In a new wave of cyberattacks, the Russia-aligned hacking group “RomCom” has been found exploiting critical zero-day vulnerabilities in Microsoft Windows and Mozilla Firefox products. Security researchers at ESET uncovered the alarming attack chain, which uses the vulnerabilities to deploy…
Category: GBHackers Security | #1 Globally Trusted Cyber Security News Platform
Chinese APT Hackers Using Multiple Tools And Vulnerabilities To Attack Telecom Orgs
Earth Estries, a Chinese APT group, has been actively targeting critical sectors like telecommunications and government entities since 2023. They employ advanced techniques, including exploiting vulnerabilities, lateral movement, and deploying multiple backdoors like GHOSTSPIDER, SNAPPYBEE, and MASOL RAT, which have…
200,000 WordPress Sites Exposed to Cyber Attack, Following Plugin Vulnerability
A critical security vulnerability has been discovered in the popular WordPress plugin Anti-Spam by CleanTalk, which is installed on over 200,000 websites. The vulnerability, which includes two distinct flaws (CVE-2024-10542 and CVE-2024-10781), could allow attackers to install and activate arbitrary plugins…
Beware Of SpyLoan Apps Exploits Social Engineering To Steal User Data
SpyLoan apps, a type of PUP, are rapidly increasing, exploiting social engineering to deceive users into granting excessive permissions, where these apps, installed millions of times, exfiltrate sensitive data to C2 servers via encrypted HTTP requests. Primarily targeting South America,…
Researchers Detailed Tools Used By Hacktivists Fueling Ransomware Attacks
CyberVolk, a politically motivated hacktivist group, has leveraged readily available ransomware builders like AzzaSec, Diamond, LockBit, and Chaos to launch DDoS and ransomware attacks against targets opposing Russian interests. The highly skilled members of the group modify and improve these…
Blue Yonder Ransomware Attack Impacts Starbucks & Multiple Supermarkets
A ransomware attack on Blue Yonder, a leading supply chain management software provider, has created ripples across global retail and manufacturing sectors, affecting major players like Starbucks and prominent UK supermarket chains. The breach, which occurred on November 21, underscores…
Multiple Flaws With Android & Google Pixel Devices Let Attackers Elevate Privileges
Several high-severity vulnerabilities have been identified in Android and Google Pixel devices, exposing millions of users to potential security risks. These flaws, categorized under various CVEs (Common Vulnerabilities and Exposures), range from privilege escalation to data theft and unauthorized access…
IBM Workload Scheduler Vulnerability Stores User Credentials in Plain Text
IBM has issued a security bulletin warning customers about a vulnerability in its Workload Scheduler software that allows user credentials to be stored in plain text. This issue, identified as CVE-2024-49351, could enable local users to access sensitive information such…
CISA Details Red Team Assessment Including TTPs & Network Defense
The Cybersecurity and Infrastructure Security Agency (CISA) recently detailed findings from a Red Team Assessment (RTA) conducted on a critical infrastructure organization in the United States. The assessment, carried out over three months, simulated real-world cyberattacks to evaluate the organization’s…
Dell Wyse Management Suite Vulnerabilities Let Attackers Exploit Affected Systems Remotely
Dell Technologies has released a security update for its Wyse Management Suite (WMS) to address multiple vulnerabilities that could allow malicious users to compromise affected systems. Wyse Management Suite is a flexible hybrid cloud solution that empowers IT admin to securely…
Python NodeStealer: Targeting Facebook Business Accounts to Harvest Login Credentials
The Python-based NodeStealer, a sophisticated info-stealer, has evolved to target new information and employ advanced techniques, whereas recent variants focus on stealing Facebook Ads Manager budget details, potentially enabling malicious ad campaigns. Now they pilfer credit card information alongside browser…
Threat Actors Exploit Google Docs And Weebly Services For Malware Attacks
Phishing attackers used Google Docs to deliver malicious links, bypassing security measures and redirecting victims to fake login pages hosted on Weebly, targeting telecommunications and financial sectors in late October 2024. Financially motivated threat actors exploit Weebly’s ease of use…
