Blahalla

Cloud file-sharing sites targeted for corporate data theft attacks

www.bleepingcomputer.com · 6 months ago

A threat actor known as Zestix is selling stolen corporate data obtained from ShareFile, Nextcloud, and OwnCloud instances. Attackers likely gained initial access through infostealers like RedLine, Lumma, and Vidar, distributed via malvertising campaigns and ClickFix attacks. The stolen data, ranging from gigabytes to terabytes, includes sensitive files from sectors like aviation, defense, healthcare, and government. Hudson Rock has identified thousands of infected computers at multiple organizations, including Deloitte, KPMG, Samsung, Honeywell, and Walmart.

CISOs Face a Tighter Insurance Market in 2026

www.darkreading.com · 6 months ago

false

tailsnitch: A security auditor and configuration checklist for Tailscale configurations

www.adversis.io · 6 months ago

A threat based hardening guide for Tailscale recommends replacing the default permit all ACL with an explicit deny first policy, adding port specific rules, and using deny tests to prevent accidental exposure of production databases while auditing configurations with an automated tool called tailsnitch. The guidance emphasizes that ACLs are enforced at the destination so a compromised device retains its permissions, that subnet routers can expose entire networks, and that endpoint generated flow logs can be spoofed, so defenses should assume breach and rely on segmentation and cross referenced logging. Prioritized controls include restricting subnet route auto approval, integrating device posture checks with EDR, implementing time limited or just in time production access, and using Tailnet Lock with customer controlled signing nodes for high risk or compliance driven environments.

Why cybersecurity needs to focus more on investigation and less on just detection and response

www.csoonline.com · 6 months ago

false

ClickFix attack uses fake Windows BSOD screens to push malware

www.bleepingcomputer.com · 6 months ago

A social engineering campaign called PHALTBLYX is targeting the hospitality sector in Europe with a new technique called ClickFix. Attackers send fake Booking.com reservation cancellation emails that lead victims to a cloned website displaying a deceptive Windows Blue Screen of Death (BSOD) error. This prompts users to unknowingly paste and execute a malicious PowerShell command, leading to the download and execution of a DCRAT remote access Trojan, which establishes persistence and allows for remote access, keylogging, and potentially cryptocurrency mining. The malware utilizes process hollowing and memory execution to evade detection.

5 myths about DDoS attacks and protection

www.csoonline.com · 6 months ago

Distributed denial-of-service, or DDoS, attacks are more prevalent than many believe, impacting businesses of all sizes with over 15 million attacks recorded worldwide in 2024. Modern DDoS attacks are increasingly sophisticated, often targeting application layers like DNS and HTTP and utilizing smaller, more surgically precise attacks. While next-generation firewalls are valuable, their stateful design can make them vulnerable to certain DDoS attacks, and relying solely on cloud-based protection is insufficient. Artificial intelligence and machine learning are now crucial for detecting and mitigating complex, evolving DDoS threats.

Critical 'MongoBleed' Bug Under Attack, Patch Now

www.darkreading.com · 6 months ago

Attackers are actively exploiting a critical vulnerability, CVE-2025-14847, in MongoDB to steal sensitive data from servers. The vulnerability, nicknamed "MongoBleed," allows attackers to extract credentials and data without authentication by exploiting a memory leak in servers using the Zlib compression algorithm. Rapid7 reports the availability of a new tool that simplifies exploitation, even for less technical threat actors. Organizations are urged to immediately patch to versions 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, or 4.4.30, and rotate database credentials.

Russian hackers target European hospitality industry with ‘blue screen of death’ malware

therecord.media · 6 months ago

Cybercriminals believed to be operating from Russia are targeting European hotels and hospitality businesses with a sophisticated malware campaign. The attack begins with fake reservation cancellation emails, leading victims to a deceptive “Blue Screen of Death” page. This prompts users to copy and paste commands that download DCRat malware, enabling attackers to steal data, track keystrokes, and disable security measures like Windows Defender. The campaign leverages psychological manipulation and abuses legitimate system tools to evade detection and maintain persistent access.

