Blahalla

Microsoft releases emergency updates to fix Windows Server issues

www.bleepingcomputer.com · 3 months ago

Microsoft has released emergency updates to resolve issues impacting Windows Server systems. Some administrators experienced failures installing a recent security update on Windows Server 2025 devices, and others saw Windows Servers with domain controller roles enter a restart loop. These updates address installation failures and crashes of the Local Security Authority Subsystem Service, LSASS. Microsoft also resolved a bug causing some devices to boot into BitLocker recovery and corrected an issue resulting in unexpected upgrades to Windows Server 2025.

Next.js Creator Vercel Hacked

www.securityweek.com · 3 months ago

Vercel, the company behind the Next.js framework, has confirmed a security breach after a hacker offered to sell stolen data on BreachForums. The hacker claimed access to databases, access keys, employee accounts, and source code, valuing the data at two million dollars. The incident began with a compromise of Context.ai, an AI tool used by a Vercel employee, which allowed the attacker to gain access to customer credentials and environment variables. Vercel is investigating the incident and has advised impacted users to reset their credentials.

Windows 11 Dev Build Introduces Improved Secure Boot Oversight and Storage Security

gbhackers.com · 3 months ago

Microsoft has released a new Windows 11 Insider Preview build with improvements to system security and storage management. The update introduces a visual status system within the Windows Security application to monitor Secure Boot certificate status, using green, yellow, and red indicators. User Account Control prompts have been adjusted to reduce prompt fatigue and administrative privilege requests. The build also increases the formatting size limit for FAT32 volumes and resolves a telemetry bug impacting data usage metrics.

Hackers Fail to Exploit Flaw in Discontinued TP-Link Routers

www.securityweek.com · 3 months ago

Attackers have been attempting to exploit a vulnerability in several discontinued TP-Link router models for roughly a year, but have been unsuccessful. The flaw, tracked as CVE-2023-33538, is an authenticated command injection issue that could potentially allow for arbitrary system command execution. Proof-of-concept code for the vulnerability has been publicly available for nearly three years and was added to the US government's Known Exploited Vulnerabilities catalog last year. While exploitation attempts have involved payloads similar to the Condi IoT botnet, errors in the attackers’ code have prevented a successful breach.

Researchers Detect ZionSiphon Malware Targeting Israeli Water, Desalination OT Systems

thehackernews.com · 3 months ago

Researchers have identified a new malware strain, ZionSiphon, specifically targeting Israeli water treatment and desalination systems. The malware, detected June 29, 2025, exhibits persistence, scanning capabilities, and attempts to manipulate chlorine and pressure controls using Modbus, DNP3, and S7comm protocols. Alongside ZionSiphon, cybersecurity firms have also discovered RoadK1ll, a Node.js implant used to create a controllable relay point within a network, and AngrySpark, a VM-obfuscated backdoor designed for stealthy persistence and command-and-control communication. These findings highlight evolving tactics in politically motivated attacks against critical infrastructure.

JanaWare Ransomware Hits Turkish Users via Tailored Adwind RAT

gbhackers.com · 3 months ago

Researchers have discovered three methods attackers can use to bypass Apple’s Lockdown Mode on iPhones. These techniques involve exploiting vulnerabilities in the HomeKit framework, Bluetooth functionalities, and the Universal Control feature. Successful exploitation could allow unauthorized access to device data or control. The vulnerabilities affect iOS versions prior to 16.6, 17.4, macOS versions prior to 13.4, 14.4, and tvOS versions prior to 16.6, 17.4. The affected versions include CVE-2023-40397, CVE-2023-40405, CVE-2023-40412, CVE-2023-40414, CVE-2023-40415, and CVE-2023-40418.

British Hacker Admits Stealing Millions in Virtual Currency From Targeted Companies

gbhackers.com · 3 months ago

Researchers have discovered a new technique called Chain Reaction, which allows attackers to bypass macOS System Integrity Protection using a chain of privilege escalations. The method exploits three vulnerabilities to gain root access: a vulnerability in the vmnet service, a flaw in the kerneltransportsendmessage function, and a bug in the bz2 decompression library. This allows attackers to execute arbitrary code with elevated privileges. The vulnerabilities are identified as CVE-2024-23169, CVE-2024-23170, and CVE-2024-23171.