XSS Vulnerability in Bing.com Let Attackers Send Crafted Malicious Requests
A significant XSS vulnerability was recently uncovered in Microsoft’s Bing.com, potentially allowing attackers to execute malicious JavaScript and send crafted requests to interconnected Microsoft applications like Outlook, OneDrive, and Copilot. The exploit leveraged the trust placed in Bing’s root domain…
Meta Removed 2 Million Account Linked to Malicious Activities
Meta has announced the removal of over 2 million accounts connected to malicious activities, including sophisticated fraud schemes such as “pig butchering.” This move is part of Meta’s ongoing effort to combat organized criminal networks that exploit social media platforms…
Veritas Enterprise Vault Vulnerabilities Lets Attackers Execute Arbitrary Code Remotely
Critical security vulnerability has been identified in Veritas Enterprise Vault, a widely-used archiving and content management solution. The vulnerability, rated with a CVSS v3.1 Base Score of 9.8 (Critical), could allow attackers to execute arbitrary code on affected servers. This…
7-Zip RCE Vulnerability Let Attackers Execute Remote Code
A critical security vulnerability has been disclosed in the popular file archiving tool 7-Zip, allowing attackers to execute arbitrary code remotely. The flaw, identified as CVE-2024-11477, has been attributed to an integer underflow in the Zstandard decompression implementation, which could…
Massive Credit Card Leak, Database of 1,221,551 Cards Circulating on Dark Web
A massive data breach has sent shockwaves across the globe, as a database containing sensitive financial information for over 1.2 million credit cards has been leaked on the dark web. According to reports from cybersecurity watchers, the database was shared…
Nearest Neighbor Attacks: Russian APT Hack The Target By Exploiting Nearby Wi-Fi Networks
Recent research has revealed that a Russian advanced persistent threat (APT) group, tracked as “GruesomeLarch” (also known as APT28, Fancy Bear, or Forest Blizzard), has unveiled a novel attack technique dubbed the “Nearest Neighbor Attack.” Leveraging compromised Wi-Fi networks close…
240+ Domains Used By PhaaS Platform ONNX Seized by Microsoft
Microsoft’s Digital Crimes Unit (DCU) has disrupted a significant phishing-as-a-service (PhaaS) operation run by Egypt-based cybercriminal Abanoub Nady, known online as “MRxC0DER.” Nady developed and sold “do-it-yourself” phishing kits under the fraudulent “ONNX” brand, enabling cybercriminals to easily launch large-scale…
Earth Kasha Upgraded Their Arsenal With New Tactics To Attack Organizations
Earth Kasha, a threat actor linked to APT10, has expanded its targeting scope to India, Taiwan, and Japan, leveraging spear-phishing and exploiting vulnerabilities in public-facing applications like SSL-VPN and file storage services. The group has deployed various backdoors, including Cobalt…
Russian TAG-110 Hacked 60+ Users With HTML Loaded & Python Backdoor
The Russian threat group TAG-110, linked to BlueDelta (APT28), is actively targeting organizations in Central Asia, East Asia, and Europe by deploying custom malware, HATVIBE and CHERRYSPY, to compromise government entities, human rights groups, and educational institutions. Initial access is…
Raspberry Robin Employs TOR Network For C2 Servers Communication
Raspberry Robin, a stealthy malware discovered in 2021, leverages advanced obfuscation techniques to evade detection and analysis by infiltrating systems primarily via USB drives, utilizing the TOR network for covert communication with its C2 servers. The malware’s multi-layered structure and…
145,000 ICS Systems, Thousands of HMIs Exposed to Cyber Attacks
Critical infrastructure, the lifeblood of modern society, is under increasing threat as a new report from Censys reveals that over 145,000 industrial control system (ICS) devices are exposed to the internet. Among these, thousands of human-machine interfaces (HMIs) — which…
DOJ Asks Google to Sell $20 Billion Worth Chrome to End Monopoly
In a dramatic escalation of its antitrust lawsuit against Google, the U.S. Department of Justice (DOJ) has proposed sweeping changes to the tech giant’s operations, including the forced sale of its Chrome browser and potentially its Android operating system. The…
US Seizes PopeyeTools Cybercrime Platform & Arrested Admins
