A new wave of cyberattacks has surfaced, with a Mirai-based botnet exploiting a number of significant vulnerabilities in routers and smart devices, primarily targeting industrial and home networks worldwide. The Shadowserver Foundation recently shared on X the botnet’s active exploitation…
Tag: Cyber Security News
Unpatched SonicWall Firewalls Vulnerability Actively Exploited To Hijack SSL VPN Sessions
A critical vulnerability in SonicWall firewalls, identified as CVE-2024-53704, has been actively exploited by attackers to hijack SSL VPN sessions. This vulnerability affects SonicOS versions 7.1.x (7.1.1-7058 and older), 7.1.2-7019, and 8.0.0-8035. The exploit allows a remote attacker to bypass…
Windows Driver Zero-Day Vulnerability Allow Attackers To Gain System Access Remotely
A critical zero-day vulnerability has been discovered in a Windows driver, allowing attackers to gain remote access to systems. This vulnerability, identified as CVE-2025-21418, was disclosed on February 11, 2025, and is classified as “Important” with a CVSS score of…
Hackers Exploiting Ivanti Connect Secure RCE Vulnerability to Install SPAWNCHIMERA Malware
A critical vulnerability in Ivanti Connect Secure (CVE-2025-0282) is being actively exploited by multiple threat actors to deploy an advanced malware variant known as SPAWNCHIMERA. This vulnerability, disclosed in January 2025, is a stack-based buffer overflow that allows remote unauthenticated…
‘Wormable’ Windows LDAP Vulnerability Allow Attackers Arbitrary Code Remotely
A critical security vulnerability has been identified in Windows’ Lightweight Directory Access Protocol (LDAP) implementation, allowing attackers to execute arbitrary code remotely. This “wormable” vulnerability, designated as CVE-2025-21376, was disclosed on February 11, 2025, by Microsoft. The vulnerability is classified…
Hackers Trick You To Run PowerShell As Admin & Paste Their Code to Hack Windows
Microsoft Threat Intelligence has uncovered a new tactic employed by the North Korean state-sponsored hacking group Emerald Sleet, also known as Kimsuky or VELVET CHOLLIMA. The group is leveraging social engineering techniques to trick victims into running PowerShell commands as…
Windows Storage 0-Day Vulnerability Let Attackers Delete The Target Files Remotely
A significant security vulnerability has been identified in Windows, allowing attackers to remotely delete targeted files on affected systems. This vulnerability, tracked as CVE-2025-21391, was disclosed on February 11, 2025, and is classified as an Elevation of Privilege vulnerability with…
Hackers Exploit Prompt Injection to Tamper with Gemini AI’s Long-Term Memory
A sophisticated attack targeting Google’s Gemini Advanced chatbot. The exploit leverages indirect prompt injection and delayed tool invocation to corrupt the AI’s long-term memory, allowing attackers to plant false information that persists across user sessions. This vulnerability raises serious concerns…
Ivanti Connect Secure Vulnerabilities Let Attackers Execute Code Remotely
Ivanti has disclosed a critical vulnerability, CVE-2025-22467, impacting its Connect Secure (ICS) product. This stack-based buffer overflow vulnerability, rated 9.9 (Critical) on the CVSS v3.1 scale, allows remote authenticated attackers to execute arbitrary code on affected systems. The flaw is…
Google Chrome’s Safe Browsing Now Protect 1 Billion Users With 300,000 Deep Scans
In honor of Safer Internet Day, Google has announced a significant milestone in online security, more than 1 billion Chrome users are now safeguarded by the browser’s Enhanced Protection mode. This advanced security feature, introduced in 2020 as part of…
Remote Desktop Manager Vulnerabilities Let Attackers Intercept Encrypted Communications
Devolutions have disclosed critical vulnerabilities in its Remote Desktop Manager (RDM) software, which could allow attackers to intercept and modify encrypted communications through man-in-the-middle (MITM) attacks. These flaws stem from improper certificate validation across all platforms and have been assigned…
Microsoft Secure Boot Security 0-Day Lets Attackers Steal The Admin Credentials
A significant security vulnerability, identified as CVE-2023-24932, has been discovered in Microsoft’s Secure Boot feature. This vulnerability allows attackers to bypass Secure Boot, potentially leading to the theft of admin credentials. The vulnerability was first disclosed on May 9, 2023,…
Linux X.509 Certificate-Based User Login Flaws Let Attackers Bypass Authentication