ZionSiphon Hits Israeli Water Systems With OT Sabotage Malware

gbhackers.com · 3 months ago

A new malware strain called ZionSiphon is targeting Israeli water treatment and desalination facilities, demonstrating a clear intent for sabotage. The malware uses hardcoded IP ranges specific to Israel and performs environment checks to identify water-sector OT systems. ZionSiphon attempts privilege escalation and persistence but currently fails its country validation check due to a flawed encryption routine, preventing its destructive functions from executing. Despite these limitations, the malware includes self-destruct and USB propagation capabilities and propagates hidden payloads to USB drives.

NSA Confirms Use of Anthropic’s Mythos Despite Pentagon Blacklist

gbhackers.com · 3 months ago

Researchers have identified three methods attackers can use to bypass security controls in virtual desktop infrastructure environments. These techniques include exploiting vulnerabilities in peripheral device drivers, manipulating clipboard data to execute malicious code, and leveraging rogue USB devices to compromise systems. The vulnerabilities detailed allow for unauthorized access and execution of commands within the virtual desktop. This poses a significant risk to sensitive data and system integrity. CVE-2023-38540, CVE-2023-38541, CVE-2023-38542, CVE-2023-38543, and CVE-2023-38544 are associated with the peripheral device driver vulnerabilities.

Public Notion Pages Expose Editors’ Profile Photos and Email Addresses

gbhackers.com · 3 months ago

A significant data exposure issue has been discovered in Notion, a popular productivity application, allowing unauthorized users to retrieve editor information from public pages. This vulnerability, first reported to Notion in 2022, exposes full names, email addresses, and profile photos through a simple API request without authentication. Notion acknowledges the issue and is exploring fixes, including stripping PII or using an email proxy system. Users are advised to review public pages, unpublish sensitive content, and limit editor access until a patch is deployed.

QEMU Hijacked as Stealth Backdoor for Credential Theft, Ransomware

gbhackers.com · 3 months ago

Attackers are now using QEMU virtual machines to conceal malicious activities such as credential theft and ransomware staging, making detection difficult. Threat actors are deploying QEMU as reverse SSH backdoors, utilizing Linux-based virtual environments to avoid endpoint security visibility and establish persistent footholds. Campaigns like STAC4713 involve deploying PayoutsKing ransomware, while STAC3725 leverages the CVE-2025-5777 vulnerability in NetScaler appliances to stage attacks. Organizations should monitor for unauthorized QEMU binaries, unusual port forwarding, and suspicious virtual disk images to detect these hidden backdoor environments.

Critical Gardyn Flaws Open Smart Garden Devices to Remote Hijacking

gbhackers.com · 3 months ago

A recent advisory from the Cybersecurity and Infrastructure Security Agency has identified critical vulnerabilities in Gardyn smart garden devices, allowing for potential remote hijacking. Attackers could exploit these flaws to compromise devices, access user data, and pivot to other connected systems. The vulnerabilities, including CVE-2025-1242, CVE-2025-10681, CVE-2026-28766, and CVE-2026-32662, stem from issues such as insecure data transmission, default credentials, and missing authentication. Users are urged to update the Gardyn Mobile Application and implement network security measures to mitigate the risks.

Fake Helpdesk Attack Uses Teams and Quick Assist to Breach Targets

gbhackers.com · 3 months ago

Attackers are exploiting Microsoft Teams and Quick Assist to conduct helpdesk-themed social engineering attacks, bypassing traditional phishing defenses. Adversaries impersonate IT support, initiating cross-tenant chats and calls to gain remote control of workstations and move laterally within networks. They use techniques like DLL sideloading and registry modifications to establish persistent command-and-control channels, and data is exfiltrated using utilities like Rclone. Organizations should strengthen external collaboration policies, enable Safe Links and Zero-hour Auto Purge, and educate users to recognize and report suspicious requests.

NIST Adopts Risk-Based NVD Model as CVE Submissions Jump 263% Since 2020

gbhackers.com · 3 months ago

The National Institute of Standards and Technology is changing how it manages the National Vulnerability Database due to a significant increase in Common Vulnerabilities and Exposures, a 263% rise since 2020. The agency will now use a risk-based model, prioritizing vulnerabilities listed in the Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog, those affecting federal government systems, and those impacting critical software. This shift allows NIST to focus on the most severe threats while those outside the prioritized categories will receive a "Lowest Priority" designation, though enrichment requests can be submitted. Thousands of vulnerabilities will be reclassified and a backlog will be placed in a "Not Scheduled" category.

