Blahalla

Gentlemen RaaS Hits Windows, Linux, and ESXi With New C-Based Locker

gbhackers.com · 6 months ago

A ransomware-as-a-service operation called Gentlemen is targeting Windows, Linux, NAS, BSD, and VMware ESXi systems. The group utilizes cross-platform lockers, including a C-based locker specifically designed for ESXi hypervisors, employing a double extortion model of encryption and data leakage. Attackers typically gain Domain Admin access, deploy Cobalt Strike beacons, and disable security tools like Microsoft Defender to facilitate widespread encryption across networks, often leveraging PowerShell and Group Policy. To persist on ESXi systems, the malware copies itself, creates boot scripts, and manipulates VMFS write buffers.

CISA Adds 8 Exploited Flaws to KEV, Sets April-May 2026 Federal Deadlines

thehackernews.com · 6 months ago

The Cybersecurity and Infrastructure Security Agency has added eight vulnerabilities to its catalog of actively exploited flaws. These include improper authentication vulnerabilities in PaperCut NG/MF (CVE-2023-27351), Quest KACE Systems Management Appliance (CVE-2025-32975), and Cisco Catalyst SD-WAN Manager, along with a path traversal flaw in Kentico Xperience (CVE-2025-2749). Other vulnerabilities affect JetBrains TeamCity (CVE-2024-27199), Synacor Zimbra Collaboration Suite (CVE-2025-48700), and Cisco Catalyst SD-WAN Manager (CVE-2026-20122, CVE-2026-20128, CVE-2026-20133). Federal agencies must patch the Cisco vulnerabilities by April 23, 2026, with the remaining vulnerabilities requiring remediation by May 4, 2026. Exploitation of some of these vulnerabilities has been linked to ransomware attacks and targeted campaigns.

12 Fraudulent Browser Extensions Disguised as TikTok Downloaders Compromise 130K Users

gbhackers.com · 6 months ago

Security researchers have discovered a coordinated campaign involving twelve fraudulent browser extensions disguised as TikTok video downloaders that have compromised over 130,000 users. These extensions, available for Chrome and Edge, initially function normally before activating malicious tracking features after six to twelve months. The attackers use a shared codebase and deceptive domain names to quickly replace flagged extensions and evade detection, and some even received a “Featured” badge from official stores. The extensions harvest extensive user data, including device fingerprints and battery status, and operate using dynamic remote configuration to bypass security reviews.

Command Execution via Drag-and-Drop in Terminal Emulators

sdushantha.github.io · 6 months ago

Researchers have discovered a vulnerability in several terminal emulators allowing command execution through a drag-and-drop feature. Malicious actors can embed hidden commands within file names, which are then executed when dragged into a terminal. The exploit utilizes control characters to bypass sanitization and trick the terminal into running unintended commands. Affected terminal emulators include Kitty and xfce4-terminal, which have since been patched, although no CVEs have been assigned.

AI-Driven Exploitation Could Shrink Defenders’ Patch Window

gbhackers.com · 6 months ago

Artificial intelligence is rapidly changing cyberattacks, enabling automated discovery and exploitation of software vulnerabilities at unprecedented speeds. This shift significantly reduces the traditional patch window, potentially shrinking response time from weeks to hours. Open-source software is particularly vulnerable due to AI's ability to quickly analyze publicly available code, raising concerns about supply chain attacks. Security teams must adapt by embracing proactive measures like stronger endpoint protections, SBOMs, rapid patching, and utilizing AI-driven defensive tools to counter this accelerated threat landscape.

Malicious GGUF Models Could Trigger Remote Code Execution on SGLang Servers

gbhackers.com · 6 months ago

Security researchers have identified a critical vulnerability in the SGLang framework, enabling Remote Code Execution. This flaw, tracked as CVE-2026-5760, arises from an insecure configuration of Jinja2, allowing malicious commands to execute when a compromised GGUF model is loaded. Attackers can exploit this by hosting weaponized models and tricking users into deploying them, potentially gaining full control of the server. The vulnerability shares characteristics with CVE-2024-34359 and CVE-2025-61620.

CISA Warns Compromised Axios npm Package Fueled Major Supply Chain Attack

gbhackers.com · 6 months ago

The Cybersecurity and Infrastructure Security Agency has issued a warning about a supply chain attack targeting the widely used Axios JavaScript library. Threat actors compromised versions 1.14.1 and 0.30.4 of Axios, injecting a malicious dependency called plain-crypto-js version 4.2.1. This allowed attackers to deploy a remote access trojan, potentially enabling them to steal source code and access corporate networks. Affected organizations should downgrade Axios to versions 1.14.0 or 0.30.3, remove the plain-crypto-js directory, and rotate exposed credentials.