Three critical vulnerabilities have been identified in the PAM-PKCS#11 module, a widely used Linux-PAM login module that facilitates X.509 certificate-based user authentication. These vulnerabilities, cataloged under CVE-2025-24032, CVE-2025-24531, and CVE-2025-24031, pose significant risks by allowing attackers to bypass authentication mechanisms,…
Critical OpenSSL Vulnerability Allow Hackers to Launch Man-in-the-Middle Attacks
The OpenSSL Project announced a high-severity vulnerability (CVE-2024-12797) affecting versions 3.2, 3.3, and 3.4 of the widely used cryptographic library. The vulnerability, discovered by Apple Inc. in December 2024, could potentially allow man-in-the-middle (MitM) attacks on TLS and DTLS connections…
Microsoft Patch Tuesday February 2025 – 61 Vulnerabilities Fixed, 3 Zero-Day’s Actively Exploited
Microsoft released a security update as part of the February Patch Tuesday that addressed 61 vulnerabilities, including 25 classified as critical Remote Code Execution (RCE) vulnerabilities, including 3 zero-day vulnerabilities that were actively exploited in the wild. The update covers…
Fortinet 0-Day in FortiOS & FortiProxy Let Attackers Hijacks Firewall to Get Super Admin Access
Fortinet has issued an urgent warning about actively exploiting a new zero-day authentication bypass vulnerability (CVE-2025-24472) affecting its FortiOS and FortiProxy products. This critical flaw allows remote attackers to gain super-admin privileges by sending maliciously crafted CSF proxy requests. The…
Fortinet Addresses Critical Zero-Day & Multiple Vulnerabilities in Major Security Update
Fortinet has rolled out critical security updates to address a severe zero-day vulnerability (CVE-2025-24472) and multiple high-risk flaws across its product portfolio, including FortiOS, FortiProxy, FortiManager, and FortiAnalyzer. Fortinet warns of a new zero-day flaw (CVE-2025-24472), which allows attackers to…
Microsoft Patch Tuesday February 2025 – 61 Vulnerabilities Fixed, 3 Actively Exploited in the Wild
Microsoft released a security update as part of the February Patch Tuesday that addressed 61 vulnerabilities, including 25 classified as critical Remote Code Execution (RCE) vulnerabilities, including 3 actively exploited in the wild. The update covers a wide range of…
Researcher Details Fortinet FortiOS Vulnerabilities Allowing DoS & RCE Attacks
A security audit of Fortinet’s FortiOS VPN conducted by Akamai researcher Ben Barnea has uncovered multiple vulnerabilities that could enable attackers to launch denial-of-service (DoS) attacks and potentially execute remote code (RCE). The findings, responsibly disclosed to Fortinet, prompted a…
Critical Ivanti CSA Vulnerability Let Attackers Execute Arbitrary Code Remotely
Ivanti has issued critical updates for its Cloud Services Application (CSA) to address two significant vulnerabilities, one of which could allow attackers to execute arbitrary code remotely. The vulnerabilities, identified as CVE-2024-47908 and CVE-2024-11771, affect CSA versions 5.0.4 and earlier.…
FortiOS Security Fabric Vulnerability Let Attackers Escalate Privileges to Super-admin
Fortinet has addressed a critical security flaw in its FortiOS Security Fabric that could allow authenticated administrators to elevate privileges to the super-admin level by connecting vulnerable devices to malicious upstream FortiGate systems. Tracked as an “incorrect privilege assignment” vulnerability,…
Hackers Newly Registering Valentine’s Day Themed Domains for Stealthy Cyber Attacks
Researchers have identified a surge in newly registered Valentine’s Day-themed domains, with threat actors leveraging terms like “love,” “gift,” and “Valentine” to orchestrate phishing, malware, and romance scams. This trend aligns with historical patterns where cybercriminals exploit seasonal events to…
UK Cracked Down Russian ZSERVERS Network Acts as Launchpad for Cyber Attacks
The UK government has imposed strict sanctions on ZSERVERS, a Russian-based cyber entity identified as a key enabler of global ransomware attacks. The sanctions target six members of the ZSERVERS network and its UK-based front company, XHOST Internet Solutions LP,…
EARLYCROW – Detecting APT Malware Command and Control Over HTTPS
Advanced Persistent Threats (APTs) represent a significant challenge for cybersecurity, targeting critical organizations with stealth and precision. Traditional Network Intrusion Detection Systems (NIDS) often fail to detect these threats due to their sophisticated tactics. To address this, researchers Almuthanna Alageel…
Check Point and Wiz Partner to Deliver End-to-End Cloud Security