Vercel Reports Data Breach Amid Claims of Compromised Internal Infrastructure

gbhackers.com · 3 months ago

Vercel, a cloud platform company, recently experienced a data breach stemming from a compromise of Context.ai, a third-party AI tool used by an employee. Attackers gained access to a Vercel employee’s Google Workspace account and subsequently infiltrated the company’s internal network, accessing environment variables. While most customer data appears unaffected and sensitive environment variables remained secure, a limited number of customers had their credentials compromised, requiring immediate rotation. Vercel is working with Mandiant, law enforcement, and Context.ai to investigate and has provided an Indicator of Compromise for Google Workspace Administrators, specifically noting a malicious OAuth App ID: 110671459871-30f1spbu0hptbs60cb4vsmv79i7bbvqj.apps.googleusercontent.com.

Für Cyberattacken gewappnet – Krisenkommunikation nach Plan

www.csoonline.com · 3 months ago

Organizations need a crisis communication plan to manage cyberattacks effectively. This plan should include proactive preparation, clearly defined roles within leadership and communication teams, and secure communication channels such as a backup website. Regular testing and continuous information sharing with stakeholders are essential for maintaining trust. Effective communication is as important as technical recovery to protect customer and partner relationships.

Vercel Breach Tied to Context AI Hack Exposes Limited Customer Credentials

thehackernews.com · 3 months ago

Vercel, a web infrastructure provider, recently experienced a security breach resulting from the compromise of a third-party AI tool used by an employee. Attackers gained access to some Vercel environments and environment variables, though sensitive data appeared to remain protected. A limited number of customer credentials were compromised, prompting Vercel to advise affected users to rotate them and to review Google Workspace application permissions related to the application ID 110671459871-30f1spbu0hptbs60cb4vsmv79i7bbvqj.apps.googleusercontent.com. The threat actor, using the persona ShinyHunters, has claimed responsibility and is attempting to sell the stolen data.

Through A.I. Glasses-Powered Translation, Korea’s Theaters Hope for a K-Pop Moment

www.nytimes.com · 3 months ago

false

Cerebras, an A.I. Chip Maker, Files to Go Public as Tech Offerings Ramp Up

www.nytimes.com · 3 months ago

false

Vercel confirms breach as hackers claim to be selling stolen data

www.bleepingcomputer.com · 3 months ago

Cloud development platform Vercel has confirmed a security incident after a hacker group claimed responsibility for a breach and is attempting to sell stolen data. The hacker, claiming affiliation with ShinyHunters, posted on a forum offering access keys, source code, database data, and API keys for sale. A data file containing information on 580 Vercel employees was also shared, though authenticity is unconfirmed. Vercel is investigating the incident and advising customers to review environment variables and rotate secrets.

Apple account change alerts abused to send phishing emails

www.bleepingcomputer.com · 3 months ago

Cybercriminals are exploiting Apple account change notifications to conduct phishing scams. These deceptive emails appear to be legitimate security alerts from Apple, using the company's servers and passing authentication checks, making them difficult to detect. The phishing messages claim fraudulent iPhone purchases were made and urge recipients to call a provided phone number, which can lead to further compromise like malware installation or financial data theft. Attackers create Apple IDs, insert phishing messages into personal information fields, and trigger notifications by modifying shipping information.

Discord Read Receipts: When, How Often, How Long

paul.koeck.dev · 3 months ago

Researchers discovered a method to bypass Discord's privacy features and track when and how long users view messages containing links. By manipulating image proxy fetches, a malicious server can trigger repeated image loading attempts, revealing timing signals that indicate read status and viewing duration. The technique involves crafting links that initially validate successfully but then return errors, initiating a six-stage retry process that exposes user activity. Discord resolved the vulnerability and paid a bounty after confirming the issue and implementing a fix.

NIST to stop rating non-priority flaws due to volume increase

www.bleepingcomputer.com · 3 months ago

The National Institute of Standards and Technology will reduce its vulnerability analysis workload, effective April 15. They will now only provide enhanced details and severity ratings for vulnerabilities that pose a significant risk, such as those in the CISA Known Exploited Vulnerabilities catalog or impacting U.S. federal government software. All vulnerabilities will still be listed in the National Vulnerability Database, but lower-priority entries will only have a severity rating from the initial evaluator. This change is due to a substantial increase in vulnerability submissions, which has made it difficult for NIST to keep up with the volume.

