Palo Alto Networks has disclosed a medium-severity vulnerability (CVE-2025-0127) in its PAN-OS software, enabling authenticated administrators on VM-Series firewalls to execute arbitrary commands with root privileges. The flaw, discovered internally, affects specific legacy PAN-OS versions and requires immediate patching for impacted users.…
Tag: GBHackers Security | #1 Globally Trusted Cyber Security News Platform
OpenSSH 10.0 Released: New Protocol Changes and Key Security Improvements
The OpenSSH team has announced the release of OpenSSH 10.0 on April 9, marking an important milestone for one of the most widely-used open-source tools in secure communications. With significant protocol changes, security advancements, and new features, this version aims to provide…
Researchers Uncover Hacking Tools and Techniques Shared on Russian-Speaking Cybercrime Forums
Trend Micro, a cybersecurity firm, has released its 50th installment report on the Russian-speaking cybercriminal underground, revealing the intricate web of tools, techniques, and cultural elements defining this notorious cybercrime ecosystem. The report highlights the sophistication and resilience of this…
Russian APT Hackers Use Device Code Phishing Technique to Bypass MFA
Russian state-backed advanced persistent threat (APT) group Storm-2372 has exploited device code phishing to bypass multi-factor authentication (MFA) and infiltrate high-value targets across governments, NGOs, and critical industries. Since August 2024, this group has weaponized the OAuth device authorization flow—a…
SideCopy APT Hackers Impersonate Government Officials to Deploy Open-Source XenoRAT Tool
The Pakistan-linked Advanced Persistent Threat (APT) group known as SideCopy has significantly expanded its targeting scope since late December 2024. Initially, the group focused on infiltrating India’s government, defense, maritime sectors, and university students. Recent developments indicate an inclusion of…
Scattered Spider Launches Sophisticated Attacks to Steal Login Credentials and MFA Tokens
The cyber threat landscape has witnessed remarkable adaptation from the notorious hacker collective known as Scattered Spider. Active since at least 2022, this group has been consistently refining its strategies for system compromise, data exfiltration, and identity theft. Silent Push…
Threat Actors Exploit Messaging Services as Lucrative Cybercrime Platforms
Threat actors are exploiting weaknesses in SMS verification systems to generate massive, fraudulent message traffic, costing businesses millions. This type of fraud involves artificially triggering SMS verification requests by creating numerous synthetic identities or using automated bots, thereby inflating the…
North Korean Hackers Use Social Engineering and Python Scripts to Execute Stealthy Commands
North Korean threat actors have demonstrated their adept use of social engineering techniques combined with Python scripting to infiltrate secure networks. The Democratic People’s Republic of Korea (DPRK) operatives are leveraging the accessibility and power of Python to craft initial…
New Mirai Botnet Variant Exploits TVT DVRs to Gain Admin Control
GreyNoise has noted a sharp escalation in hacking attempts targeting TVT NVMS9000 Digital Video Recorders (DVRs). The surge in malicious activity, peaking on April 3, 2025, with over 2,500 unique IP addresses, suggests a new variant of the notorious Mirai…
HollowQuill Malware Targets Government Agencies Globally Through Weaponized PDF Documents
In a disturbing escalation of cyber threats, a new malware campaign dubbed ‘HollowQuill’ has been identified targeting academic institutions and government agencies worldwide. This sophisticated attack leverages weaponized PDF documents to infiltrate systems, using a combination of social engineering and…
Windows Kerberos Vulnerability Enables Security Feature Bypass
Microsoft has disclosed a new security vulnerability in Windows operating systems, tracked as CVE-2025-29809. This flaw, classified with Important severity, impacts the Kerberos authentication protocol, potentially enabling attackers to bypass critical security features. The vulnerability stems from weaknesses described under CWE-922: Insecure Storage of…
CISA Alerts on Active Exploitation of CentreStack Hard-Coded Key Vulnerability
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert highlighting a critical vulnerability in Gladinet CentreStack, a cloud-based enterprise file-sharing platform. The issue, tracked as CVE-2025-30406, involves the use of a hard-coded cryptographic key that could enable attackers to…
Hellcat Ransomware Upgrades Arsenal to Target Government, Education, and Energy Sectors
The cybersecurity community has raised alarms over the rapid evolution of the Hellcat ransomware group, which has escalated its tactics to target critical sectors. Hellcat, which emerged in mid-2024, now employs a sophisticated blend of psychological manipulation, zero-day vulnerabilities, and…
Ransomware Groups Target Organizations to Exfiltrate Data and Blackmail via Leak Site Posts
Ransomware attacks have continued their relentless assault on organizations worldwide, with a focus on data exfiltration and subsequent blackmail through leak site posts. Rapid7 Labs’ analysis of internal and public data provides insights into the evolving landscape of ransomware threats.…
Ransomware Group Actively Exploits Windows CLFS Zero-Day Vulnerability
Microsoft has uncovered a sophisticated ransomware campaign exploiting a zero-day vulnerability in the Windows Common Log File System (CLFS), tracked as CVE-2025-29824. The vulnerability allows attackers to escalate privileges from a standard user account to SYSTEM level, enabling widespread deployment…
CISA Issues Alert on Active Exploits of Windows CLFS Vulnerability
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert regarding active exploitation of a critical vulnerability in the Microsoft Windows Common Log File System (CLFS) Driver. The vulnerability, tracked as CVE-2025-29824, poses a significant security risk by allowing…
NCSC Issues Alert on MOONSHINE and BADBAZAAR Mobile Malware
GCHQ’s National Cyber Security Centre (NCSC), in collaboration with international and industry partners, has issued a global alert regarding two dangerous spyware applications – MOONSHINE and BADBAZAAR – aiming to help vulnerable communities protect themselves from digital surveillance. The NCSC…
Apache mod_auth_openidc Flaw Lets Unauthenticated Users Access Protected Data
A critical flaw in Apache mod_auth_openidc (versions ≤2.4.16.10) allows unauthenticated attackers to bypass authentication and access protected resources. The bug, CVE-2025-31492, patched in version 2.4.16.11, affects systems using OIDCProviderAuthRequestMethod POST without an application-level gateway or load balancer. Technical Breakdown The vulnerability stems from improper…
Windows CLFS 0-Day Vulnerability Exploited in the Wild
Microsoft has disclosed an active exploitation of a zero-day vulnerability in the Windows Common Log File System (CLFS) driver, tracked as CVE-2025-29824. The flaw, classified as an Elevation of Privilege (EoP) vulnerability, has been assigned a CVSS score of 7.8, indicating its significant security…
Chrome Use-After-Free Vulnerability Enables Remote Code Attacks
Google has rolled out a critical update for its Chrome browser, addressing a high-severity vulnerability that could allow remote code execution. The flaw, identified as CVE-2025-3066, targets Chrome’s Site Isolation feature, underscoring the importance of regular browser updates in protecting…