Blahalla

Lies, Damned Lies, and Cybersecurity Metrics

www.darkreading.com · 3 months ago

false

Severe StrongBox Vulnerability Patched in Android

www.securityweek.com · 3 months ago

Android’s latest security update addresses two vulnerabilities. One is a critical denial-of-service issue affecting the Framework component, tracked as CVE-2026-0049, which can be exploited by a local attacker. The other is a high-severity flaw in StrongBox, Android's secure keystore, identified as CVE-2025-48651, impacting implementations from Google, NXP, STMicroelectronics, and Thales. Details regarding the StrongBox vulnerability’s impact are currently unknown, but potential exploitation could involve key extraction, privilege escalation, or denial of service. Neither vulnerability appears to have been actively exploited.

Why Your Automated Pentesting Tool Just Hit a Wall

www.bleepingcomputer.com · 3 months ago

Automated penetration testing tools initially provide valuable insights, but their effectiveness diminishes after a few runs due to a phenomenon called the Proof-of-Concept Cliff, where they exhaust known attack paths. This limits the scope of validation and creates a "Validation Gap," leaving many areas of the attack surface untested. Breach and Attack Simulation offers a different approach, independently testing numerous attack techniques to validate the effectiveness of security controls like firewalls and EDRs. Organizations need to assess their validation coverage across six key surfaces, network, detection, infrastructure, identity, cloud, and AI, to ensure a comprehensive security posture.

SOHO router compromise leads to DNS hijacking and adversary-in-the-middle attacks

www.microsoft.com · 3 months ago

A threat group linked to the Russian military, known as Forest Blizzard, is exploiting vulnerabilities in home and small-office routers to hijack DNS settings. This allows them to intercept network traffic and potentially steal sensitive data through adversary-in-the-middle attacks. The campaign has affected numerous organizations and consumer devices, impacting those with remote workers and exposed routers. Microsoft recommends enhanced authentication, risk-based policies, proactive monitoring, and leveraging artificial intelligence to defend against this threat.

GrafanaGhost: Attackers Can Abuse Grafana to Leak Enterprise Data

www.securityweek.com · 3 months ago

Researchers have discovered a vulnerability, dubbed GrafanaGhost, that allows attackers to leak enterprise data from Grafana installations. This vulnerability bypasses client-side security measures by exploiting the application’s AI capabilities to send sensitive data, such as financial metrics and customer information, to external servers without user interaction. Attackers can craft malicious prompts that trick Grafana's AI companion into rendering external images, unknowingly transmitting data as URL parameters. The exploitability of this vulnerability depends on specific deployment configurations and AI feature enablement.

CUPS Vulnerabilities Could Allow Remote Attackers to Achieve Root-Level Code Execution

gbhackers.com · 3 months ago

Security researchers have discovered two critical vulnerabilities in the CUPS printing system, potentially impacting Linux and Unix-like operating systems. CVE-2026-34980 allows unauthenticated attackers to execute code remotely by exploiting a parsing error in PostScript queues, enabling remote code execution. CVE-2026-34990 allows local users to escalate privileges to root by creating fake printers and overwriting system files. System administrators are advised to disable network exposure, enforce authentication, and implement security modules like AppArmor or SELinux to mitigate these risks.

Focusing on the People in Cybersecurity at RSAC 2026 Conference

www.darkreading.com · 3 months ago

false

BPFDoor Variants Hide with Stateless C2 and ICMP Relay Tactics

gbhackers.com · 3 months ago

Researchers have identified seven new variants of the BPFDoor Linux backdoor that embed themselves within the kernel for stealth. These variants use Berkeley Packet Filters to inspect traffic and employ unique command-and-control techniques, including treating the magic packet sender as the C2 endpoint and utilizing ICMP relay to bypass firewalls. Some variants hide C2 within HTTP traffic, while others use a dynamic BPF filter for an interactive ICMP shell, and one variant masquerades as time synchronization traffic over TCP 443 using OpenSSL and RC4. Detecting these backdoors requires focusing on structural anomalies like unusual BPF filters and hardcoded ICMP sequence numbers.

