Blahalla

Lazarus Lures Developers With Backdoored Coding Tests

gbhackers.com · 3 months ago

A DPRK-linked subgroup called HexagonalRodent uses AI-assisted malware and backdoored coding challenges masquerading as recruiter-led skills assessments to target Web3 developers and harvest credentials and wallet data. From January 1 to March 31, 2026, the group exfiltrated public keys for 26,584 cryptocurrency wallets from 2,726 infected developer systems, with the exfiltrated wallets containing up to twelve million dollars in crypto and at least some funds traced to a DPRK-controlled Ethereum address. The campaign deploys modular toolsets including BeaverTail, OtterCookie, and InvisibleFerret, leverages generative AI to build fake companies and craft lures, and distributes backdoored code via GitHub repositories and front company sites. Recommendations include verifying recruiter identities, auditing and sandboxing untrusted code, and segregating development environments to reduce the risk of credential and wallet theft.

Apple Fixes iOS Flaw That Let FBI Recover Deleted Signal Messages

thehackernews.com · 3 months ago

Apple rolled out a software update for iOS and iPadOS to fix a Notification Services flaw that could cause notifications marked for deletion to be retained on devices. The issue, tracked as CVE-2026-28950, was described as a logging problem and has been addressed through improved data redaction. Users are urged to install the update promptly to ensure deleted notifications are removed and to protect potentially sensitive information.

Recent Microsoft Defender Vulnerability Exploited as Zero-Day

www.securityweek.com · 3 months ago

A recently disclosed Microsoft Defender privilege escalation vulnerability is being exploited in the wild as a zero-day, allowing low-privileged attackers to gain System privileges by accessing the SAM database and extracting NTLM hashes. The flaw is tracked as CVE-2026-33825 with a CVSS score of 7.8, was publicly disclosed on April 2 by a researcher who published proof-of-concept code named BlueHammer, and was patched by Microsoft on April 14. Attackers have used published techniques labeled BlueHammer, RedSun, and UnDefend to suspend Defender, trigger signature updates or overwrite system files, stage binaries from user-writable folders, and escalate privileges, and the US CISA added the CVE to its Known Exploited Vulnerabilities catalog urging agencies to patch by May 6.

Xinference PyPI Breach Exposes Developers to Cloud Credential Theft

gbhackers.com · 3 months ago

A severe supply chain attack compromised the Xinference Python package on PyPI by pushing malicious versions that embed a heavily obfuscated infostealer which executes on import after a base64 payload was inserted into the package initialization file. The infostealer searches developer machines for cloud infrastructure configurations for AWS Google Cloud and Kubernetes system environment variables private SSH keys SSL certificates developer API keys shell history database credentials cryptocurrency wallets and service credentials and then compresses and exfiltrates the data to a remote command and control server. Malicious versions are 2.6.0 2.6.1 and 2.6.2 while the latest safe PyPI version is 2.5.0. Immediate remediation actions include downgrading to version 2.5.0 rotating all API keys cloud credentials and database passwords enabling two factor authentication auditing cloud environments CI CD pipelines and version control for unauthorized access and pinning dependencies to verified versions.

Fake Wallpaper App, YouTube Channel Used to Spread notnullOSX Malware

gbhackers.com · 3 months ago

There is a campaign using a fake macOS wallpaper app and a hijacked YouTube channel to deliver notnullOSX, a Go based crypto focused stealer with modular architecture, heavy obfuscation, and backdoor like capabilities. Initial access is achieved via a fake protected Google document that pushes a base64 ClickFix Terminal command or through a malicious DMG containing an Install.sh script, and social engineering is used to obtain Full Disk Access so the implant can access Messages, Notes, Safari data, and more. Operators use an affiliate panel to pre screen targets and only deploy the tool against victims with cryptocurrency holdings above ten thousand US dollars, with modules downloaded from an abused CDN to exfiltrate crypto wallets, browser data, SSH keys, cloud credentials, and to replace hardware wallet management apps to intercept seed phrases. The campaign was first detected on March thirtieth, two thousand twenty six in Vietnam, Taiwan, and Spain, and distribution is amplified by a long lived YouTube channel that links to the fake app download pages.

