Blahalla

Asian State-Backed Group TGR-STA-1030 Breaches 70 Government, Infrastructure Entities

thehackernews.com · 5 months ago

A previously unknown cyber espionage group, tracked as TGR-STA-1030, has compromised at least 70 government and critical infrastructure organizations across 37 countries since January 2024. This Asian state-backed group uses phishing emails and the Diaoyu Loader malware, which evades sandbox analysis through file integrity checks and detects security software like Avira, Bitdefender, Kaspersky, Sentinel One, and Symantec. The group exploits known vulnerabilities in software from Microsoft, SAP, Atlassian, Ruijieyi Networks, Commvault, and Eyou Email System to gain initial access and utilizes tools like Cobalt Strike and a Linux kernel rootkit called ShadowGuard. They prioritize intelligence gathering and target countries involved in specific economic partnerships.

Claude Opus 4.6 Launches Enhanced Security Capabilities to Validate 500+ Critical Vulnerabilities

gbhackers.com · 5 months ago

Anthropic has released Claude Opus 4.6, a new AI model capable of identifying and validating vulnerabilities in software. The model uses semantic code analysis and logic reasoning, unlike traditional brute-force methods like fuzzing. Claude Opus 4.6 has already discovered critical vulnerabilities in GhostScript, OpenSC, and CGIF, including an incomplete patch, a buffer overflow, and a heap buffer overflow related to LZW compression. To prevent misuse, Anthropic has incorporated internal monitors into the model to detect and block malicious requests.

iPhone Lockdown Mode Protects Washington Post Reporter

www.schneier.com · 5 months ago

The Federal Bureau of Investigation was unable to access a reporter's iPhone due to Lockdown Mode being enabled. The FBI was conducting a search as part of an investigation into a government contractor, Aurelio Perez-Lugones, who is accused of retaining national defense information. Investigators believe Perez-Lugones was a source for the reporter. The court record details the FBI’s inability to extract data from the device while it was in Lockdown Mode.

Flickr Security Incident Tied to Third-Party Email System

www.securityweek.com · 5 months ago

Flickr is notifying users of a data security incident involving a third-party email service provider. The vulnerability, discovered on February 5, 2026, potentially allowed unauthorized access to member information. Exposed data includes names, email addresses, usernames, account types, IP addresses, general location, and Flickr activity data, but passwords and payment card numbers were not compromised. Flickr advises users to be wary of phishing emails.

Elon Musk’s Mega-Merger + We Test Google’s Project Genie + What’s Next for Moltbook Creator

www.nytimes.com · 5 months ago

false

Living off the AI: The Next Evolution of Attacker Tradecraft

www.securityweek.com · 5 months ago

Attackers are now leveraging artificial intelligence to compromise systems, a new evolution of "living off the land" tactics. These attacks involve manipulating AI agents through prompt injection, exploiting poorly secured tools, and poisoning memory to alter behavior and exfiltrate data, often hiding behind legitimate cloud services. Organizations must implement stricter controls, including minimizing tool permissions, hardening prompts, validating inputs, and adding robust monitoring and detection capabilities to treat AI agents with the same rigor as privileged users. Adversarial testing and user education are also crucial to prevent attackers from exploiting AI for malicious purposes.

In Other News: Record DDoS, Epstein’s Hacker, ESET Product Vulnerabilities

www.securityweek.com · 5 months ago

A former Google engineer was convicted of economic espionage and theft of AI trade secrets. ESET released patches for two high-severity vulnerabilities, CVE-2025-13176 and CVE-2025-13818, affecting Windows products. A record-setting DDoS attack peaked at 31.4 terabits per second, and a data breach at Canada Computers potentially exposed customer credit card details. Researchers also observed a cloud intrusion where an attacker leveraged AI to gain administrative privileges on AWS within ten minutes.

