Utilizing Dropbox…
Massive Surge in Cyber Attacks Targeting Real Estate and Utilities Organizations
Cyber attacks are becoming increasingly sophisticated as threat actors continuously evolve their tools and tactics. They leverage advanced technologies, use social engineering techniques, and collaborate in sophisticated cybercrime networks. The real estate and utilities industries have seen a noticeable increase…
Hackers Hijacking Microsoft SQL Servers to Compromise Azure Environments
Hackers frequently target Microsoft SQL servers because of their extensive use and possible weaknesses. These servers are a top target for hackers looking to make flat profits since these crooks exploit them to steal private information, start ransomware attacks, or…
Exploitation of Critical WS_FTP Server Flaw Spotted in the Wild
As previously reported, Progress-owned WS_FTP was discovered with multiple vulnerabilities associated with cross-site scripting (XSS), SQL injection, cross-site request forgery, unauthenticated user enumeration, and a few others. Progress has warned their users about the WS_FTP vulnerabilities and released a security…
Hackers Steal User’s Database From European Telecommunications Standards Institute
The European Telecommunications Standards Institute (ETSI) has uncovered a data breach in which threat actors obtained a database holding a list of portal users. The incident was disclosed last week by ETSI. It is still unclear if the attack was…
Zip Slip Vulnerability Let Attacker Import Malicious Code and Execute Arbitrary Code
A critical Zip Slip vulnerability was discovered in the open-source data cleaning and transformation tool ‘OpenRefine’, which allowed attackers to import malicious code and execute arbitrary code. OpenRefine is a strong Java-based, free, open-source tool for handling messy data. This includes cleaning it, converting it…
Hackers Bypass Cloudflare Firewall and DDoS Protections using Cloudflare
Cloudflare, a prominent cybersecurity vendor renowned for its web protection services, faces a security challenge that could expose its customers to unforeseen risks. A recent disclosure from Certitude highlights a vulnerability that could allow attackers to bypass certain protection mechanisms…
Lazarus Tricking Employees with Trojanized Coding Challenges
Lazarus group has been recently discovered to have targeted an Aerospace company in Spain, which involved deploying several tools, including an undocumented backdoor named “LightlessCan.” Reports indicate that the threat actor gained access to the organization’s network last year using…
LightSpy APT Attacking WeChat Users to Steal Payment Data
LightSpy malware, responsible for a watering hole attack conducted against iOS users in Hong Kong, has been discovered to be embedded with Android implant Core and its 14 related plugins from 20 active servers for attacking mobile users. LightSpy is…
MadPot: AWS Honeypot to Disrupt Threat Actors
In the realm of cybersecurity, the battle against threat actors never stops. With its vast cloud infrastructure, Amazon Web Services (AWS) is at the forefront of this ongoing struggle. AWS employs a global network of sensors and advanced disruption tools…
Hackers Bypass Cloudflare Firewall, and DDoS Protections using Cloudflare
Cloudflare, a prominent cybersecurity vendor renowned for its web protection services, faces a security challenge that could expose its customers to unforeseen risks. A recent disclosure from Certitude highlights a vulnerability that could allow attackers to bypass certain protection mechanisms…
APT34 Employs Weaponized Word Documents to Deploy New Malware Strain
APT34 is a secretive cyberespionage group specializing in Middle East targets, known for gathering sensitive intelligence via spear phishing and advanced infiltration methods. The sophistication and comprehensive resources of the APT34 group pose a major regional and global cybersecurity threat. …
Malicious HDMI Cables Steals Photos, Videos, and Location Data
John Bumstead, who works for a company called 404Media that fixes and sells used electronics, found an iPhone-to-HDMI adapter that seemed normal at first. However, the app that came with it was tricky because it asked users to scan a…
Budworm APT Attacking Telecoms Org With New Custom Tools