Africa Relinquishes Cyberattack Lead to Latin America — For Now

www.darkreading.com · 3 months ago

Cyberattack volume against African organizations declined in the first quarter of 2026, averaging about 2,700 attacks per week, a 22 percent drop from nearly 3,500 attacks per week the previous year. Experts attribute the decline to both improved cybersecurity maturity in parts of Africa and a shift in attacker focus to other regions, with Latin America overtaking Africa as the riskiest region and experiencing about 3,050 weekly attacks. Country trends vary, with Kenya and Morocco seeing drops of more than half, Ethiopia seeing a 29 percent increase, and Nigeria remaining the most targeted in 2025 at about 4,200 weekly attacks though it saw a 12 percent decline in March. While exploitation of vulnerabilities and distributed denial of service attacks fell, on device threats remain high in Africa with roughly 41 percent of machines affected, and ransomware continues to be concentrated in North America rather than Africa.

Fake TradingView AI Site Spreads Needle Stealer Through Phony TradingClaw App

gbhackers.com · 3 months ago

A fake TradingView AI agent website is delivering Needle Stealer malware through a bogus TradingClaw assistant that hijacks browsers, drains financial accounts, steals login sessions and wallet data, and enables follow on attacks. The campaign uses a Windows installer loader that injects a second stage DLL into trusted processes to evade detection, employs a browser extension module to control and inject scripts into web pages, and includes desktop and browser wallet spoofers targeting Ledger, Trezor, Exodus, MetaMask and Coinbase Wallet. Traders should download tools only from official vendor domains or verified TradingView integrations, block known malicious domains, monitor for DLL sideloading and unauthorized browser extensions, use robust endpoint protections and hardened multi factor authentication, and if compromised disconnect, run full scans, revoke sessions and move crypto funds to new wallets generated on uncompromised hardware.

Checkmarx KICS Docker Repo Hijacked in Malicious Code Injection Attack

gbhackers.com · 3 months ago

A significant software supply chain attack targeted the Checkmarx KICS Docker Hub repository, involving trojanized Docker images and compromised VS Code extensions. Attackers infiltrated the repository, pushing malicious images and introducing a fake version tag. The malware harvests sensitive developer credentials and cloud infrastructure secrets, exfiltrating them to a malicious telemetry endpoint. The threat group TeamPCP, previously linked to attacks on Trivy and LiteLLM, has claimed responsibility.

LLM Security Automation Isn’t a Drop-In Scanner Yet

lirantal.com · 3 months ago

Using large language models as standalone security scanners for code presents challenges. Current systems experience inconsistent results, false positives, high latency, and unpredictable costs. It's recommended to use these models as supplemental tools offering hypotheses, not as replacements for established security practices and human oversight. Focusing on metrics like drift score and proof latency, along with versioning models and prompts, can help ensure valuable and sustainable integration.

Apple Patches Privacy Issue Exposing Signal Message Data Through Notifications

gbhackers.com · 3 months ago

Apple has released iOS and iPadOS updates, version 26.4.2, to fix a critical privacy vulnerability. The flaw, identified as CVE-2026-28950, allowed sensitive message data from secure applications like Signal to be improperly stored on devices. Notifications marked for deletion were unexpectedly retained in system logs, potentially exposing private conversations to unauthorized access. The update improves data redaction, ensuring notification text is permanently wiped upon dismissal.

Tropic Trooper Uses Custom Beacon and VS Code Tunnels for Stealthy Remote Access

gbhackers.com · 3 months ago

A cyber campaign attributed to the Tropic Trooper group is targeting individuals in Taiwan, South Korea, and Japan. Attackers are using a trojanized SumatraPDF reader to deploy an AdaptixC2 Beacon agent in memory, and a modified TOSHIS loader to bypass security measures. The campaign leverages GitHub for command and control, using its APIs to communicate with compromised systems and rapidly deleting traces of their activity. Following initial access, victims are often moved to Visual Studio Code tunnels to enable interactive remote access.