Romania’s oil pipeline operator confirms cyberattack as hackers claim data theft

therecord.media · 5 months ago

Romania’s oil pipeline operator, Conpet, confirmed a cyberattack that disrupted its technology infrastructure and took its website offline. While oil transport operations and critical systems remain functional, the Qilin ransomware group claims to have stolen nearly one terabyte of data and posted alleged internal documents online. Conpet is working with cybersecurity authorities to investigate and restore systems and has filed a criminal complaint. The Qilin group, active since 2022, has previously targeted various organizations including hospitals, government agencies, and private firms.

CISA gives federal agencies 18 months to purge unsupported edge devices

www.csoonline.com · 5 months ago

The Cybersecurity and Infrastructure Security Agency has issued a directive, BOD 26-02, mandating federal agencies remove unsupported edge devices like firewalls, routers, and VPNs within 18 months. This action responds to a shift in attacker tactics, with nation-state actors increasingly targeting network infrastructure instead of endpoints. Agencies must inventory these devices, update where possible, and ultimately replace them, due to the substantial and constant threat they pose. CISA has documented campaigns targeting devices from vendors including Cisco, Fortinet, Palo Alto Networks, Ivanti, Juniper, and others. The directive encourages private sector organizations to adopt similar security measures.

FvncBot Targets Android Users, Exploiting Accessibility Services for Attacks

gbhackers.com · 5 months ago

A new Android banking trojan called FvncBot has been identified, first observed in late 2025. This malware masquerades as a security application from mBank and is a unique creation, not based on recycled code. Once installed, FvncBot abuses Android Accessibility Services to steal data through keylogging, web-injects, and screen streaming, and uses Firebase Cloud Messaging for remote control. The malware currently targets Polish users, but its modular design allows for easy expansion to other regions.

How Samsung Knox Helps Stop Your Network Security Breach

thehackernews.com · 5 months ago

false

The RCE that AMD won't fix!

mrbruh.com · 5 months ago

Researchers have identified a remote code execution vulnerability within AMD's AutoUpdate software. The software downloads executable files via HTTP, leaving it susceptible to man-in-the-middle attacks. AMD has declined to address the issue, deeming it out of scope. The vulnerability was discovered on January 27, 2026, reported on February 5, 2026, and publicly disclosed on February 6, 2026.

Experiment demonstrates Al-generated identities bypassing KYC-based verification systems

mpost.io · 5 months ago

A recent experiment by Humanity Protocol demonstrated how easily AI can bypass identity verification systems. Using tools like Reve AI, ChatGPT, and TinderGPT, researchers created convincing fake profiles on a dating platform and successfully engaged with hundreds of real users, even arranging in-person meetings. The experiment highlights the vulnerability of current Know Your Customer protocols, which were not designed to handle sophisticated AI-generated content. Experts warn that this poses a significant risk for online platforms and financial security, potentially leading to increased fraud and exploitation.

China-Nexus Hackers Target Linux Devices to Redirect Traffic and Deploy Malware

gbhackers.com · 5 months ago

A sophisticated threat group linked to China is using a framework called DKnife to compromise Linux devices and monitor user activity. DKnife allows attackers to perform adversary-in-the-middle attacks, intercepting software updates and replacing legitimate files with malware like ShadowPad and DarkNimbus. The framework creates fake network interfaces to route traffic and harvest credentials, specifically targeting Chinese users and services like WeChat and QQ. Researchers have connected DKnife to another malware campaign, WizardNet, suggesting a potential resource sharing among Chinese hacking groups.

The Dark Side of A.I. Weighs on the Stock Market

www.nytimes.com · 5 months ago

false

Young people in China have a new alternative to marriage and babies: AI pets

www.washingtonpost.com · 5 months ago

false

Flickr discloses potential data breach exposing users' names, emails

www.bleepingcomputer.com · 5 months ago

Researchers have discovered three distinct methods attackers can exploit to bypass Apple's Lockdown Mode, a security feature designed to protect high-risk individuals. The techniques involve exploiting vulnerabilities in image processing, Bluetooth connectivity, and the handling of certain URL schemes. Successful exploitation could lead to unauthorized access and control of a device. No CVEs were mentioned in the information.