Windmill Developer Platform Flaws Expose Users to RCE Attacks, Proof-of-Concept Published

gbhackers.com · 3 months ago

Critical vulnerabilities have been discovered in the Windmill developer platform and Nextcloud Flow, enabling remote attackers to gain complete control of affected systems without passwords. A path traversal flaw, identified as CVE-2026-29059, allows attackers to read sensitive files and execute malicious code, potentially breaking out of Docker containers. Additionally, an authenticated SQL injection vulnerability, pending CVE assignment, allows low-level users to escalate privileges and extract database data. A proof-of-concept exploit framework called Windfall has been released, lowering the barrier for attackers, and includes a stealth mode to erase evidence of a breach. Immediate updates to Windmill version 1.603.3 and Nextcloud Flow version 1.3.0 are crucial to mitigate these risks.

Zero‑click Grafana AI attack can enable enterprise data exfiltration

www.csoonline.com · 3 months ago

Security researchers have identified a critical vulnerability, dubbed GrafanaGhost, that allows attackers to exfiltrate sensitive data from Grafana environments without user interaction. The attack combines indirect prompt injection with client-side bypasses, tricking Grafana’s AI into sending sensitive information, like financial metrics and customer data, to an attacker's server. The exploit leverages flawed URL validation and bypasses AI guardrails by manipulating prompts. While some consider the risk overhyped, security experts recommend patching Grafana, restricting image sources, and implementing egress controls to mitigate potential data leaks.

Over 1,000 Exposed ComfyUI Instances Targeted in Cryptomining Botnet Campaign

thehackernews.com · 3 months ago

A botnet campaign is targeting publicly accessible instances of the ComfyUI stable diffusion platform to enlist them in cryptocurrency mining and proxy operations. Attackers scan for exposed instances using Python scripts, exploiting misconfigured custom nodes to achieve remote code execution. The malware mines Monero and Conflux, installs a Hysteria V2 botnet, and includes mechanisms for persistence and evasion. This activity is part of a broader trend of botnet campaigns exploiting vulnerabilities like CVE-2025-68613, CVE-2025-7544, CVE-2023-46604, CVE-2023-38646, CVE-2025-55182, and a suspected zero-day in fnOS NAS.

Kubernetes Flaws Let Hackers Jump From Containers to Cloud Accounts

gbhackers.com · 3 months ago

Hackers are exploiting Kubernetes misconfigurations to gain access to cloud accounts, often starting with application-layer vulnerabilities and then escalating privileges within the cluster. Attackers are stealing service account tokens to move laterally and access cloud-hosted backend systems, sometimes resulting in data theft. The React2Shell vulnerability, CVE-2025-55182, has been quickly exploited for remote code execution within Kubernetes containers. Organizations should implement stronger access controls, use short-lived tokens, and enable continuous runtime monitoring to detect and prevent these attacks.

GPUBreach Attack Could Lead to Full System Takeover and Root Shell Access

gbhackers.com · 3 months ago

Researchers have discovered a new vulnerability, dubbed GPUBreach, which allows attackers to gain complete system control through GPU-based Rowhammer attacks. This exploit targets GPU page tables in GDDR6 memory, bypassing hardware protections and achieving root shell access by manipulating NVIDIA kernel drivers. Attackers can extract cryptographic keys, degrade AI model accuracy, and steal large language model weights. The vulnerability achieves system compromise by corrupting metadata within trusted buffers, triggering out-of-bounds writes in the NVIDIA kernel driver, and functioning even with the Input-Output Memory Management Unit active.

Microsoft Speech - Lateral Movement

ipurple.team · 3 months ago

A new lateral movement technique, called SpeechRuntimeMove and COM Hijacking, has been identified that allows attackers to execute code under the context of a logged-in user. This technique leverages the Microsoft Speech Runtime, modifies the Remote Registry service, and exploits a specific COM object with the CLSID {655D9BF9-3876-43D0-B6E8-C83C1224154C}. Detection involves monitoring registry key access, process creation events, and changes in service status. Organizations should prepare for increased log volume when implementing these detection strategies.