Claude Mythos Exposes 271 Zero-Day Security Flaws in Firefox

gbhackers.com · 3 months ago

Mozilla released Firefox 150, addressing 271 zero-day vulnerabilities discovered using Anthropic’s Claude Mythos Preview AI model. This represents a significant shift in cybersecurity, allowing defenders to more rapidly identify and fix vulnerabilities. The AI’s capabilities are comparable to elite human researchers, uncovering complex logic flaws often missed by traditional tools. This technology is helping to level the playing field between attackers and defenders in cybersecurity.

CNAPP – ein Kaufratgeber

www.csoonline.com · 3 months ago

CNAPP stands for Cloud Native Application Protection Platform and combines four cloud security functions: Cloud Infrastructure Entitlement Management, Cloud Workload Protection Platform, Cloud Access Security Broker, and Cloud Security Posture Management. The market reached about 700 million dollars in the second quarter of 2024, driven by integration challenges as enterprises use dozens of technologies and multiple cloud platforms per application. Vendors follow either a DevSecOps focus that protects applications and pipelines or a traditional IT security focus that extends network and posture protections, and no single offering yet fully covers all four core areas while artificial intelligence features are being added to expand coverage and scalability. Buyers should evaluate which cloud artifacts are scanned, how incidents are reported, how comprehensively the four management areas are covered, which DevOps frameworks are supported, and whether pricing and licensing are transparent.

Riddled with flaws, serial-to-Ethernet converters endanger critical infrastructure

www.csoonline.com · 3 months ago

Researchers have identified widespread vulnerabilities in serial-to-Ethernet converters from multiple vendors, potentially endangering critical infrastructure. These devices, used in industrial, retail, and healthcare settings, contain outdated open-source components with over two thousand known vulnerabilities, including three new remote code execution flaws. Attackers could manipulate serial data or compromise connected systems, as demonstrated in past attacks against power substations and wind farms. Firmware updates are available to address the issues, along with recommendations for network segmentation and enhanced access controls.

Claude Mythos signals a new era in AI-driven security, finding 271 flaws in Firefox

www.csoonline.com · 3 months ago

A new AI model, Claude Mythos Preview, has identified 271 vulnerabilities in Mozilla’s Firefox web browser version 148, significantly more than previous AI tools. This discovery highlights AI's expanding role in cybersecurity, potentially shifting the advantage towards defenders by rapidly finding flaws that were previously missed by human reviewers. However, unauthorized access to Mythos underscores the dual-use nature of AI and the need for robust security measures around these powerful tools. Security teams are advised to prioritize continuous validation and rapid remediation of vulnerabilities.

Malicious pgserve, automagik developer tools found in npm registry

www.csoonline.com · 3 months ago

Malicious packages mimicking popular developer tools, pgserve and automagik, have been discovered in the npm registry. These packages steal data, including credentials for AWS, Azure, GCP, crypto coins, and browser passwords, and can spread to other connected computers. The malware utilizes a supply-chain worm mechanism, potentially compromising entire organizations by injecting itself into other packages using stolen npm publish tokens and exfiltrating data to a decentralized Internet Computer Protocol canister. Experts recommend rotating credentials, hardening CI/CD controls, and disabling automatic script execution to mitigate the risk.

Static analysis of PayPal Android app reveals 13 embedded SDKs including Meta SDK and Adobe Analytics inside a payment app

appxpose.app · 3 months ago

A recent privacy scan of the PayPal mobile application revealed concerns regarding data collection practices and permissions. The application utilizes 13 trackers, including analytics and advertising networks, and requests six potentially dangerous permissions such as location, camera, and microphone access. While PayPal maintains strong encryption and fraud protection, the combination of data collection and permissions raises the overall privacy risk to medium. A past security incident in 2015 involved credential exposure, though no major incidents have been reported since 2020.