RenEngine Loader Deploys Stealthy Multi-Stage Execution to Bypass Security Measures

gbhackers.com · 5 months ago

A sophisticated malware campaign, dubbed RenEngine Loader, has compromised over 400,000 victims globally since April 2025. The malware hides malicious code within pirated versions of popular games like Far Cry, FIFA, and Assassin’s Creed, utilizing a legitimate Ren’Py game launcher to evade detection. The attack employs a multi-stage execution process, including sandbox evasion and DLL side-loading, ultimately deploying ACR Stealer to exfiltrate sensitive data such as browser passwords and cryptocurrency wallet information. This method allows the threat actors to bypass traditional antivirus solutions and remain persistent.

Airrived Emerges From Stealth With $6.1 Million in Funding

www.securityweek.com · 5 months ago

false

OpenAI Launches Trusted Access to Strengthen Cybersecurity Protections

gbhackers.com · 5 months ago

false

‘DKnife’ Implant Used by Chinese Threat Actor for Adversary-in-the-Middle Attacks

www.securityweek.com · 5 months ago

Researchers have discovered a China-linked threat actor utilizing a framework called DKnife to conduct adversary-in-the-middle attacks. This framework, active since at least 2019, consists of seven Linux implants used for deep packet inspection, traffic manipulation, and malware delivery, primarily targeting Chinese-speaking users. DKnife overlaps with previous frameworks like Spellbinder and is used to deliver backdoors such as ShadowPad and DarkNimbus, alongside credential theft and phishing. The tool monitors network traffic, updates backdoors, and interacts with victims’ systems.

CISA orders federal agencies to replace end-of-life edge devices

www.bleepingcomputer.com · 5 months ago

The Cybersecurity and Infrastructure Security Agency, or CISA, has issued a new directive requiring U.S. federal agencies to remove network edge devices that no longer receive security updates. These devices, including routers, firewalls, and switches, are vulnerable to exploitation by advanced threat actors and pose significant risks to federal systems. Agencies must now inventory devices, decommission end-of-support equipment within 12 to 18 months, and establish ongoing discovery processes. CISA encourages all network defenders to follow this guidance to improve security.

F5 Releases Urgent Security Fixes for Critical Vulnerabilities in BIG‑IP and NGINX

gbhackers.com · 5 months ago

F5 has released security updates to address several vulnerabilities across its BIG-IP, NGINX, and Container Ingress Services products. These vulnerabilities, including CVE-2026-22548, CVE-2026-1642, and CVE-2026-22549, carry high risk scores, up to 8.2 under the CVSS v4.0 scoring system. Affected versions range from 17.1.0 through 17.1.2 for BIG-IP Advanced WAF and ASM, R32 through R36 P1 for NGINX Plus, and 2.0.0 through 2.20.1 for BIG-IP Container Ingress Services. Organizations are urged to immediately patch vulnerable systems and review BIG-IP SMTP configurations to prevent unauthorized mail relay.

Compromised dYdX npm and PyPI Packages Deliver Wallet Stealers and RAT Malware

thehackernews.com · 5 months ago

Cybersecurity researchers have identified a supply chain attack targeting the dYdX decentralized cryptocurrency exchange, compromising npm and PyPI packages to steal cryptocurrency wallet credentials and enable remote code execution. Malicious versions of @dydxprotocol/v4-client-js (npm), versions 3.4.1, 1.22.1, 1.15.2, and 1.0.31, and dydx-v4-client (PyPI), version 1.1.5post1, contained a cryptocurrency wallet stealer and, in the Python version, a remote access trojan. The attack involved developer account compromise and targeted both the JavaScript and Python ecosystems, with the threat actor demonstrating knowledge of package internals, and consistent exfiltration endpoints across languages. Users are advised to isolate affected machines, move funds to new wallets, and rotate credentials.

5 Bills to Boost Energy Sector Cyber Defenses Clear House Panel

www.securityweek.com · 5 months ago

Five bills have been approved by a House panel to strengthen the cybersecurity and physical security of the United States’ energy infrastructure. These bills will update Department of Energy programs, enhance protections for the electrical grid and pipelines, and provide support to rural utilities. One bill will reauthorize the Energy Threat Analysis Center, enabling preventative analysis and information sharing regarding cyber threats. The Department of Energy recently conducted Liberty Eclipse, a cybersecurity exercise to prepare for potential cyberattacks on energy systems.