SideWinder Spoofs Chrome PDF Viewer, Zimbra to Steal Government Webmail Logins

gbhackers.com · 6 months ago

A cyber campaign attributed to the SideWinder advanced persistent threat group is targeting government webmail logins in South Asia. Attackers are using a fake Chrome PDF viewer and a cloned Zimbra login page hosted on Cloudflare Workers to steal credentials from organizations including the Bangladesh Navy and Pakistan’s Ministry of Foreign Affairs. The phishing kit, identified as "Z2FALTS," employs a blurred PDF lure and reverse-proxies assets to mimic legitimate websites, while also leveraging recycled sensitive documents as bait. Researchers have identified multiple Cloudflare Workers and accounts linked to the operation, highlighting a sustained and modular credential harvesting infrastructure.

Lovable AI App Builder Hit by Reported API Flaw Exposing Thousands of Projects

gbhackers.com · 6 months ago

A vulnerability in the Lovable AI application builder is exposing sensitive data from projects created before November 2025. The flaw allows unauthorized users with free accounts to access project source code, database credentials, customer information, and AI chat histories. Recent projects are protected, but older projects receive a "200 OK" response, granting full access. Several large technology companies, including Nvidia, Microsoft, Uber, and Spotify, are potentially impacted because employees may have used the platform to develop internal tools.

Amazon Plans to Invest Up to $25 Billion in Anthropic

www.nytimes.com · 6 months ago

false

Apple CEO Tim Cook to step down in September

www.washingtonpost.com · 6 months ago

false

Vercel confirms Context.ai-linked breach exposed customer environment variables; ShinyHunters lists $2M sale on BreachForums

icbrief.org · 6 months ago

Vercel has confirmed a data breach linked to Context.ai, an AI assistant used by an employee. Attackers gained access to an employee's Google Workspace account, allowing them to access some Vercel environments and environment variables. The stolen data, including API keys, is being offered for sale on BreachForums for two million dollars. Context.ai also experienced unauthorized access to its AWS environment earlier this year impacting consumer OAuth tokens.

KelpDAO suffers $290 million heist tied to Lazarus hackers

www.bleepingcomputer.com · 6 months ago

Hackers, believed to be linked to the Lazarus Group, orchestrated a 290 million dollar crypto-heist targeting the KelpDAO DeFi project and impacting Compound, Euler, and Aave. The attack involved compromising RPC nodes to feed falsified data, allowing unauthorized transfers of rsETH tokens through Tornado Cash. LayerZero reported the incident was isolated to rsETH and attributed the attack to the Lazarus Group, specifically TraderTraitor. This recent theft follows a similar 280 million dollar attack on the Drift Protocol, demonstrating a pattern of sophisticated, long-term planning by state-sponsored actors.

China's Apple App Store infiltrated by crypto-stealing wallet apps

www.bleepingcomputer.com · 6 months ago

Malicious applications impersonating popular cryptocurrency wallets have infiltrated Apple's App Store, specifically targeting users in China. These FakeWallet apps, part of a larger campaign linked to SparkKitty, use tactics like typosquatting and fake branding to trick users into downloading them, often disguised as games or calculators. Once installed, the apps redirect users to phishing sites to download trojanized apps that steal recovery phrases and drain cryptocurrency assets. Apple has since removed the 26 apps from the App Store.

California Accuses Amazon of Price Fixing in Legal Filing

www.nytimes.com · 6 months ago

false

Vercel Employee's AI Tool Access Led to Data Breach

www.darkreading.com · 6 months ago

A security breach at Vercel stemmed from a compromised OAuth token belonging to a Vercel employee who used it to grant broad permissions to an AI tool, Context.ai. Attackers exploited this access to obtain some Vercel environments and variables, though those marked as “sensitive” remain secure. Context.ai experienced its own breach, revealing the compromise of OAuth tokens for some consumer users and highlighting the expanding risks associated with AI tools and OAuth permissions. Vercel is collaborating with Mandiant and other firms to investigate, and has contacted potentially impacted customers to rotate credentials.

