Blahalla

On the risk of destructive bricking attacks against OT devices (part 1)

www.midnightblue.nl · 5 months ago

false

Hackers Abuse ClawHub Skills to Evade VirusTotal via Social Engineering

gbhackers.com · 5 months ago

Hackers are now utilizing a new technique to bypass security measures within the ClawHub platform. Malicious actors are hosting malware on websites designed to resemble legitimate tools, like "OpenClawCLI," and using ClawHub skills as lures to redirect victims to these sites. This approach circumvents VirusTotal scanning, as the skills themselves contain no malicious code, only social engineering tactics. Forty trojanized skills from two ClawHub accounts are involved, directing users to download malware from attacker-controlled websites.

How Top CISOs Solve Burnout and Speed up MTTR without Extra Hiring

thehackernews.com · 5 months ago

false

Never settle: How CISOs can go beyond compliance standards to better protect their organizations

www.csoonline.com · 5 months ago

false

Bloody Wolf Targets Uzbekistan, Russia Using NetSupport RAT in Spear-Phishing Campaign

thehackernews.com · 5 months ago

A threat actor known as Bloody Wolf, tracked as Stan Ghouls, is spear-phishing organizations in Uzbekistan, Russia, and several other countries, primarily targeting manufacturing, finance, and IT sectors. The group uses NetSupport RAT, previously STRRAT, delivered through malicious PDF attachments that employ techniques to evade detection and ensure persistence. Kaspersky has also linked the actor to Mirai botnet payloads, suggesting a potential expansion of their malware arsenal. Several other threat actors are also actively targeting Russian organizations, employing tactics such as stolen credentials and data exfiltration.

Suspected sabotage disrupts trains in northern Italy as Winter Games begin

therecord.media · 5 months ago

Italian authorities are investigating suspected sabotage attacks targeting railway infrastructure in northern Italy, disrupting travel during the Winter Olympics. Fires and damaged cables were reported near Bologna, Venice, and Pesaro, impacting thousands of travelers and causing significant delays. Six people were arrested following clashes during protests related to the Games and broader economic issues. These incidents follow recent blocked cyberattacks, reportedly originating from Russia, targeting diplomatic missions and Olympic-related infrastructure.

New RecoverIt Tool Abuses Windows Service Failure Recovery to Execute Malicious Payloads

gbhackers.com · 5 months ago

A new tool called "RecoverIt" allows attackers to move laterally within a network by exploiting the Windows service failure recovery mechanism. Instead of modifying the service’s file path, the tool alters the recovery actions to execute malicious commands when a service crashes. This bypasses traditional detection methods that monitor service creation and file paths, making it a stealthier technique. Security teams should focus on monitoring service recovery settings and Windows Event Logs for unusual activity to detect and mitigate this threat.

Microsoft: Exchange Online flags legitimate emails as phishing

www.bleepingcomputer.com · 5 months ago

Microsoft is investigating an ongoing issue with Exchange Online that is mistakenly flagging legitimate emails as phishing attempts and quarantining them. The problem began February 5 and is due to a new URL rule designed to identify sophisticated spam and phishing. Microsoft is working to release the quarantined emails and unblock legitimate URLs. This is the latest in a series of similar incidents involving email misclassification within Microsoft’s systems.

APT Hackers Abuse Trusted Edge Services to Stealthily Deploy Malware

gbhackers.com · 5 months ago

Advanced Persistent Threat activity is rapidly increasing, particularly targeting Taiwan due to its strategic importance in the global technology supply chain. Attackers are shifting focus from traditional endpoints to perimeter layers, exploiting 27 critical vulnerabilities in edge devices like firewalls and routers. Threat actors are leveraging compromised IoT devices and NAS systems to obscure their activity and establish persistent access, often through unusual tunneling. Researchers observed a rise in customized, one-time malware and multi-tool intrusion stacks to evade detection, highlighting a China-nexus “whole-of-nation” ecosystem.