Fake Gemini npm Package Steals AI Tool Tokens

gbhackers.com · 3 months ago

Hackers have created a malicious npm package disguised as a Google Gemini AI checker to steal tokens and secrets. The package, named gemini-ai-checker, downloads and executes JavaScript from a Vercel-hosted endpoint and mimics legitimate Node.js projects to appear credible. The malware includes modules for credential theft, file exfiltration, clipboard stealing, and remote access, showing similarities to the OtterCookie backdoor. Attackers target directories associated with AI development tools to steal API keys and potentially compromise enterprise networks.

GPUBreach: Root Shell Access Achieved via GPU Rowhammer Attack

www.securityweek.com · 3 months ago

Researchers have discovered a new attack called GPUBreach that exploits a Rowhammer vulnerability in Nvidia GPUs. This attack induces bit flips in GDDR6 memory, corrupting page tables and allowing attackers to gain arbitrary read-write access to memory. When combined with driver vulnerabilities, GPUBreach can escalate privileges to root shell access and full system compromise, posing a risk to cloud environments. Error-correcting code, or ECC, can help mitigate the attack, but is not a complete solution.

The Hidden Cost of Recurring Credential Incidents

thehackernews.com · 3 months ago

Recurring credential incidents are a persistent problem for organizations, costing more than just major data breaches. Repeated account lockouts and compromised credentials lead to increased helpdesk tickets and disruptions in workflows, costing organizations significant time and money. Password resets alone account for up to 30% of helpdesk tickets, with each costing around $70. Tools like Specops Password Policy’s Breached Password Protection, which scans against a database of over 5.8 billion compromised passwords, can help mitigate these risks.

Medusa Ransomware Fast to Exploit Vulnerabilities, Breached Systems

www.securityweek.com · 3 months ago

The Medusa ransomware group, also known as Storm-1175, is rapidly exploiting vulnerabilities to compromise organizations. This ransomware-as-a-service has targeted over 300 organizations, particularly in critical infrastructure, healthcare, education, and finance sectors across Australia, the United Kingdom, and the United States. The group quickly weaponizes newly disclosed vulnerabilities and exploits zero-day flaws, demonstrated by exploiting a SAP NetWeaver bug just one day after public disclosure. Microsoft attributes exploitation of CVE-2026-23760 and CVE-2025-10035 to the threat actor.

Microsoft says Medusa-linked Storm-1175 is speeding ransomware attacks

www.csoonline.com · 3 months ago

Microsoft has identified Storm-1175, a cybercrime group linked to the Medusa ransomware, as conducting exceptionally rapid ransomware attacks. This group is exploiting vulnerable web-facing systems, sometimes moving from initial access to ransomware deployment within just 24 hours, and has targeted organizations in healthcare, education, finance, and professional services. They have leveraged zero-day vulnerabilities and chained multiple exploits to accelerate their operations, highlighting a shift away from traditional, longer dwell times. Experts emphasize the need for proactive attack surface reduction, rapid patching, and improved network segmentation to counter this accelerated threat.

Hackers Exploit Next.js React2Shell Vulnerability, Breach 766 Hosts in 24 Hours

gbhackers.com · 3 months ago

Hackers are exploiting a critical vulnerability, CVE-2025-55182, known as React2Shell, in Next.js applications to steal credentials and secrets. The automated campaign, tracked as UAT-10608, has already compromised at least 766 servers in under 24 hours, using a framework called NEXUS Listener to organize stolen data. The vulnerability allows for remote code execution without authentication, enabling attackers to extract sensitive information such as database credentials, SSH keys, and cloud tokens. Stolen data is uploaded and accessible through a password-protected interface, and researchers have observed instances left exposed. Security experts advise immediate patching and a thorough audit of server-side configurations.

Tor-Backed ClickFix Campaign Drops Node.js RAT on Windows

gbhackers.com · 3 months ago

Hackers are utilizing a deceptive technique called ClickFix to distribute a Node.js-based remote access Trojan targeting Windows users. The attack begins with a fake CAPTCHA prompt, which triggers a hidden PowerShell command to silently install a malicious MSI file. This malware operates with a fileless-like architecture, dynamically downloading components from a command-and-control server through the Tor network to evade detection. An operational security failure exposed a malware-as-a-service platform, revealing features like multi-operator dashboards and automated attack rules.