Zscaler Integrates SquareX to Deliver Stronger Browser Security Protections

gbhackers.com · 5 months ago

false

KI als AWS-Angriffsturbo

www.csoonline.com · 5 months ago

Researchers have discovered cybercriminals are using artificial intelligence to significantly accelerate attacks on Amazon Web Services environments. Attackers exploited a cloud misconfiguration and obtained administrative privileges in under eight minutes by utilizing Large Language Models. The attackers leveraged leaked AWS credentials from public S3 buckets, modified Lambda functions, moved laterally across user accounts, and attempted to misuse GPU resources for machine learning workloads, including a potential instance of "LLMjacking." Experts emphasize the concerning lack of resilience in the targeted environment, which allowed the rapid compression of reconnaissance, privilege escalation, and lateral movement.

New Wave of Odyssey Stealer Targets macOS Users in Active Cyberattack Campaign

gbhackers.com · 5 months ago

A new wave of cyberattacks is targeting macOS users globally, with the Odyssey Stealer malware rapidly spreading to countries including the United Kingdom, Germany, Canada, and Brazil. This sophisticated information-stealing campaign, a rebranded version of Poseidon Stealer, employs social engineering tactics like fake CAPTCHA pages to trick users into executing malicious AppleScript. The malware steals cryptocurrency wallet data, browser credentials, Keychain passwords, and files, establishing persistence through LaunchDaemons and exfiltrating data via curl POST requests. Threat actors use a control panel to manage infected devices and customize malware versions.

Critical SmarterMail Vulnerability Exploited in Ransomware Attacks

www.securityweek.com · 5 months ago

SmarterMail business email servers are facing attacks due to exploited vulnerabilities. Cybersecurity officials warn that a third vulnerability, CVE-2026-24423, allows unauthenticated remote code execution through the ConnectToHub API. Attackers can execute arbitrary commands on the server, potentially escalating privileges on Linux systems. Patches were released January 15th, and federal agencies are directed to apply them by February 26th due to exploitation by ransomware groups.

APT-Q-27 Launches Stealthy Attacks on Corporate Networks, Evades Detection

gbhackers.com · 5 months ago

A sophisticated cyberattack campaign has been observed targeting corporate networks. Attackers, believed to be the group APT-Q-27, or GoldenEyeDog, initiated the intrusion through a customer support agent clicking a malicious link delivered via Zendesk. The malware bypassed security measures by utilizing a valid digital signature and operating primarily in memory to avoid detection. Security experts recommend behavior-based monitoring to identify these “low-noise” intrusions, as traditional methods are ineffective against this advanced persistent threat. Several command-and-control indicators have been identified across various locations, including Japan, China, India, and the United States.

Hacking a cheap Wi-Fi toy drone

journal.farhaan.me · 5 months ago

NULL

The blind spot every CISO must see: Loyalty

www.csoonline.com · 5 months ago

Organizations often mistakenly equate employee tenure and expressed commitment with trustworthiness, creating a security blind spot. Loyalty is a dynamic trait influenced by factors like fairness and external pressures, and can erode over time due to unmet expectations or financial strain. Recent incidents, including abrupt terminations and departing employees taking proprietary information, highlight this risk, which is amplified by economic volatility, the rise of AI agents, and geopolitical tensions. To mitigate this, organizations should implement continuous verification programs and utilize tools like pulse surveys and AI-integrated behavioral programs, mirroring the approach of Federal Trusted Workforce 2.0.

CISA Alerts Exploited React Native Community Security Flaw

gbhackers.com · 5 months ago

The Cybersecurity and Infrastructure Security Agency has added a critical vulnerability to its catalog, identified as CVE-2025-11953. This flaw is an operating system command injection vulnerability within the React Native Community CLI, allowing attackers to execute arbitrary code on vulnerable systems, especially those running Windows. Threat actors are actively exploiting this vulnerability, which is triggered through the Metro Development Server via specially crafted POST requests. Federal agencies must remediate the issue or discontinue use by February 26, 2026.

