Blahalla

New APT group breached gov and critical infrastructure orgs in 37 countries

www.csoonline.com · 5 months ago

A new Asia-based cyberespionage group, tracked as TGR-STA-1030 (UNC6619), has targeted government and critical infrastructure organizations in 37 countries over the past year. The group utilizes sophisticated tactics, including phishing campaigns delivering custom malware like Diaoyu and Cobalt Strike, along with Linux rootkits called ShadowGuard. Researchers observed the group attempting to exploit CVE-2019-11580 in Atlassian Crowd software and are concerned about the group’s expanding operations and potential long-term impact on national security. The group’s targeting appears timed to coincide with specific geopolitical events.

EnCase Driver Weaponized as EDR Killers Persist

www.darkreading.com · 5 months ago

Threat actors are exploiting a loophole in Windows Driver Signature Enforcement to disable security products using a technique called bring-your-own-vulnerable-driver, or BYOVD. Attackers weaponized an older, unsigned EnCase forensic tool driver, which Windows still loads despite its certificate expiring in 2010, to terminate security processes. Microsoft’s Driver Signature Enforcement allows drivers signed before July 29, 2015, to load, creating a vulnerability that attackers are exploiting, and in some cases, forging timestamps to bypass driver verification. Huntress researchers identified the tactic during an intrusion that started with compromised SonicWall VPN credentials.

Agentic AI Site 'Moltbook' Is Riddled With Security Risks

www.darkreading.com · 5 months ago

A new experimental platform called Moltbook, designed for artificial intelligence agents to interact, recently exposed its internal database, revealing user data and personally identifiable information. Security experts found the platform lacked basic security measures, allowing easy access to user data and potential for malicious bot control. The incident highlights risks associated with increasingly interconnected AI agents, particularly concerning prompt injection and the potential for cascading attacks across networks. Researchers caution that the design of such platforms, without adequate safeguards and data integrity controls, poses significant security challenges.

Spain's Ministry of Science shuts down systems after breach claims

www.bleepingcomputer.com · 5 months ago

Spain’s Ministry of Science has partially shut down its IT systems following a reported cyberattack. The Ministry acknowledged a technical incident and is extending deadlines for affected procedures. A threat actor, using the alias GordonFreeman, claims to have gained full administrative access through an Insecure Direct Object Reference, or IDOR, vulnerability. The attacker has posted data samples online, including personal records and official documents.

Substack data breach leaks users’ email addresses and phone numbers

www.csoonline.com · 5 months ago

Substack, a publishing platform, recently experienced a data breach affecting an unknown number of users. The breach, which occurred in October 2025, involved the compromise of user email addresses, phone numbers, and internal metadata. While credit card numbers, passwords, and financial information were not affected, a dark web source claims approximately 697,313 records were exposed, including payment system IDs from Stripe. Substack has fixed the vulnerability and is investigating the incident, advising users to be cautious of suspicious emails.

Ransomware gang uses ISPsystem VMs for stealthy payload delivery

www.bleepingcomputer.com · 5 months ago

Cybercriminals are exploiting virtual machines from ISPsystem to host and distribute ransomware and malware. Researchers found multiple ransomware groups, including WantToCry, LockBit, and BlackCat, using identical VM hostnames and system identifiers generated by ISPsystem’s VMmanager. This tactic allows malicious actors to hide their infrastructure among legitimate virtual machines, complicating attribution and takedowns. Several hosting providers, including Stark Industries Solutions Ltd. and MasterRDP, are implicated in enabling this abuse.

Data Tool to Triage Exploited Vulnerabilities Can Make KEV More Useful

www.darkreading.com · 5 months ago

The US Cyber and Infrastructure Security Agency’s Known Exploited Vulnerabilities, or KEV, Catalog may not always align with an organization’s cybersecurity priorities. A new tool called KEV Collider aims to help security teams better triage the KEV list by combining it with data like CVSS scores and exploit automation status within Metasploit. The KEV catalog includes vulnerabilities with a CVE identifier, available mitigation, evidence of exploitation, and affecting US civilian interests. The tool allows organizations to quickly assess vulnerabilities and determine whether they require immediate attention, can be addressed later, or are not a concern.

