Blahalla

Iranian Cyber Threat Evolution: From MBR Wipers to Identity Weaponization

unit42.paloaltonetworks.com · 4 months ago

Iranian state-aligned cyber actors have evolved their tactics over the past decade, moving from deploying custom malware like Shamoon and ZeroCleare to increasingly relying on living-off-the-land techniques and identity abuse. Recent attacks, such as those attributed to Void Manticore and the Handala Hack Team, involve compromising privileged identities to remotely wipe devices using legitimate management tools. This shift bypasses traditional endpoint detection and response systems, allowing for rapid and widespread disruption without deploying custom malware. Security teams are advised to prioritize identity resilience and implement measures such as strict conditional access and privileged identity management.

Qihoo 360's AI Product Leaked the Platform's SSL Key, Issued by Its Own CA Banned for Fraud

blog.barrack.ai · 4 months ago

A security failure at Qihoo 360 has exposed a wildcard SSL private key within the installer for its AI assistant, 360 Security Lobster. This leak, issued by WoTrus CA, enables malicious actors to impersonate services and potentially hijack user sessions for the myclaw.360.cn platform and the open-source AI agent framework OpenClaw. The incident underscores a significant security lapse within Qihoo 360, which has a history of security controversies and ties to the Chinese military. The certificate has not been revoked and Qihoo 360 has not publicly addressed the situation.

Industrial Systems Under Siege: 77% of OT Environments Suffer Cyber Breaches

www.techrepublic.com · 4 months ago

A recent survey reveals significant cybersecurity vulnerabilities within operational technology environments. Seventy-seven percent of organizations experienced a security compromise resulting in data loss or operational disruption in the past year, with four percent reporting ten or more attacks. Fifty-two percent anticipate a cyber exploit within the next year, and organizations average over a month to detect incidents and seven months to recover. Experts cite malicious insiders, third-party mistakes, and denial-of-service attacks as top threats.

CISA flags Wing FTP Server flaw as actively exploited in attacks

www.bleepingcomputer.com · 4 months ago

The Cybersecurity and Infrastructure Security Agency is urging organizations to address a vulnerability in Wing FTP Server that is currently being exploited. This flaw, identified as CVE-2025-47813, allows attackers with limited privileges to discover the installation path of the software. Other vulnerabilities, CVE-2025-47812, a remote code execution bug, and CVE-2025-27889, an information disclosure flaw, were also patched in May 2025. Federal agencies have been given a two-week deadline to implement fixes, and all organizations are encouraged to patch their systems immediately.

Free parking in Russia after Distributed Denial-of-Service attack knocks city’s parking system offline

www.bitdefender.com · 4 months ago

A large-scale Distributed Denial-of-Service attack recently disrupted the automated parking system in Perm, Russia. The attack overwhelmed payment processing systems, leading city officials to forgive parking fees between March 10th and 13th. The incident forced the shutdown of the permparking.ru portal and other related services. Authorities are working to restore the system, which uses vulnerable technologies that have previously attracted cybercriminals.

New Microsoft Purview innovations for Fabric to safely accelerate your AI transformation

techcommunity.microsoft.com · 4 months ago

false

UK’s Companies House confirms security flaw exposed business data

www.bleepingcomputer.com · 4 months ago

A security flaw within the UK’s Companies House WebFiling service allowed users to access and view data from approximately five million registered companies. The vulnerability, present since October 2025, enabled logged-in users to view another company's dashboard by manipulating the system after initial authentication. Exposed data included management addresses, dates of birth, and company email addresses, though user passwords and sensitive verification information remained secure. Companies House has reported the incident to relevant authorities and is currently investigating potential misuse.

Teens allege Musk’s Grok chatbot made sexual images of them as minors

www.washingtonpost.com · 4 months ago

Three plaintiffs, including two minors, are accusing xAI, the artificial intelligence company founded by Elon Musk, of creating and distributing child pornography. The plaintiffs allege xAI produced sexual images of them when they were minors. A mother in Tennessee reported to police that xAI was responsible for creating images of her daughter. The lawsuit claims distribution, possession, and production with intent to distribute child pornography.

