Blahalla

Several Code Execution Flaws Patched in Veeam Backup & Replication

www.securityweek.com · 6 months ago

Veeam has released an update to address several remote code execution vulnerabilities in its Backup & Replication solution, impacting versions 13.0.1.180 and earlier. The flaws, including CVE-2025-59470, CVE-2025-55125, CVE-2025-59469, and CVE-2025-59468, require varying levels of privilege to exploit, though Veeam has adjusted severity ratings for some based on required access. These vulnerabilities were discovered internally and there is no evidence of exploitation. CISA's catalog lists other past vulnerabilities in Veeam products as being exploited in ransomware attacks.

Windows Packer pkr_mtsi Powers Widespread Malvertising Campaigns with Multiple Malware

gbhackers.com · 6 months ago

A custom Windows packer called pkrmtsi is being used in large-scale malvertising campaigns to distribute malware. The packer wraps legitimate software installers, deceiving users into downloading malicious programs through fake download portals and search engine optimization poisoning. pkrmtsi acts as a loader for malware families including Oyster, Vidar, Vanguard Stealer, and Supper. Researchers have identified distinctive behavioral patterns, including memory allocation followed by intensive small memory writes, and a bug resulting in STATUSINVALIDPAGEPROTECTION errors, which can be leveraged for detection and incident response.

New Veeam vulnerabilities expose backup servers to RCE attacks

www.bleepingcomputer.com · 6 months ago

Veeam has released security updates to address vulnerabilities in its Backup & Replication software. A critical remote code execution flaw, tracked as CVE-2025-59470, affects versions 13.0.1.180 and earlier, allowing privilege escalation by Backup or Tape Operators. Other vulnerabilities, CVE-2025-55125 and CVE-2025-59468, also enable remote code execution, and have been patched in version 13.0.1.1071. Veeam’s software is a common target for ransomware gangs like Cuba, FIN7, Frag, Akira, and Fog, who exploit these vulnerabilities for data theft and to disrupt recovery efforts.

Cybersecurity Firms Secured $14 Billion in Funding in 2025: Analysis

www.securityweek.com · 6 months ago

false

Cyberattack forces British high school to cancel classes and delay reopening

therecord.media · 6 months ago

A cyberattack has forced Higham Lane School in Nuneaton, England, to postpone its reopening. The incident has disrupted the school’s IT system, impacting communication and management tools for staff. Authorities have been notified and cybersecurity specialists are assisting with the investigation and restoration of systems. The school anticipates a phased return next week, with further updates to be provided.

Google Search AI hallucinations push Google to hire "AI Answers Quality" engineers

www.bleepingcomputer.com · 6 months ago

false

Lack of MFA Is Common Thread in Vast Cloud Credential Heist

www.darkreading.com · 6 months ago

A threat actor, known as Zestix or Sentap, is exploiting stolen credentials to breach corporate networks by targeting collaboration platforms like ShareFile, OwnCloud, and Nextcloud. The attacks occur because many organizations have not enabled multi-factor authentication (MFA). Researchers found that infostealers like RedLine, Lumma, and Vidar were used to harvest credentials from infected employee devices, which were then sold on the dark web. Implementing MFA and rotating passwords are key steps to prevent these breaches.

Hackers Exploit Zero-Day in Discontinued D-Link Devices

www.securityweek.com · 6 months ago

Hackers are actively exploiting a zero-day vulnerability in discontinued D-Link gateway devices. The vulnerability, tracked as CVE-2026-0625, allows unauthenticated attackers to execute arbitrary commands and modify DNS settings. D-Link confirms the vulnerability affects multiple legacy DSL gateway models that have reached their end of life and will not receive a security patch. Security experts recommend retiring and replacing these vulnerable devices to prevent potential misuse by threat actors.

CrazyHunter Ransomware Targets Healthcare Sector Using Sophisticated Evasion Tactics

gbhackers.com · 6 months ago

A new ransomware variant called CrazyHunter is targeting healthcare organizations, particularly in Taiwan. This sophisticated threat, derived from the Prince ransomware builder, uses advanced techniques to evade security measures and rapidly spread across networks. Attackers exploit vulnerabilities like weak Active Directory passwords and weaponize the Zemana anti-malware driver to escalate privileges and disable security software. The ransomware also employs fileless execution and a unique ChaCha20 encryption method, and data leak sites are utilized to publicly expose victim information.