Check Point Software Technologies Ltd, a leading provider of cyber security solutions, has announced a strategic partnership with Wiz, a cloud security provider, to tackle the increasing challenges of securing hybrid cloud environments. This collaboration aims to bridge the gap…
SAP Security Update – 19 Vulnerabilities Across Multiple Products Patched
SAP has released 19 new Security Notes and two updates to existing patches in its February 2025 Security Patch Day, targeting high-risk vulnerabilities across its product suite. The updates include fixes for cross-site scripting (XSS), authentication bypasses, and authorization flaws…
Discord Unveils New Privacy Feature to Ignore Users Without Knowing Them
Discord has introduced a groundbreaking privacy feature called “Ignore.” This announcement coincides with Safer Internet Day 2025, celebrated globally on February 11, which emphasizes creating a safer and more responsible digital environment. The inclusion of Ignore demonstrates Discord’s recognition of…
IllusionCAPTCHA – A Security Mechanism To Stop AI-Based Breaking CAPTCHA
In the ongoing battle between cybersecurity and AI, researchers have introduced a groundbreaking innovation, IllusionCAPTCHA, a CAPTCHA system that leverages visual illusions to differentiate between human users and AI bots. This novel approach aims to counter the increasing threat of…
USB Army Knife – A Powerful Red Team Tool for Penetration Testers
The USB Army Knife is a versatile red-teaming tool for penetration testers that emulates a USB Ethernet adapter for traffic capture, enables custom attack interfaces, and functions as covert storage all in one compact device. This multi-functional firmware combines a…
SouthKorea Spy Agency Says DeepSeek Excessively Collects Personal Data
SEOUL, South Korea’s National Intelligence Service (NIS) has raised concerns over the Chinese AI app DeepSeek, accusing it of “excessively” collecting personal data and posing national security risks. The NIS issued an advisory urging government agencies to adopt stringent security…
FinStealer Malware Attacking Leading Indian Bank’s Mobile Users To Steal Login Credentials
A sophisticated malware campaign dubbed “FinStealer” is actively targeting customers of a leading Indian bank through fraudulent mobile applications. The malware, identified as Trojan.rewardsteal/joxpk, employs advanced tactics to steal banking credentials and personal information from unsuspecting users. The malicious campaign…
Progress LoadMaster Security Vulnerability let Attackers Execute Arbitrary System Commands
Progress has disclosed multiple critical security vulnerabilities affecting its LoadMaster product line, including the Multi-Tenant (MT) hypervisor. These vulnerabilities, identified as CVE-2024-56131, CVE-2024-56132, CVE-2024-56133, CVE-2024-56134, and CVE-2024-56135, allow attackers to execute arbitrary system commands or access sensitive files. While no…
Akira Ransomware Leads The Number of Ransomware Attacks For January 2025
January 2025 marked a significant month in the ransomware landscape, with Akira emerging as the leading threat. According to recent reports, Akira was responsible for 72 attacks globally, highlighting its rapid rise in prominence. This surge in activity is part…
Alabama Man Pleaded Guilty for Hacking U.S. Securities and Exchange Commission X Account
Eric Council Jr., a 25-year-old from Athens, Alabama, pleaded guilty on February 10, 2025, to charges stemming from the January 2024 hacking of the U.S. Securities and Exchange Commission’s (SEC) social media account on X (formerly Twitter). The breach involved…
Researchers Unveiled Tactics, Techniques, and Procedures Used by North Korean Hackers
Researchers have shed light recently on the sophisticated tactics, techniques, and procedures (TTPs) employed by North Korean hackers. This comprehensive analysis, spanning nearly three years, focuses on targeted digital threats against civil society organizations (CSOs) in South Korea. The research…
Ubuntu Printing Vulnerability Let Attackers Execute Arbitrary Code on Locked Laptops
A recently discovered vulnerability in Ubuntu 22.04’s printing subsystem, specifically within the “ippusbxd” package, could have allowed attackers to execute arbitrary code on locked laptops. However, modern compiler features stepped in to mitigate the risk, preventing exploitation beyond a system…
Apple 0-Day Vulnerability Exploited in “Extremely Sophisticated” Attacks in the Wild