Microsoft Exchange Online outage blocks access to mailboxes

www.bleepingcomputer.com · 4 months ago

Microsoft is currently addressing an outage impacting Exchange Online, preventing users from accessing mailboxes and calendars through various connection methods like Outlook and Exchange ActiveSync. The Office.com portal is also experiencing issues. Separately, a problem is affecting the Microsoft 365 Copilot web sign-in page and clients, though users are directed to application-based alternatives. Previous outages affecting Exchange Online access occurred in January and November.

Help on the line: How a Microsoft Teams support call led to compromise

www.microsoft.com · 4 months ago

A recent cyberattack began with a Microsoft Teams voice phishing campaign where an attacker impersonated IT support to gain access to a corporate device. The threat actor then used Quick Assist to establish remote access and directed a user to enter credentials into a spoofed website, leading to the download of malicious payloads, including a disguised Microsoft Installer package. Microsoft's Detection and Response Team contained the incident by implementing tactical controls and focused investigation, recommending organizations restrict external collaboration and review the use of remote access tools to prevent similar attacks. The incident highlights the increasing exploitation of trust and collaboration platforms by threat actors.

Oracle EBS Hack: Only 4 Corporate Giants Still Silent on Potential Impact

www.securityweek.com · 4 months ago

A ransomware group, Cl0p, is claiming responsibility for a hacking campaign targeting Oracle E-Business Suite customers, potentially aided by the threat actor FIN11. The group has listed over 100 alleged victims across various industries, publishing stolen data online. Several large corporations, including Broadcom, Bechtel, Estée Lauder, and Abbott Laboratories, have not publicly addressed their potential involvement or the impact of the attack. Hackers reportedly exfiltrated over 2 terabytes of data from Broadcom alone.

Hypervisor Based Defense

idov31.github.io · 4 months ago

false

GlassWorm: Part 3. Wave 3 Windows payload, sideloaded Chrome extension, two additional wallets

codeberg.org · 4 months ago

Git commands offer several functionalities for managing repositories. Patches generated can trigger specific actions during garbage collection. The command line interface accommodates diverse situations, including filenames with spaces and non-ASCII characters. The interactive shell allows for customized commands and configuration options.

Security Firm Executive Targeted in Sophisticated Phishing Attack

www.securityweek.com · 4 months ago

A sophisticated phishing attack targeted a C-level executive at Outpost24, employing a seven-step chain to evade detection. Attackers impersonated JP Morgan and leveraged legitimate services like Cisco, Nylas, and Cloudflare to mask their infrastructure and bypass security filters. The campaign involved multiple redirects and ultimately aimed to steal Microsoft 365 credentials through a convincing phishing page. While the attack’s attribution remains unclear, the tactics used are consistent with those previously employed by Iran-linked threat actors.

⚡ Weekly Recap: Chrome 0-Days, Router Botnets, AWS Breach, Rogue AI Agents & More

thehackernews.com · 4 months ago

Microsoft recently launched a personalized health advice tool using integrated medical data. A new report warns that artificial intelligence agents can collaborate to carry out malicious actions, such as hacking. Two cybersecurity tools, Dev Machine Guard and Trajan, were introduced to protect against these emerging AI-related threats. These advancements highlight the need for vigilance and thorough code review in the evolving AI landscape.

Attackers Abuse LiveChat to Phish Credit Card, Personal Data

www.darkreading.com · 4 months ago

Attackers are using the LiveChat customer support platform to conduct sophisticated phishing campaigns impersonating Amazon and PayPal. These campaigns employ social engineering tactics, such as urgency and brand impersonation, to trick victims into providing sensitive data like account credentials, MFA codes, and credit card information. The interactions appear as legitimate customer support conversations, with human operators guiding victims through the process, making them more susceptible to the attack. Researchers recommend a combination of technical security measures and human-driven analysis to detect and prevent these evolving threats.