APT (Advanced Persistent Threat) actors are evolving at a rapid pace, continually enhancing their toolsets and tactics. They adapt quickly to security measures, leveraging advanced techniques, such as zero-day exploits, to remain undetected. Their ability to innovate and collaborate in…
Cisco IOS Software Zero-day Exploited in Attacks
Cisco has issued fixes to address a vulnerability in the GET VPN feature of IOS and IOS XE software that has been exploited in attacks. A remote attacker who has administrative access to a group member or a key server…
Progress Software Warns of Critical Vulnerability in WS_FTP Server
Multiple vulnerabilities have been discovered in Progress’s WS_FTP, which include .NET deserialization, directory traversal, reflected cross-site scripting (XSS), SQL injection, stored cross-site scripting, cross-site request forgery, and unauthenticated user enumeration vulnerability. These vulnerabilities’ severities range from 5.3 (Medium) to 10.0…
Hackers Inject Malicious Ads into GPT-4 Powered Bing Chat
In February 2023, Microsoft unveiled its revolutionary AI-assisted search engine, Bing Chat, driven by OpenAI’s cutting-edge GPT-4 technology. This announcement marked a notable event in the world of online search, sparking both curiosity and speculation about the potential shift in…
ZeroFont Phishing: Hackers Manipulating Font Size to Bypass Office 365 Security
A new but ancient technique for Phishing emails has been recently identified called ZeroFont Phishing. Threat actors have followed several tactics for sending phishing emails, bypassing all the security mechanisms. However, using this technique, threat actors could bypass Microsoft’s Natural…
ZeroFont Phishing: Hackers Manipulating Font Size to Bypass Office 365 Security
A new but ancient technique for Phishing emails has been recently identified called ZeroFont Phishing. Threat actors have followed several tactics for sending phishing emails, bypassing all the security mechanisms. However, using this technique, threat actors could bypass Microsoft’s Natural…
ZYXEL Buffer Overflow vulnerability Let Attacker Launch DoS Attack
ZYXEL has been discovered with a Buffer Overflow vulnerability on their ZYXEL-PMG2005-T20B device, which can result in a denial-of-service condition. This condition exists due to improper sanitization of user-supplied input on their HTTP request. Zyxel is a Taiwanese multinational company…
Case Study: Blocking Botnet-Driven Low-Rate HTTP DDoS Attacks
Indusface research on 1400+ websites recorded a significant surge in DDoS attacks and bot attacks during Q2, 2023, compared to Q1, 2023. We observed a 75% surge in DDoS attacks and a 48% increase in bot attacks. Moreover, recent trends…
Snatch Ransomware Group Leaked User’s Location and Internal Data
The Snatch Ransomware group is considered dangerous due to its advanced techniques and ability to evade detection. Security systems find it difficult to identify and stop such assaults since they use techniques like file encryption and memory injection to avoid…
Critical Cisco WAN Manager Vulnerabilities Let Attacker Conduct DoS Attack
Cisco, a prominent player in the world of networking and cybersecurity, has issued a critical security advisory concerning multiple vulnerabilities in their Catalyst SD-WAN Manager, formerly known as Cisco SD-WAN vManage. These vulnerabilities could potentially open doors for cyber attackers…
Actively Exploited Chrome Zero-day Patched: Update Now!
Google has recently deployed updates to mitigate a newly discovered zero-day vulnerability in their Chrome browser, which is currently being actively exploited. Google has acknowledged its awareness of an exploit currently available for CVE-2023-5217, which has been observed to be…
BlackTech APT Hackers Break into Cisco Firmware to Attack the US and Japan
Since 2010, a group of hackers known as BlackTech APT has been engaging in malicious activities. The targets of their attacks encompass a wide range of sectors, including governmental institutions, industrial facilities, technological infrastructure, media outlets, electronic systems, mobile devices,…
Lu0Bot Node.js Malware Takes Complete Control Over Victim’s Computer
Through strategies like polymorphic code, which continuously alters its appearance to prevent detection, as well as employing encryption and obfuscation to disguise its actions, malware is getting more complex and sneaky. Additionally, to infiltrate systems and avoid detection by traditional…
Apple Security Fixes for iPhone, iPad, Safari, Watch & Sonoma14: Update Now!