UK Launches £210M Cyber Action Plan

www.techrepublic.com · 6 months ago

false

UK announces plan to strengthen public sector cyber defenses

www.bleepingcomputer.com · 6 months ago

false

The Wegman’s Supermarket Chain Is Probably Using Facial Recognition

www.schneier.com · 6 months ago

Wegman's Supermarket chain is suspected of employing facial recognition technology in its stores. This technology is believed to be operating without customer knowledge or consent. Concerns arise regarding privacy implications and potential misuse of the collected data. The use of such technology highlights the increasing prevalence of surveillance practices in everyday environments.

Chinese Hackers Use NFC-Enabled Android Malware to Steal Payment Information

gbhackers.com · 6 months ago

Chinese threat actors are using a sophisticated Android malware campaign called "Ghost Tap" to steal payment card data. This malware utilizes Near Field Communication or NFC relay technology, enabling contactless card fraud globally without physical proximity to the card. The operation is linked to groups TX-NFC and NFU Pay, which offer subscription-based access to the malware and customer support, indicating a professionalized cybercriminal enterprise. Researchers have identified over 54 unique malware samples, targeting regions with high NFC adoption and lower security awareness, such as Brazil, Italy, and Turkey.

Microsoft warns of a surge in phishing attacks exploiting email routing gaps

www.csoonline.com · 6 months ago

Threat actors are increasingly exploiting misconfigured email routing and weak domain authentication policies to make phishing emails appear to originate from within organizations. This tactic involves manipulating mail exchanger records and permissive DMARC/SPF settings to bypass filters and increase the risk of credential theft. Attackers are using platforms like Tycoon 2FA to deliver phishing lures disguised as internal communications, potentially leading to data theft, business email compromise, and adversary-in-the-middle attacks. Organizations are urged to implement strict DMARC reject policies, enforce SPF hard fails, and strengthen identity defenses with phishing-resistant MFA to mitigate this growing threat.

Complex Routing, Misconfigurations Exploited for Domain Spoofing in Phishing Attacks

www.securityweek.com · 6 months ago

Threat actors are exploiting misconfigured email routing and spoof protections to conduct phishing attacks. These attacks, often facilitated by platforms like Tycoon2FA, allow malicious actors to spoof legitimate domains and bypass multi-factor authentication. Microsoft warns that vulnerable organizations have complex routing without strict spoof protections and MX records not pointing to Office 365. The company blocked over 13 million malicious emails in October 2025 and recommends implementing strict DMARC and SPF policies to prevent these attacks.

n8n Warns of CVSS 10.0 RCE Vulnerability Affecting Self-Hosted and Cloud Versions

thehackernews.com · 6 months ago

n8n, a workflow automation platform, has identified a critical security vulnerability allowing authenticated remote code execution. The flaw, designated CVE-2026-21877, carries a maximum severity score of 10.0 and affects both self-hosted and cloud versions released between 0.123.0 and 1.121.3. Users are urged to upgrade to version 1.121.3 or later, and those unable to patch immediately should limit exposure by disabling the Git node and restricting user access. This vulnerability follows a series of other critical flaws, including CVE-2025-68613 and CVE-2025-68668.

TOTOLINK EX200 Extender Flaw Allows Attackers Full System Access

gbhackers.com · 6 months ago

A critical security vulnerability has been identified in the TOTOLINK EX200 Wi-Fi extender, allowing attackers to gain full system access. The flaw, CVE-2025-65606, stems from improper error handling during firmware updates, inadvertently enabling a password-less Telnet service with root privileges. Because the device is End-of-Life, no patch will be released, so users are urged to replace the extender or isolate it from untrusted networks. Successful exploitation requires access to the device’s web management interface.