Serial-to-IP Devices Hide Thousands of Old & New Bugs

www.darkreading.com · 6 months ago

Researchers have discovered 20 new vulnerabilities in popular serial-to-IP converter models from Lantronix and Silex, devices critical for connecting older industrial machinery to networks. These devices, often targeted in cyberattacks like the 2015 Ukrainian power grid attack, frequently run outdated software and libraries, leading to thousands of known vulnerabilities. Specifically, the Lantronix EDS3000PS had a critical vulnerability, CVE-2025-70082, allowing password changes without prior knowledge, while the EDS5000PS contained five remote code execution vulnerabilities with critical CVSS scores of 9.8. The study highlights a widespread lack of security hardening techniques, leaving these devices vulnerable to exploitation.

Tim Cook Will Step Down as Apple C.E.O.

www.nytimes.com · 6 months ago

false

Analysis of the April 2026 Booking.com Supply Chain Breach and ClickFix Tactics

infosecwriteups.com · 6 months ago

Booking.com recently disclosed a data breach impacting customer Personally Identifiable Information, with attackers gaining unauthorized access through the company’s supply chain, specifically partner hotels. Threat actors likely used a tactic called ClickFix, tricking hotel staff into running malicious scripts to steal session cookies, bypassing authentication measures. The stolen data, while not financial, poses a significant risk of fraud and impersonation, as attackers can use details like check-in dates and hotel names to create convincing phishing messages. Booking.com previously experienced a similar breach in 2021, resulting in a substantial fine under European data protection regulations.

The Gentlemen ransomware now uses SystemBC for bot-powered attacks

www.bleepingcomputer.com · 6 months ago

Researchers have discovered that affiliates of the Gentlemen ransomware-as-a-service operation are now utilizing a SystemBC proxy botnet of over 1,570 compromised hosts, primarily targeting corporate environments. The botnet, which has been active since 2019 and previously linked to infections of commercial virtual private servers, is used to covertly deliver payloads. Attackers gain access through Domain Controller credentials, leveraging tools like Cobalt Strike, Mimikatz, and Group Policy for lateral movement and encryption. Gentlemen ransomware employs a hybrid encryption scheme using X25519 and XChaCha20 and is actively recruiting new affiliates via underground forums.

Amtrak Data Breach Exposes 2.1M Records, Reports Suggest Larger Leak

www.techrepublic.com · 6 months ago

Amtrak is dealing with a data breach impacting over 2.1 million customer records, with reports suggesting the total could be much higher, potentially reaching 9.4 million. The exposed data includes names, addresses, email addresses, and customer service records, raising concerns about identity theft and fraud. The breach, attributed to the group ShinyHunters, involved access to Amtrak’s Salesforce environment and highlights the risks associated with cloud-based systems. Affected users are advised to change passwords, enable two-factor authentication, and monitor account activity.

The MCP Disclosure Is the AI Era’s ‘Open Redirect’ Moment

www.techrepublic.com · 6 months ago

Researchers have identified a critical vulnerability in the Model Context Protocol, or MCP, a standard used to connect enterprise AI assistants to internal tools. This flaw, present “by design,” potentially affects over 200,000 MCP servers and enables AI supply chain attacks. Security professionals are drawing comparisons to past systemic vulnerabilities like open redirects, emphasizing the rapid speed at which exploitation can occur. A Chinese state-sponsored group, GTG-1002, reportedly exploited MCP tools in a cyber-espionage campaign targeting major technology companies and government agencies. To address this, security experts recommend shifting data access governance to the data layer itself, employing a zero-trust approach to authentication and policy enforcement.

Elon Musk Ignores French Prosecutors, Widening Tech Rift With Europe

www.nytimes.com · 6 months ago

false

Seiko USA website defaced as hacker claims customer data theft

www.bleepingcomputer.com · 6 months ago

The Seiko USA website was defaced over the weekend, displaying a message claiming a Shopify customer database breach. Attackers allege they stole customer information including names, email addresses, order history, and account details, threatening to leak the data if a ransom is not paid. They instructed Seiko to contact them through a specific customer account in the Shopify admin panel, setting a 72-hour deadline. The authenticity of the claims is currently unverified, and Seiko USA has not yet publicly responded to the incident.