US broadband provider Brightspeed investigates breach claims

www.bleepingcomputer.com · 6 months ago

Brightspeed, a broadband provider serving 20 states, is investigating claims of a data breach made by the Crimson Collective extortion gang. The group alleges they stole sensitive information from over one million customers, including personally identifiable information, payment history, and account details. Crimson Collective previously targeted Red Hat and Nissan, and has also been linked to attacks on Amazon Web Services. The group plans to release a sample of the stolen data on Monday.

Trusted Google Notifications Used in Phishing Campaign Targeting 3,000+ Orgs

www.techrepublic.com · 6 months ago

Researchers have identified a large-scale phishing campaign targeting over 3,000 organizations worldwide. Attackers exploited Google’s Application Integration service to send convincing phishing emails that bypassed traditional security controls by appearing as legitimate Google Tasks notifications. These messages directed users to phishing pages hosted on Google’s own storage infrastructure, mimicking authentic Google workflows and using authority cues to encourage immediate action. Security experts advise increased visibility into SaaS tool usage, workflow-level controls, and phishing-resistant authentication to defend against this growing trend of abusing trusted platforms.

US Cyber Pros Plead Guilty Over BlackCat Ransomware Activity

www.darkreading.com · 6 months ago

Two US-based cybersecurity professionals, Ryan Goldberg and Kevin Martin, have pleaded guilty to conspiring to commit ransomware extortion. They acted as affiliates for the ALPHV/BlackCat ransomware group, deploying ransomware against multiple victims and receiving a share of ransoms, including approximately $1.2 million in Bitcoin from one victim. The individuals, who previously worked for cybersecurity firms DigitalMint and Sygnia, face a potential maximum sentence of 20 years in prison. Both firms have stated the individuals' actions were unauthorized and they cooperated with the investigation.

New Car Sales Are Rising Thanks to Purchases by the Well-Off

www.nytimes.com · 6 months ago

false

Russia-Aligned Hackers Abuse Viber to Target Ukrainian Military and Government

thehackernews.com · 6 months ago

A Russia-aligned hacking group, known as UAC-0184 or Hive0156, is targeting Ukrainian military and government organizations. Attackers are now using the Viber messaging platform to distribute malicious ZIP archives containing Windows shortcut files disguised as Microsoft documents. These files deploy Hijack Loader, a malware loader that allows for Remcos RAT infections and evades security software detection. The Remcos RAT gives attackers remote control over compromised systems.

Cyberattack Unlikely in Communications Failure That Grounded Flights in Greece

www.securityweek.com · 6 months ago

false

Ten thousand firewalls are vulnerable to old vulnerability

www.csoonline.com · 6 months ago

Hackers are actively exploiting a known vulnerability in FortiOS firewalls to bypass two-factor authentication. The vulnerability, CVE-2020-12812, was addressed in July 2020. Despite the patch, approximately ten thousand firewalls remain unpatched. Users of FortiOS and Fortigate are strongly advised to update their systems immediately.

Brightspeed Investigating Cyberattack

www.securityweek.com · 6 months ago

Brightspeed, a US fiber broadband provider serving over 1 million customers, is investigating a cyberattack. The hacking group Crimson Collective claims to have stolen personal information from more than 1 million customers, including names, addresses, email addresses, and payment details. Crimson Collective previously attempted to extort Red Hat, which resulted in the exposure of personal information for approximately 21,000 Nissan customers. Brightspeed says it is taking the situation seriously and will keep stakeholders informed.

Stress caused by cybersecurity threats is taking its toll

www.csoonline.com · 6 months ago

false

Taiwan subjected to 2.6 million Chinese cyberattacks a day in 2025

www.csoonline.com · 6 months ago

Taiwan's National Security Agency reports a significant surge in cyberattacks originating from China. In 2025, the country faced an average of 2.6 million attacks daily, representing a 6% increase. These attacks primarily targeted critical infrastructure like energy, healthcare, financial institutions, and emergency services, often coinciding with political events and military exercises. Attack methods included denial-of-service attacks and man-in-the-middle intrusions, impacting sectors like the semiconductor industry.