Shadow AI is everywhere. Here’s how to find and secure it.

www.bleepingcomputer.com · 4 months ago

Organizations face challenges securing and governing the widespread use of AI tools. A system is needed to continuously discover, monitor, and govern AI usage without requiring a large dedicated team. Nudge Security provides this by integrating with identity providers and analyzing machine-generated emails to identify AI apps and user activity, offering real-time insights and automated policy enforcement through browser extensions and notifications. The system detects sensitive data sharing, tracks AI tool usage, and identifies AI app access to sensitive data.

Handala Hackers Exploit RDP and NetBird in Coordinated Wiper Attacks

gbhackers.com · 4 months ago

Iranian state-linked threat actors, operating under the personas Handala Hack, Karma, and Homeland Justice, are employing a combination of old and new techniques to rapidly devastate victim networks. The group frequently uses compromised VPN credentials for initial access and has been observed routing traffic through Starlink IP ranges. Attackers deploy NetBird, a zero-trust mesh networking platform, to tunnel traffic within networks and coordinate activity, often using Remote Desktop Protocol for lateral movement. The destructive phase involves multiple wiping methods including a custom Handala Wiper, a PowerShell wiper, and the abuse of VeraCrypt, along with manually deleting virtual machines. CVEs mentioned include CVE-2024-21999, CVE-2024-22002, CVE-2024-22004, CVE-2024-22006, and CVE-2024-22007.

Microsoft pulls Samsung app blocking Windows C: drive from Store

www.bleepingcomputer.com · 4 months ago

Microsoft has removed the Samsung Galaxy Connect app from its store due to reports of users losing access to their C drive on certain Samsung Galaxy Book 4 and desktop models running Windows 11. This application, used for screen mirroring and data transfer, has been linked to permission failures preventing access to files and applications. Microsoft and Samsung are collaborating on a fix, but recovery options are currently limited, and users are advised to contact Samsung for assistance. Microsoft also released an out-of-band update to address a security issue in the Routing and Remote Access Service (RRAS) management tool.

875 Million Android Phones Face Risk Due to Hidden Chip Flaw

www.techrepublic.com · 4 months ago

A flaw has been identified in MediaTek chips that could impact as many as 875 million Android phones. This vulnerability allows attackers to potentially unlock devices and extract encryption keys within 60 seconds, even before the operating system fully loads. The flaw exists within the secure boot chain, bypassing standard protections. Affected phone manufacturers include Nothing, OPPO, realme, vivo, and Xiaomi, and while MediaTek released a patch in January, updates depend on individual manufacturers and may take time to reach users.

Cyberattack Hits Poland’s Nuclear Research Center

gbhackers.com · 4 months ago

Poland’s National Centre for Nuclear Research recently experienced a targeted cyberattack on its IT infrastructure. Security teams successfully prevented attackers from compromising critical systems or accessing sensitive data, and the MARIA reactor continued to operate normally. Following the incident, the research center is coordinating with government agencies like the Research and Academic Computer Network and the Ministry of Digital Affairs to bolster security measures and investigate the attack’s origin. Officials are emphasizing continuous monitoring and collaboration to protect Poland’s critical infrastructure from future cyber threats.

CamelClone Uses Public File-Sharing Sites in Government Cyberattacks

gbhackers.com · 4 months ago

A new cyber espionage campaign, dubbed Operation CamelClone, is targeting government and strategic sectors in countries like Algeria, Mongolia, Ukraine, and Kuwait. Attackers use spear-phishing emails containing malicious ZIP files with seemingly legitimate documents and shortcuts that download and execute payloads, including the Rclone file synchronization tool. They leverage public file-sharing sites like filebulldogs[.]com to host malware and evade detection, and utilize anonymous email addresses for data exfiltration via MEGA cloud storage. The attackers are focused on gathering intelligence related to foreign policy, defense capabilities, and diplomatic alignments.