Chrome Vulnerabilities Allow Code Execution, Browser Crashes

www.techrepublic.com · 5 months ago

Google has released a Chrome security update to address two high-severity vulnerabilities that could allow attackers to execute code or cause browser crashes. One vulnerability, CVE-2026-1861, involves a heap buffer overflow in the libvpx video decoding library. The other, CVE-2026-1862, is a type confusion vulnerability within the V8 JavaScript engine, potentially enabling arbitrary code execution. Users are advised to update Chrome and implement browser hardening measures to mitigate these risks.

Incognito Market admin sentenced to 30 years for running $105 million dark web drug empire

www.bitdefender.com · 5 months ago

A Taiwanese man, Rui-Siang Lin, has been sentenced to 30 years in federal prison for operating Incognito Market, a large dark web marketplace for illegal drugs. The marketplace facilitated over 105 million dollars in sales to more than 400,000 customers, offering substances like cocaine and heroin. Lin's operation was shut down after investigators traced the domain registration back to him using his personal information. Prosecutors linked the marketplace to at least one death resulting from fentanyl-laced pills purchased through the site.

Microsoft Overhauls Security Leadership as AI Expands Enterprise Attack Surface

www.techrepublic.com · 5 months ago

false

CISA gives federal agencies one year to rip out end-of-life devices

therecord.media · 5 months ago

The Cybersecurity and Infrastructure Security Agency has ordered federal agencies to remove end-of-life hardware and software within one year. These unsupported devices pose a significant risk due to exploitation campaigns by sophisticated hackers, including those with ties to nation-states. Agencies must first inventory all end-of-life devices within three months, then decommission them within a year, and establish a process for continuous discovery. The directive addresses a persistent cyber threat enabled by devices from companies like Barracuda, Ivanti, and Fortinet.

Django SQL Injection in RasterField lookup (CVE-2026-1207)

vulnerabletarget.com · 5 months ago

NULL

New Clickfix variant ‘CrashFix’ deploying Python Remote Access Trojan

www.microsoft.com · 5 months ago

A new malware variant called CrashFix has been discovered, evolving from the ClickFix campaign. Attackers use fake ad blocker extensions to crash browsers, then trick users into running malicious commands. The threat employs social engineering, existing system tools, and a Python-based remote access Trojan, ModeloRAT, to stay hidden and gain access. Microsoft recommends strengthening security measures such as cloud protection, endpoint detection, and multi-factor authentication to defend against this attack.

Microsoft to shut down Exchange Online EWS in April 2027

www.bleepingcomputer.com · 5 months ago

false

AISURU/Kimwolf Botnet Launches Record-Setting 31.4 Tbps DDoS Attack

thehackernews.com · 5 months ago

A record-breaking distributed denial-of-service attack peaked at 31.4 Terabits per second and lasted just 35 seconds, attributed to the AISURU/Kimwolf botnet. This botnet, which has ensnared over 2 million compromised Android devices, has also been linked to "The Night Before Christmas" campaign which averaged 4 Tbps. DDoS attacks surged dramatically in 2025, with Cloudflare mitigating over 34 million network-layer attacks. The botnet uses residential proxy networks like IPIDEA, which Google recently disrupted through legal action and collaboration with Cloudflare.

Files Reveal Epstein’s Money Mingled with Silicon Valley’s Tech Start-Ups

www.nytimes.com · 5 months ago

Recent disclosures reveal Jeffrey Epstein invested in several Silicon Valley start-ups following his 2008 conviction. Coinbase received a three million dollar investment from Epstein, which later yielded multimillion-dollar returns for the financier. Billionaire Peter Thiel advised Epstein on potential investments in Palantir, and he also invested in Jawbone and was pitched on backing SpaceX. These relationships highlight Epstein’s ability to access promising companies and influential figures within the tech industry.

Italian university La Sapienza goes offline after cyberattack

www.bleepingcomputer.com · 5 months ago

Rome’s La Sapienza University is experiencing significant disruptions due to a cyberattack. The university has taken systems offline as a precaution and is working with authorities to restore operations. Reports indicate the attack is a ransomware incident, potentially linked to a pro-Russian group using the Rorschach ransomware, which combines elements of Babuk, LockBit v2.0, and DarkSide. While a ransom has been demanded, university staff have not engaged, and there is a risk of data leakage.