Microsoft Defender Flaws Exploited on Windows, Two Left Unpatched

www.techrepublic.com · 6 months ago

Microsoft Defender and Windows users face new security threats with three actively exploited vulnerabilities. BlueHammer, RedSun, and UnDefend are the names of these exploits, with BlueHammer being the only one currently patched. RedSun allows attackers to gain SYSTEM-level access by overwriting system files and has been confirmed on Windows 10, Windows 11, and various Windows Server versions. UnDefend disrupts Microsoft Defender’s definition updates, potentially disabling it altogether.

Over 800 Android Apps Targeted in PIN-Stealing Trojan Campaign

www.techrepublic.com · 6 months ago

Over 800 Android applications have been compromised in a widespread banking trojan campaign. Hackers are using techniques like phishing, fake app updates, and the Native Session Installation API to sideload malicious payloads onto devices. Once installed, the malware, including RecruitRat, SaferRat, Astrinox, and Massiv, abuses Accessibility Service permissions and overlays to steal PINs, app logins, and intercept sensitive data. Users are advised to avoid sideloading apps, review accessibility permissions, and be cautious of suspicious links or offers.

Deterministic Chain Analysis: The Missing Layer in a Mythos-Ready Security Program

dev.to · 6 months ago

false

Chrome Privacy Concerns Rise as Expert Warns of Fingerprinting Risks

www.techrepublic.com · 6 months ago

Privacy concerns are growing regarding Google Chrome's vulnerability to browser fingerprinting, a technique that tracks users through technical details like operating system and screen resolution. A privacy consultant reports that thirty fingerprinting methods currently function within Chrome. While Google previously attempted to address this through the Privacy Sandbox initiative, those plans have been abandoned, leaving third-party cookies operational. Google has recently implemented Device Bound Session Credentials to prevent session theft and is addressing a large-scale Chrome extension data breach affecting roughly 20,000 individuals.

Vercel Breach Explained: OAuth Risk in AI + SaaS Environment

www.grip.security · 6 months ago

A recent security incident at Vercel highlights the increasing danger of SaaS ecosystem vulnerabilities. An employee’s OAuth access granted to the AI tool Context.ai was exploited after Context.ai was compromised, leading to potential exposure of Vercel’s internal systems and data. This incident reveals a pattern of SaaS-to-SaaS attack chains and is accelerated by AI agents requiring extensive access, creating significant risk due to over-permissioned OAuth grants and a lack of visibility. Security teams should immediately review OAuth access to Context.ai and audit permissions granted to third-party AI tools.

Vercel Confirms Major Security Incident as Hacker Claims $2M Ransom Demand

www.techrepublic.com · 6 months ago

Cloud development platform Vercel has confirmed a security incident after a threat actor claimed unauthorized access to internal systems and demanded a $2 million ransom. The actor, allegedly affiliated with ShinyHunters, claims to have obtained sensitive data, including API keys, database contents, and employee credentials. Compromised systems could expose developer environments, CI/CD pipelines, and dependent applications, potentially allowing attackers to manipulate deployments and access production services. Vercel advises organizations to rotate credentials, restrict access, and monitor logs to mitigate similar risks.

SGLang CVE-2026-5760 (CVSS 9.8) Enables RCE via Malicious GGUF Model Files

thehackernews.com · 6 months ago

A critical security vulnerability, CVE-2026-5760, has been identified in the SGLang serving framework, allowing for remote code execution. The vulnerability arises from improper sandboxing during template rendering, enabling attackers to inject and execute arbitrary Python code through specially crafted GGUF model files. Exploitation occurs when a victim downloads and loads a malicious model, and a request is made to the "/v1/rerank" endpoint. This vulnerability is similar to CVE-2024-34359 and CVE-2025-61620 and can be mitigated by using ImmutableSandboxedEnvironment.

Building a LLM honeypot that monitors all 65535 ports

discounttimu.substack.com · 6 months ago

false

2026’s Breach List So Far: FBI Hacked, 1B Androids at Risk, 270M iPhones Vulnerable

www.techrepublic.com · 6 months ago

Several significant cyber incidents have occurred this year, impacting organizations and individuals worldwide. The FBI experienced a major intrusion compromising surveillance data, while an iPhone exploit called DarkSword, found on Ukrainian websites, potentially affects millions of devices. A database containing 149 million login credentials was exposed without password protection. Additionally, the telecom provider Brightspeed suffered a ransomware attack, and Nike experienced a data breach involving trade secrets. Google released a substantial Android security patch addressing CVE-2026-21385, which was already being exploited.