Apple has rolled out iOS 18.3.1 and iPadOS 18.3.1, addressing a Zero-day vulnerability exploited in targeted extremely sophisticated attacks by taking advantage of disabling the USB-restricted mode. Apple’s USB Restricted Mode is a security feature that prevents unauthorized access to data…
8Base Ransomware Dark Web Site Seized, Four Operators Arrested
In a significant breakthrough against global cybercrime, Thai authorities announced today the arrest of four European nationals linked to the notorious 8Base ransomware group. The operation, codenamed “Phobos Aetor,” culminated in the seizure of the group’s dark web infrastructure and…
12K+ KerioControl Firewall Instances Vulnerable to 1-Click RCE Exploit
A critical security vulnerability, CVE-2024-52875, has been identified in GFI KerioControl firewalls, affecting versions 9.2.5 through 9.4.5. This flaw, which can be exploited for remote code execution (RCE), has already drawn significant attention from cybercriminals, with thousands of unpatched systems…
Microsoft SharePoint Connector Vulnerability Let Attackers Steal User’s Credentials
A critical server-side request forgery (SSRF) vulnerability in Microsoft Power Platform’s SharePoint connector allowed attackers to harvest user credentials and impersonate victims across multiple services, including Power Apps, Power Automate, Copilot Studio, and Copilot 365. The patched flaw posed severe…
NetSupport RAT Grant Attackers Full Access To Victims Systems
Cybersecurity experts have observed a significant increase in the use of the NetSupport Remote Access Trojan (RAT) in recent months, a malicious tool that allows attackers to gain full control over compromised systems. This surge in activity has been linked…
Quishing via QR Codes Emerging As a Top Attack Vector Used by Hackers
QR codes have become an integral part of our digital lives, offering quick access to websites, services, and even payment systems. However, their widespread use has also made them a prime target for scammers. A new threat, known as “quishing,”…
LLM Hijackers Gained Stolen Access to DeepSeek-V3 Model Very Next Day After Release
With the release of DeepSeek-V3 on December 25, 2024, the number of LLMjacking attacks in the cybersecurity space has significantly increased. Within hours of its launch, malicious actors had compromised the model, integrating it into OpenAI Reverse Proxy (ORP) systems…
1M+ Malware Samples Analysis Reveal Application Layer Abused for Stealthy C2
A recent analysis of over 1 million malware samples unveiled a trend where adversaries increasingly exploit the Application Layer of the Open System Interconnection (OSI) model to conduct stealthy Command-and-Control (C2) operations. By leveraging trusted Application Layer Protocols, attackers are…
GitHub Copilot’s New Agent Mode Let Developers Autonomously Complete Coding Tasks
GitHub has unveiled a groundbreaking update to its AI-powered coding assistant, GitHub Copilot, with the introduction of Agent Mode. This new feature, available in preview for Visual Studio Code (VS Code) Insiders, empowers developers to autonomously complete complex coding tasks…
Cisco Hacked – Ransomware Group Allegedly Breach Internal Network & Gained AD Access
Cisco has reportedly fallen victim to a significant data breach, with sensitive credentials from its internal network and domain infrastructure leaked online. The breach is allegedly linked to the Kraken ransomware group, which has published a dataset on its dark…
Seven Years Old Linux Kernel Vulnerability Let Attackers Execute Remote Code
Researchers have uncovered a critical flaw in the Linux kernel that could allow attackers to execute remote code. The vulnerability, which had been inactive for seven years, was uncovered while conducting routine research on the Linux kernel’s TCP subsystem. This…
Penetration Testers Arrested by Police During Authorized Physical Penetration Testing
A routine physical penetration test conducted by cybersecurity professionals took an unexpected turn when armed police arrested two security experts during a simulated breach at a corporate office in Malta. The incident involving miscommunication between the client and local authorities…
Ransomware Payments Dropped By 35%, As Victims Refusing To Pay
In a significant shift in the ransomware landscape, payments to attackers have decreased by approximately 35% year-over-year. This decline is attributed to increased law enforcement actions, improved international collaboration, and a growing trend among victims to refuse ransom demands. Here…
World’s Longest and Strongest WiFi Passwords From 31m Passwords List