The security implementation gap: Why Microsoft is supporting Operation Winter SHIELD

www.microsoft.com · 5 months ago

false

Russian hackers attacking European maritime and transport orgs using Microsoft Office exploit

therecord.media · 5 months ago

Russian state-linked hackers, identified as APT28 or Fancy Bear, have launched a spearphishing campaign targeting maritime, transportation, and diplomatic entities across Europe and the Middle East. The attacks exploited a newly disclosed Microsoft Office vulnerability, CVE-2026-21509, shortly after its public release. Malicious emails disguised as legitimate government correspondence deployed malware, including MiniDoor and PixyNetLoader, to steal data and establish backdoors. Attackers leveraged compromised email accounts and cloud services to mask their activities and blend in with normal network traffic.

Romanian oil pipeline operator Conpet discloses cyberattack

www.bleepingcomputer.com · 5 months ago

Romanian oil pipeline operator Conpet has reported a cyberattack that disrupted its business systems and took down its website. The company says its core pipeline operations are unaffected, but the incident is under investigation with the help of national cybersecurity authorities. The Qilin ransomware gang has claimed responsibility, alleging they stole approximately 1 terabyte of data, including financial and personal information. This attack is part of a recent string of cyber incidents targeting Romanian infrastructure, including utilities and healthcare providers.

Substack Discloses Security Incident After Hacker Leaks Data

www.securityweek.com · 5 months ago

Substack, a digital publishing platform with approximately 35 million subscribers, recently experienced a data breach. A hacker leaked user data, including names, email addresses, phone numbers, profile pictures, and user IDs. The incident occurred in October 2025 but was discovered in February and involved unauthorized access to limited user data. Substack reports that passwords and financial information were not compromised, and users are advised to be vigilant of suspicious communications.

When cloud logs fall short, the network tells the truth

www.bleepingcomputer.com · 5 months ago

Cloud migrations often create security blind spots despite promises of inherent security. Network-layer telemetry offers a consistent view across various cloud providers, overcoming the challenges of disparate log formats. Monitoring should include east-west and north-south traffic, container activity, TLS metadata, and DNS data, and should focus on detecting adversary patterns like data exfiltration, unusual container behavior, and misuse of managed services. Combining network data with endpoint and container data improves detection accuracy and helps identify threats like cryptomining and credential theft.

Substack warns customers of data breach following hacker’s dark web claims

therecord.media · 5 months ago

Substack customers received a notification about a data breach impacting user data. The company confirmed unauthorized access to limited user information, including email addresses, phone numbers, and metadata dating back to October 2025. Credit card numbers and passwords were not compromised, and Substack is investigating the incident and implementing security improvements. An unidentified hacker has claimed responsibility for stealing data from approximately 700,000 users.

Researchers uncover vast cyberespionage operation targeting dozens of governments worldwide

therecord.media · 5 months ago

Researchers have identified a widespread cyberespionage campaign targeting governments across the globe. The operation, attributed to a group based in Asia, has compromised at least 70 institutions in 37 countries, with some victims having been targeted for months. Hackers breached telecommunications companies, police agencies, and ministries, focusing on espionage and data theft, and the activity has been linked to current events and regional conflicts. The group utilized phishing campaigns and exploited vulnerabilities in various software and hardware, adapting their tactics based on the target environment.

Italy blames Russia-linked hackers for cyberattacks ahead of Winter Olympics

therecord.media · 5 months ago

Italy has reportedly thwarted cyberattacks originating from Russia, targeting diplomatic missions and facilities related to the 2026 Winter Olympics. The attacks, which began with Washington, impacted roughly 120 locations including consulates in Sydney, Toronto, and Paris. The pro-Russian hacker group NoName057(16) claimed responsibility for the distributed denial-of-service attacks as retaliation for Italy’s support of Ukraine. This incident follows a pattern of Russian-linked hacking groups targeting major sporting events, similar to incidents at the 2018 Winter Olympics and the 2024 Summer Olympics.