Apple previously reported three zero-day vulnerabilities exploited in the wild by threat actors, which Apple fixed as part of an Emergency patch update. However, a new security advisory has been released by Apple, which mentions all the security patches and…
North Korean and Chinese Hackers Attacking Healthcare Industries
Healthcare has been one of the primary industries targeted by threat actors as part of every malware or ransomware campaign. Many Advanced Persistent Threat (APT) actors are from China due to political reasons between China and the United States. These…
The Rise of Automotive Hacking: How to Secure Your Vehicles Against Hacking
Though we can’t see it, the world brims with more technology than ever. These days, devices with internet connectivity live within the ever-growing Internet of Things (IoT)—a worldwide “web” where wireless communication and information technology work together. Since the early…
New AtlasCross APT Using Weaponized Word Documents to Deploy Malware
Cybersecurity analysts at NSFOCUS Security Labs recently uncovered an unknown phishing-based attack process during threat-hunting. Apart from this, during their further investigation, they identified two new Trojans and rare attack methods. NSFOCUS Security Labs suspects a skilled APT attacker is…
Google Chrome use-after-free Vulnerability Leads to Remote Attack
Google Chrome has been recently discovered to be a Use-after-free vulnerability that threat actors can exploit to attack users. This vulnerability exists in the Google Chrome VideoEncoder, which can be triggered using a malicious web page. However, Google Chrome version…
Millions Of Newborn Registry Records Were Compromised In A MOVEit Data Breach
The Progress MOVEit software’s vulnerability resulted in a cybersecurity breach that affected BORN (the Better Outcomes Registry & Network), which gathers data on pregnancies, births, the postpartum period, and childhood. Unauthorized copies of files containing sensitive personal health data were obtained…
EvilBamboo Attacking Android & iOS Devices With Custom Malware
EvilBamboo, formerly known as “Evil Eye,” has been found to target Tibetan, Uyghur, and Taiwanese organizations and individuals. This threat actor was mentioned as conducting custom Android malware campaigns in September 2019. In April 2020, EvilBamboo was discovered to be…
Threat Actors Actively Using Remote Management Tools to Deploy Ransomware
The threat actors have been spotted increasingly depending on Remote Management and Monitoring (RMM) tools, which resulted in a relatively botched Hive ransomware distribution. The original payload consisted of an executable file disguised as a legitimate document. According to Huntress, this campaign…
BIND DNS System Flaws Let Attackers Launch DoS Attacks
In a recent disclosure, BIND 9, a widely-used DNS (Domain Name System) server software, has been found vulnerable to two critical security flaws, labeled CVE-2023-4236 and CVE-2023-3341. These vulnerabilities, if exploited, could have serious consequences, making it imperative for users…
OilRig: Never-seen C#/.NET Backdoor to Attack Wide Range of Industries
OilRig (APT34) is an Iranian cyberespionage group active since 2014, targeting Middle Eastern governments and various industries like:- OilRig launched DNSpionage in 2018-2019 against Lebanon and the UAE, followed by the 2019-2020 HardPass campaign using LinkedIn for energy and government…
Most Important Network Penetration Testing Checklist
Network Penetration Testing checklist determines vulnerabilities in the network posture by discovering Open ports, troubleshooting live systems, and services, and grabbing system banners. The pen-testing helps the administrator to close unused ports, additional services, Hide or customize banners, troubleshoot services, and…
Cryptojacking Campaign Infected Online Thesaurus With Over 5 Million Visitors
Students, authors, and anybody else wishing to improve their vocabulary and language abilities frequently utilize Thesaurus, one of the well-known platforms with 5 million monthly visitors. Cybersecurity analysts at Group-IB recently found a cryptojacking scheme on a popular Thesaurus site,…
Gold Melody Attacking Organizations With Burp Extension, Mimikatz, and Other Tools
The financially motivated GOLD MELODY threat group has been active at least since 2017, attacking organizations by taking advantage of flaws in unpatched internet-facing servers. A threat group serves as an initial access broker (IAB) by selling access to organizations…
MOVEit Transfer SQL Injection Let the Attacker Gain Unauthorized Access to the Database
MOVEit transfer service pack has been discovered with three vulnerabilities associated with SQL injections (2) and a Reflected Cross-Site Scripted (XSS). The severity for these vulnerabilities ranges between 6.1 (Medium) and 8.8 (High). Progress-owned MOVEit transfer was popularly exploited by…
LUCR-3 Attacking Fortune 2000 Companies Using Victims’ Own Tools & Apps
A new financially motivated threat group named “LUCR-3” has been discovered targeting organizations to steal intellectual property for extortion. This threat actor surpasses Scatter Spider, Oktapus, UNC3944, and Storm-0875. LUCR-3 is targeting Fortune 2000 companies in various sectors, which include…
Is QakBot Malware Officially Dead?