Supply chain security is now a board-level issue: Here’s what CSOs need to know

www.csoonline.com · 3 months ago

Supply chain security has become a critical, board-level issue due to increasing regulations and the widespread use of open-source software, with 97% of applications containing open-source code and 86% including vulnerabilities. The Log4Shell vulnerability highlighted the interconnectedness of software ecosystems and the potential for rapid exploitation. Organizations now face pressure from regulations like the European Cyber Resilience Act, which carries potential fines of up to 2.5% of global turnover, and must utilize Software Bills of Materials, or SBOMs, to manage vulnerabilities and communicate effectively with customers. Finding the right security tools involves careful evaluation to minimize false positives and automate workflows, and documentation is crucial for demonstrating responsible software stewardship.

Hong Kong Police Can Force You to Reveal Your Encryption Keys

www.schneier.com · 3 months ago

Hong Kong police now have the authority to compel individuals to reveal encryption keys, even those passing through the airport. This change, enacted March 23, 2026, expands enforcement of the National Security Law allowing police to demand passwords and access to electronic devices like cellphones and laptops. Refusal to comply with these demands is now a criminal offense. Authorities can also seize and retain personal electronic devices if deemed connected to national security offenses.

Critical Android Flaw Allows Zero-Interaction Denial-of-Service Attacks

gbhackers.com · 3 months ago

Researchers have identified several vulnerabilities affecting Ivanti Connect Secure and Policy Secure gateways. These flaws include an authentication bypass allowing unauthorized access and a cross-site scripting vulnerability that could lead to sensitive information disclosure. One vulnerability allows for remote code execution with sufficient privileges. Affected versions include 21.12.0.0 through 23.7.1, and 23.8.0.0 through the latest build, 23.8.2.2, with associated CVEs including CVE-2024-20247, CVE-2024-23292, CVE-2024-23293, CVE-2024-23294, and CVE-2024-23295.

German Police Unmask REvil Ransomware Leader

www.securityweek.com · 3 months ago

German authorities have identified Daniil Maksimovich Shchukin as the leader of the GandCrab and REvil ransomware operations. Shchukin, along with co-conspirator Anatoly Sergeevitsch Kravchuk, orchestrated over 130 extortion attempts between 2019 and 2021, resulting in over 40 million dollars in damages and 2 million dollars in ransom payments. These operations utilized a ransomware-as-a-service model and targeted both businesses and public institutions. Shchukin, also known as Oneiilk2, is believed to be currently residing in Russia.

The rise of proactive cyber: Why defense is no longer enough

www.csoonline.com · 3 months ago

false

The noisy tenants: Engineering fairness in multi-tenant SIEM solutions

www.csoonline.com · 3 months ago

There are growing concerns that major SIEM offerings advertise features like round the clock SOC monitoring, proactive threat hunting, and AI-driven detection without explaining how they prevent multi-tenant interference, leaving platforms exposed to the noisy neighbor effect where one tenant’s high-volume workload can increase ingestion latency and violate SLAs for others. There are clear architectural layers in modern SIEMs, ingestion, normalization, rule based detection, ad hoc search, storage, and analytics, and fairness can be engineered through admission control and soft rate shaping such as token buckets, tenant aware fair share scheduling via weighted fair queuing and per tenant partitions, virtual resource isolation with quotas and reservations, and per tenant buffering to decouple backpressure. There are trade offs: provisioning a dedicated cluster per tenant eliminates noisy neighbors and simplifies compliance at much higher cost, while shared deployments must be transparent about fairness engineering to preserve real time detection and response.

Life imprisonment for Cambodian scam compound operators – but will it make a difference?

www.bitdefender.com · 3 months ago

Cambodia has enacted a new law to combat online scams, imposing severe penalties including life imprisonment for ringleaders involved in violence, trafficking, or forced labor. The law aims to protect individuals forced into scamming operations from criminal liability. Authorities claim to have shut down hundreds of scam centers and arrested numerous leaders, but concerns remain about corruption and the links between scam operations and state-licensed casinos. An estimated 100,000 to 150,000 people are exploited in these compounds, contributing to over 12.5 billion US dollars in annual fraud.