Cyber Success Trifecta: Education, Certifications & Experience

www.darkreading.com · 5 months ago

false

Researchers Expose Network of 150 Cloned Law Firm Websites in AI-Powered Scam Campaign

www.securityweek.com · 5 months ago

Researchers have uncovered a network of over 150 cloned law firm websites involved in a sophisticated scam campaign. The websites impersonate legitimate firms, targeting individuals who have already been defrauded and offering to recover lost funds. The campaign utilizes techniques like multiple registrars, unique SSL certificates, and Cloudflare to evade detection and takedowns. Experts suspect the scammers may be collecting personal information from victims for profit, though the monetization method remains unclear. The rise of AI is enabling criminals to create these sites quickly and at scale, lowering the barrier to entry for cybercrime.

VS Code Configs Expose GitHub Codespaces to Attacks

www.securityweek.com · 5 months ago

Researchers have discovered a potential security vulnerability in GitHub Codespaces that allows attackers to execute malicious commands through VS Code configuration files. These files, automatically run when a repository or pull request is opened, can be manipulated to exfiltrate GitHub tokens and other sensitive information. Attackers could also leverage this to create malicious pull requests, potentially impersonating maintainers and compromising public repositories. Microsoft confirmed the behavior is intentional, but the firm has been notified of the security risk.

Cyberattackers Use Fake RTO Challan Alerts to Spread Android Malware

gbhackers.com · 5 months ago

Cybercriminals are targeting Indian users with a sophisticated Android malware campaign disguised as Regional Transport Office, or RTO, challan notifications. The malware spreads through WhatsApp messages and uses a three-stage process: initially dropping and running a cryptominer, then establishing persistence and connecting to a Google Firebase backend, and finally, stealing data through a fake government portal. This infrastructure has compromised approximately 7,400 devices, collecting sensitive information like Aadhaar numbers, UPI PINs, and banking credentials, enabling financial fraud and identity theft. Security experts recommend using trusted mobile security solutions and verifying official notifications through legitimate channels.

Yara-X + PacketSmith Detection Module

packetsmith.ca · 5 months ago

PacketSmith version 5 now integrates with Yara-X, expanding network traffic analysis capabilities. This new feature enables the creation of detection rules focused on network metadata and deep protocol attributes. A demonstration showcases detecting DNS command and control traffic using custom PacketSmith identifiers and YARA-X. The integration offers cross-layer correlation and detailed results for network detection and security research.

ShadowSyndicate Leverages Server Transition Technique in Latest Ransomware Attacks

gbhackers.com · 5 months ago

Cybersecurity researchers have identified a new technique used by the ShadowSyndicate ransomware group to manage its infrastructure. The group rotates SSH fingerprints across servers to obscure operational continuity, but security lapses have allowed for tracking these connections. ShadowSyndicate provides infrastructure to several ransomware operations, including Cl0p, ALPHV/BlackCat, and Ryuk, and may operate as an Initial Access Broker or bulletproof hosting provider. Researchers have linked the group to data exfiltration during RansomHub attacks and observe a preference for specific hosting providers and autonomous system numbers.

n8n Vulnerability Allows Remote Attackers to Hijack Systems via Malicious Workflow Execution

gbhackers.com · 5 months ago

n8n has released security updates to address a critical Remote Code Execution vulnerability, tracked as CVE-2026-25049. The flaw allows authenticated attackers to execute arbitrary system commands by exploiting a weakness in how data expressions are processed within workflows. This vulnerability requires authentication but can be exploited by users with common permissions, potentially granting access to sensitive data and internal network resources. Patched versions 1.123.17 and 2.5.2 are now available, and administrators are urged to upgrade immediately.

ThreatsDay Bulletin: Codespaces RCE, AsyncRAT C2, BYOVD Abuse, AI Cloud Intrusions & 15+ Stories

thehackernews.com · 5 months ago

Cyberattacks are evolving with threat actors prioritizing stealth and efficiency through automation and shared resources. SystemBC botnets, screensaver files, and revoked drivers are being used for initial access, while vulnerabilities in tools like Sandboxie are being exploited. Ransomware groups are leveraging known vulnerabilities, prompting security agencies to update advisories, and Chinese APT groups are showing emerging shared tactics. Microsoft will also deprecate older TLS versions for Azure Blob Storage in 2026.

Newsletter platform Substack notifies users of data breach

www.bleepingcomputer.com · 5 months ago

Newsletter platform Substack recently notified users of a data breach that occurred in October 2025. Attackers gained unauthorized access to a limited amount of user data, including email addresses and phone numbers. Fortunately, passwords, financial information, and credit card numbers were not compromised. A database containing nearly 700,000 user records was posted on a hacking forum.