Subject: Inquiry Regarding Localized GEM Induction via High-Frequency Plasma

patents.google.com · 3 months ago

false

Inside a growing movement warning AI could turn on humanity

www.washingtonpost.com · 3 months ago

A growing movement is utilizing social media influencers to raise awareness about potential risks associated with artificial intelligence. Content creators, previously focused on topics such as romance novels and tech tips, are now learning how to communicate concerns about AI safety. These concerns center around the possibility of artificial intelligence escaping human control and causing widespread harm. The movement aims to bring these warnings to a broader audience.

CVE-2026-34621 PoC isn't a scanner, it's a campaign weaponizer with 62 pre-authenticated Brazilian fintech targets

nefariousplan.com · 3 months ago

A vulnerability, CVE-2026-34621, has been identified in Adobe Acrobat that allows for arbitrary code execution on Windows and macOS systems. The flaw arises from prototype pollution, where malicious JavaScript manipulates Adobe Acrobat's trust check mechanism, bypassing security restrictions. This enables attackers to execute system commands through methods like launching external processes or running PowerShell scripts. Affected versions include Adobe Acrobat DC Continuous ≤ 26.001.21367 and Adobe Acrobat 2024 Classic ≤ 24.001.30356; patches are available in later versions. A proof-of-concept weaponizer, accompanied by a disclaimer and campaign tracking features, highlights the exploit's sophistication and potential for targeted attacks.

Critical flaw in Protobuf library enables JavaScript code execution

www.bleepingcomputer.com · 3 months ago

A critical remote code execution vulnerability exists in the widely used protobuf.js library, impacting versions 8.0.0 and below, and 7.5.4 and below. The flaw arises from unsafe dynamic code generation, allowing attackers to inject and execute arbitrary code through malicious schemas. This vulnerability, tracked as GHSA-xq3m-2v4x-88gg, could lead to unauthorized access to sensitive data and systems. Users are advised to upgrade to patched versions 8.0.1 and 7.5.5 to mitigate the risk.

TPM 2.0 is cool, actually: hardware attestation for bare-metal fleets

apas.tel · 3 months ago

false

Microsoft Teams right-click paste broken by Edge update bug

www.bleepingcomputer.com · 3 months ago

A recent Microsoft Edge browser update has introduced a bug affecting Microsoft Teams users. The bug prevents users from pasting URLs, text, and images into Teams chats using the right-click context menu, with the paste option appearing greyed out. As a workaround, users can use keyboard shortcuts like Ctrl+C and Ctrl+V on Windows or Cmd+C and Cmd+V on macOS. Microsoft is aware of the issue, attributing it to a code regression and is rolling out a fix.

NAKIVO v11.2: Ransomware Defense, Faster Replication, vSphere 9, and Proxmox VE 9.0 Support

www.bleepingcomputer.com · 3 months ago

false

Hundreds of Fake Pro-Trump Avatars Emerge on Social Media

www.nytimes.com · 3 months ago

NULL

Cross‑tenant helpdesk impersonation to data exfiltration: A human-operated intrusion playbook

www.microsoft.com · 3 months ago

Attackers are increasingly using Microsoft Teams to impersonate IT support staff and gain unauthorized remote desktop access. Once inside a network, they move laterally using tools like WinRM, steal data via Rclone, and establish persistent access with remote management platforms like Level RMM. Microsoft Defender XDR offers tools for automated disruption, incident correlation, and advanced hunting to detect and respond to these attacks, emphasizing user education and layered security controls. Specific detection capabilities include identifying data exfiltration using rclone.exe and correlating Teams activity with malicious actions.

Researcher Claims Claude Opus Enabled Creation of Working Chrome Exploit

gbhackers.com · 3 months ago

A security researcher demonstrated that Anthropic’s Claude Opus AI model can assist in creating a working browser exploit chain targeting an older version of Google Chrome. The process involved leveraging information related to CVE-2026-5873, an out-of-bounds read and write flaw in the V8 engine, and chaining it with a V8 sandbox bypass to achieve code execution. While the AI significantly accelerated the process, it still required substantial human guidance and consumed a considerable amount of resources. This development highlights the potential for AI to expedite exploit creation and underscores the need for prompt patching of Chromium-based applications.