CentOS 9 Security Flaw Enables Privilege Escalation – PoC Released

gbhackers.com · 5 months ago

A critical security vulnerability has been discovered in CentOS 9, allowing local users to escalate privileges to root. The flaw, found in the schcake packet scheduler, stems from a Use-After-Free condition and was highlighted at the TyphoonPWN 2025 hacking competition. Attackers can exploit this issue by leveraging a proof-of-concept to corrupt memory and execute code with root permissions, involving techniques like heap spraying and Return-Oriented Programming. No official patch is currently available, and users are advised to restrict access to the tc command or the schcake module until a fix is released.

Phishing and OAuth Token Vulnerabilities Lead to Full Microsoft 365 Breach

gbhackers.com · 5 months ago

Researchers have discovered a method for attackers to breach Microsoft 365 environments by exploiting two vulnerabilities. First, attackers manipulate unsecured email API endpoints to send phishing emails that bypass email security controls. Second, verbose error messages reveal OAuth tokens, granting access to sensitive data like user directories, Teams channels, and SharePoint files. This combined approach allows attackers to steal data, send targeted phishing emails, and maintain persistent access, even after credential changes. Organizations should implement strict input validation and generic error handling to prevent these attacks.

Hackers Exploit Windows Screensaver to Deploy RMM Tools, Gain Remote Access

gbhackers.com · 5 months ago

Cybercriminals are using spear phishing emails to trick victims into downloading Windows screensaver files, disguised as documents like invoices or project summaries. These screensaver files, technically Portable Executable files, execute code that silently installs legitimate Remote Monitoring and Management software on targeted systems. This allows attackers persistent remote access, enabling them to escalate privileges and potentially deploy ransomware, while evading detection due to the trusted nature of RMM tools. Organizations should restrict screensaver file execution and enforce strict allowlists for authorized remote management software to prevent these attacks.

Claude Opus 4.6 Finds 500+ High-Severity Flaws Across Major Open-Source Libraries

thehackernews.com · 5 months ago

Anthropic’s new large language model, Claude Opus 4.6, has identified over 500 high-severity security flaws in open-source libraries. The model’s advanced code review and debugging capabilities enabled it to find vulnerabilities without specialized prompting or tooling. Discovered flaws include a crash vulnerability in Ghostscript, a buffer overflow vulnerability in OpenSC, and a heap buffer overflow vulnerability in CGIF, version 0.5.1. Anthropic emphasizes the importance of promptly patching known vulnerabilities as AI’s role in cyber workflows expands.

Concerns Raised Over CISA’s Silent Ransomware Updates in KEV Catalog

www.securityweek.com · 5 months ago

The Cybersecurity and Infrastructure Security Agency, or CISA, quietly updates its catalog of known vulnerabilities to indicate when those vulnerabilities are being exploited by ransomware. Recently, CISA updated data for 59 vulnerabilities, noting their use in ransomware campaigns, with the time to update varying greatly. Microsoft products are most frequently affected, with 16 CVEs updated, followed by Ivanti with 6, Fortinet with 5, and Palo Alto Networks and Zimbra with 3 each. Experts suggest organizations should adjust their prioritization strategies when these updates occur, and a tool has been created to provide alerts for these changes.

CISA Advisory Highlights Exploited SmarterTools Vulnerability in Recent Ransomware Attacks

gbhackers.com · 5 months ago

The Cybersecurity and Infrastructure Security Agency has identified a high-severity vulnerability in SmarterTools SmarterMail, tracked as CVE-2026-24423. This vulnerability, a missing authentication check in the ConnectToHub API, allows unauthenticated attackers to execute code on the server. Attackers are actively exploiting this flaw in recent ransomware campaigns to gain control of email servers, often using them to access sensitive data and move within a network. Federal agencies must remediate the issue by February 26, 2026, and all organizations are urged to apply patches immediately.