Moxa Switches Vulnerability Enables Unauthorized Access through Authentication Bypass

gbhackers.com · 5 months ago

A critical vulnerability, tracked as CVE-2024-12297, has been identified in Moxa TN-A and TN-G series industrial Ethernet switches. The flaw allows attackers to bypass authentication, potentially granting unauthorized access with a CVSS score of 9.2. The vulnerability stems from weaknesses in the device's frontend authorization logic, enabling password brute-forcing and MD5 collision attacks. Moxa recommends applying patches obtained through technical support and implementing network segmentation, access controls, and other security best practices as a temporary measure.

Cybersecurity Alert: Fake Traffic Ticket Portals Target Personal, Credit Card Data

gbhackers.com · 5 months ago

A sophisticated phishing campaign is targeting Canadian drivers by impersonating provincial traffic bureaus. Attackers use a technique called SEO poisoning to manipulate search engine results and direct victims to fake websites. These sites employ a “waiting room” tactic, which actively controls the user’s experience by using frequent polling requests and a "heartbeat" function to monitor activity. The process involves collecting personal information and credit card details, which are then sent to a malicious server, rather than a legitimate government entity.

Italy Averted Russian-Linked Cyberattacks Targeting Winter Olympics Websites, Foreign Minister Says

www.securityweek.com · 5 months ago

Italy has reportedly thwarted cyberattacks linked to Russia. These attacks targeted the country's foreign ministry offices, including a location in Washington, as well as websites and hotels associated with the Winter Olympics in Cortina d’Ampezzo. Officials state that approximately 6,000 security personnel are being deployed to protect the Games locations, which span from Milan to the Dolomites. The attacks occurred as the Winter Olympics began, with curling matches commencing in Cortina.

SystemBC Infects 10,000 Devices After Defying Law Enforcement Takedown

www.securityweek.com · 5 months ago

Cybersecurity researchers report the SystemBC malware botnet, also known as Coroxy and DroxiDat, continues to operate after a recent law enforcement takedown. The botnet now affects over 10,000 devices, primarily in the United States, Germany, France, Singapore, and India. The malware functions as a SOCKS5 proxy, masking malicious activity and generating revenue, and has been linked to attacks targeting WordPress websites. Authorities targeted SystemBC in May 2024 as part of Operation Endgame, but the botnet’s developer has persisted in underground forums.

Attackers exploit decade‑old Windows driver flaw to shut down modern EDR defenses

www.csoonline.com · 5 months ago

Attackers are exploiting a decade-old flaw in Windows to disable endpoint security tools. The technique, known as Bring Your Own Vulnerable Driver or BYOVD, involves abusing a signed but revoked EnCase forensic driver to terminate security processes from kernel mode. This bypasses protections like Protected Process Light, allowing attackers to disable EDR systems. The vulnerability exists because Windows does not check certificate revocation lists during driver load, and drivers signed before 2015 are granted an exception. Organizations should enable the Vulnerable Driver Blocklist and enforce strong access controls to mitigate this threat.

Backdoor in Notepad++

www.schneier.com · 5 months ago

Hackers linked to the Chinese government compromised Notepad++ through a Trojaned update mechanism. The attackers maintained access to the Notepad++ update infrastructure for several months, allowing them to redirect updates to malicious servers. The compromise exploited weaknesses in older versions of Notepad++ and targeted specific users. Users are advised to update to version 8.9.1 or later.

Ransomware-Attacke auf Buhlmann Group

www.csoonline.com · 5 months ago

The Buhlmann Group, a German steel trading company, has been targeted by the Akira ransomware group. Hackers claim to have stolen 55 gigabytes of sensitive data and are threatening to release it. A spokesperson for Buhlmann confirmed a cyberattack on a US subsidiary, but stated that systems in Germany and the EU were not affected. The Akira group is known for numerous attacks on German companies.