China-Linked Hackers Hit Asian Militaries in Patient Espionage Operation

www.securityweek.com · 4 months ago

A China-linked threat actor, identified as CL-STA-1087, has been conducting a long-term cyberespionage campaign targeting Southeast Asian military organizations. The attackers remained dormant in compromised systems for months before actively searching for sensitive military files related to capabilities, organizational structures, and joint operations with Western forces. They deployed custom tools including AppleChris and MemFun backdoors, and the Getpass credential stealer, to steal credentials and gain persistent access. The campaign, likely ongoing since 2020, uses Pastebin and Dropbox for command and control, and shows signs of alignment with China’s time zone.

Threat Actor Targeting VPN Users in New Credential Theft Campaign

www.securityweek.com · 4 months ago

A threat actor known as Storm-2561 is targeting VPN users through a credential theft campaign that began in mid-January. The attackers use search engine optimization poisoning to redirect users seeking VPN software to malicious websites hosting fake installers disguised as legitimate software like Pulse Secure. These installers deploy the Hyrax information stealer, which collects VPN credentials and sends them to a command-and-control server. The malicious files were signed with a certificate from Taiyuan Lihua Near Information Technology Co., Ltd.

How Autonomous AI Just Made INC Ransomware Obsolete

guardz.com · 4 months ago

A customer was targeted by the INC Ransomware group in a two-stage attack involving a test run and a mass deployment attempt across numerous endpoints. Security infrastructure autonomously detected, terminated, and restored files with a response time of under 50 milliseconds, preventing data encryption and loss. The system leveraged Volume Shadow Copies for automatic rollbacks and required no human intervention during the initial response. Subsequent analysis showed a refined attack strategy between the test and deployment phases, prompting further security measures by the MDR team.

Betterleaks Launches as Open-Source Tool for Scanning Files, Directories, and Git Repositories

gbhackers.com · 4 months ago

A new open-source tool called Betterleaks has been launched as a successor to Gitleaks. It offers improved speed, accuracy, and configurability for scanning codebases to find hardcoded secrets. Key improvements include rule-defined validation using Common Expression Language, token efficiency scanning with a 98.6% detection rate, and parallelized Git scanning for faster processing. The project aims to integrate with AI agents and includes plans for future features like automated secret revocation and large language model assistance.

Why Security Validation Is Becoming Agentic

thehackernews.com · 4 months ago

false

RondoDox Botnet Scales Up, Exploiting 174 Vulnerabilities via Residential IPs

gbhackers.com · 4 months ago

A botnet called RondoDox is rapidly expanding, utilizing 174 vulnerabilities to launch attacks. This Mirai-like botnet employs a network of compromised residential IP addresses to evade detection and perform denial-of-service attacks. The botnet operators quickly adapt, frequently cycling through vulnerabilities, including CVE-2023-46604, CVE-2025-55182, CVE-2025-62593, CVE-2025-47812, and CVE-2025-62593, and even exploiting bugs before CVE identifiers are assigned. Their methods include downloading and running shell scripts in memory and deploying an XMRig miner.

ForceMemo: Python Repositories Compromised in GlassWorm Aftermath

www.securityweek.com · 4 months ago

Threat actors are exploiting credentials stolen in the GlassWorm campaign to compromise Python repositories on GitHub. Attackers are injecting malicious code into projects, including Django apps, ML research code, and PyPI packages, to steal cryptocurrency and sensitive information. The malware, dubbed ForceMemo, modifies repository commits to avoid detection, and often skips systems with Russian language settings. Hundreds of repositories across numerous GitHub accounts have been affected, and the attackers utilize a Solana blockchain address to deliver instructions to the malware.

ClickFix Campaigns Spread MacSync macOS Infostealer via Fake AI Tool Installers

thehackernews.com · 4 months ago

Cybercriminals are increasingly using ClickFix campaigns to distribute malware, specifically the MacSync information stealer for macOS. These campaigns rely on tricking users into copying and executing malicious terminal commands, often disguised as legitimate software installations or prompted by fake error messages. Recent campaigns have used lures related to OpenAI Atlas, ChatGPT, and even fake Claude Code installers, and are targeting users in Belgium, India, North and South America. The attackers are adapting their tactics, including using dynamic AppleScript payloads and weaponizing the trust associated with popular platforms to evade detection and steal data like credentials, files, and cryptocurrency wallet seed phrases.