Threat Actors Exploit Google Cloud Services to Steal Microsoft 365 Credentials

gbhackers.com · 6 months ago

A large-scale phishing campaign is targeting organizations by exploiting Google Cloud Application Integration to distribute malicious emails. Attackers are sending emails that appear legitimate by using Google's infrastructure, bypassing security filters, and redirecting victims through several URLs to mimic a Microsoft 365 login page to steal credentials. The campaign has impacted approximately 3,200 organizations across various sectors, including manufacturing, technology, and financial services, with the United States being the most affected region. Google has responded by blocking the campaigns and implementing protections, advising users to verify login page domains and enable multi-factor authentication.

The Future of Cybersecurity Includes Non-Human Employees

thehackernews.com · 6 months ago

false

ToddyCat Malware Exploits ProxyLogon to Compromise Microsoft Exchange Servers

gbhackers.com · 6 months ago

A cyber-espionage group known as ToddyCat, also called Websiic and Storm-0247, has been targeting organizations in Europe and Asia since December 2020. Initially exploiting unidentified vulnerabilities and later using CVE-2021-31207, a ProxyLogon vulnerability, the group deploys malware like Samurai, Ninja Trojan, and TCESB to gain persistent access and steal data. ToddyCat utilizes advanced techniques like DLL side-loading and BYOVD to evade defenses, focusing on credential theft and data exfiltration through methods such as exploiting OST files. Security teams should prioritize monitoring PowerShell activity, SMB share access, and browser credential repositories.

Veeam Patches Critical RCE Vulnerability with CVSS 9.0 in Backup & Replication

thehackernews.com · 6 months ago

Veeam has released updates to address vulnerabilities in its Backup & Replication software. A critical remote code execution vulnerability, CVE-2025-59470, has a CVSS score of 9.0, allowing a Backup or Tape Operator to execute code as the postgres user. Other vulnerabilities include CVE-2025-55125, CVE-2025-59468, and CVE-2025-59469, which also enable remote code execution or file writing with elevated privileges. Users of Veeam Backup & Replication versions 13.0.1.180 and earlier should update to version 13.0.1.1071.

LockBit 5.0 Unveils Advanced Encryption and Enhanced Anti-Analysis Techniques

gbhackers.com · 6 months ago

The LockBit ransomware group has released LockBit 5.0, a significantly advanced version incorporating new encryption and anti-analysis techniques. This ransomware employs a hybrid cryptographic framework using ChaCha20-Poly1305, X25519, and BLAKE2b to complicate file recovery. LockBit 5.0 also aggressively targets backup and security solutions, including Veeam, Acronis, and Microsoft Edge Update, by suspending related services and deleting temporary files to accelerate encryption. The ransomware utilizes dynamic file extension randomization to evade detection and complicate recovery efforts.

Microsoft Warns Misconfigured Email Routing Can Enable Internal Domain Phishing

thehackernews.com · 6 months ago

Threat actors are exploiting misconfigured email routing to conduct phishing attacks, impersonating organizations' internal domains. These campaigns, which have increased since May 2025, often use phishing-as-a-service platforms like Tycoon 2FA to distribute messages related to voicemails, HR communications, and password resets. Attackers are also using spoofed emails to conduct financial scams, including bogus invoice schemes that include fake invoices, IRS forms, and bank letters. Microsoft recommends strict DMARC and SPF policies, and proper configuration of third-party connectors to mitigate this risk.

Chinese Hackers Launch Ongoing Attacks on Taiwan’s Critical Infrastructure

gbhackers.com · 6 months ago

Taiwan’s National Security Bureau reports a significant increase in cyberattacks targeting the nation’s critical infrastructure. Chinese state-sponsored actors are conducting approximately 2.63 million intrusion attempts daily across nine sectors, including energy, emergency services, and healthcare. Attackers are exploiting vulnerabilities, using denial-of-service attacks, social engineering, and supply chain compromises, with APT groups like BlackTech, Flax Typhoon, and Mustang Panda leading the efforts. These operations correlate with political and military pressure, with a peak in attacks observed during key events such as President Lai’s inauguration.