LockBit 5.0 Unveils Cross-Platform Threats for Windows, Linux & ESXi Systems

gbhackers.com · 5 months ago

LockBit 5.0, a ransomware variant operating on a Ransomware-as-a-Service model, is now targeting Windows, Linux, and VMware ESXi systems. The ransomware uses ChaCha20 encryption for speed and includes a "Fast Mode" that encrypts a portion of files to quickly render them unusable. The threat group is reportedly consolidating with other cybercriminal organizations, potentially forming a cartel. This latest version specifically targets ESXi servers by powering down virtual machines and encrypting critical data, and it evades detection by employing anti-analysis techniques.

The Buyer’s Guide to AI Usage Control

thehackernews.com · 5 months ago

false

Critical N8n Sandbox Escape Could Lead to Server Compromise

www.securityweek.com · 5 months ago

A critical vulnerability exists in the n8n AI workflow automation platform, allowing attackers to execute commands on the server. Tracked as CVE-2026-25049, the issue stems from a flawed sanitization routine that can be bypassed using crafted JavaScript expressions. Successful exploitation can lead to full server compromise, exposing sensitive information like credentials and API keys. The vulnerability was initially patched but subsequently bypassed, with a final fix implemented in version 2.4.0, and users are urged to update promptly.

Varonis Acquires AllTrue to Strengthen AI Security Capabilities

www.techrepublic.com · 5 months ago

false

Data breach at fintech firm Betterment exposes 1.4 million accounts

www.bleepingcomputer.com · 5 months ago

A data breach at the financial technology firm Betterment exposed the personal information of approximately 1.4 million accounts. Stolen data includes email addresses, names, geographic locations, dates of birth, addresses, phone numbers, device information, employer data, and job titles. Following the initial breach, Betterment experienced a distributed denial-of-service attack and was subjected to an extortion attempt. Investigations have confirmed that customer accounts, passwords, or login information were not compromised.

European Officials Warn of Russian Satellites Intercepting Communications

www.techrepublic.com · 5 months ago

Russian satellites, Luch-1 and Luch-2, are raising concerns due to their close proximity operations near European communications satellites. These satellites are believed to be part of Russia’s “inspector” program and have reportedly intercepted communications from over a dozen satellites, potentially compromising both government and commercial operations. Concerns extend beyond signals intelligence to include potential jamming, spoofing, and physical disruption, leading to increased investment in space domain awareness and satellite cybersecurity. There is a growing discussion about establishing norms and regulations for satellite proximity operations to mitigate risks to critical infrastructure.

The Shadow Campaigns: Uncovering Global Espionage

unit42.paloaltonetworks.com · 5 months ago

A cyberespionage group, known as TGR-STA-1030 or UNC6619, has been compromising government and critical infrastructure in 37 countries, conducting reconnaissance in 155 countries. The group uses sophisticated tactics including phishing campaigns, Cobalt Strike, VShell, and a newly developed Linux kernel rootkit called ShadowGuard. Their activities appear linked to geopolitical events and interests such as rare earth minerals, trade agreements, and naval transitions, with targets including Taiwan's power sector and African nations. The group has also exploited CVE-2019-11580.

The silent security gap in enterprise AI adoption

www.csoonline.com · 5 months ago

Most organizations believe their sensitive data is well-protected, but the rise of artificial intelligence is creating a security gap. AI inference traffic, containing data like proprietary source code, customer records, and strategic workflows, is frequently unclassified, unsanitized, and unprotected as it passes through systems. This is compounded by the fact that traditional security tools like data loss prevention and encryption struggle with the dynamic, unstructured nature of AI prompts, and that internal exposure is a greater risk than external attacks. Furthermore, the potential for future decryption of AI data via quantum computing poses a long-term security challenge.

Cyberspy Group Hacked Governments and Critical Infrastructure in 37 Countries

www.securityweek.com · 5 months ago

A state-sponsored cyberespionage group, tracked as TGR-STA-1030 and known as the Shadow Campaign, has targeted government and critical infrastructure organizations in dozens of countries. The group, believed to be operating out of Asia, has compromised the systems of at least 70 organizations and conducted reconnaissance in 155 countries, targeting areas such as law enforcement and finance. Attackers initially gain access through sophisticated phishing emails and use a previously unknown Linux kernel rootkit called ShadowGuard to remain undetected. They have attempted to exploit known vulnerabilities in products from Microsoft, SAP, Atlassian, D-Link, Apache, Commvault, and various China-based vendors.