The U.S. Department of Justice (DOJ) announced the seizure of the illicit PopeyeTools platform, a notorious online marketplace for stolen credit cards and cybercrime tools. Alongside the takedown, authorities unsealed criminal charges against three alleged administrators: Abdul Ghaffar (25) and…
Chinese Hackers Breached Deep Into US Telecom to Spy on Calls and Texts
In a breach that lawmakers are calling the most serious in U.S. history, Chinese hackers infiltrated the nation’s telecommunications systems, gaining the ability to listen to phone conversations and read text messages by exploiting outdated equipment and vulnerabilities in network…
FortiClient VPN Flaw Enables Undetected Brute-Force Attacks
A design flaw in the logging mechanism of Fortinet’s VPN servers has been uncovered, allowing attackers to conduct brute-force attacks without detection. This vulnerability, disclosed by cybersecurity researchers at Pentera, highlights a critical gap in Fortinet’s ability to log successful…
Helldown Ransomware Attacking VMware ESXi And Linux Servers
Helldown, a new ransomware group, actively exploits vulnerabilities to breach networks, as since August 2024, they have compromised 28 victims, leaking their data on a dedicated website. The ransomware group IS has updated its data leak site, removing three victims,…
Two PyPi Malicious Package Mimic ChatGPT & Claude Steals Developers Data
Two malicious Python packages masquerading as tools for interacting with popular AI models ChatGPT and Claude were recently discovered on the Python Package Index (PyPI), the official repository for Python libraries. These packages reportedly remained undetected for over a year,…
5 Hackers Charged for Attacking Companies via Phishing Text Messages
Federal authorities have unsealed charges against five individuals accused of orchestrating sophisticated phishing schemes that targeted employees of companies across the United States. The alleged hackers reportedly stole confidential company data and millions of dollars in cryptocurrency by exploiting stolen…
Researchers Detailed FrostyGoop Malware Attacking ICS Devices
FrostyGoop, a newly discovered OT-centric malware that exploited Modbus TCP to disrupt critical infrastructure in Ukraine, capable of both internal and external attacks, targets industrial control systems (ICS) devices. By sending malicious Modbus commands, FrostyGoop can cause physical damage to…
Phobos Ransomware Admin as Part of International Hacking Operation
The U.S. Department of Justice unsealed criminal charges today against Evgenii Ptitsyn, a 42-year-old Russian national accused of being a key figure in the notorious Phobos ransomware syndicate. Ptitsyn was extradited from South Korea and made his initial appearance in the…
Apache Kafka Vulnerability Let Attackers Escalate Privileges
A newly identified vulnerability tracked as CVE-2024-31141, has been discovered in Apache Kafka Clients that could allow attackers to escalate privileges and gain unauthorized filesystem read access. This vulnerability, rated as Moderate in severity, affects multiple versions of Apache Kafka Clients and has raised concerns…
Maxar Space Data Leak, Threat Actors Gain Unauthorized Access to the System
Maxar Space Systems, a leader in space technology and Earth intelligence solutions, has recently confirmed a significant data breach that exposed the personal information of both current and former employees. The breach, which took place in mid-October 2024, has raised…
Zohocorp ManageEngine ADAudit Plus SQL Injection Vulnerability
Zohocorp, the company behind ManageEngine, has released a security update addressing a critical SQL injection vulnerability in its ADAudit Plus software. The flaw, identified as CVE-2024-49574, affects all builds of ADAudit Plus before version 8123 and has been classified as high severity.…
Citrix Virtual Apps & Desktops Zero-Day Vulnerability Exploited in the Wild
A critical new vulnerability has been discovered in Citrix’s Virtual Apps and Desktops solution, which is widely used to facilitate secure remote access to desktop applications now exploited in the wild. The vulnerability, which remains unpatched, was detailed last week…
Sonatype Nexus Repository Manager Hit by RCE & XSS Vulnerability
Sonatype, the company behind the popular Nexus Repository Manager, has issued security advisories addressing two critical vulnerabilities affecting Nexus Repository 2.x OSS/Pro versions. These vulnerabilities, identified as CVE-2024-5082 and CVE-2024-5083, could potentially allow attackers to exploit the system through remote code execution (RCE)…