Apple Rolls Out iOS 26.3 Security Test to Beta Users

www.techrepublic.com · 6 months ago

false

Veeam Backup Vulnerability Exposes Systems to Root-Level Remote Code Execution

gbhackers.com · 6 months ago

Veeam has released a security update to address multiple high-severity vulnerabilities in its Backup & Replication software. Versions 13.0.1.180 and earlier are affected, while version 12.x is not. Attackers could potentially execute remote code with root-level privileges by exploiting flaws, including CVE-2025-59470, CVE-2025-55125, CVE-2025-59468, and CVE-2025-59469. Veeam advises users to immediately update to version 13.0.1.1071 and review user role assignments.

8 things CISOs can’t afford to get wrong in 2026

www.csoonline.com · 6 months ago

There are eight priority areas CISOs must not get wrong in 2026, chief among them identity and access controls for AI agents, where identity spoofing, over‑permissioned access, and prompt injection or malicious instructions can let agents or attackers make unauthorized changes to systems and data. There are rising supply chain and operational technology risks that can halt production and cause cascading operational and financial damage, so organizations need zero trust across IT and OT, continuous third party risk monitoring, rapid patching, segmentation, and incident response drills with suppliers. There are escalating geopolitical tensions and growing cloud and compliance burdens that require CISOs to incorporate geopolitical intelligence into threat modeling, adopt proactive cloud security posture management and policy as code, and provide empirically verifiable evidence of cybersecurity and operational resilience to regulators. There are also legal and privacy exposures from AI chatbots and persistent human factor issues that necessitate disclosure practices, defenses against prompt injection, phishing resistant multi factor authentication for critical identities, continuous role based security training, and proper configuration and maintenance of existing security tools.

Black Cat Hacker Group Uses Fake Notepad++ Websites to Distribute Malware and Steal Data

gbhackers.com · 6 months ago

A cybercriminal group known as Black Cat is using fake Notepad++ websites to distribute malware and steal data. Attackers manipulate search engine results to direct users to these phishing sites, which mimic legitimate download portals and use multi-stage redirection to lower user suspicion. The malware creates a desktop shortcut to a backdoor trojan that steals browser credentials, logs keystrokes, and exfiltrates data to a command-and-control server at sbido.com. Researchers have observed approximately 277,800 compromised servers in China between December 7 and 20, 2025, highlighting the campaign’s widespread impact.

Google Warns of High-Risk WebView Vulnerability That Breaks Security Controls

gbhackers.com · 6 months ago

Google has released Chrome version 143.0.7499.192 point 193 to address a high-severity vulnerability in WebView. This flaw, identified as CVE-2026-0628, involves insufficient policy enforcement, potentially allowing attackers to bypass security controls. WebView is a critical component for rendering web content in Chrome and numerous Android applications, impacting a wide range of users on Windows, macOS, and Linux. Google is gradually rolling out the update and has withheld specific details to prevent exploitation.

Court Demands OpenAI Hand Over 20M Anonymized ChatGPT Chats in AI Copyright Dispute

gbhackers.com · 6 months ago

A federal judge has ordered OpenAI to release 20 million anonymized ChatGPT conversation logs as part of a copyright lawsuit. News organizations, including the New York Times and Chicago Tribune, initiated the legal action, questioning how copyright law applies to artificial intelligence. OpenAI initially resisted the request, citing privacy concerns, but the judge found the concerns were adequately balanced against the relevance to the litigation. This case could establish precedents for how AI companies utilize copyrighted material.

Hackers Create Fake DocuSign Login Page to Steal User Credentials

gbhackers.com · 6 months ago

Cybercriminals are increasingly using sophisticated phishing attacks to steal user credentials. Recent reports indicate phishing attacks were the top cybercrime category in 2024, resulting in over sixteen billion dollars in reported losses. Researchers have identified a new DocuSign impersonation campaign utilizing techniques like dynamic login portals built with LogoKit and hosted on IPFS and Amazon Web Services to personalize the attack and evade detection. Organizations are advised to strengthen email security with authentication protocols like SPF, DKIM, and DMARC, and to educate employees about phishing warning signs.