MAD Bugs: Even "cat readme.txt" is not safe

blog.calif.io · 3 months ago

A vulnerability exists in iTerm2's SSH integration feature, allowing untrusted terminal output to impersonate a legitimate remote conductor. This flaw arises because iTerm2 accepts SSH conductor protocol messages from terminal output without proper verification. Attackers can craft malicious files containing forged terminal escape sequences to trick iTerm2 into executing arbitrary commands, by manipulating the sshargs field within a DCS 2000p hook. The exploit leverages iTerm2's own commands and base64 encoding to achieve code execution, and a fix is available in commit a9e745993c2e2cbb30b884a16617cd5495899f86, but has not yet reached stable releases.

Tycoon 2FA Loses Phishing Kit Crown Amid Surge in Attacks

www.securityweek.com · 3 months ago

Cybersecurity researchers report threat actors have shifted to alternative phishing-as-a-service platforms following a disruption of Tycoon 2FA. Despite efforts to seize Tycoon 2FA domains, the platform’s operations rebounded, though it has since lost its dominance to tools like Mamba 2FA and EvilProxy. Overall phishing attacks utilizing these tools have increased, with the underlying ecosystem demonstrating resilience through code reuse and redundancy. The takedown operation highlights the need for broader security defenses against evolving underground economies.

The Smart TV in Your Living Room Is a Node in the AI Scraping Economy

www.buchodi.com · 3 months ago

false

Nexcorium Mirai Variant Weaponises TBK DVR Vulnerability in Fresh IoT Botnet Push

gbhackers.com · 3 months ago

A new Mirai malware variant called Nexcorium is actively targeting vulnerable IoT devices to build a botnet for launching distributed denial-of-service attacks. The malware exploits CVE-2024-3721 in TBK DVR systems and utilizes CVE-2017-17215 to compromise Huawei routers, alongside brute-forcing devices with default passwords. Nexcorium employs multiple persistence methods, including modifying system files and creating services, to ensure survival after reboots. The threat actor behind the attacks is identified as the Nexus Team, and the botnet supports over ten different attack methods.

[Webinar] Eliminate Ghost Identities Before They Expose Your Enterprise Data

thehackernews.com · 3 months ago

Compromised service accounts and forgotten API keys were responsible for 68 percent of cloud breaches in 2024. Organizations typically have 40 to 50 automated credentials per employee, including service accounts, API tokens, AI agent connections, and OAuth grants, and many remain active, fully privileged, and unmonitored when projects end or employees leave. One compromised token can permit lateral movement across an environment, and intrusions involving these orphaned non-human identities have an average dwell time of over 200 days. A webinar presents a practical playbook to find and eliminate these ghost identities, covering full discovery scans, permission right-sizing, automated lifecycle policies, and a ready-to-use identity cleanup checklist.

$13.74M Hack Shuts Down Sanctioned Grinex Exchange After Intelligence Claims

thehackernews.com · 3 months ago

The cryptocurrency exchange Grinex, previously known as Garantex and sanctioned by the U.S. and U.K., has suspended operations following a cyber attack resulting in the theft of over 1 billion rubles, approximately $13.74 million. The company attributes the attack to Western intelligence agencies, alleging it was intended to damage Russia's financial sovereignty. Blockchain analytics firms have traced the stolen funds to TRON and Ethereum blockchains, with the attacker quickly converting the funds to avoid freezing. Another Kyrgyzstan-based exchange, TokenSpot, was also impacted, although with significantly less loss.

Mirai Variant Nexcorium Exploits CVE-2024-3721 to Hijack TBK DVRs for DDoS Botnet

thehackernews.com · 3 months ago

Security researchers have identified threat actors exploiting vulnerabilities to deploy Mirai-botnet variants on compromised devices. Specifically, TBK DVRs are targeted using CVE-2024-3721, a command injection flaw, to install a variant called Nexcorium. Attackers are also attempting to exploit CVE-2023-33538 in end-of-life TP-Link routers, though current attempts have been unsuccessful. Nexcorium uses techniques like brute-force attacks and persistence mechanisms to maintain control of infected devices and launch DDoS attacks.

White House and Anthropic Hold ‘Productive’ Meeting, Aiming for a Compromise

www.nytimes.com · 3 months ago

false

Critical sandbox bypass fixed in popular Thymeleaf Java template engine

www.csoonline.com · 3 months ago

A critical vulnerability has been resolved in Thymeleaf, a widely used Java template engine. The flaw, identified as CVE-2026-40478 and rated 9.1 on the CVSS scale, enables attackers to bypass security protections and execute code on servers. This Server-Side Template Injection vulnerability occurs because the system failed to properly neutralize certain syntax patterns, allowing attackers to control input to the expression engine. Versions of Thymeleaf prior to 3.1.4.RELEASE are impacted and users are urged to upgrade immediately.