GeoVision 0-Day Vulnerability Exploited in the Wild
Cybersecurity researchers have detected the active exploitation of a zero-day vulnerability in GeoVision devices, which the manufacturer no longer supports. The vulnerability, now designated as CVE-2024-11120, has been assigned a high-severity CVSS score of 9.8 and used by a sophisticated…
Critical TP-Link DHCP Vulnerability Let Attackers Execute Arbitrary Code Remotely
A critical security flaw has been uncovered in certain TP-Link routers, potentially allowing malicious actors to remotely compromise affected devices. The vulnerability, identified as CVE-2024-11237, affects TP-Link VN020 F3v(T) routers running firmware version TT_V6.2.1021, which are primarily deployed through Tunisie…
Critical TP-Link DHCP Vulnerability Let Attackers Execute Arbitary Code Remotely
A critical security flaw has been uncovered in certain TP-Link routers, potentially allowing malicious actors to remotely compromise affected devices. The vulnerability, identified as CVE-2024-11237, affects TP-Link VN020 F3v(T) routers running firmware version TT_V6.2.1021, which are primarily deployed through Tunisie…
Cybercriminals Launch SEO Poisoning Attack to Lure Shoppers to Fake Online Stores
The research revealed how threat actors exploit SEO poisoning to redirect unsuspecting users to malicious e-commerce websites, leveraging multiple SEO malware families to achieve their goal. Three distinct threat actor groups were identified, each employing a unique malware family, with…
Chinese SilkSpecter Hackers Attacking Black Friday Shoppers
SilkSpecter, a Chinese financially motivated threat actor, launched a sophisticated phishing campaign targeting e-commerce shoppers in Europe and the USA during the Black Friday shopping season. The campaign leveraged the legitimate payment processor Stripe to steal victims’ Cardholder Data (CHD)…
Black Basta Ransomware Leveraging Social Engineering For Malware Deployment
Black Basta, a prominent ransomware group, has rapidly gained notoriety since its emergence in 2022 by employing sophisticated social engineering techniques to infiltrate target networks, often leveraging advanced malware to compromise systems undetected. Once inside, Black Basta extorts victims with…
Critical Laravel Vulnerability CVE-2024-52301 Allows Unauthorized Access
CVE-2024-52301 is a critical vulnerability identified in Laravel, a widely used PHP framework for building web applications. The vulnerability allows unauthorized access by exploiting improperly validated inputs, potentially leading to privilege escalation, data tampering, or full system compromise. Given Laravel’s…
CISA Warns of Actors Exploiting Two Palo Alto Networks Vulnerabilities
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert and added two new vulnerabilities related to Palo Alto Networks to its Known Exploited Vulnerabilities Catalog. These vulnerabilities, CVE-2024-9463 and CVE-2024-9465, are reportedly actively exploited by malicious cyber…
4M+ WordPress Websites to Attacks, Following Plugin Vulnerability
A critical vulnerability has been discovered in the popular “Really Simple Security” WordPress plugin, formerly known as “Really Simple SSL,” putting over 4 million websites at risk. The flaw, identified as CVE-2024-10924, exposes websites using the plugin to potential remote attacks,…
Chinese National Faces 20 Years of Jail Time for Laundering Millions in Crypto
Daren Li, 41, a dual citizen of China and St. Kitts and Nevis, and a resident of China, Cambodia, and the United Arab Emirates, pleaded guilty today to one count of conspiracy to commit money laundering for his role in…
Google Unveils New Intelligent, Real-Time Protections for Android Users
Google has once again raised the bar for mobile security by introducing two new AI-powered real-time protection features for Android users. With a strong commitment to user privacy and safety, these innovative tools aim to shield users from scams, fraud,…
Google to Issue CVEs for Critical Cloud Vulnerabilities
Google Cloud has announced a significant step forward in its commitment to transparency and security by stating it will begin issuing Common Vulnerabilities and Exposures (CVEs) for critical vulnerabilities found in its cloud services. This move, which underscores Google’s dedication…
GitLab Patches Critical Flaws Leads to Unauthorized Access to Kubernetes Cluster