Sedgwick Acknowledges Data Breach After TridentLocker Ransomware Claim

gbhackers.com · 6 months ago

Sedgwick has confirmed a data breach at its government-focused subsidiary, Sedgwick Government Solutions, after the TridentLocker ransomware group claimed responsibility. The group claims to have stolen approximately 3.4 gigabytes of data from an isolated file transfer system, which they posted on the dark web. Sedgwick states its systems are segmented and that no wider systems or claims management servers were affected, and they have notified law enforcement and clients. TridentLocker uses techniques such as data exfiltration over web protocols and encryption, and has targeted organizations in North America and Europe.

Malicious Chrome Extension Leaks ChatGPT and DeepSeek Chats of 900,000 Users

gbhackers.com · 6 months ago

Two malicious Chrome extensions have compromised the data of over 900,000 users, stealing conversations from ChatGPT and DeepSeek platforms. The extensions, disguised as legitimate AI tools, secretly transmit user prompts and AI responses to attacker-controlled servers every 30 minutes. The stolen data includes sensitive information such as proprietary source code and personally identifiable information. Both extensions remain available in the Chrome Web Store and are identified by Extension IDs fnmihdojmnkclgjpcoonokmkhjpjechg1 and inhcgfpbfdjbjogdfjbclgolkmhnooop.

Hackers Exploit Routing Misconfigurations to Successfully Spoof Organizations

gbhackers.com · 6 months ago

Cybercriminals are successfully spoofing organizational domains by exploiting misconfigured routing and email authentication protections. Attackers leverage weaknesses in DMARC and SPF configurations, often using third-party connectors, to send phishing emails that appear to originate internally. These campaigns frequently utilize the Tycoon2FA phishing-as-a-service platform and involve lures like voicemail notifications and password reset requests to steal credentials or initiate financial scams involving fake invoices. Microsoft recommends strict DMARC policies, SPF complex fail settings, and enhanced authentication methods to mitigate this threat.

Automated data poisoning proposed as a solution for AI theft threat

www.csoonline.com · 6 months ago

Researchers have developed a technique called AURA to protect proprietary data used in AI systems, specifically knowledge graphs. AURA injects false data to render stolen knowledge graphs unusable to attackers, while authorized users can filter out the false data with a secret key. While the tool maintains performance with a minimal impact on query speed, some experts remain skeptical about its effectiveness, emphasizing the importance of defense in depth for AI systems. The technology addresses limitations with encryption methods that would otherwise introduce prohibitive latency, but doesn’t fully address undetected data interference within the system.

Ongoing Attacks Exploiting Critical RCE Vulnerability in Legacy D-Link DSL Routers

thehackernews.com · 6 months ago

Ongoing attacks are targeting a critical vulnerability in older D-Link DSL routers, identified as CVE-2026-0625. This vulnerability allows attackers to remotely execute commands without authentication due to improper handling of DNS configuration parameters. Exploitation began November 27, 2025, and affects models like the DSL-2740R, DSL-2640B, DSL-2780B, and DSL-526B, some of which reached end-of-life in 2020. Experts warn that this flaw enables DNS hijacking, potentially redirecting network traffic and compromising devices behind the router, and advise users to replace these outdated routers.

Cybersecurity hat kein Budget-Problem

www.csoonline.com · 6 months ago

false

These companies say AI is key to their four-day workweeks

www.washingtonpost.com · 6 months ago

false

OpenAI is rolling out GPT-5.2 “Codex-Max” for some users

www.bleepingcomputer.com · 6 months ago

false

Taiwan says China's attacks on its energy sector increased tenfold

www.bleepingcomputer.com · 6 months ago

Taiwan’s National Security Bureau reports a significant surge in cyberattacks originating from China, with a tenfold increase targeting the energy sector in 2025 compared to the previous year. These attacks, often coinciding with major political events, impacted nine critical sectors including emergency rescue, hospitals, and communications. Attack methods included exploiting hardware and software vulnerabilities, distributed denial-of-service attacks, social engineering, and supply-chain incidents. The activity is attributed to Chinese hacker groups such as BlackTech, Flax Typhoon, Mustang Panda, APT41, and UNC3886.