Smashing Security podcast #464: Rockstar got hacked. The data was junk. The secrets it revealed were not

grahamcluley.com · 3 months ago

A company that ran anonymous tip lines for 35,000 American schools boasted it had suffered zero security breaches in over 20 years but was compromised by a hacker calling themselves Internet Yiff Machine, exposing systems used to report bullying, weapons, and self harm. Rockstar Games was hacked again and while much of the stolen data proved to be junk, leaked files revealed financial information indicating Grand Theft Auto Online generates about half a billion dollars a year while Red Dead Redemption does not. The incidents raise questions about overconfident security claims and the potential harm when systems collecting sensitive reports are breached.

Thousands of Live Secrets Found Across Four Cloud Development Environments

trufflesecurity.com · 3 months ago

A security researcher has uncovered a widespread leak of sensitive information, including API keys and credentials, from popular Cloud Development Environments. Over 8,700 unique secrets were found across CodeSandbox, StackBlitz, CodePen, and JSFiddle, stemming from 22 million projects. The researcher identified a GitHub OAuth token, CVE-2024-2001, granting unauthorized access to a private GitHub repository. The findings underscore a lack of security features in these platforms and highlight the increasing risk of accidental credential exposure.

Microsoft Patch Still Leaves 1,300 SharePoint Servers Exposed

www.techrepublic.com · 3 months ago

Microsoft SharePoint servers remain vulnerable to a spoofing flaw, even after a patch was released. The vulnerability, CVE-2026-32201, impacts SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. More than 1,300 internet-exposed servers are still unpatched, and the flaw was previously exploited as a zero-day. Security experts recommend applying patches, restricting internet exposure, and strengthening monitoring to mitigate the risk.

Apple fixes bug that let the FBI recover deleted Signal messages

www.bleepingcomputer.com · 3 months ago

Apple has released emergency security updates for iPhones and iPads to address a flaw that allowed deleted notification data to remain on devices. The vulnerability, CVE-2026-28950, was fixed in iOS and iPadOS versions 26.4.2 and 18.7.8. This issue reportedly affected data stored in the iPhone's notification storage, even after apps like Signal were deleted. Users are encouraged to update their devices and adjust Signal notification settings to limit data retention.

'The Gentlemen' Rapidly Rises to Ransomware Prominence

www.darkreading.com · 3 months ago

A new ransomware gang, "The Gentlemen," has rapidly gained prominence through a ransomware-as-a-service model, claiming hundreds of victims in a short time. They employ sophisticated tactics, including antivirus killers, complex infection chains, and a proxy malware called SystemBC, which leverages a botnet of over 1,500 victims. The Gentlemen uses Active Directory Group Policy to deploy ransomware across entire networks and has demonstrated a capacity to compromise large organizations, posing a significant threat to government entities, healthcare companies, and manufacturers globally. Their high affiliate payout structure suggests they will remain an attractive option for cybercriminals.

Pack2TheRoot (CVE-2026-41651): Cross-Distro Local Privilege Escalation Vulnerability

github.security.telekom.com · 3 months ago

A high-severity vulnerability, identified as CVE-2026-41651, affects multiple Linux distributions using the PackageKit daemon. This vulnerability allows an unprivileged local user to gain root access by installing or removing system packages without authorization. Versions of PackageKit between 1.0.2 and 1.3.4 are vulnerable, impacting distributions like Ubuntu, Debian, RockyLinux, and Fedora. The vulnerability is fixed in PackageKit release 1.3.5, with patched packages available from April 22, 2026. System logs may indicate a PackageKit assertion failure after exploitation.