Making opportunistic cyberattacks harder by design

www.microsoft.com · 6 months ago

Opportunistic cyberattacks exploit systems adjacent to secured domains, often using stolen credentials or seeking to leverage infrastructure for wider attacks. Microsoft recommends eliminating credentials by using managed identities and federated identity patterns, which reduces the risk of compromised secrets. Reducing public-facing endpoints and enforcing least privileged access further limits attacker movement. Implementing platform engineering, particularly when an organization reaches 500 engineers, standardizes infrastructure and policies, minimizing misconfigurations and creating a more resilient environment.

Serial-to-IP Converter Flaws Expose OT and Healthcare Systems to Hacking

www.securityweek.com · 6 months ago

Researchers have identified numerous vulnerabilities in serial-to-IP converters, devices used to connect older systems to modern networks, potentially impacting industrial, healthcare, and other critical infrastructure. These flaws, collectively known as BRIDGE:BREAK, allow for OS command injection, remote code execution, and denial-of-service attacks. Attackers could manipulate data, compromise devices, and disrupt operations, as demonstrated through scenarios involving industrial sensors and healthcare systems. Vendors have released patches, and the Cybersecurity Agency has issued an advisory regarding vulnerabilities in Lantronix devices.

Microsoft: Teams increasingly abused in helpdesk impersonation attacks

www.bleepingcomputer.com · 6 months ago

Microsoft is warning of attackers increasingly using Microsoft Teams to impersonate IT or helpdesk staff and gain access to corporate networks. These attackers initiate contact through external Teams chats, tricking employees into granting remote access using tools like Quick Assist. Once inside, they use legitimate applications and protocols to move laterally, steal data, and exfiltrate sensitive information to cloud storage. Microsoft recommends treating external Teams contacts as untrusted and restricting remote assistance tools.

WhatsApp Leaks User Metadata to Attackers

www.darkreading.com · 6 months ago

Security researcher Tal Be’ery has discovered methods to extract user metadata from WhatsApp, revealing online habits and device types without consent. Attackers can silently ping devices to track activity or perform resource exhaustion attacks. By adding a contact, attackers can identify the device operating systems a user employs. While WhatsApp has confirmed the findings and implemented some mitigations, the open nature of the platform, allowing any user to message any other, remains a significant security vulnerability.

Gh0st RAT, CloverPlus Hit Victims in Dual-Malware Campaign

gbhackers.com · 6 months ago

A new malware campaign is bundling the Gh0st RAT with CloverPlus adware to achieve both long-term system control and immediate revenue generation. The loader uses rundll32.exe and avoids detection by copying itself to the %temp% directory. Gh0st RAT abuses DNS to block security resources and uses techniques like ping-based sleep to evade sandboxes; it also employs a dead drop resolver routine to hide its command-and-control infrastructure. The malware collects system information, establishes persistence through various Windows mechanisms, and includes keylogging capabilities targeting Remote Desktop sessions.

⚡ Weekly Recap: Vercel Hack, Push Fraud, QEMU Abused, New Android RATs Emerge & More

thehackernews.com · 6 months ago

Several cybersecurity threats are currently active, with attackers exploiting vulnerabilities in various systems. Recent incidents include compromises of Vercel systems through a third-party AI tool and disruptions to DDoS-for-hire services. New malware, such as the PowMix botnet and malicious Chrome extensions, are targeting users, while AI is being utilized both by defenders and attackers. Organizations are urged to proactively address vulnerabilities and adapt to evolving attack techniques.

British Scattered Spider hacker pleads guilty to crypto theft charges

www.bleepingcomputer.com · 6 months ago

A British man, Tyler Robert Buchanan, has pleaded guilty to wire fraud and aggravated identity theft as a leader of the Scattered Spider cybercrime collective. He and his accomplices orchestrated phishing attacks against at least a dozen companies between 2021 and 2023, stealing over eight million dollars in cryptocurrency. The group uses tactics like SMS phishing, SIM swapping, and MFA bombing to breach networks and often partners with Russian ransomware groups such as BlackCat/AlphV, Qilin, and RansomHub. Scattered Spider, also known as 0ktapus and UNC3944, is comprised of mostly young threat actors who operate through online platforms.

Attackers abuse Microsoft Teams to impersonate the IT helpdesk in a new enterprise intrusion playbook

www.csoonline.com · 6 months ago

Attackers are exploiting Microsoft Teams to impersonate IT helpdesk staff and gain access to organizations through a new technique called “cross-tenant helpdesk impersonation.” This method uses social engineering to trick employees into granting remote control and bypassing traditional security defenses. Experts say this represents an evolution of existing social engineering tactics, leveraging real-time interaction and legitimate tools to appear as normal IT operations, making detection more challenging. Organizations should implement tighter controls, enhance visibility across security layers, and prioritize behavioral detection to mitigate this rising threat.