GitLab has rolled out critical security updates to address multiple vulnerabilities in its Community Edition (CE) and Enterprise Edition (EE), fixing issues that could lead to unauthorized access to Kubernetes clusters and other potential exploits. The latest patch versions, 17.5.2,…
Windows 0-Day Exploited in Wild with Single Right Click
A newly discovered zero-day vulnerability, CVE-2024-43451, has been actively exploited in the wild, targeting Windows systems across various versions. This critical vulnerability, uncovered by the ClearSky Cyber Security team in June 2024, has been linked to attacks aimed specifically at Ukrainian…
Finding The Right E-Commerce Platform – Comparing Reselling Solutions
If you’re looking to make some extra cash or to start a business, you should consider online reselling. Online reselling is growing rapidly at 11% each year- according to ThredUp. When partaking in online reselling it is important to have…
Automating Identity and Access Management for Modern Enterprises
Keeping track of who has access and managing their permissions has gotten a lot more complicated because there are so many users, devices, and systems involved. Using automation for managing who can access what helps companies stay secure, work more…
Fortinet Patches Critical Flaws That Affected Multiple Products
Fortinet, a leading cybersecurity provider, has issued patches for several critical vulnerabilities impacting multiple products, including FortiAnalyzer, FortiClient, FortiManager, and FortiOS. These vulnerabilities could allow attackers to perform unauthorized operations, escalate privileges, or hijack user sessions. Below are detailed descriptions…
China-Nexus Actors Hijack Websites to Deliver Cobalt Strike malware
A Chinese state-sponsored threat group, identified as TAG-112, has been discovered hijacking Tibetan community websites to deliver Cobalt Strike malware, according to a recent investigation by Recorded Future’s Insikt Group. According to a report from Recorded Future, the investigation revealed…
Ivanti Warns of Critical Vulnerabilities in Connect Secure, Policy Secure & Secure Access
Ivanti, the well-known provider of IT asset and service management solutions, has issued critical security updates for its products Ivanti Connect Secure (ICS), Ivanti Policy Secure (IPS), and Ivanti Secure Access Client (ISAC). These updates address multiple vulnerabilities, including medium, high, and critical…
Chrome 131 Released with the Fix for Multiple Vulnerabilities
The Chrome team has officially announced the release of Chrome 131 for Windows, Mac, and Linux. The new version, Chrome 131.0.6778.69 for Linux and 131.0.6778.69/.70 for Windows and Mac is set to roll out to users over the coming days…
Thousands of EOL D-Link Routers Vulnerable to Password Change Attacks
In a critical security disclosure, it has been revealed that thousands of end-of-life (EOL) D-Link DSL-6740C routers are vulnerable to password change attacks. The vulnerability tracked as CVE-2024-11068 has been rated as critical by the TWCERT/CC, with an alarming CVSS score…
Mastering Crypto Wallet Management: Secure Your Digital Assets With Confidence
Navigating the world of cryptocurrencies can feel like unlocking a new frontier. I remember my first foray into crypto wallet management, and the thrill of securing my digital assets was exhilarating. With the rapid growth of digital currencies, managing a…
Maximise Crypto Mining Profitability: Strategies For Success In 2023
Diving into the world of crypto mining has always intrigued me. The allure of turning computer power into digital currency feels like a modern-day gold rush. As I explored this field, I discovered that understanding the profitability of crypto mining…
Crypto Network Security: Essential Tips To Protect Your Digital Assets In 2023
Exploring the world of cryptocurrencies has been a thrilling journey for me. The allure of digital currencies lies not just in their potential for profit but also in the intricate technology that underpins them. One aspect that’s particularly fascinating is…
Understanding Crypto Macroeconomic Factors: Navigating Inflation, Rates, And Regulations
Diving into the world of cryptocurrencies, I’ve found it’s a fascinating intersection of technology and economics. The crypto market isn’t just about digital coins; it’s deeply influenced by macroeconomic factors that shape its dynamics. Understanding these factors can unlock insights…
Crafting A Successful Crypto Investment Thesis: Strategies For Long-Term Growth