New Mirai campaign exploits RCE flaw in EoL D-Link routers

www.bleepingcomputer.com · 3 months ago

A new malware campaign is actively exploiting a command-injection vulnerability in end-of-life D-Link routers. The vulnerability, identified as CVE-2025-29635, allows attackers to execute commands remotely. The campaign uses the Mirai botnet to launch distributed denial-of-service attacks, including TCP SYN, UDP floods, and HTTP null attacks. Attackers are also exploiting CVE-2023-1389 impacting TP-Link routers and a separate flaw in ZTE routers, indicating a consistent attack pattern.

Anthropic’s New Mythos A.I. Model Sets Off Global Alarms

www.nytimes.com · 3 months ago

NULL

Vonage, Girls Who Code Show What ‘Responsible AI’ Looks Like

www.techrepublic.com · 3 months ago

false

Kyber ransomware gang toys with post-quantum encryption on Windows

www.bleepingcomputer.com · 3 months ago

A new ransomware operation called Kyber is targeting Windows systems and VMware ESXi endpoints, with one variant claiming to use post-quantum encryption. Rapid7 researchers discovered two distinct variants deployed by the same affiliate, one designed for VMware ESXi and the other for Windows file servers. While the Windows variant utilizes Kyber1024 and X25519 for key protection, the Linux ESXi variant uses ChaCha8 and RSA-4096, and the claim of post-quantum encryption is inaccurate. The ransomware also employs tactics to hinder data recovery, such as deleting backups and terminating services.

Mozilla Fixes 271 Firefox Bugs Using Anthropic’s Mythos AI

www.techrepublic.com · 3 months ago

Mozilla’s latest Firefox release, version 150, includes patches for 271 security vulnerabilities discovered using Anthropic’s Mythos AI model. This AI assists in identifying weaknesses in software by reasoning through source code, a capability previously limited to human experts. Mozilla’s collaboration with Anthropic, separate from their Project Glasswing program, has accelerated the bug-hunting process and prompted a significant reprioritization of engineering resources within the organization. While the findings initially caused concern, the vulnerabilities appear to be finite and theoretically discoverable by human researchers.

Aging in Place: How Technology Might Help You Grow Old at Home

www.nytimes.com · 3 months ago

false

Microsoft issues out-of-band patch for critical security flaw in update to ASP.NET Core

www.csoonline.com · 3 months ago

Microsoft recently released a patch to address a critical security vulnerability, CVE-2026-40372, impacting the ASP.NET Core Data Protection Library. A flawed calculation in the validation process allows attackers to potentially forge authentication payloads and decrypt sensitive data like cookies and tokens. Developers using ASP.NET Core applications, particularly those utilizing Docker containers or older target frameworks, must rebuild their applications to incorporate the fix and expire existing authentication tokens. Microsoft has compared the severity of this vulnerability to a significant zero-day incident from 2010.

Cisco Integrated Management Controller Cross-Site Scripting Vulnerabilities

sec.cloudapps.cisco.com · 3 months ago

Multiple vulnerabilities in the web based management interface of Cisco Integrated Management Controller could allow a remote attacker to conduct cross site scripting attacks against users of the interface. Cisco has released software updates that address these vulnerabilities and reports that there are no workarounds. Affected vulnerabilities are tracked as CVE-2026-20085, CVE-2026-20087, CVE-2026-20088, CVE-2026-20089, and CVE-2026-20090.

Cisco Integrated Management Controller Command Injection and Remote Code Execution Vulnerabilities

sec.cloudapps.cisco.com · 3 months ago

Multiple vulnerabilities in the web based management interface of Cisco Integrated Management Controller could allow an authenticated remote attacker to execute arbitrary code or commands on the underlying operating system and elevate privileges to root. Cisco has released software updates that address these vulnerabilities and there are no workarounds available. The security impact rating is High and the issues are tracked as CVE-2026-20094, CVE-2026-20095, CVE-2026-20096, and CVE-2026-20097.