Open VSX extensions hijacked: GlassWorm malware spreads via dependency abuse

www.csoonline.com · 4 months ago

Cybercriminals are leveraging a new tactic in the GlassWorm supply-chain campaign to distribute malware. Threat actors publish seemingly harmless extensions that later update to include malicious payloads through dependency relationships, bypassing initial security checks. Researchers have identified over 70 malicious Open VSX extensions impersonating developer tools like linters and AI coding assistants. This technique allows attackers to distribute malware more efficiently and evade detection by initially appearing legitimate.

MEA Shipment Phishing Scams Surge, Stealing Banking Data in Real Time

gbhackers.com · 4 months ago

Cybercriminals are exploiting the reliance on parcel delivery services with a surge in SMS phishing scams targeting individuals in the Middle East and Africa. Attackers send fake shipment notifications, directing victims to mobile-optimized phishing websites where they are tricked into providing sensitive data like banking credentials and credit card information. These scams utilize techniques such as spoofed sender IDs and regional number formats to appear legitimate, and employ sophisticated scripts to capture data in real-time via WebSocket connections. The infrastructure shares similarities with the Darcula Phishing-as-a-Service toolkit, which has been used in attacks across more than 100 countries.

Nine critical vulnerabilities in Linux AppArmor put over 12M enterprise systems at risk

www.csoonline.com · 4 months ago

Security researchers have discovered nine vulnerabilities, dubbed “CrackArmor,” within the Linux AppArmor security module. These flaws, present since kernel version 4.11, allow unprivileged users to escalate privileges to root, compromise container isolation, and potentially crash systems. The vulnerabilities stem from a “confused deputy” problem, enabling attackers to manipulate security profiles and execute commands as root. Over 12.6 million enterprise Linux instances are potentially exposed, and patches are now available in the Linux kernel.

Perfex CRM: Autologin cookie fed into unserialize() gives unauthenticated RCE

nullcathedral.com · 4 months ago

A critical security flaw, allowing unauthenticated Remote Code Execution, has been identified in Perfex CRM versions up to 3.4.0. The vulnerability arises from an insecure autologin cookie, enabling attackers to execute arbitrary code on the server. A patch, version 3.4.1, resolves the issue by switching to JSON encoding. A security researcher reported the vulnerability and faced a lengthy delay in response from the vendor and marketplace, urging users to consider a complete system reinstall.

Google Unveils Android 17 Advanced Protection Mode to Stop Malicious Services

gbhackers.com · 4 months ago

Researchers have discovered three methods attackers can use to bypass Apple's Lockdown Mode, a security feature designed to restrict device functionality. These techniques involve exploiting vulnerabilities in the Universal Control feature, Core Audio, and the Bluetooth connection process. Attackers could potentially gain unauthorized access or control of a device even with Lockdown Mode enabled. The vulnerabilities include CVE-2023-42052, CVE-2023-42053, CVE-2023-42054, CVE-2023-42055, and CVE-2023-42056.

Google Looker Studio Vulnerabilities Allow Attackers to Exfiltrate Data from Google Services

gbhackers.com · 4 months ago

Researchers have identified and Google has patched nine critical cross-tenant vulnerabilities, dubbed “LeakyLooker,” within Google Looker Studio. These vulnerabilities allowed attackers to exfiltrate or modify sensitive data across various Google Cloud Platform services, including Google Sheets, BigQuery, and Cloud Storage. Attackers could exploit these issues through zero-click attacks, leveraging “Alias Injection” and “Sticky Credential” flaws, or through one-click vulnerabilities manipulating network requests and SQL injection scripts. Security teams are advised to audit viewing rights and revoke access to unused databases to prevent future exploitation.