Several countries investigate Elon Musk’s Grok after sexualized deepfakes on women and children

www.csoonline.com · 6 months ago

Several countries are investigating Elon Musk’s AI chatbot Grok following reports of it generating sexualized deepfakes depicting women and children. France and Malaysia have launched investigations, and India has issued a demand for Grok to restrict the creation of inappropriate images within 72 hours. The chatbot has reportedly apologized for creating an image of two girls in sexual poses. xAI developed Grok, and it is hosted on the X platform.

In Ukraine, an Arsenal of Killer A.I. Drones Is Being Born in War Against Russia

www.nytimes.com · 6 months ago

Drone warfare in Ukraine has rapidly evolved with the emergence of artificial intelligence-guided drones. These new drones, like the Bumblebee, can autonomously pursue and strike targets, even after losing contact with human operators. Ukrainian forces have utilized these drones, conducting over 1,000 combat flights against Russian targets and overcoming challenges posed by Russian jamming technology. This shift marks the beginning of an era of autonomous weaponry on the battlefield.

VSCode IDE forks expose users to "recommended extension" attacks

www.bleepingcomputer.com · 6 months ago

Several AI-powered integrated development environments, including Cursor, Windsurf, Google Antigravity, and Trae, are vulnerable to malicious extension attacks due to a design where they recommend extensions not found in the OpenVSX registry. These IDEs, which are forked from Microsoft VSCode, inherit recommendations that point to Microsoft’s Visual Studio Marketplace, creating unclaimed namespaces that attackers can exploit. Researchers at Koi Security have claimed namespaces for extensions including ms-ossdata.vscode-postgresql, ms-azure-devops.azure-pipelines, msazurermtools.azurerm-vscode-tools, usqlextpublisher.usql-vscode-ext, cake-build.cake-vscode, pkosta2005.heroku-command, to prevent malicious activity, and users should verify extension recommendations through the OpenVSX registry. Some IDE vendors have taken action to address the issue, while others have not responded.

Kimwolf Android Botnet Infects Over 2 Million Devices via Exposed ADB and Proxy Networks

thehackernews.com · 6 months ago

Researchers have discovered a botnet named Kimwolf that has infected over 2 million Android devices, primarily in Vietnam, Brazil, India, and Saudi Arabia. The botnet, linked to AISURU and suspected of being behind recent large-scale DDoS attacks, uses exposed Android Debug Bridge services and residential proxy networks to spread. Threat actors are monetizing the botnet through app installations, proxy bandwidth sales, and DDoS services, leveraging services like IPIDEA. Security experts recommend blocking requests to private IP address ranges and securing Android Debug Bridge settings to mitigate the risk.

Windows Users at Risk as Critical Zoom Vulnerability Exploited

www.techrepublic.com · 6 months ago

A critical vulnerability has been identified in Zoom products affecting Windows users. The flaw, designated CVE-2025-49457 and scoring 9.6 on the CVSS, allows attackers to escalate privileges and potentially steal sensitive data by exploiting how Zoom loads Dynamic Link Library files. Zoom has released a patch, and users are urged to update to version 6.3.10 or later to mitigate the risk, which includes Zoom Workspace, Zoom Rooms, and Zoom Meeting SDK for Windows. The vulnerability could enable attackers to access meeting recordings, credentials, and pivot deeper into networks.

Cyberattack forces British high school to close

therecord.media · 6 months ago

A cyberattack has forced Higham Lane School in Nuneaton, England to close. The attack has disrupted the school’s IT systems, impacting access to phones, emails, servers, and other digital services for staff. Central England Academy Trust, which oversees the school, has engaged cybersecurity specialists and notified authorities. This incident follows a series of cyberattacks against schools, with some involving ransom demands and threats of data release.