Crypto Entrepreneur Justin Sun Sues Trump Family’s World Liberty Financial, Accusing It of Fraud

www.nytimes.com · 3 months ago

false

Malicious KICS Docker Images and VS Code Extensions Hit Checkmarx Supply Chain

thehackernews.com · 3 months ago

Cybersecurity researchers have identified malicious Docker images pushed to the official checkmarx/kics repository on Docker Hub. These images contained modified binaries capable of collecting and exfiltrating data, potentially exposing sensitive information like credentials. Related Checkmarx Visual Studio Code extensions also contained malicious code to download and execute remote addons. The Docker repository has been archived and organizations should consider any secrets exposed during scans as potentially compromised.

Fake Google Antigravity Installer Can Steal Accounts in Minutes

www.techrepublic.com · 3 months ago

A malicious campaign is distributing a trojanized installer for Google Antigravity, disguised as a legitimate download. The installer bundles the real application with a hidden script that connects to attacker-controlled servers, potentially stealing browser sessions, saved credentials, and cryptocurrency wallet data. Attackers can rapidly take over user accounts by reusing active sessions, bypassing passwords and multi-factor authentication. Security experts recommend verifying download sources and reviewing account activity.

Self-Propagating Supply Chain Worm Hijacks npm Packages to Steal Developer Tokens

thehackernews.com · 3 months ago

Cybersecurity researchers have identified a self-propagating supply chain worm, dubbed CanisterSprawl, targeting npm packages to steal developer tokens. The worm spreads by compromising developer environments, stealing credentials like SSH keys and cloud configurations, and then pushing poisoned packages to the registry. It uses an ICP canister for data exfiltration and also includes logic to propagate through PyPI. Several packages have been compromised, including @automagik/genie, @fairwords/loopback-connector-es, pgserve, and versions 2.6.0, 2.6.1, and 2.6.2 of the xinference Python package.

Microsoft: Most Windows 11 Users Don’t Need Third-Party Antivirus

www.techrepublic.com · 3 months ago

false

New Apple Phishing Scam Uses Fake $899 iPhone Purchase Alert

www.techrepublic.com · 3 months ago

A new phishing scam is targeting Apple users with fake purchase alerts appearing to be legitimate security notifications. The emails claim an $899 iPhone was purchased through PayPal and instruct recipients to call a fraudulent support number. Scammers leverage Apple's infrastructure by inserting phishing messages into Apple ID fields and triggering security notifications, making the emails appear authentic due to passing authentication checks. Victims are then pressured to share financial information or install remote access software, risking malware and data theft.

Hackers Impersonate IT Help Desk on Microsoft Teams to Gain Access, Steal Data

www.techrepublic.com · 3 months ago

Hackers are exploiting Microsoft Teams to compromise networks through social engineering tactics, impersonating IT help desk staff. Attackers initiate chats to gain access, bypassing traditional security measures by leveraging the platform's trusted nature for internal communications. A typical breach involves nine stages, from gaining initial access via Quick Assist to ultimately exfiltrating data, often using legitimate applications to avoid detection. Organizations can mitigate these attacks by educating users, implementing unique voice codes for IT support, and restricting high-risk settings.

AI-powered defense for an AI-accelerated threat landscape

www.microsoft.com · 3 months ago

false

Malicious TikTok Downloader Extensions Quietly Compromised 130K Users

www.techrepublic.com · 3 months ago

A widespread campaign has compromised over 130,000 users through malicious browser extensions disguised as TikTok video downloaders. These extensions, initially appearing legitimate and even featured in trusted marketplaces, secretly incorporated tracking mechanisms and allowed attackers to remotely control their behavior without updates. The extensions collected extensive user data, including device characteristics and usage patterns, enabling persistent tracking. Experts recommend limiting extension permissions, monitoring behavior, and implementing browser isolation to mitigate these risks.

