A new critical vulnerability has been discovered in two of the Rust standard libraries, which could allow a threat actor to execute shell commands on vulnerable versions. This vulnerability has been assigned CVE-2024-24576, and its severity has been given as…
Category: GBHackers on Security | #1 Globally Trusted Cyber Security News Platform
New SharePoint Technique Lets Hackers Bypass Security Measures
Two new techniques uncovered in SharePoint enable malicious actors to bypass traditional security measures and exfiltrate sensitive data without triggering standard detection mechanisms. Illicit file downloads can be disguised as harmless activities, making it difficult for cybersecurity defenses to detect…
How to Use Cyber Threat Intelligence? 4 TI Categories to Learn SOC/DFIR Team
Cyber Threat Intelligence (CTI) is a process that actively gathers and analyzes information on potential cyber threats, including Indicators of Compromise (IOCs) and Tactics, Techniques, and Procedures (TTPs) used by attackers, along with their goals and capabilities. The ultimate goal…
How to Use Cyber Threat Intelligence ? 4 TI Categories to Learn SOC/DFIR Team
Cyber Threat Intelligence (CTI) is a process that actively gathers and analyzes information on potential cyber threats, including Indicators of Compromise (IOCs) and Tactics, Techniques, and Procedures (TTPs) used by attackers, along with their goals and capabilities. The ultimate goal…
Ahoi Attacks – New Attack Breaking VMs With Malicious Interrupts
Ahoy, which is often associated with communicating to ships, has now been playfully adopted in pirate language. We coin ‘Ahoi,’ an anagram of ‘Iago,’ to pay tribute to research on interface attacks with TEEs. Confidential computing, also referred to as…
Hackers Using ScrubCrypt ‘AV Evasion Tool’ To Exploit Oracle WebLogic Servers
Hackers exploit Oracle WebLogic Servers, knowing that they are extensively used in enterprises. Threat actors can use security vulnerabilities present in the WebLogic servers to gain unauthorized access to sensitive data and install backdoors that open avenues for further exploitation.…
Thousands Of Internet-Exposed Ivanti VPN Appliances Vulnerable To RCE Attacks
In a recent cybersecurity revelation, Ivanti, a leading provider of enterprise-grade secure access solutions, has been found to have significant vulnerabilities in its VPN appliances. The most critical of these, identified as CVE-2024-21894, is a heap overflow vulnerability that could…
Google Adds V8 Sandbox To Chrome To Fight Against Browser Attacks
A Sandbox is a protective medium that blocks the entire system from any application accessing vulnerable resources. Restrictive environments for web content in browsers called sandboxes reduce the impact that can be caused by browser-based attacks such as malicious programs…
Cyber Attack on Consulting Firm Exposes DOJ Data of 341,000 People
Greylock McKinnon Associates, a prominent consulting firm, has reported a cyber attack that exposed personal data belonging to 341,000 individuals, including sensitive information from the Department of Justice (DOJ). Greylock McKinnon Associates, located at 75 Park Plaza, Boston, MA, discovered…
Targus Hacked: Attackers Gain Access to File Servers
Targus International, LLC and its affiliates fell victim to a sophisticated cyberattack. The company, an indirect subsidiary of B. Riley Financial, Inc., announced that an unauthorized entity breached its file systems, prompting an immediate and robust response to mitigate the…
Top Israeli Spy Chief Identity Exposed In A Privacy Mistake
Privacy mistakes could pose a serious threat to sensitive information or systems,, which threat actors could exploit for their gain. These mistakes can include weak passwords, unsecured networks, and outdated software, making it easier for threat actors to infiltrate and…
Notepad++ Wants Your Help to Take Down the Parasite Website
In a recent announcement, the team behind the widely acclaimed source code editor, Notepad++, has issued a call to arms for its user community. The appeal comes in response to the emergence of a deceptive website that misleads users and…
Google Rolls Out “Find My Device” Network for Android Users
Google has announced the global rollout of its revamped Find My Device network. This innovative feature is set to transform how Android users locate their misplaced devices and everyday items, leveraging a vast, crowdsourced network of over a billion Android…
D-Link RCE Vulnerability That Affects 92,000 Devices Exploited in Wild
Cybercriminals have actively exploited a critical vulnerability in D-Link Network Attached Storage (NAS) devices globally. Identified as CVE-2024-3273, this remote code execution (RCE) flaw poses a significant threat to as many as 92,000 devices worldwide. The exploit allows attackers to…
HTTP/2 Vulnerability Let Hackers Launch DOS Attacks on Web Servers
Researchers identified a significant vulnerability within the HTTP/2 protocol, potentially allowing hackers to launch Denial of Service (DOS) attacks on web servers. The vulnerability tracked as CVE-2024-28182 has raised concerns among internet security experts and prompted responses from various technology…
Exploring How Penetration Tests Are Classified – Pentesting Aspirant Guide 2024
In the dynamic and ever-evolving landscape of cyber security defenses, enterprise-grade penetration testing is one of the most crucial practices for organizations to adopt. With cyber criminals operating on a far more sophisticated level than ever, continuous and multi-layered security…
AGENT TESLA Malware Steals login Credentials From Chrome & Firefox
Researchers investigated a recent Agent Tesla malware campaign targeting US and Australian organizations, which used phishing emails with fake purchase orders to trick victims into clicking malicious links. Upon clicking, an obfuscated Agent Tesla sample protected by Cassandra Protector was…
Threat Actors Deliver Malware via YouTube Video Game Cracks
Threat actors target home users with information-stealing malware like Vidar, StealC, and Lumma Stealer, which disguises the malware as pirated software and video game cracks in YouTube videos. The videos appear to instruct users on obtaining free software or game…
Chinese Hackers Using AI Tools To Influence Upcoming Elections
By exploiting the AI tools deepfake hackers could make videos or audios of political candidates to spread misinformation or disinformation, which may be used in election campaigns. Large language models (LLMs) can also enable them to produce realistic but misleading…
Cisco IOS Vulnerability Allows DOS Attacks via Malicious Traffic
Cisco recently fixed a high-severity vulnerability in Cisco IOS Software for Catalyst 6000 Series Switches, which could lead to a denial of service (DoS). This high-severity vulnerability, which has a base score of 7.4 and is tracked as CVE-2024-20276, is triggered by improper…