Attackers Exploit Flowise Injection Vulnerability as 15,000+ Instances Remain Exposed

gbhackers.com · 3 months ago

A critical security vulnerability, tracked as CVE-2025-59528, is currently being exploited in the Flowise AI development platform. The flaw allows remote attackers to execute malicious code and gain complete control of servers due to improper handling of external server configurations. Approximately 15,000 Flowise instances remain exposed online, making them targets for attackers who can execute arbitrary commands and potentially exfiltrate sensitive data. Users should immediately update to version 3.0.6 to mitigate the risk, as previous vulnerabilities like CVE-2025-8943 and CVE-2025-26319 have also been actively exploited.

New GPUBreach Attack Enables Full CPU Privilege Escalation via GDDR6 Bit-Flips

thehackernews.com · 3 months ago

New research has identified vulnerabilities in high-performance GPUs, enabling privilege escalation and potential system compromise. The GPUBreach attack exploits RowHammer bit-flips in GDDR6 memory to corrupt GPU page tables, allowing unprivileged processes to gain control and escalate privileges to the CPU. This attack bypasses IOMMU protections and can lead to the leaking of cryptographic keys and the degradation of machine learning model accuracy. Concurrent research, GDDRHammer and GeForge, also targets GPU memory corruption, with GeForge requiring IOMMU to be disabled.

White House Seeks to Slash CISA Funding by $707 Million

www.securityweek.com · 3 months ago

false

Fake Installers Spread RATs, Monero Miners in Ongoing Malware Campaign

gbhackers.com · 3 months ago

A persistent malware campaign, tracked as REF1695, is using fake software installers to infect systems with various malicious tools. Attackers are deploying RATs, Monero cryptominers, and a new.NET implant called CNB Bot, alongside tools like PureRAT, PureMiner, and SilentCryptoMiner. The operation utilizes techniques like Microsoft Defender exclusion abuse, custom loaders with driver deployment for enhanced mining efficiency, and GitHub for payload delivery to evade detection and maximize profits through cryptomining and Cost Per Action fraud. Researchers estimate the actor has received over 9,400 USD in Monero.

Detecting CI/CD Supply Chain Attacks with Canary Credentials

tracebit.com · 3 months ago

A threat actor group, TeamPCP, recently compromised several open-source tools including Trivy, KICS, LiteLLM, and Telnyx, using stolen credentials to propagate through the supply chain. The malware harvests secrets like SSH keys and cloud credentials, with the LiteLLM compromise resulting in approximately 300GB of data exfiltration. To detect credential exfiltration, a technique called canary credentials, fake credentials injected into build environments, can provide an alert when compromised actions or packages exfiltrate them. Tracebit offers a free GitHub Action to deploy these canaries, providing context and detection of compromised workflows.

Threat Actors Exploit LogMeIn Resolve, ScreenConnect in Phishing Campaigns

gbhackers.com · 3 months ago

Researchers have identified several methods attackers can use to bypass security controls on Apple macOS devices. These techniques include exploiting vulnerabilities in system daemons, manipulating entitlements, and leveraging code injection to gain elevated privileges. Attackers can also abuse System Integrity Protection, a security feature designed to protect system files, to install malicious software. The vulnerabilities include CVE-2023-32376, CVE-2023-32377, CVE-2023-32378, CVE-2023-32379, and CVE-2023-32380.

Iran-Linked Hackers Hit M365 Tenants in Middle East Password Spray Campaign

gbhackers.com · 3 months ago

Iran-linked threat actors conducted a password-spraying campaign targeting Microsoft 365 environments across the Middle East throughout March 2026. The campaign impacted over 300 entities in Israel and more than 25 in the United Arab Emirates, with limited targeting also observed in Europe, the United States, the United Kingdom, and Saudi Arabia. Attackers utilized VPN services and rotating IP addresses, including Tor exit nodes, to evade detection while attempting to gain access to municipal systems, government agencies, energy sector organizations, and private companies. Researchers attribute the activity to an Iran-based threat actor with similarities to known groups like Gray Sandstorm and Peach Sandstorm.