Diving into the world of crypto investments has been one of the most exhilarating journeys I’ve embarked on. The dynamic nature of cryptocurrencies offers a unique blend of innovation and opportunity that’s hard to find elsewhere. Crafting a solid crypto…
VMware Workstation & Fusion Now Available for Free to All Users
VMware has announced that its popular desktop hypervisor products, VMware Workstation and VMware Fusion, are now free to all users across various commercial, educational, and personal sectors. The transition, effective November 11, 2024, marks a shift in VMware’s strategy to…
Dell Enterprise SONiC Flaw Let Attackers Hijack the System
Dell Technologies has disclosed multiple critical security vulnerabilities in its Enterprise SONiC OS, which could allow attackers to gain control of affected systems. These vulnerabilities, identified through the Common Vulnerabilities and Exposures (CVE) system, are critical and affect Dell Enterprise…
Amazon Confirms Employee Data Breach Via Third-party Vendor
Amazon has confirmed that sensitive employee data was exposed due to a breach at a third-party vendor. The breach arose from exploiting a critical vulnerability in MOVEit, a widely used file transfer software. The vulnerability, first reported in mid-2023 under…
10 Best DNS Management Tools – 2025
Best DNS Management Tools play a crucial role in efficiently managing domain names and their associated DNS records. These tools enable users to make necessary changes and updates to DNS records, ensuring seamless website performance and accessibility. These tools are…
Tor Network Suffers IP Spoofing Attack Via Non-Exit Relays
In late October 2024, a coordinated IP spoofing attack targeted the Tor network, prompting abuse complaints and temporary disruptions. While the attack affected non-exit relays and caused some relays to be taken offline, the overall impact on Tor users was…
New Android Malware SpyAgent Taking Screenshots Of User’s Devices
SpyAgent, a newly discovered Android malware, leverages OCR technology to extract cryptocurrency recovery phrases from screenshots stored on infected devices. By stealthily capturing screenshots, the malware bypasses traditional security measures that rely on text-based detection, which allows it to efficiently…
Metasploit Framework Released with New Features
The Metasploit Framework, a widely used open-source penetration testing tool maintained by Rapid7, has introduced an exciting new release packed with cutting-edge features. The latest update includes new payloads targeting the emerging RISC-V architecture, a sophisticated SMB-to-HTTP(S) relay exploit for…
Threat Actors Allegedly Claim Leak of 489 Million Lines of Instagram Data
A threat actor has allegedly scraped 489 million lines of Instagram user data, including sensitive information, which is now reportedly being sold on the dark web. DarkWebInformer’s official X account revealed the alarming incident, raising concerns over the scale and…
Threat Actors Allegedly Claim Leak of Harley-Davidson Database
Threat actors known as “888” have allegedly leaked the database of Appleton Harley-Davidson, a prominent dealership affiliated with the iconic motorcycle brand. The breach, first reported by DarkWebInformer on their account on X, has sparked concerns over the safety of…
CISA Warns of Critical Palo Alto Networks Vulnerability Exploited in Attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warns organizations of a critical vulnerability in Palo Alto Networks’ Expedition tool, which could lead to severe security breaches. The vulnerability, CVE-2024-5910, is classified as a “Missing Authentication” flaw that potentially allows…
Cisco Desk Phone Series Vulnerability Lets Remote Attacker Access Sensitive Information
A significant vulnerability (CVE-2024-20445) has been discovered in Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 that could allow remote, unauthenticated attackers to access sensitive information. This vulnerability, classified under CWE-200 (Exposure of Sensitive Information…
Cisco Flaw Let Attackers Run Command as Root User
A critical vulnerability has been discovered in Cisco Unified Industrial Wireless Software, which affects Cisco Ultra-Reliable Wireless Backhaul (URWB) Access Points. This flaw tracked as CVE-2024-20418 enables unauthenticated, remote attackers to perform command injection attacks and execute arbitrary commands as…
HookBot Malware Use Overlay Attacks Impersonate As Popular Brands To Steal Data