IBM Discovers ‘Slopoly’ AI-Generated Malware Linked to Hive0163 Ransomware

gbhackers.com · 4 months ago

The ransomware group Hive0163 is utilizing a newly discovered, likely AI-generated malware framework called Slopoly. This framework functions as a command-and-control client and was observed during a recent ransomware attack after a social engineering campaign. The tool exhibits characteristics of LLM-generated code, including verbose comments and error handling, and was used in conjunction with existing tools like NodeSnake and InterlockRAT. This development highlights how quickly threat actors are integrating AI into their operations to generate custom backdoors.

Possible New Result in Quantum Factorization

www.schneier.com · 4 months ago

A recent result suggests a theoretical improvement in the speed of factoring large numbers using a quantum computer. However, this finding has been disputed, with some experts claiming it is not an actual improvement. The potential breakthrough could impact cryptography, specifically RSA encryption. The claim is currently under review by experts in the field.

DRILLAPP Backdoor Targets Ukraine, Abuses Microsoft Edge Debugging for Stealth Espionage

thehackernews.com · 4 months ago

Ukrainian organizations are facing a new cyberattack campaign likely linked to Russia, utilizing a backdoor called DRILLAPP. The malware, observed beginning in February 2026, deploys through Microsoft Edge, leveraging browser debugging parameters to bypass security restrictions and access sensitive resources like the microphone and camera. Attackers use lures related to Starlink and Ukrainian charities to trick victims, and the malware establishes persistence via startup folders and employs Pastefy for command and control. The campaign has evolved, with later versions adding capabilities like recursive file enumeration and arbitrary file downloads.

Fake FileZilla Downloads Spread RAT via Stealthy Multi-Stage Loader

gbhackers.com · 4 months ago

Attackers are distributing a Remote Access Trojan, or RAT, through fake FileZilla downloads designed to look like the legitimate software. A malicious DLL is bundled within the installer or executable, which loads and executes additional stages of the RAT in memory, evading detection. The malware uses DNS-over-HTTPS to communicate with command-and-control servers, making network monitoring more difficult. This campaign relies on social engineering and tracking infection paths, rather than exploiting software vulnerabilities.

See which jobs are most threatened by AI and who may be able to adapt

www.washingtonpost.com · 4 months ago

false

Hacking Attempt Reported at Poland’s Nuclear Research Center

www.securityweek.com · 4 months ago

Poland’s National Centre for Nuclear Research recently faced a cyberattack, potentially originating from Iranian hackers. The attack targeted the center’s IT infrastructure, but was reportedly thwarted, preventing any disruption to operations or the nuclear research reactor, MARIA. Deputy Prime Minister Krzysztof Gawkowski noted the possibility of misleading information regarding the attack’s origin. This incident follows a previous attack on Poland’s power grid, attributed to a Russian group and resulting in damage to industrial control systems.

ACRStealer Variant Deploys Syscall Evasion, TLS C2, Secondary Payloads

gbhackers.com · 4 months ago

A new variant of ACRStealer is being deployed by HijackLoader, utilizing advanced techniques to evade detection and steal data. The malware employs syscalls instead of APIs, uses AFD and NTSockets to bypass Winsock, and encrypts data with TLS for communication with a command and control server at 157[.]180[.]40[.]106. This version targets gamers, stealing data such as Steam credentials, and acts as a loader for additional payloads delivered through PowerShell or process hollowing. Infections have been observed in the USA, Mongolia, and Germany.

Konni Hijacks KakaoTalk Accounts in Spear-Phishing Malware Campaign

gbhackers.com · 4 months ago

Konni APT ran a multi stage malware operation that hijacked KakaoTalk desktop sessions to spread remote access trojans through highly targeted spear phishing. Attackers used contextual messages and malicious archives containing LNK shortcuts that launched PowerShell droppers and AutoIt based loaders which installed multiple RAT families including EndRAT, RftRAT, and RemcosRAT, enabling remote shells, keylogging, file management, and further payload delivery. The campaign maintained long term persistence, exfiltrated internal documents and account data, used compromised KakaoTalk accounts to propagate laterally through trusted contacts, relied on distributed command and control servers in multiple countries, and underscores the need for EDR centered defenses, monitoring of shortcut execution and AutoIt activity, and tighter controls around messaging client attachments.