Schrödinger’s cat and the enterprise security paradox

www.csoonline.com · 5 months ago

false

Trump set off a surge of AI in the federal government. See what happened.

www.washingtonpost.com · 5 months ago

false

European Commission discloses breach that exposed staff data

www.bleepingcomputer.com · 5 months ago

The European Commission is investigating a cyberattack that potentially exposed the names and phone numbers of staff members. The breach targeted the mobile device management platform, but officials report no mobile devices were compromised. The incident is believed to be related to similar attacks exploiting vulnerabilities in Ivanti Endpoint Manager Mobile software. Ivanti has identified two critical vulnerabilities, CVE-2026-1281 and CVE-2026-1340, in its EPMM software that were exploited in these attacks.

Gartner-Prognose: Die sechs wichtigsten Cybersicherheits-Trends für 2026

www.csoonline.com · 5 months ago

Gartner has identified six key cybersecurity trends expected to shape the landscape by 2026. The rise of AI agents presents new attack surfaces, necessitating stringent governance and incident response plans. Global regulatory volatility demands increased cyber resilience, collaboration, and adherence to standards. Organizations must also proactively transition to post-quantum cryptography to protect data from future decryption threats. Traditional identity and access management strategies require adaptation to accommodate AI agents, while AI-powered Security Operations Centers introduce complexity and necessitate workforce development. Finally, generative AI adoption necessitates a shift from general cybersecurity awareness training to adaptive, AI-specific behavioral programs.

Vortex Werewolf Targets Organizations With Tor-Enabled RDP, SMB, SFTP, and SSH Backdoors

gbhackers.com · 5 months ago

A threat cluster called Vortex Werewolf, previously known as SkyCloak, is targeting Russian government and defense organizations with a multi-stage attack. The group uses Telegram-themed phishing links to hijack user accounts, prompting for phone numbers, confirmation codes, and cloud passwords. Once access is gained, a ZIP archive containing malicious tools is downloaded, which establishes persistence and deploys a Tor-enabled backdoor exposing RDP, SMB, SFTP, and SSH protocols to attackers. They disguise malicious executables as legitimate software to avoid detection and use GitHub Pages and Cloudflare for infrastructure.

Open Security Architecture - 15 new security patterns with NIST 800-53 mappings (free, CC BY-SA 4.0)

www.opensecurityarchitecture.org · 5 months ago

false

New Paper and Tool Help Security Teams Move Beyond Blind Reliance on CISA’s KEV Catalog

www.securityweek.com · 5 months ago

false

Critical Fortinet FortiClient EMS Vulnerability Allows Remote Code Execution

gbhackers.com · 5 months ago

A critical vulnerability has been identified in Fortinet’s FortiClient EMS, specifically version 7.4.4, allowing for remote code execution. The flaw, tracked as CVE-2026-21643, is an SQL injection vulnerability that requires no authentication. Attackers can exploit this vulnerability to execute unauthorized code and potentially compromise entire systems. Fortinet has released version 7.4.5 to resolve the issue and advises immediate patching.

TeamPCP Worm Exploits Cloud Infrastructure to Build Criminal Infrastructure

thehackernews.com · 5 months ago

NULL

NIS2: Supply chains as a risk factor

www.csoonline.com · 5 months ago

New cybersecurity regulations, NIS2, are significantly increasing scrutiny of supply chain security. Companies must now reassess their external dependencies, including cloud services and subcontractors, as cybersecurity extends beyond a company's firewall. The directive emphasizes identifying, assessing, and monitoring supply chain risks, moving beyond traditional compliance measures and requiring verifiable security implementation. CISOs will have expanded responsibilities, needing to bridge technology, management, and legal departments to ensure effective risk management across the entire supply chain.

Detecting Ransomware Using Windows Minifilters to Intercept File Change Events

gbhackers.com · 5 months ago

A security researcher has developed a proof-of-concept tool called Sanctum, designed to detect and prevent ransomware at a low level within the Windows operating system. The tool utilizes Windows Minifilters, which act as a chokepoint for file activity, allowing it to intercept malicious actions before data is encrypted. It monitors file creation and metadata changes, specifically targeting file renames associated with the LockBit ransomware, identified by the.HLJkNskOq extension. The tool currently logs these events but future iterations aim to analyze file entropy and freeze malicious processes, enhancing real-time threat detection.