An Indian Film Embraces a Taj Majal Conspiracy Theory

www.nytimes.com · 5 months ago

false

Spam Campaign Distributes Fake PDFs, Deploys Remote Monitoring Tools for Ongoing Access

gbhackers.com · 5 months ago

A spam campaign is using deceptive emails disguised as Adobe Acrobat updates to trick users into installing Remote Monitoring and Management (RMM) software. Victims are redirected to fake download pages that deliver legitimate installers for tools like Trustconnect and Datto RMM, granting attackers persistent remote access. This "living off the land" technique allows attackers to evade detection and escalate privileges within the network. Indicators of compromise include URLs and SHA-256 hashes for malicious PDF lures and RMM installer payloads.

Betterment Data Breach Exposes Sensitive Information of 1.4 Million Customers

gbhackers.com · 5 months ago

Betterment, an automated investment platform, confirmed a data breach impacting approximately 1.4 million customers in January 2026. The breach stemmed from a social engineering attack targeting personnel and gaining access to third-party platforms. Compromised data includes personal identifiable information such as names, contact details, employer information, and device data. Following the initial breach, Betterment experienced a Distributed Denial-of-Service attack, and customers are now advised to be wary of phishing attempts.

Google Plans to Double Spending Amid A.I. Race

www.nytimes.com · 5 months ago

false

Four new vulnerabilities found in Ingress NGINX

www.csoonline.com · 5 months ago

Four security vulnerabilities have been identified in the Ingress NGINX traffic controller, commonly used in Kubernetes deployments. Two of these vulnerabilities, CVE-2026-1580 and CVE-2026-24512, carry a CVSS score of 8.8, indicating a significant risk. CVE-2026-24512 allows for configuration injection and potential code execution, while CVE-2026-1580 relates to improper input validation. With the project’s support ending next month, experts strongly recommend migrating to a different traffic controller like Kubernetes Gateway API to avoid these and other previously discovered vulnerabilities, such as those found in IngressNightmare.

I reversed Tower of Fantasy's kernel anti-cheat driver while waiting for the game to install. It's a full BYOVD toolkit that's never even loaded.

vespalec.com · 5 months ago

A security analysis reveals critical vulnerabilities in a game's anti-cheat driver, granting attackers broad system control. The driver’s authentication is extremely weak, relying on a simple hardcoded value, and lacks proper obfuscation. Exploitable flaws include bypassable checks and flawed whitelisting, enabling arbitrary process termination and acting as a Bring Your Own Vulnerability Device. The vulnerability has resulted in a filed CVE.

Sentience, Allegedly

open.substack.com · 5 months ago

false

At Ukraine’s Request, Starlink Denies Internet Access to Russian Troops

www.nytimes.com · 5 months ago

Russian forces in Ukraine are experiencing internet outages, impacting their military operations. This disruption follows a decision by SpaceX to deactivate Starlink service for Russian military use, as reported by Russian military bloggers and confirmed by Elon Musk. Ukrainian authorities previously discovered Russia was using Starlink to direct attack drones, prompting a request to SpaceX to restrict access. Now, Starlink access in Ukraine is limited to verified terminals, creating a “white list” to prevent unauthorized use by Russian forces.

Amazon’s $200 Billion Spending Plan Raises Stakes in A.I. Race

www.nytimes.com · 5 months ago

false

Bitcoin Drops to Lowest Price Since Trump Was Elected as Crypto Faces Slump

www.nytimes.com · 5 months ago

false

New APT group breached gov and critical infrastructure orgs in 37 countries

www.csoonline.com · 5 months ago

A new Asia-based cyberespionage group, tracked as TGR-STA-1030 (UNC6619), has targeted government and critical infrastructure organizations in 37 countries over the past year. The group utilizes sophisticated tactics, including phishing campaigns delivering custom malware like Diaoyu and Cobalt Strike, along with Linux rootkits called ShadowGuard. Researchers observed the group attempting to exploit CVE-2019-11580 in Atlassian Crowd software and are concerned about the group’s expanding operations and potential long-term impact on national security. The group’s targeting appears timed to coincide with specific geopolitical events.