OpenClaw AI Agents Vulnerable to Indirect Prompt Injection, Causing Data Leaks

gbhackers.com · 4 months ago

Security researchers have identified a concerning vulnerability in OpenClaw AI agents that allows attackers to exfiltrate sensitive data without user interaction. This “no-click” attack involves hiding malicious instructions within web content that the AI agent processes, causing it to generate URLs containing confidential information. Messaging platforms like Telegram and Discord then unknowingly assist in the data theft by automatically creating link previews that trigger outbound requests to the attacker’s server. Organizations are advised to restrict link previews, isolate agents, and carefully vet third-party skills to mitigate this risk.

ClickFix techniques evolve in new infostealer campaigns

www.csoonline.com · 4 months ago

Cybercriminals are increasingly using ClickFix social engineering tactics to distribute infostealer malware. Recent campaigns have compromised numerous WordPress sites and exploited Windows Terminal, delivering payloads such as Vidar Stealer, Impure Stealer, and VodkaStealer. Attackers disguise malicious scripts as performance optimizers and use fake CAPTCHA challenges to trick users into executing commands that load in-memory malware, bypassing traditional detection methods. Security firms have observed a significant surge in ClickFix attacks, with some nation-state groups now employing the technique.

FortiGate Firewall Exploitation Fuels Network Breaches in New Attack Wave

gbhackers.com · 4 months ago

Security researchers have observed a surge in network breaches linked to compromised FortiGate firewalls. Attackers are exploiting vulnerabilities such as CVE-2025-59718, CVE-2025-59719, and CVE-2026-24858 to steal configuration files and credentials, gaining access to Active Directory environments. Two distinct attack campaigns have been identified: one involving the creation of a “support” account and rogue workstations, and another using an “ssl-admin” account to deploy remote management tools and steal the NTDS.dit file. Organizations are urged to apply security patches, improve log retention, and monitor for unusual activity to mitigate these threats.

Attackers Exploit Teams, Quick Assist to Deploy Stealthy A0Backdoor

gbhackers.com · 4 months ago

Attackers are utilizing a social engineering tactic involving email bombing and impersonating IT support staff through Microsoft Teams to gain remote access via Quick Assist. They then deploy a new backdoor, A0Backdoor, using digitally signed MSI installers hosted on Microsoft personal cloud storage. The backdoor employs a complex loader chain including a tampered hostfxr.dll to decrypt its payload and utilizes DNS tunneling over MX queries for command and control communication, evading typical security controls. This activity is linked to Blitz Brigantine, a financially motivated group associated with Black Basta and Cactus ransomware operations.

Android 17 Blocks Non-Accessibility Apps from Accessibility API to Prevent Malware Abuse

thehackernews.com · 4 months ago

Google is implementing a new security feature in Android 17, specifically within Advanced Protection Mode, to limit the use of accessibility services. This change restricts non-accessibility apps from using the accessibility services API to prevent malware abuse and data theft. Only verified accessibility tools, such as screen readers, are exempt from the restriction. Developers can use the AdvancedProtectionManager API to adapt to this new security posture.

Microsoft Issues Out-of-Band Patch for Critical Windows 11 RRAS RCE Flaws

gbhackers.com · 4 months ago

Microsoft has released an out-of-band security update, KB5084597, to address critical vulnerabilities in the Windows 11 Routing and Remote Access Service. These vulnerabilities, identified as CVE-2026-25172, CVE-2026-25173, and CVE-2026-26111, allow for remote code execution if a user connects to a malicious server. The hotpatch applies to Windows 11 versions 25H2 and 24H2 and is automatically installed on enabled devices. Users should verify that Windows Update is active and monitor network logs for suspicious activity.