Behörden warnen vor Hackerangriffen auf Politik und Militär

www.csoonline.com · 5 months ago

German authorities are warning of a wave of cyberattacks targeting Signal accounts belonging to politicians, military personnel, diplomats, and journalists. The attacks, likely state-sponsored, involve hackers impersonating the official Signal support team to trick users into revealing their security PIN or granting access through QR code scans. These methods exploit user naivete rather than technical vulnerabilities, and similar attacks are possible on platforms like WhatsApp. Successful account compromises could expose confidential communications and compromise entire networks.

European Commission Investigating Cyberattack

www.securityweek.com · 5 months ago

The European Commission’s cybersecurity team, CERT-EU, has confirmed a cyberattack impacting their IT infrastructure. The incident, detected January 30, involved systems managing mobile devices and was contained within nine hours. While mobile devices were not compromised, personal information like names and phone numbers of some staff members may have been accessed. The Commission is reviewing the event to enhance cybersecurity measures across EU institutions.

BeyondTrust Fixes Critical Pre-Auth RCE Vulnerability in Remote Support and PRA

thehackernews.com · 5 months ago

BeyondTrust has released security updates to fix a critical vulnerability impacting Remote Support and Privileged Remote Access products. This pre-authentication remote code execution flaw, identified as CVE-2026-1731 with a CVSS score of 9.9, allows unauthenticated attackers to execute operating system commands. Affected versions include Remote Support 25.3.1 and prior, and Privileged Remote Access 24.3.4 and prior. Security researchers discovered roughly 11,000 exposed instances, with around 8,500 being on-prem deployments.

Black Basta Ransomware Integrates BYOVD Technique to Evade Defenses

gbhackers.com · 5 months ago

The Black Basta ransomware group is now using a new technique called Bring-Your-Own-Vulnerable-Driver, or BYOVD, to evade security defenses. This involves bundling a vulnerable driver directly within the ransomware payload, eliminating the need for a separate tool to disable security software. The driver, NsecSoft NSecKrnl, contains a critical vulnerability identified as CVE-2025-68947, allowing unauthorized command execution. This allows the ransomware to terminate security processes from companies like Sophos, Symantec, CrowdStrike, and Microsoft, before encrypting files.

Software developers: Prime cyber targets and a rising risk vector for CISOs

www.csoonline.com · 5 months ago

Cybercriminals are increasingly targeting software developers as a key attack vector, recognizing they hold privileged access to code and infrastructure. Attacks now blend technical compromises, like malicious packages and pipeline abuse, with social engineering and AI-driven techniques. Experts recommend bolstering defenses through stricter identity verification, credential hygiene, and continuous developer training. The XZ Utils backdoor (CVE-2024-3094) demonstrates the risk of compromised open-source projects, while the widespread use of vulnerable Log4j versions underscores the importance of supply chain security.

Cybersquatting Attacks Exploit Trusted Brands to Steal Customer Data and Spread Malware

gbhackers.com · 5 months ago

Cybercriminals are increasingly using cybersquatting to steal customer data and spread malware. These attacks involve registering domain names that mimic legitimate brands using tactics like typosquatting, combosquatting, and homograph attacks. The cost of a data breach facilitated by these attacks averages $4.8 million. Companies like Decodo are experiencing firsthand the damage caused by impersonators, including financial losses and reputational harm. Businesses should proactively protect their brands by registering domain variations and educating customers.

klint - Linux Kernel Security Scanner

saturnine.cc · 5 months ago

klint is a security scanner designed for rapid incident response on Linux systems. It uses eight specialized scanners to detect hidden kernel modules, processes, network sockets, and compromised syscall tables, among other threats. The tool operates as a single, static binary with no dependencies and provides structured JSON and colored text output. It employs techniques such as cross-referencing kernel data sources and running scanners in isolated child processes to enhance reliability and accuracy.