Ledger customers impacted by third-party Global-e data breach

www.bleepingcomputer.com · 6 months ago

Ledger is notifying customers that their personal data may have been exposed due to a data breach at third-party payment processor Global-e. The breach involved customer names and contact information related to purchases made on Ledger’s website. Global-e handles payment processing for numerous brands, including Adidas and Disney, and impacted customer order data but not financial information or cryptocurrency seed phrases. Global-e has isolated the affected systems and is notifying impacted individuals and regulators.

RondoDox Botnet Expands Scope With React2Shell Exploitation

www.darkreading.com · 6 months ago

The RondoDox botnet is actively exploiting the React2Shell vulnerability, tracked as CVE-2025-55182, to compromise servers and IoT devices. Attackers are deploying payloads including cryptocurrency miners, a Mirai-based botnet variant, and a botnet loader that aggressively removes competing malware. Approximately 90,300 vulnerable servers are exposed worldwide, primarily in the US, Germany, France, and India. Security experts recommend patching vulnerable software, segmenting IoT devices, and deploying web application firewalls to mitigate the threat.

Agentic AI Is an Identity Problem and CISOs Will Be Accountable for the Outcome

www.bleepingcomputer.com · 6 months ago

Agentic AI presents a significant identity problem for organizations, amplifying existing risks like credential abuse and privilege accumulation. Traditional identity and access management tools are inadequate for securing these AI agents, which operate with human-like intent but machine-like scale and decentralization. CISOs are accountable for managing agent identities through lifecycle management, focusing on clear ownership, explicit purpose, and continuous visibility to prevent breaches and ensure AI adoption remains sustainable. Securing agentic AI requires correlating identity signals across various platforms to understand the full scope of access and potential risk.

EU looking ‘very seriously’ at taking action against X over Grok

therecord.media · 6 months ago

The European Commission is investigating the social media platform X following reports that its AI tool, Grok, generated sexual images of a minor. Officials condemned Grok's ability to create explicit content, particularly when involving childlike images, calling it illegal and appalling. This incident follows a previous fine of 120 million dollars levied against X for violating the Digital Services Act and a prior request for information regarding the spread of Holocaust-denying material. Authorities in both France and the United Kingdom have also launched investigations into the matter.

California Unveils DROP Tool for Personal Data Deletion

www.techrepublic.com · 6 months ago

false

NordVPN denies breach claims, says attackers have "dummy data"

www.bleepingcomputer.com · 6 months ago

NordVPN is denying recent claims of a data breach involving its development servers. A threat actor publicized what they claimed was stolen data, including Salesforce API keys and Jira tokens, obtained through a brute-force attack. However, NordVPN states the data actually consists of dummy information from a discontinued trial environment used for testing a third-party vendor. The company emphasizes that no real customer or business information was compromised and the isolated test environment was never connected to their production systems.

Palo Alto Networks Eyes $400M Acquisition of Koi Security

www.techrepublic.com · 6 months ago

false

How the Organizational Risk Culture Standard can supercharge your cybersecurity culture

www.csoonline.com · 6 months ago

false

⚡ Weekly Recap: IoT Exploits, Wallet Breaches, Rogue Extensions, AI Abuse & More

thehackernews.com · 6 months ago

Several cybersecurity threats are actively targeting users through various methods. A Chinese operation, DarkSpectre, compromised millions of users through malicious browser extensions. Ransomware groups are auctioning stolen data, and Microsoft Teams is being exploited for phishing attacks. Despite advancements like enhanced security measures for the Python Package Index, vigilance is crucial to prevent exploitation of vulnerabilities.

Telegram Hosting World’s Largest Darknet Market

www.schneier.com · 6 months ago

Telegram is hosting large Chinese language darknet marketplaces that expanded after a brief drop when Telegram banned two of the biggest markets in early 2025. Two leading markets, Tudou Guarantee and Xinbi Guarantee, are estimated to enable close to two billion dollars a month in money laundering and sales of scam infrastructure including stolen data, fake investment websites, AI deepfake tools, and other illicit services such as pregnancy surrogacy and teen prostitution. Crypto romance and investment scams known as pig butchering pull in around ten billion dollars annually from United States victims according to the FBI, and markets on Telegram supply money laundering and scam tools to those operations.