A cybersecurity enthusiast discovered the longest and most complicated passwords ever used by searching through a huge dataset of 31 million likely WPA WiFi passwords. Typically, a password’s length and complexity directly affect its security. While diverse character sets prevent…
New ‘BYOTB’ Attack Exploits Trusted Binaries to Evade Detection, Researchers Reveal
Security researcher David Kennedy unveiled a novel attack technique known as “BYOTB” (Bring Your Own Trusted Binary) in a recent presentation at BSides London 2024, which leverages trusted binaries to bypass security measures and evade detection. This approach exploits the…
GhidrAssist Brings AI Features to Ghidra in Reverse Engineering
Reverse engineering has long been a challenging yet essential process for cybersecurity professionals, software analysts, and researchers. With the introduction of GhidrAssist, a cutting-edge plugin for the popular reverse engineering platform Ghidra, the process becomes significantly more streamlined and efficient. …
SAML Bypass Authentication on GitHub Enterprise Servers To Login as Other User Account
A significant vulnerability has been identified in GitHub Enterprise Servers, allowing attackers to bypass SAML authentication and log in as other user accounts. This exploit leverages quirks in the libxml2 library, specifically related to XML entities, to deceive the verification…
PoC Exploit Released for AnyDesk Vulnerability Exploited to Gain Admin Access Via Wallpapers
A recently disclosed vulnerability in AnyDesk, a popular remote desktop software, identified as CVE-2024-12754, enables local attackers to exploit the handling of Windows background images to gain unauthorized access to sensitive system files. This could potentially escalate their privileges to…
Hackers Exploiting Google Tag Manager To Steal Credit Card From eCommerce Sites
Hackers have been exploiting Google Tag Manager (GTM) to steal sensitive credit card information from eCommerce sites, particularly those built on the Magento platform. This sophisticated attack shows the evolving tactics of cybercriminals in leveraging legitimate tools for malicious purposes.…
Linux Kernel 6.14 Released – What’s New With rc2!
Linus Torvalds announced the release of Linux Kernel 6.14-rc2, the second release candidate in the 6.14 series. The release follows the usual weekly schedule and comes as a relatively small update, consistent with the overall size of the 6.14 kernel.…
Unpatched Marvel Game RCE Exploit Could Let Hackers Take Over PCs & PS5s
A critical security vulnerability has been discovered in the popular online game Marvel Rivals, raising alarms about the potential for hackers to exploit unsuspecting players. The exploit, identified as a Remote Code Execution (RCE) vulnerability, allows attackers on the same…
Massive Brute Force Attack Targets VPN & Firewall Logins Using 2.8 Million IPs
A global brute force attack campaign leveraging 2.8 million IP addresses actively targets edge security devices, including VPNs, firewalls, and gateways from vendors such as Palo Alto Networks, Ivanti, and SonicWall. The attack, first detected in January 2025, has been…
Cybersecurity Weekly Brief: Latest on Attacks, Vulnerabilities, & Data Breaches
Welcome to this week’s Cybersecurity Newsletter, which provides the latest updates and key insights from the ever-evolving field of cybersecurity. In the current fast-paced digital landscape, it is essential to remain informed. Our objective is to deliver the most pertinent…
10 Best UTM (Unified Threat Management) Firewalls – 2025
Unified Threat Management (UTM) firewall is a comprehensive cybersecurity solution that integrates multiple security functions into a single platform or appliance. It is designed to simplify security management, reduce costs, and provide robust protection against a variety of cyber threats. UTM solutions are especially popular among…
Hackers Compromising IIS Servers to Deploy BadIIS Malware
A widespread campaign targeting Microsoft Internet Information Services (IIS) servers to deploy the BadIIS malware, a tool used for search engine optimization (SEO) fraud and malicious content injection. The campaign, attributed to the Chinese-speaking hacking group DragonRank, has affected over…
CISA Warns of Trimble Cityworks RCE Vulnerability Exploited to Hack IIS Servers
The CISA has issued a warning regarding a critical remote code execution (RCE) vulnerability affecting Trimble Cityworks, a popular software solution for local government and public works asset management. The vulnerability, identified as CVE-2025-0994, allows an external actor to exploit…