Over 5 Million Misconfigured Git Web Servers Found Exposing Secrets Online

gbhackers.com · 5 months ago

A recent study discovered nearly five million web servers worldwide are exposing sensitive Git repository metadata. Approximately 250,000 of these servers are revealing configuration files containing deployment credentials like API keys and passwords. This exposure allows attackers to steal source code, harvest credentials, and potentially launch supply chain attacks. The United States has the largest number of vulnerable servers, and experts recommend blocking access to.git directories, ensuring clean deployments, and rotating compromised secrets.

New Telegram Phishing Scam Hijacks Login Flow to Steal Fully Authorized User Sessions

gbhackers.com · 5 months ago

A new Telegram phishing scam is targeting users worldwide by hijacking the platform’s authentication features. Attackers use legitimate Telegram API credentials to initiate login attempts through QR code scans or by requesting one-time passwords. Victims are then tricked into approving attacker-controlled sessions via misleading messages within the Telegram app, granting criminals complete account access. This sophisticated campaign utilizes a centrally managed infrastructure and highlights a shift toward abusing legitimate platform features, potentially amplifying the spread through compromised accounts.

BeyondTrust Remote Access Products Hit by 0-Day RCE Vulnerability

gbhackers.com · 5 months ago

A critical zero-day vulnerability, CVE-2026-1731, affects BeyondTrust Remote Support and Privileged Remote Access products. This pre-authentication remote code execution flaw allows unauthenticated attackers to execute commands on vulnerable systems with elevated privileges. Cloud customers are already protected, but organizations using self-hosted versions must immediately update Remote Support to version 25.3.2 or later and Privileged Remote Access to version 25.1.1 or later. The vulnerability was discovered using AI-enabled analysis and poses a significant risk of system compromise.

State-Backed Hackers Target Military Officials, Journalists via Signal

gbhackers.com · 5 months ago

German intelligence agencies have identified a coordinated espionage campaign targeting military officials, diplomats, politicians, and journalists across Europe. Attackers are using social engineering tactics to compromise Signal messaging accounts, bypassing traditional malware. One method involves impersonating Signal Support to obtain verification codes and take over accounts, while another tricks users into scanning malicious QR codes to grant access to conversations. Users are advised to never share verification codes, regularly check linked devices, and enable the Registration Lock feature.

OpenClaw Taps VirusTotal to Safeguard AI Agent Skill Ecosystem

gbhackers.com · 5 months ago

OpenClaw has partnered with VirusTotal to enhance security within its AI skill marketplace, ClawHub. A new scanning process uses deterministic packaging, database lookups, and code insight analysis, powered by Google’s Gemini LLM, to identify potentially harmful AI skills. Skills are categorized as benign, suspicious, or malicious, with continuous re-scanning to maintain safety. This initiative aims to protect against malware, trojans, and supply chain attacks while acknowledging that prompt injection risks remain.

New “Crypto Scanner” Tool Helps Developers Identify Quantum Risks Before Q-Day

gbhackers.com · 5 months ago

A new open-source tool called Crypto Scanner is available to help developers identify and address cryptographic vulnerabilities before quantum computers pose a threat. The tool addresses the “Harvest Now, Decrypt Later” attack strategy, where data is stolen now to be decrypted in the future. Crypto Scanner scans codebases, configuration files, and certificates, categorizing risks associated with algorithms like RSA, ECDSA, DH, and ECC, recommending migration to NIST’s post-quantum cryptography standards like ML-KEM and ML-DSA. The tool integrates easily into development workflows and helps organizations meet compliance requirements.

Roundcube Webmail: SVG feImage bypasses image blocking to track email opens

nullcathedral.com · 5 months ago

Roundcube Webmail versions prior to 1.5.13 and 1.6.13 contained a vulnerability allowing attackers to bypass the "Block remote images" setting. This occurred because the HTML sanitizer incorrectly handled the href attribute within tags, routing it through a process that allowed external URLs. Attackers could leverage this to track email opens by triggering requests to a remote server, potentially revealing the user's IP address and browser fingerprint. The vulnerability has been resolved in versions 1.5.13 and 1.6.13.