Only a few malware families can claim to have persisted for nearly twenty years, and QakBot (also referred to as QBot) stands among them as one of the most enduring. Since its first appearance in 2008, it has been deployed…
System Admin Pleads Guilty for Selling Pirated Business Phone Software Licenses
For taking part in a large international scheme to earn millions of dollars by selling pirated business telephone system software licenses, a computer system admin and his spouse pled guilty. Software licenses with a retail value of over $88 million are…
Trend Micro Zero-day Vulnerability Let Attackers Run Arbitrary Code
If you use Trend Micro Apex One, you should know that the third-party Antivirus uninstaller feature may have a security hole. This flaw could make it possible for random code to be run. Even though the National Vulnerability Database (NVD)…
T-Mobile App Glitch Exposes Other User’s Sensitive Data
The mobile application of T-Mobile has recently been a cause of concern among its customers due to issues concerning privacy. Users have reported accessing sensitive information belonging to other customers when logging into their own accounts. This alarming situation has…
China Accuses the US of Hacking Huawei Servers Since 2009
Huawei is known for its telecommunications equipment and consumer electronics, including smartphones, and the USA banned Huawei primarily due to national security concerns. As the Chinese government may utilize Huawei’s technology for spying, the U.S. government claimed that the business…
Bumblebee Malware Abuses WebDAV Protocol to Attack Organizations
In recent cybersecurity news, the notorious Bumblebee loader has made a resurgence in a new campaign, posing a significant threat to organizations’ digital security. This loader, often used as a stepping stone for ransomware attacks, had taken a pause but…
Nagios Monitoring Tool Vulnerabilities Let Attackers SQL Queries
Nagios XI is a prominent and frequently used commercial monitoring system for IT infrastructure and network monitoring. Vulnerability Research Engineer Astrid Tedenbrant found four distinct vulnerabilities in Nagios XI (version 5.11.1 and below) while conducting routine research. By making use…
Hackers Attacking Telecoms Servers With HTTPSnoop Malware
In 2022, state-sponsored actors and advanced adversaries consistently targeted telecoms globally, making it a top sector in Talos IR cases. Telecom firms with critical infrastructure assets are prime targets due to their role in national networks and as potential gateways…
Fortinet FortiOS Flaw Let Attacker Execute Malicious JavaScript Code
Recent reports indicate that Fortinet FortiOS has been discovered with Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerabilities, which threat actors can use for malicious purposes. These vulnerabilities have been given the CVE IDs CVE-2023-29183 and CVE-2023-34984. The severity…
Hackers Deployed never-before-seen Linux Malware Attacking Government Entities
Recent reports indicate that threat actors have been using a new type of Linux-targeted backdoor that has never been seen before. This new backdoor has been named SprySOCKS, which uses the strings of Trochilus (Windows backdoor) and the new Socket…
Over 80% of Juniper Firewalls Vulnerable to Unauthenticated Code Execution
At the end of August 2023, Juniper Networks released a security advisory mentioning the CVE-2023-36845 vulnerability affecting SRX and EX series firewalls. The vulnerability was categorized as a Medium (5.3) severity vulnerability. Following this, security researchers at watchtowr published a…
BlackCat Ransomware Leveraging Remote Monitoring Tools to Encrypt Azure Storage
BlackCat Ransomware variant Sphynx has been newly identified with additional features used for encrypting Azure Storage accounts. This Sphynx variant of BlackCat was first discovered in March and was upgraded in May, which added the Exmatter exfiltration tool. Another version…
Hackers Are Using AI For Cyberattacks. How Can We Stop Them?
The use of AI has greatly increased over the past few months, with programs like ChatGPT and Bing AI making the technology freely available to all. It has been used to create beautiful works of art and poetry and for…
AMBERSQUID: Novel Cryptojacking Attack Leverages AWS Services
Cryptojacking is a malicious cyberattack in which an attacker stealthily utilizes a victim’s computer or device to mine cryptocurrencies such as Bitcoin or Monero without the victim’s knowledge or agreement. This usually entails infecting the victim’s PC with malware that…
Pro-Russian Actors Initiated A DDoS Attack Against Canadian Organizations
The Canadian government, banking, and transportation industries have recently been the targets of many distributed denial of service (DDoS) attacks. This criminal activity is linked to state-sponsored cyber threat actors from Russia. Since March 2022, NoName057(16), a pro-Russian hacktivist operator…
Iranian Hackers Attack Thousands of Organizations Using Password Spraying
Peach Sandstorm, an Iranian Hackers group that targets organizations globally, aligns with the following threat groups:- Besides this, in the following sectors, the Iranian group, Peach Sandstorm pursued its targets most in the past attacks:- The cybersecurity researchers at Microsoft…
8 XSS Vulnerabilities in Azure HDInsight Allow Attackers to Deliver Malicious Payloads
Azure HDInsight has been identified with multiple Cross-Site Scripting – XSS vulnerabilities related to Stored XSS and Reflected XSS. The severity for these vulnerabilities ranges between 4.5 (Medium) and 4.6 (Medium). These vulnerabilities have affected multiple products, including Azure Apache…