The HookBot malware family employs overlay attacks to trick users into revealing sensitive information by impersonating various brands and apps to gain trust. It also utilizes C2 servers to receive updates and evolve continuously. A builder tool empowers threat actors…
CRON#TRAP Campaign Attacks Windows Machine With Weaponized Linux Virtual Machine
Weaponized Linux virtual machines are used for offensive cybersecurity purposes, such as “penetration testing” or “exploiting vulnerabilities.” These setups often use the tools and frameworks that are designed for ethical hacking. Securonix researchers recently detected CRON#TRAP campaign that has been…
North Korean Hackers Employing New Tactic To Acruire Remote Jobs
North Korean threat actors behind the Contagious Interview and WageMole campaigns have refined their tactics, enhancing the obfuscation of their scripts to evade detection. InvisibleFerret now boasts a dynamic RMM configuration and OS-specific persistence mechanisms, while Contagious Interview has expanded…
Rise Of Ransomware-As-A-Service Leads To Decline Of Custom Tools
Ransomware-as-a-Service (RaaS) platforms have revolutionized the ransomware market. Unlike traditional standalone ransomware sales, RaaS offers a subscription-based model where attackers can access pre-built ransomware tools and infrastructure without significant upfront costs. These platforms provide user-friendly dashboards, customization options, and ongoing…
Researchers Detailed Credential Abuse Cycle
The United States Department of Justice has unsealed an indictment against Anonymous Sudan, a hacking group responsible for distributed denial-of-service attacks. LameDuck, a new threat actor, has carried out several massive distributed denial of service (DDoS) attacks to affect critical…
Azure API Management Vulnerabilities Let Attackers Escalate Privileges
Recent discoveries by Binary Security have revealed critical vulnerabilities in Azure API Management (APIM) that could allow attackers with minimal privileges to escalate their access and take full control over the APIM service. These vulnerabilities were reported to Microsoft, leading to some…
Google Patches High-Severity Vulnerabilities in Chrome
Google has released a new update for its Chrome browser, addressing two high-severity vulnerabilities. The Stable channel has now been updated to version 130.0.6723.116/.117 for Windows and Mac and version 130.0.6723.116 for Linux. The update will be rolled out to users over the next…
ClickFix Exploits GMeet & Zoom Pages to Deliver Sophisticated Malware
A new tactic, “ClickFix,” has emerged. It exploits fake Google Meet and Zoom pages to deliver sophisticated malware. The Sekoia Threat Detection & Research (TDR) team monitors this social engineering strategy closely. It represents a significant evolution in how threat…
APT36 Hackers Attacking Windows Deevices With ElizaRAT
APT36, a sophisticated threat actor, has been actively targeting Indian entities with advanced malware like ElizaRAT, which is designed for espionage. It leverages cloud-based services for covert communication and data exfiltration. Recent campaigns have seen significant enhancements in ElizaRAT’s evasion…
Hackers Created 100+ Fake Web Stores To Steal Millions Of Dollars From Customers
The Phish, ‘n’ Ships fraud operation leverages, compromised websites to redirect users to fake online stores, which, optimized for search engine visibility, trick victims into providing credit card details to third-party payment processors, resulting in financial loss without receiving any…
Hackers Using AV/EDR Bypass Tool From Cybercrime Forums To Bypass Endpoints
Researchers uncovered two previously unknown endpoints with older Cortex XDR agents that used to test an AV/EDR bypass tool were compromised, granting unauthorized access. The threat actor utilized a bypass tool, likely purchased from cybercrime forums, to compromise the system.…
Google Patched 40 Security Vulnerabilities Along With Two Zero-Days
Google has released a batch of security updates addressing 40 vulnerabilities, two of which are critical zero-day exploits. As reported in the November 2024 Android Security Bulletin, these updates are crucial for maintaining the integrity and safety of Android devices…
Threat Actor IntelBroker Claims Leak of Nokia’s Source Code
The threat actor known as IntelBroker, in collaboration with EnergyWeaponUser, has claimed responsibility for a significant data breach involving Nokia’s proprietary source code. The news, which has sent ripples through the tech industry, was shared on social media, highlighting the…