HPE Alerts Employees of Data Breach After Russian Cyberattack on Office 365
Hewlett Packard Enterprise (HPE) has disclosed a significant data breach involving its Office 365 email environment, attributed to the Russian state-sponsored hacking group known as Midnight Blizzard, also referred to as Cozy Bear or APT29. The breach, which began in…
Meta Trained Its Llama AI Models Using 81.7 TB of Books Stolen From Torrent Shadow Libraries
Meta Platforms, Inc. is facing serious allegations in a copyright infringement lawsuit, with plaintiffs claiming the tech giant used 81.7 terabytes of pirated books from shadow libraries to train its Llama AI models. The lawsuit, filed in the U.S. District…
Hackers Attacking Web Login Pages of Popular Firewalls for Brute-Force Attacks
In recent weeks, ShadowServer has observed a significant rise in brute-force attacks targeting web login pages of edge devices, with honeypot data revealing up to 2.8 million IPs involved daily. These attacks, primarily originating from Brazil, are aimed at devices…
New Facebook Fake Copyright Notices Phishing Steals Your FB Credentials
A recent phishing campaign has been targeting Facebook users with fake copyright infringement notices, aiming to steal their login credentials. This sophisticated scam has been sent to over 12,279 email addresses, primarily affecting enterprises across the EU, US, and Australia.…
New Attack Technique Uncovered Abusing Kerberos Delegation in Active Directory Networks
A new attack vector exploiting vulnerabilities in Kerberos delegation within Active Directory (AD) networks has been uncovered, posing significant risks to enterprise security. This technique leverages the inherent weaknesses of Unconstrained Kerberos Delegation, a legacy feature that allows services to…
Microsoft Edge Vulnerabilities Let Attackers Execute Remote Code – Update Now!
Microsoft has released a critical security update for its Edge browser, addressing multiple vulnerabilities that could allow attackers to execute remote code and compromise user systems. Users are strongly urged to update their browsers immediately to mitigate potential risks. Four…
Developers Beware! Malicious ML Models Detected on Hugging Face Platform
In a concerning development for the machine learning community, researchers at ReversingLabs have identified malicious models on the popular Hugging Face platform. These models exploit vulnerabilities in the Pickle file serialization format, a widely used method for storing and sharing…
HPE Aruba Networking ClearPass Policy Manager Vulnerabilities Allow Arbitrary Code Execution
Hewlett Packard Enterprise (HPE) has disclosed multiple critical vulnerabilities in its Aruba Networking ClearPass Policy Manager (CPPM), a widely used network access control solution. These flaws, if exploited, could lead to arbitrary code execution, privilege escalation, and sensitive data exposure.…
DeepSeek iOS App Sending Data Unencrypted to ByteDance Controlled Server
Critical vulnerabilities have been disclosed in the DeepSeek iOS app, raising concerns over privacy and national security risks. The app, which has been the top iOS download since January 25, 2025, transmits sensitive user data unencrypted to servers controlled by…
Dell Update Manager Plugin Vulnerability Let Hackers Access Sensitive Data
Dell Technologies has issued a security update addressing a vulnerability in its Update Manager Plugin (UMP), which could allow attackers to exploit sensitive data through improper neutralization of HTML tags in web pages. This vulnerability, identified as CVE-2025-22402, has been…
Ex-Google Engineer Charged for Stealing AI Secrets to China
In a groundbreaking case highlighting the intersection of technology and national security, a federal grand jury has indicted Linwei Ding, also known as Leon Ding, on four counts of theft of trade secrets. The charges allege that Ding, a former…
Logsign Vulnerability Remote Attackers to Bypass Authentication
A severe security vulnerability identified as CVE-2025-1044 has been disclosed in the Logsign Unified SecOps Platform, a widely used software for security operations. This flaw, rated with a CVSS score of 9.8, poses a critical threat, allowing remote attackers to…
Hackers Exploiting DeepSeek & Qwen AI Models To Develop Malware
Hackers have begun leveraging the capabilities of DeepSeek and Qwen AI models to create sophisticated malware. These models, known for their advanced language processing capabilities, have attracted the attention of cybercriminals due to their potential for generating malicious content with…