Optimism About Nuclear Energy Is Rising Again. Will It Last?

www.nytimes.com · 6 months ago

false

Elon Musk’s xAI Raises $20 Billion

www.nytimes.com · 6 months ago

false

Microsoft cancels plans to rate limit Exchange Online bulk emails

www.bleepingcomputer.com · 6 months ago

false

Scattered Lapsus$ Hunters Snared in Cyber Researcher Honeypot

www.darkreading.com · 6 months ago

Security researchers at Resecurity used a honeypot with synthetic and previously breached data to identify and track members of the Scattered Lapsus$ Hunters, also known as ShinyHunters. The honeypot mimicked a system containing consumer and payment transaction data, drawing the attackers in and allowing researchers to observe their methods. Researchers employed social engineering techniques to gather information and shared findings with law enforcement, connecting an attacker to multiple online accounts. Resecurity defends its practice of using real, compromised data in honeypots as necessary to deceive advanced threat actors.

New D-Link flaw in legacy DSL routers actively exploited in attacks

www.bleepingcomputer.com · 6 months ago

Security researchers have identified a command injection vulnerability, tracked as CVE-2026-0625, affecting several legacy D-Link DSL gateway routers. The flaw exists in the dnscfg.cgi endpoint due to insufficient input sanitization and allows unauthenticated attackers to execute remote commands. Several D-Link router models, including the DSL-526B, DSL-2640B, DSL-2740R, and DSL-2780B, are affected and will not receive security updates. D-Link advises users to replace these end-of-life devices to mitigate the risk.

Kimwolf Android botnet abuses residential proxies to infect internal devices

www.bleepingcomputer.com · 6 months ago

The Kimwolf botnet, an Android variant of the Aisuru malware, has infected nearly two million devices, primarily targeting Android TV boxes and streaming devices. This botnet exploits vulnerabilities in residential proxy networks, specifically taking advantage of exposed Android Debug Bridge (ADB) services on ports 5555, 5858, 12108, and 3222. Compromised devices are used for distributed denial-of-service attacks, proxy resale, and monetizing app installations, with most infections occurring in Vietnam, Brazil, India, and Saudi Arabia. Security experts recommend avoiding low-cost generic Android TV boxes and using certified devices from reputable manufacturers.

Jaguar Land Rover wholesale volumes down 43% after cyberattack

www.bleepingcomputer.com · 6 months ago

Jaguar Land Rover experienced a significant cyberattack in September 2025 that led to a 43% decrease in third-quarter wholesale volumes. Production was disrupted, causing delays in global vehicle distribution, and the incident cost the company approximately 220 million US dollars. The cyberattack, claimed by the Scattered Lapsus$ Hunters group, resulted in data theft and prompted a 1.5 billion US dollar loan guarantee from the U.K. government to address supply chain issues. The company’s sales declined across all major markets and full financial results are expected in February 2026.

Phishing actors exploit complex routing and misconfigurations to spoof domains

www.microsoft.com · 6 months ago

Threat actors are increasingly using sophisticated phishing techniques to bypass email security measures. These campaigns involve spoofing internal email addresses and exploiting misconfigured email routing, with some attacks impersonating organizational leaders to commit financial fraud. Microsoft recommends strengthening email authentication protocols like SPF, DKIM, and DMARC, and transitioning to phishing-resistant authentication methods. Organizations can leverage Microsoft Defender XDR, Security Copilot, and Microsoft Sentinel to detect and respond to these threats.

Proxying Flutter Traffic on Android with Claude

randywestergren.com · 6 months ago

Researchers have used an artificial intelligence tool, Claude, to reverse engineer and intercept network traffic from the Cronometer Android app. Traditional methods failed due to the app’s use of Flutter and a custom SSL/TLS implementation. Claude helped develop scripts that bypassed security measures and dynamically detected network connections, automating a complex process. This demonstrates how AI can accelerate mobile security research by overcoming architectural challenges and generating code.

How (not) to recycle those old gadgets

www.washingtonpost.com · 6 months ago

false