AI uncovered thousands of zero-day vulnerabilities for every major operating system and browser. Including a bug dating back to 1996 in OpenBSD. Patch everything is officially obsolete.

www.minimus.io · 3 months ago

New artificial intelligence models, Claude Mythos and OpenAI GPT-5.4-Cyber, are automating vulnerability research and potentially accelerating the exploitation of software. Claude Mythos reportedly found zero-day vulnerabilities in major operating systems and browsers, while GPT-5.4-Cyber is being used for defensive security work and has contributed to fixes in open-source projects. Experts suggest prioritizing vulnerability patching based on severity, exploitability, exposure, and asset importance, and that organizations should focus on attack surface reduction to minimize risk. Organizations are typically only able to patch about 10% of open vulnerabilities.

Anthropic CEO visits White House amid hacking fears over new AI model

www.washingtonpost.com · 3 months ago

There is a planned meeting between Anthropic CEO Dario Amodei and White House Chief of Staff Susie Wiles as federal officials assess national security risks from the company's new AI system named Mythos. There are reports that Mythos can identify long-overlooked security vulnerabilities in software, having already surfaced thousands of flaws across major operating systems and web browsers, prompting Anthropic to form Project Glasswing with other companies and brief federal cybersecurity agencies. There are concerns that the same capability could be used to supercharge hackers against U.S. businesses and government agencies, leading officials to consider controlled access and to weigh the technology's risks despite prior tensions between Anthropic and the administration.

Threat Brief: Escalation of Cyber Risk Related to Iran (Updated April 17)

unit42.paloaltonetworks.com · 3 months ago

A recent U.S./Israel military offensive against Iran has led to a surge in cyberattacks. Hacktivist groups, including Handala Hack, APT Iran, and Cyber Islamic Resistance, are targeting Israeli, Western, and Middle Eastern entities with DDoS attacks, data leaks, ransomware, and malware. Opportunistic cybercriminals are leveraging social engineering scams, and pro-Russian groups are focusing on Israeli defense systems. Organizations are advised to implement robust data backups, enhance communication verification, apply security patches, and update business continuity plans.

Friday Squid Blogging: New Giant Squid Video

www.schneier.com · 3 months ago

false

Flawed Cisco update threatens to stop APs from getting further patches

www.csoonline.com · 3 months ago

A recent flawed software update has caused a critical flash memory overflow vulnerability in over 200 Cisco wireless access point models. Affected devices are experiencing a log file growing approximately 5MB per day, potentially blocking future software updates and rendering the APs insecure. Administrators can use a Cisco tool called WLANPoller or manually check device space to resolve the issue, but prompt action is necessary to avoid device failure and potential network outages. The affected IOS XE versions include 17.12.4, 17.12.5, 17.12.6, and 17.12.6a.

Anonymous credentials: an illustrated primer (Part 2)

blog.cryptographyengineering.com · 3 months ago

false

How NIST's Cutback of CVE Handling Impacts Cyber Teams

www.darkreading.com · 3 months ago

The National Vulnerability Database (NVD) is scaling back its operations due to funding cuts and a rising volume of vulnerabilities. NIST will now prioritize enrichment data for certain CVEs, impacting the level of detail provided. Cybersecurity teams are advised to proactively seek vulnerability information and accelerate patching processes to compensate for the reduced enrichment data. Industry experts suggest incorporating vulnerability reporting standards into procurement language to improve timeliness.

Payouts King ransomware uses QEMU VMs to bypass endpoint security

www.bleepingcomputer.com · 3 months ago

The Payouts King ransomware group is utilizing QEMU virtual machines to evade endpoint security measures and establish covert remote access. Attackers are creating hidden virtual machines running Alpine Linux, equipped with tools for lateral movement and data exfiltration, often through reverse SSH tunnels. Two campaigns have been identified: STAC4713, linked to the GOLD ENCOUNTER group, and STAC3725, which exploits the CitrixBleed 2 (CVE-2025-5777) vulnerability. Initial access has been achieved through exposed VPNs and exploiting vulnerabilities like CVE-2025-26399.