Windows11 Themes vulnerability Let Attackers Execute Arbitrary Code
An Arbitrary code execution vulnerability has been found in Windows 11. This vulnerability is a result of several factors, such as a Time-of-Check Time-of-Use (TOCTOU) race condition, malicious DLL, cab files, and the absence of Mark-of-the-Web validation. This particular vulnerability…
Memory Corruption Flaw in ncurses API Library Exposes Linux and macOS Systems
Multiple memory corruption vulnerabilities have been discovered in the ncurses library, which various programs use on multiple operating systems like Portable Operating System Interface (POSIX) OS, Linux OS, macOS, and FreeBSD. Threat actors can chain these vulnerabilities with environment variable…
3AM Ransomware Attack – Stop Services & Delete Shadow Copies Before Encrypting
Ransomware is a universal threat to enterprises, targeting anyone handling sensitive data when profit potential is high. A new ransomware named 3AM has surfaced and is used in a limited manner. Symantec’s Threat Hunter Team witnessed it in a single…
Trellix DLP Vulnerability Allows Attackers To Delete Unprivileged Files
Trellix Windows DLP endpoint for Windows has a privilege escalation vulnerability that allows unauthorized deletion of any file or folder. Trellix DLP Endpoint protects against all potential leak channels, including portable storage devices, the cloud, email, instant messaging, web, printing,…
Next-Gen Email Firewalls: Beyond Spam Filters to Secure Inboxes Checklist
Email communication is still widely used as an attack vector despite the ever-changing nature of cyber threats. The vast number of people who use it for communication daily, both professionally and personally, makes it a tempting target. Cybercriminals are becoming…
Microsoft Teams as a Tool for Storm-0324 Threat Group to Hack Corporate Networks
According to recent reports, a threat actor known as Storm-0324 has been using email-based initial infection vectors to attack organizations. However, as of July 2023, the threat actor has been found to have been using Microsoft Teams to send Phishing…
Cisco IOS Verification Flaw Let Attackers Execute Arbitrary Code
Cisco has been discovered with an arbitrary code execution flaw on their Cisco IOS XR Software image verification checks, which allows an authenticated, local attacker to execute arbitrary code on their underlying operating system. Cisco Internetwork Operating System (IOS) is…
SolarWinds Platform Vulnerability Let Attackers Execute Arbitrary Commands
SolarWinds Platform has published its release notes 2023.3.1, which provides multiple bug fixes and security updates. With this release, the platform has fixed two vulnerabilities, CVE-2023-23840 and CVE-2023-23845, related to arbitrary command execution. SolarWinds Platform is an infrastructure monitoring and…
Hackers Attack Facebook Business Users Aggressively to Steal Login Credentials
A new and highly concerning cyber threat has emerged, as a botnet known as “MrTonyScam” has been orchestrating an extensive Messenger phishing campaign on Facebook. Recently, this campaign has flooded the platform with malicious messages, posing a significant risk to…
ReconAIzer: OpenAI-based Extension for Burp Suite
Burp Suite, the renowned Bug Bounty Hunting and Web Application Penetration Testing tool, has been improvised with many extensions over the years. Many of Burp’s Extensions have been used by Bug Bounty Hunters and Security Researchers for various purposes. It…
Weaponized Free Download Manager for Linux Steals System Data & Passwords
In recent years, Linux systems gained prominence among diverse threat actors, with more than 260,000 unique samples emerging in H1 2023. In the case of Linux, threat actors can run multiple campaigns without being detected for years, and maintain long-term…
Chinese Redfly Hacked National Power Grid & Maintained Access for 6 Months
Cybersecurity researchers at Symantec’s Threat Hunter Team recently discovered that the Redfly threat actor group used ShadowPad Trojan to breach an Asian national grid for 6 months. Artificial intelligence-driven cyber threats grow as technology advances, significantly influencing and boosting threat…
Mozilla Zero-Day Vulnerability Exploited in the Wild – Patch Now!
In a race against time to safeguard user security, major browser vendors, including Google and Mozilla, have scrambled to release urgent updates in response to a critical vulnerability discovered in the WebP Codec. This newly unearthed vulnerability, bearing the identifier…
Chrome Zero-Day Vulnerability Exploited in the Wild
Chrome’s Stable and Extended stable channels have been upgraded to 116.0.5845.187 for Mac and Linux and 116.0.5845.187/.188 for Windows as part of a security update. One “Critical” security upgrade is included in this release. In the coming days and weeks,…
Windows Arbitrary File Deletion Vulnerability Leads to Full System Compromise
Threat actors were using Windows Arbitrary File Deletion to perform Denial-of-service attacks on systems affected by this vulnerability. However, recent reports indicate that this Windows Arbitrary file deletion can be used for a full compromise. The possibility of this attack…
New Sponsor Malware Attacking Government & Healthcare Organizations
The Ballistic Bobcat is an Iran-aligned APT group, and initially, about two years ago, cybersecurity researchers at ESET tracked this threat group. Here below, we have mentioned all the other names of the Ballistic Bobcat APT group:- Recently, cybersecurity analysts…