Hackers Exploited 3,000+ ASP.NET Keys To Execute Code on IIS Server Remotely
A recent security incident has revealed that over 3,000 publicly disclosed ASP.NET machine keys were exploited by hackers to execute remote code on IIS servers. This attack utilized ViewState code injection techniques, allowing malicious actors to gain unauthorized access and…
Splunk Unveils a New AI Based Honeypot “DECEIVE” to Log Attacker Activities
Splunk, a leader in data analytics and cybersecurity solutions, has introduced a groundbreaking proof-of-concept honeypot system named DECEIVE (DECeption with Evaluative Integrated Validation Engine). This AI-powered tool is designed to simulate high-interaction systems with minimal setup effort, offering organizations an…
7-Zip Vulnerability Actively Exploited in The Wild in Attacks – CISA Adds Its Catalog
A critical vulnerability in the popular file archiving tool 7-Zip (CVE-2025-0411) has been actively exploited in the wild, primarily targeting Ukrainian organizations, added to CISA’s known exploited vulnerability database. This flaw allows attackers to bypass Windows’ Mark-of-the-Web (MoTW) security feature,…
Critical Microsoft Outlook Vulnerability (CVE-2024-21413) Actively Exploited in Attacks – CISA Warns
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning to federal agencies regarding active exploitation of a critical Microsoft Outlook vulnerability, tracked as CVE-2024-21413. This remote code execution (RCE) flaw, discovered by Check Point researcher Haifei…
Ghidra 11.3 Released – NSA’s Powerful Reverse Engineering Tool
The National Security Agency (NSA) has launched Ghidra 11.3, the latest version of its open-source software reverse engineering (SRE) framework. The National Security Agency (NSA) has developed Ghidra, a cutting-edge Software Reverse Engineering (SRE) framework designed to analyze compiled code…
3 Best Ways to Speed Up Alert Triage for SOC Team – Use Cases
Security analysts know the struggle: endless alerts, repetitive tasks, and not enough hours in the day. The volume of potential threats can be overwhelming, making efficient alert triage crucial for any Security Operations Center (SOC). The great news is that…
Threat Actors Offer You Free Google Play, Amazon Gift Card From 100s of Malicious Domains to Steal Data
Cybersecurity researchers at Palo Alto have recently uncovered a large-scale gift card scam campaign involving 276 stockpiled domains. The scam targets users by advertising free or discounted gift cards for popular services such as Google Play, Amazon, and Roblox, luring…
Hail and Rapper Botnet is the Mastermind Behind the DeepSeek Cyberattack
Less than a month after its groundbreaking launch, Chinese artificial intelligence company DeepSeek has found itself at the center of a cybersecurity storm. The company, which debuted its first AI model, DeepSeek-R1, on January 20, 2025, has been grappling with…
Hackers Exploiting ScreenConnect RMM Tool to Establish Persistence
Threat actors have been leveraging the legitimate Remote Monitoring and Management (RMM) tool, ScreenConnect, to establish persistence in their cyberattacks. This trend shows the evolving tactics of hackers who exploit trusted software to gain unauthorized access to systems. ScreenConnect, now…
OpenAI Data Breach: Threat Actor Allegedly Claims 20 Million Logins for Sale
A threat actor has allegedly obtained the login information for 20 million OpenAI accounts, including passwords and email addresses. This claim was made on an underground forum, where the actor provided a sample of the data and offered the full…
Beware of Nova Stealer Malware Sold for $50 on Hacking Forums
A recent cybersecurity threat has emerged in the form of the Nova Stealer malware, a fork of the popular SnakeLogger stealer. This malware is being marketed on hacking forums under a Malware-as-a-Service (MaaS) model, making it accessible to a wide…
WhatsApp Zero-Click Paragon Spyware Terminates Contract with Italy
Israeli spyware company Paragon Solutions has terminated its contract with Italy following allegations that its military-grade surveillance software, Graphite, was misused to target journalists and civil society members. The decision comes less than a week after WhatsApp revealed that the…
Flesh Stealer Malware Targets Chrome, Firefox, and Edge to Steal Passwords
Flesh Stealer has surfaced as a high-profile malware campaign targeting web browsers like Chrome, Firefox, Edge, and even messaging platforms like Signal and Telegram. Written in C# as a .NET executable, Flesh Stealer emerged in August 2024 and has been…