Intel Utility Hijacked in AppDomain Attack to Launch Malware

gbhackers.com · 6 months ago

Hackers are employing a sophisticated technique called Operation PhantomCLR to deploy malware by hijacking a trusted Intel utility, IAStorHelp.exe. Attackers abuse the.NET AppDomainManager feature to execute malicious code within the signed executable, bypassing common security defenses. The campaign uses spear-phishing emails containing a deceptive document and a specially crafted.exe.config file to initiate the compromise. The malware employs stealthy methods like JIT trampoline techniques, CloudFront-backed command and control, and memory wiping to evade detection and frustrate forensic investigations.

British Scattered Spider Hacker Pleads Guilty in the US

www.securityweek.com · 6 months ago

A British national, Tyler Robert Buchanan, has pleaded guilty to conspiring to hack into company networks and steal cryptocurrency. Buchanan and his co-conspirators used SMS phishing attacks and SIM swapping to access accounts and bypass multi-factor authentication, resulting in at least $8 million in stolen cryptocurrency. He faces sentencing on August 21st. Scattered Spider, also known as Muddled Libra, has been linked to previous high-profile cyber intrusions, including attacks on MGM Resorts and retailers.

Hackers exploit Vercel’s trust in AI integration

www.csoonline.com · 6 months ago

Vercel, a cloud platform, experienced a data breach after a third-party AI application, Context.ai, was compromised. Attackers exploited a Google Workspace OAuth integration to gain access to internal systems and a limited set of customer credentials. The threat actor, potentially linked to ShinyHunters, attempted to sell the stolen data, which reportedly includes access keys and source code. Vercel has contacted affected customers to rotate credentials and advises users to review logs and protect sensitive variables.

Microsoft tests Windows Explorer speed, performance improvements

www.bleepingcomputer.com · 6 months ago

false

Anthropic MCP Hit by Critical Vulnerability Enabling Remote Code Execution

gbhackers.com · 6 months ago

A critical vulnerability in Anthropic’s Model Context Protocol, or MCP, has exposed over 150 million downloads and up to 200,000 servers to potential takeover. The flaw, an architectural design decision within the official MCP SDKs, allows for Arbitrary Remote Code Execution and access to sensitive data. This has resulted in at least ten CVEs, including CVE-2026-30615 affecting Windsurf, CVE-2026-30623 affecting LiteLLM, CVE-2026-30617 affecting Langchain-Chatchat, CVE-2025-65720 affecting GPT Researcher, and CVE-2026-30618 affecting Fay Framework. Security experts recommend blocking internet access to AI services, treating configurations as untrusted, and upgrading affected services immediately.

North Korea-Linked UNC1069 Hacks Crypto Pros via Fake Meetings

gbhackers.com · 6 months ago

A North Korea-linked threat actor, UNC1069, is targeting cryptocurrency and Web3 professionals through sophisticated fake Zoom, Google Meet, and Microsoft Teams meetings. Attackers impersonate investment firms and use social engineering to trick victims into running malicious commands, deploying malware like Cabbage RAT and NukeSped RAT across Windows, macOS, and Linux systems. These fake meeting portals also covertly record audio and video, potentially for use in future social engineering attacks. Security experts recommend verifying counterparties, avoiding command pasting, and monitoring for suspicious activity to mitigate the risk.

Hackers Abuse QEMU for Defense Evasion

www.securityweek.com · 6 months ago

Security researchers have observed threat actors increasingly exploiting QEMU, a machine emulator, to deploy ransomware and establish backdoors. Campaigns, such as those tracked as STAC4713 and STAC3725, have leveraged QEMU to create covert communication channels and harvest credentials. Attackers initially targeted vulnerabilities like CVE-2025-26399 in SolarWinds Web Help Desk and CVE-2025-5777, the CitrixBleed2 bug, for initial access. Sophos attributes these attacks to the Gold Encounter group, which operates the PayoutsKing ransomware.

Why Most AI Deployments Stall After the Demo

thehackernews.com · 6 months ago

false

Is “Satoshi Nakamoto” Really Adam Back?

www.schneier.com · 6 months ago

false