China-Linked Storm-1175 Exploits Zero-Days to Rapidly Deploy Medusa Ransomware

thehackernews.com · 3 months ago

A China-based threat actor, known as Storm-1175, is rapidly deploying Medusa ransomware by exploiting a combination of zero-day and recently disclosed vulnerabilities. This group targets healthcare, education, finance, and professional services organizations in Australia, the United Kingdom, and the United States, often compromising systems within days or even 24 hours. Their attacks leverage tools like PowerShell, PsExec, and RMM software, and they routinely modify security configurations to evade detection. Storm-1175 has exploited over 16 vulnerabilities since 2023, including CVE-2023-21529, CVE-2023-27351, CVE-2023-46805, CVE-2024-1708, CVE-2024-27198, CVE-2025-10035, and CVE-2026-23760.

New Microsoft Defender Update Issued for Windows 11, Windows 10, and Server Images

gbhackers.com · 3 months ago

false

Wynn Resorts Says 21,000 Employees Affected by ShinyHunters Hack

www.securityweek.com · 3 months ago

Wynn Resorts has confirmed a data breach impacting more than 21,000 employees. The cybercrime group ShinyHunters initially claimed responsibility, alleging the theft of 800,000 records including Social Security numbers. The company likely paid a ransom of over one point five million dollars to have the data removed from a leak site. The attack targeted HR systems in October 2025 and is believed to be the work of Scattered Lapsus$ Hunters, a group formed from multiple cybercriminal organizations.

Flowise AI Agent Builder Under Active CVSS 10.0 RCE Exploitation; 12,000+ Instances Exposed

thehackernews.com · 3 months ago

Threat actors are actively exploiting a critical security vulnerability in the Flowise AI platform. The vulnerability, identified as CVE-2025-59528, allows for remote code execution due to a lack of security validation when parsing user-provided configuration settings. Over twelve thousand instances of Flowise are currently exposed, making them targets for opportunistic attacks. This vulnerability grants access to sensitive system modules, enabling attackers to execute arbitrary code and potentially compromise data, and follows similar previous vulnerabilities CVE-2025-8943 and CVE-2025-26319.

Microsoft Warns Storm-1175 Exploiting Web-Facing Vulnerabilities to Deploy Medusa Ransomware

gbhackers.com · 3 months ago

A threat actor, tracked as Storm-1175, is rapidly exploiting recently disclosed vulnerabilities to deploy the Medusa ransomware. The group targets organizations in Australia, the U.K., and the U.S., often breaching systems and deploying ransomware within 24 hours of exploiting a vulnerability. Storm-1175 has exploited vulnerabilities in Microsoft Exchange, PaperCut, Ivanti Connect Secure, and other products, including CVE-2025-31324, and uses tools like PowerShell, PsExec, and RMM software for lateral movement and persistence. Microsoft recommends hardening internet-facing assets, implementing VPN and WAF protections, and enabling MFA to mitigate this threat.

50,000 WordPress Sites Running Ninja Forms Vulnerable to Critical File Upload RCE

gbhackers.com · 3 months ago

A critical vulnerability has been discovered in the Ninja Forms File Upload plugin for WordPress, allowing unauthorized users to upload malicious files and gain remote code execution. The flaw, tracked as CVE-2026-0740, impacts approximately 50,000 websites and received a CVSS score of 9.8. The vulnerability stems from inadequate file extension validation during the upload process, enabling attackers to bypass security filters and upload executable files. Users are urged to update to version 3.3.27 to mitigate the risk.

CISA Alerts Defenders to Actively Exploited Fortinet Zero-Day Vulnerability

gbhackers.com · 3 months ago

The Cybersecurity and Infrastructure Security Agency has issued a warning about a critical zero-day vulnerability actively being exploited in Fortinet products. This vulnerability, tracked as CVE-2026-35616, impacts FortiClient Enterprise Management Server and allows unauthenticated attackers to execute code without credentials. Organizations are urged to apply patches, follow security guidelines, or discontinue use of the product if mitigations are unavailable. Federal agencies and those following CISA guidance must address this vulnerability by April 9, 2026.