XE Hacker Group Exploiting Veracode 0-Days To Deploy Malware & Steal Credit Card Details
The XE Group, a sophisticated cybercriminal organization active since at least 2013, has recently been involved in exploiting zero-day vulnerabilities to deploy malware and steal sensitive information. Initially known for credit card skimming and password theft, the group has shifted…
F5 BIG-IP SNMP Vulnerability Let Attackers Trigger DoS Attack on System
A recently disclosed vulnerability in F5’s BIG-IP system has raised significant security concerns. Identified as CVE-2025-21091, this flaw allows remote, unauthenticated attackers to trigger a Denial-of-Service (DoS) attack by exploiting the Simple Network Management Protocol (SNMP) when SNMP v1 or…
Weaponized SVG Files With Google Drive Links Attacking Gmail, Outlook & Dropbox Users
Cybercriminals have escalated their phishing tactics by leveraging Scalable Vector Graphics (SVG) files to bypass traditional anti-phishing and anti-spam defenses. These attacks, which first became widespread late last year, have increased dramatically since January 2025, exploiting the unique properties of…
DeepSeek’s Exposes Full System Prompt in New Jailbreak Method
A major security vulnerability in DeepSeek, the breakthrough Chinese AI model, has been uncovered by researchers, exposing the platform’s entire system prompt through a sophisticated jailbreak technique. This discovery has raised serious concerns about AI security and model training transparency.…
MobSF Framework Zero-day Vulnerability Let Attackers Trigger Dos in Scans Results
A zero-day vulnerability has been discovered in the Mobile Security Framework (MobSF), an automated platform for mobile application penetration testing, malware analysis, and security assessments. The flaw, identified as a Partial Denial of Service (DoS) vulnerability, affects the Scans Results…
Multiple Vulnerabilities in Cisco SNMP for IOS Software Let Attackers Trigger DoS Attack
Cisco has disclosed multiple high-severity vulnerabilities in the Simple Network Management Protocol (SNMP) subsystem of its IOS, IOS XE, and IOS XR software. These vulnerabilities could allow authenticated, remote attackers to trigger a Denial of Service (DoS) condition on affected…
North Korean Hackers Use Custom-Made RDP Wrapper To Activate Remote Desktop on Hacked Machines
Cybersecurity experts have uncovered a sophisticated campaign by North Korea’s Kimsuky group, employing a custom-built RDP Wrapper to gain unauthorized access to compromised machines. This marks another alarming evolution in the group’s cyber-espionage tactics, targeting organizations globally. The Kimsuky group,…
Beware of Lazarus LinkedIn Recruiting Scam Targeting Org’s To Deliver Malware
The North Korea-linked Lazarus Group (aka APT 38) has been targeting organizations through a LinkedIn recruiting scam. Through this scam threat actors behind Lazarus Group aim to capture the credentials and deliver malware. This malicious operation exploits the trust in…
Ubuntu is Now Available on New Windows Subsystem for Linux Distribution Architecture
Canonical, the company behind Ubuntu, has announced that Ubuntu is now available on Microsoft’s new tar-based distribution architecture for Windows Subsystem for Linux (WSL). This development marks a significant shift in how Linux distributions can be deployed and managed within…
Weaponizing Windows Background Images to Gain Admin Access Using AnyDesk Vulnerability
A recently disclosed vulnerability in AnyDesk, a widely used remote desktop software, has raised significant cybersecurity concerns. The vulnerability identified by CVE-2024-12754 and tracked by ZDI-24-1711 allows local attackers to exploit the handling of Windows background images to gain unauthorized…
Password Stealing Malware Attacking macOS Users Increasing Rapidly
In recent months, macOS users have faced a significant rise in password-stealing malware attacks. These threats, often distributed through malicious advertising and fake application installers, have become increasingly sophisticated. Three prominent malware types, “Atomic Stealer,” “Poseidon Stealer,” and “Cthulhu Stealer”…
Critical Cisco ISE Vulnerabilities Allow Arbitrary Command Execution Remotely
Cisco has disclosed two critical vulnerabilities in its Identity Services Engine (ISE) software that could allow authenticated, remote attackers to execute arbitrary commands, elevate privileges, and manipulate system configurations on affected devices. These vulnerabilities tracked as CVE-2025-20124 and CVE-2025-20125, have…