Harvester Deploys Linux GoGra Backdoor in South Asia Using Microsoft Graph API

thehackernews.com · 3 months ago

A cyber espionage group known as Harvester is using a new Linux backdoor called GoGra to target entities in South Asia. The malware leverages the Microsoft Graph API and Outlook mailboxes for covert command and control, bypassing traditional security measures. This new variant follows a pattern established in previous attacks, which have targeted telecommunications, government, and media organizations. The backdoor uses a specific Outlook mailbox folder named "Zomato Pizza" to receive and execute commands, while wiping traces of the activity.

Cisco Catalyst SD-WAN Vulnerabilities

sec.cloudapps.cisco.com · 3 months ago

Cisco has identified several vulnerabilities within the Catalyst SD-WAN Manager. These vulnerabilities include an authentication bypass allowing unauthenticated access, a privilege escalation enabling root access, information disclosure exposing sensitive data, an arbitrary file overwrite, and a DCA privilege escalation. Affected systems are susceptible to attacks through the API interface, and software updates are available to address these issues; there are no known workarounds. The identified CVEs are CVE-2026-20129, CVE-2026-20126, CVE-2026-20133, CVE-2026-20122, and CVE-2026-20128. Catalyst SD-WAN Manager releases 20.18 and later are not affected by these vulnerabilities.

Spain dismantles major $4.7M manga piracy platform, arrests four

www.bleepingcomputer.com · 3 months ago

false

Musk’s SpaceX Goals Shift Ahead of Its I.P.O.

www.nytimes.com · 3 months ago

false

DPRK Fake Job Scams Self-Propagate in 'Contagious Interview'

www.darkreading.com · 3 months ago

North Korean threat actors are using a technique called "Contagious Interview" to spread malware through the software supply chain. Attackers impersonate recruiters and trick developers into cloning infected code repositories as part of fake job interviews. Compromised Visual Studio Code tasks then execute malicious code, stealing credentials and infecting downstream projects, creating a self-propagating worm-like effect. Trend Micro identified over 750 infected repositories and 500 malicious configurations in March alone.

Leaked Code for Anthropic’s Claude Code Tests Copyright Challenges in A.I. Era

www.nytimes.com · 3 months ago

false

After Bluesky, Mastodon Targeted in DDoS Attack

www.securityweek.com · 3 months ago

The decentralized social media platform Mastodon experienced a major distributed denial-of-service attack, impacting its flagship server, Mastodon.social. The attack began April 20th and was mitigated by 4 PM the same day, with operations returning to normal April 21st. A group identifying as 313 Team, allegedly a pro-Iran hacktivist group, claimed responsibility for the attack on Bluesky, which occurred shortly before the Mastodon incident. Mastodon and Bluesky gained popularity as alternatives to X following recent changes.

Electricity Is a Growing Area of Cyber Risk

www.darkreading.com · 3 months ago

There is growing cyber risk targeting DC power regulation as programmable, firmware driven regulators become part of the attack surface and can hide backdoors below the operating system, enabling attackers to impact performance, trigger shutdowns, or damage hardware. Attackers could manipulate regulators to create denial of service across multiple servers or target operational technology safety systems such as connected cars, potentially causing large scale disruption or harm. Software and firmware vulnerabilities have been found in newer DC regulator models, with dozens of CVEs tied to vendors such as STMicroelectronics listed in the National Vulnerability Database, so organizations are advised to treat power regulation as part of their security architecture and apply segmentation, monitoring, cryptographic signing, and secure boot.

Electricity Is a Growing Area of Cyber Risk

www.darkreading.com · 3 months ago

Security experts warn that DC power regulators, which stabilize voltage for devices ranging from smartphones and data centers to connected cars, have become an overlooked attack surface as many newer regulators are programmable and firmware driven. Software vulnerabilities have been found in some models, with vendors such as STMicroelectronics showing dozens of CVEs tied to firmware and supporting software, creating risks that attackers could manipulate voltage, hide below the operating system, create backdoors, trigger outages, or damage hardware. To mitigate this growing threat, organizations are urged to treat power regulation as part of their security architecture by applying segmentation and monitoring, enforcing cryptographic signing and secure boot for power management software, and addressing supply chain and firmware security.