Fake TradingView Premium Reddit Posts Spread Vidar and AMOS Stealers

gbhackers.com · 3 months ago

Cybercriminals are exploiting Reddit to distribute fake TradingView Premium software, which secretly installs Vidar and AMOS information-stealing malware on Windows and macOS systems. The attackers create seemingly legitimate Reddit accounts and subreddits to lure victims seeking free or pirated software. Downloaded files are password-protected ZIP archives hosted on compromised business domains and contain malicious components that harvest credentials, cookies, and cryptocurrency wallets. Security experts advise blocking distribution domains, monitoring for suspicious downloads, and educating users about the risks of free premium software.

Windows Defender 0-Day Published Online, Giving Attackers Potential Full Access

gbhackers.com · 3 months ago

A zero-day vulnerability, called BlueHammer, has been publicly disclosed affecting Windows Defender. This flaw allows attackers to gain local privilege escalation and potentially full administrative access to compromised systems. The exploit targets permission processing weaknesses and the proof of concept code is available on GitHub. Security experts are warning of potential misuse by threat actors, and Microsoft has not yet released a patch.

I was targeted by a fake job interview on Wellfound. Instead of becoming a victim I reverse-engineered the malware. Here's the full analysis: 571 encrypted config values decrypted, C2 and Sentry DSN exposed, DPRK/Contagious Interview attribution.

www.virustotal.com · 3 months ago

NULL

Taking a Break - 2026-04-06

blog.badsectorlabs.com · 3 months ago

false

DeepZero: An automated LLM/Ghidra pipeline for finding BYOVD zero-days in Windows drivers

blog.ahmadz.ai · 3 months ago

Researchers have developed an automated pipeline named DeepZero to identify potential vulnerabilities in Windows kernel drivers. The pipeline utilizes a combination of tools, including Ghidra for decompilation, Semgrep for pattern matching, and Google’s Gemini 2.5 for analysis, to flag exploitable drivers. During its initial run, the pipeline successfully identified a zero-day vulnerability in an ASUS driver, which is currently undergoing responsible disclosure. The system prioritizes drivers with Windows 10/11 compatibility, deduplicates drivers by SHA256 hash, and relies on a filter based on dangerous APIs like MmMapIoSpace and IoAllocateMdl.

German authorities identify REvil and GandCrab ransomware bosses

www.bleepingcomputer.com · 3 months ago

German authorities have identified two Russian nationals as leaders of the GandCrab and REvil ransomware operations, which occurred between 2019 and 2021. Daniil Shchukin and Anatoly Kravchuk are accused of orchestrating over 130 extortion cases, resulting in over two point two million dollars in ransom payments and more than forty million dollars in total financial damage. REvil, also known as Sodinokibi, utilized tactics established by GandCrab and targeted organizations including Texas local governments and Kaseya. Both suspects are believed to be in Russia and are now listed on the EU’s Most Wanted portal.

German authorities identify REvil and GandCrab ransomware bosses

www.bleepingcomputer.com · 3 months ago

German authorities have identified two Russian nationals, Daniil Shchukin and Anatoly Kravchuk, as the leaders of the GandCrab and REvil ransomware operations spanning 2019 to 2021. Shchukin, using the alias UNKN/UNKNOWN, and Kravchuk allegedly orchestrated at least 130 extortion cases, resulting in over $2.2 million in ransom payments and an estimated $40 million in financial damage. REvil, built on the affiliate model of GandCrab, notably impacted Acer, Texas local governments, and was involved in the Kaseya supply-chain attack. Both suspects are believed to be in Russia and are now on the EU’s Most Wanted portal.

Understanding Current Threats to Kubernetes Environments

unit42.paloaltonetworks.com · 3 months ago

Kubernetes environments are experiencing a significant increase in threat actor activity, with a 282 percent rise in the last year, often targeting the IT sector. Attackers are exploiting misconfigurations and vulnerabilities, including CVE-2025-55182, to steal credentials, escalate privileges, and compromise cloud infrastructure. Compromise typically results from a combination of weaknesses like overly permissive access and long-lived credentials. Security recommendations include enforcing strict role-based access control, using short-lived service account tokens, and implementing continuous runtime monitoring for malicious activity.