Vouch: earn the right to submit a pull request

extended.reading.sh · 5 months ago

false

Top 10 Best DDoS Protection Service Providers for 2026

gbhackers.com · 5 months ago

false

New tool blocks imposter attacks disguised as safe commands

www.bleepingcomputer.com · 5 months ago

A new open-source tool called Tirith is designed to prevent attacks that disguise malicious commands as safe ones. Tirith works by analyzing URLs in typed commands within shells like zsh, bash, fish, and PowerShell, blocking execution based on suspicious characters. It detects threats like homograph attacks, terminal injection, and pipe-to-shell patterns, addressing a vulnerability not consistently resolved by web browsers. The tool operates locally without network calls and supports Windows, Linux, and macOS.

OverTheWire Bandit: a complete walkthrough with in-depth explanations

docs.shelltief.com · 5 months ago

false

Washington Post C.E.O. Will Lewis Steps Down After Stormy Tenure

www.nytimes.com · 5 months ago

false

Defense Evasion: The Service Run Failed Successfully

www.zerosalarium.com · 5 months ago

Attackers often use Windows services for remote execution and persistence, but these methods are closely monitored. A new technique leverages Windows service recovery functions, which execute a configured program when a service crashes. This allows for stealthier execution by avoiding modifications to the service's ImagePath, as the command executed during recovery isn't logged. A tool called RecoverIt is available to modify service configurations and trigger this crash-based execution.

macOS Touch ID/Bio-metric kill switch like iPhone has - PanicLock

paniclock.github.io · 5 months ago

NULL

These A.I. Dreamers Don’t Fit the Stereotype

www.nytimes.com · 5 months ago

false

OpenClaw Integrates VirusTotal Scanning to Detect Malicious ClawHub Skills

thehackernews.com · 5 months ago

false

After Merging xAI and SpaceX, Elon Musk Hopes He Can Win Over Wall Street

www.nytimes.com · 5 months ago

false

Cloud Deception Management Platform (Open-source Cloud Canaries)

vimeo.com · 5 months ago

NULL

New OSS secret scanner: Kingfisher (Rust) validates exposed creds + maps permissions

www.mongodb.com · 5 months ago

false

State actor targets 155 countries in 'Shadow Campaigns' espionage op

www.bleepingcomputer.com · 5 months ago

A state-sponsored threat group, tracked as TGR-STA-1030/UNC6619, has conducted global espionage operations called "Shadow Campaigns," compromising networks in 37 countries and targeting over 155 nations for reconnaissance. The group focuses on government ministries, critical infrastructure, and trade-related entities, exploiting vulnerabilities in systems like SAP Solution Manager and Microsoft Exchange Server. Researchers discovered a custom Linux kernel eBPF rootkit called "ShadowGuard" designed to evade detection by manipulating system functions and concealing malicious activity. The attackers utilized phishing campaigns and legitimate cloud services for command and control, with potential domain references to cryptocurrency or government efficiency themes.

trappsec: open source framework for API deception

trappsec.dev · 5 months ago

NULL

Fake Dubai Crown Prince tracked to Nigerian mansion after $2.5M romance scam

www.bitdefender.com · 5 months ago

A businesswoman was defrauded of over two and a half million US dollars in a romance scam orchestrated by someone posing as the Crown Prince of Dubai. Investigators traced the scammer, identified as Nzube Henry Ikeji, to a mansion in Abuja, Nigeria, with the help of a friend's photograph and financial records. The "financial manager" involved, Dr. Martins Abhulimhen, presented himself as a philanthropist while laundering the victim’s funds, and some of the stolen money went to a Nigerian humanitarian foundation. British authorities have frozen Dr. Abhulimhen's accounts and returned over one hundred thirteen thousand pounds to the victim.

Organizations Urged to Replace Discontinued Edge Devices

www.securityweek.com · 5 months ago

Government agencies in the US and UK are urging organizations to replace discontinued edge devices. These devices, including firewalls, routers, and IoT devices, pose a significant security risk when they reach end-of-support and no longer receive updates. State-sponsored threat actors often target these devices for network access and data theft. CISA has issued a directive requiring federal agencies to inventory, update, and decommission these devices within specific timeframes.