New Windows Zero-Day Vulnerability Let Attackers Steal Credentials From Victim’s Machine
A security researcher discovered a vulnerability in Windows theme files in the previous year, which allowed malicious actors to steal Windows users’ credentials. When a theme file specifies a network path for specific properties, like the brand image or wallpaper,…
Chinese Hackers Attacking Microsoft Customers With Sophisticated Password Spray Attacks
Researchers have identified a network of compromised devices, CovertNetwork-1658, used by Chinese threat actors to launch highly evasive password spray attacks, successfully stealing credentials from multiple Microsoft customers. The stolen credentials are then leveraged by threat actors like Storm-0940 to…
Sophisticated Phishing Attack Targeting Ukraine Military Sectors
The Ukrainian Cyber Emergency Response Team discovered a targeted phishing campaign launched by UAC-0215 against critical Ukrainian infrastructure, including government agencies, key industries, and military entities. Phishing emails promoting integration with Amazon, Microsoft, and ZTA contained malicious .rdp files. Upon…
Massive Midnight Blizzard Phishing Attack Using Weaponized RDP Files
Researchers warn of ongoing spear-phishing attacks by Russian threat actor Midnight Blizzard targeting individuals in various sectors. The attacks involve sending signed RDP configuration files to thousands of targets, aiming to compromise systems for intelligence gathering. The actor impersonates Microsoft…
Evasive Panda Attacking Cloud Services To Steal Data Using New Toolkit
The Evasive Panda group deployed a new C# framework named CloudScout to target a Taiwanese government entity in early 2023, which leverages three modules, CGM, CGN, and COL, to hijack web sessions and access cloud services like Google Drive, Gmail,…
SYS01 InfoStealer Malware Attacking Meta Business Page To Steal Logins
The ongoing Meta malvertising campaign, active for over a month, employs an evolving strategy to distribute the SYS01 InfoStealer through ElectronJs applications disguised as legitimate software like video editors, productivity tools, and streaming services. The campaign leverages nearly a hundred…
Singapore’s Government Directed ISPs To Block Access To Ten Inauthentic Websites
Singapore’s government has instructed internet service providers to block access to websites deemed “inauthentic,” which are believed to be part of hostile information campaigns potentially targeting Singapore. The government’s action is intended to combat the distribution of false information and…
Embargo Ransomware Actors Abuses Safe Mode To Disable Security Solutions
In July 2024, the ransomware group Embargo targeted US companies using the malicious loader MDeployer and EDR killer MS4Killer. MDeployer deployed MS4Killer, which disabled security products, before executing the Embargo ransomware. The ransomware encrypted files with a random six-letter extension…
Russian Hackers Attacking Ukraine Military With Malware Via Telegram
Researchers discovered a Russian-linked threat actor, UNC5812, utilizing a Telegram persona named “Civil Defense. ” This persona has been distributing Windows and Android malware disguised as legitimate software designed to aid potential conscripts in Ukraine. Once installed, these malicious apps…
A Massive Hacking Toolkit From “You Dun” Threat Group Developed To Lauch Massive Cyber Attack
The “You Dun” hacking group exploited vulnerable Zhiyuan OA software using SQL injection, leveraging tools like WebLogicScan, Vulmap, and Xray for reconnaissance. They further escalated privileges on compromised hosts with tools like traitor and CDK. Active Cobalt Strike server leaked,…
Russia, Iran, And China Influence U.S. Elections, Microsoft Warns
The researchers have observed consistent efforts by Russia, Iran, and China to exert foreign influence on democratic processes in the United States. Recent U.S. government actions have exposed Iranian cyberattacks on the Trump-Vance campaign and the dissemination of stolen Trump…
Okta Verify Agent for Windows Flaw Let Attackers Steal User Passwords
A newly discovered vulnerability in Okta’s Device Access features for Windows could allow attackers to steal user passwords on compromised devices. The flaw affecting the Okta Verify agent for Windows specifically concerns how the software interacts with OktaDeviceAccessPipe, a component…