Recent research indicates that the Predator spyware, once thought to be inactive due to US sanctions, has resurfaced with enhanced evasion techniques. Despite efforts to curb its use, Predator continues to be employed in countries like the DRC and Angola,…
Category: GBHackers Security | #1 Globally Trusted Cyber Security News Platform
BBTok Abuses Legitimate Windows Utility Command Tool to Stay Undetected
Cybercriminals in Latin America have increased their use of phishing scams targeting business transactions and judicial-related matters. By leveraging trust and fear, respectively, these attacks often involve malicious links or file attachments that lead to malware infections, which include common…
SonicWall Access Control Vulnerability Exploited in the Wild
SonicWall has issued an urgent advisory regarding a critical vulnerability in its SonicOS management access and SSLVPN. The flaw, identified as CVE-2024-40766, is actively exploited in the wild. It potentially allows unauthorized access to resources and, under certain conditions, causes…
Fog Ransomware Now Targeting the Financial Sector; Adlumin Thwarts Attack
The Fog Ransomware group, known for targeting education and recreation sectors, has expanded its scope to attack financial services organizations, where the attackers exploited compromised VPN credentials to deploy the ransomware, targeting both Windows and Linux endpoints. It has detected…
NoiseAttack is a Novel Backdoor That Uses Power Spectral Density For Evasion
NoiseAttack is a new method of secretly attacking deep learning models. It uses triggers made from White Gaussian Noise to create several targeted classes in the model, rather than just one, like most current methods. This approach also helps avoid…
Tropic Trooper Attacks Government Organizations to Steal Sensitive Data
Tropic Trooper (aka KeyBoy, Pirate Panda, and APT23) is a sophisticated cyberespionage APT group, and it has been active since 2011. This APT group primarily targets government institutions, military agencies, healthcare, transportation, and high-tech industries in Taiwan, the Philippines, and…
Apache OFBiz for Linux & Windows Vulnerability Allows Unauthenticated Remote Code Execution
A series of vulnerabilities affecting Apache OFBiz has come to light, raising significant cybersecurity concerns. These vulnerabilities, identified as Common Vulnerabilities and Exposures (CVEs), enable unauthenticated remote code execution on both Linux and Windows platforms. This article delves into the…
Russian Military Hackers Attacking US and Global Critical Infrastructure
Russian military hackers, identified as Unit 29155, have been actively targeting critical infrastructure in the United States and globally. This unit, known for its sophisticated cyber operations, has been linked to attacks aimed at disrupting and compromising vital sectors. The…
Researchers Unpacked AvNeutralizer EDR Killer Used By FIN7 Group
FIN7 (aka Carbon Spider, ELBRUS, Sangria Tempest) is a Russian APT group that is primarily known for targeting the U.S. retail, restaurant, and hospitality sectors since mid-2015. In their attacks, the FIN7 group primarily uses several tactics and techniques like…
Lazarus Hackers Attacking Job-Seekers to Deliver Javascript Malware
The Lazarus Group is one of the most notorious hacker groups linked to the North Korean government. The group is known for its cyberattacks and has been active since 2010. However, Group-IB cyber security researchers recently discovered that Lazarus was actively…
Earth Lusca Using Multiplatform Backdoor to Attack Windows & Linux Machines
Earth Lusca is a suspected China-based cyber espionage group active since at least April 2019. Besides this, hackers often target Windows and Linux machines primarily due to their widespread use and potential for financial gain. Trend Micro security experts recently…
Growth of Web3 Fuled New Opportunities for Threat Actors to Attack Finance Sectors
Web3 and DeFi have been appealing to many threat actors, and there has been a significant boost in heists that have become larger than any they have experienced in more traditional finance. Mandiant’s investigation into the 2016 Bangladesh Bank heist…
Veeam Backup & Replication Vulnerabilities Let Attackers Execute Remote Code
Multiple critical vulnerabilities have been identified in Veeam Backup & Replication, a widely-used data protection and disaster recovery solution. These vulnerabilities, discovered during internal testing, pose serious risks, including remote code execution (RCE), privilege escalation, and data interception. The issues…
Tor Browser 13.5.3 Released, What’s New?
The Tor Project has unveiled Tor Browser 13.5.3, a significant update that brings crucial security enhancements and usability improvements. This latest version is now available for download from the official Tor Browser website and distribution directory. Important security updates to…
Cisco Smart Licensing Utility Vulnerability Let Attackers Gain Admin Control
Cisco has issued a security advisory (Advisory ID: cisco-sa-cslu-7gHMzWmw) regarding critical vulnerabilities in the Cisco Smart Licensing Utility. These vulnerabilities could allow unauthenticated, remote attackers to gain administrative control over affected systems. The advisory was first published on September 4,…
Warning: New Emansrepo Malware Uses HTML Files to Target Windows Users
Emansrepo, a Python infostealer, is distributed via phishing emails containing fake purchase orders and invoices, where the attacker initially sent a phishing email with an HTML file redirecting to the Emansrepo download link. In recent months, the attack flow has…
Security Flaw Allows Attackers to Clone YubiKeys by Extract Private Key
Secure elements consist mainly of tiny microcontrollers, which provide service by generating and storing secrets and performing cryptographic operations. Thomas Roche of NinjaLab finds a major security flaw in the crypto library of Infineon Technologies affecting a diverse range of…
ToddyCat APT Abuses SMB, Exploits IKEEXT A Exchange RCE To Deploy ICMP Backdoor
ToddyCat is an APT group that has been active since December 2020, and primarily it targets the government and military entities in Europe and Asia. The group is known for its sophisticated cyber-espionage tactics and has been involved in multiple…
Halliburton Confirms that Hackers Stolen Data in Cyber Attack
Halliburton Company has confirmed that a cyber attack led to unauthorized access and data theft from its systems. The incident, which came to light on August 21, 2024, has prompted the company to initiate a comprehensive cybersecurity response plan. Immediate…
PoC Exploit Released For 0-Day Windows Kernel Privilege Escalation Vulnerability
Microsoft released several patches for multiple vulnerabilities during the Patch Tuesday for August 2024. One of the vulnerabilities listed by Microsoft was the CVE-2024-38106. This vulnerability is associated with Windows Kernel Privilege Escalation affecting multiple Microsoft Windows OSes including Windows…