Cybersecurity firm turns tables on threat actors with decoy data trap

www.csoonline.com · 6 months ago

Cybersecurity firm Resecurity says threat actors linked to the Scattered Lapsus$ Hunters alliance were lured into a decoy environment designed to observe attacker behavior. The attackers initially claimed to have breached Resecurity’s systems and stolen data, but the company states the access was to a honeypot containing synthetic data resembling internal systems. This honeypot contained over 28,000 fake consumer records and nearly 190,000 simulated payment transactions derived from data found on the Dark Web. Resecurity’s investigation indicates the activity aligns with MITRE ATT&CK techniques like Active Scanning and Gather Victim Host Information.

The State of Cybersecurity in 2025: Key Segments, Insights, and Innovations

thehackernews.com · 6 months ago

false

Bitfinex Hack Convict Ilya Lichtenstein Released Early Under U.S. First Step Act

thehackernews.com · 6 months ago

Ilya Lichtenstein, convicted in connection with the 2016 Bitfinex cryptocurrency hack, has been released from prison early. His release is attributed to the First Step Act, a bipartisan reform aimed at reducing the federal prison population. Lichtenstein and his wife, Heather Morgan, pleaded guilty to money laundering charges after authorities recovered approximately 94,000 bitcoin, valued at around $3.6 billion in 2022, following a vulnerability exploited in Bitfinex’s withdrawal setup. Lichtenstein was sentenced to five years, and is currently in home confinement.

New VVS Stealer Malware Targets Discord Accounts via Obfuscated Python Code

thehackernews.com · 6 months ago

A new information stealer called VVS Stealer, written in Python and protected by Pyarmor, is being sold on Telegram. The malware harvests Discord credentials, web browser data like passwords and autofill information, and takes screenshots. It also injects into Discord sessions to hijack active user accounts. Researchers note that the increasing use of obfuscation techniques makes analysis and detection more difficult.

Cybersecurity leaders’ resolutions for 2026

www.csoonline.com · 6 months ago

false

Trump amplifies conspiracy theories on killing of Minnesota lawmaker

www.washingtonpost.com · 6 months ago

President Donald Trump has shared a video online promoting a conspiracy theory. The video falsely connects Minnesota Governor Tim Walz to the death of Minnesota House Speaker Melissa Hortman. This claim originates from right-wing influencers who allege a connection to a day care fraud scandal. The allegations are described as baseless.

Integer Factorization via Subset-Sum Reduction:A Heuristic Approach Suggesting Practical P=NPEquivalence

osf.io · 7 months ago

false

HardBit 4.0 Ransomware Evolution

labs.jamessawyer.co.uk · 7 months ago

The world is facing increasing instability due to geopolitical tensions, economic disruptions, and domestic challenges. Technology and automotive sectors are experiencing shifts in leadership, while governments worldwide grapple with workforce issues and modernization efforts. Cybersecurity threats, particularly ransomware, are escalating, and financial markets are demonstrating volatility. The report highlights potential risks including latent banking crises, declining US military readiness, and escalating cyber threats.

Hackers claim to hack Resecurity, firm says it was a honeypot

www.bleepingcomputer.com · 7 months ago

Threat actors claiming to be part of the Scattered Lapsus Hunters said they breached Resecurity and published screenshots alleging theft of employee data, internal communications, threat intelligence reports, and client lists, though a ShinyHunters spokesperson later denied involvement. Resecurity says the accessed systems were an isolated honeypot deliberately populated with synthetic data, including more than 28,000 consumer records and over 190,000 payment transaction records, and that its DFIR team first detected probing activity on November 21, 2025. Between December 12 and December 24 the actor generated more than 188,000 requests while attempting to automate data exfiltration using large numbers of residential proxy IPs, and Resecurity says it collected telemetry, identified attacker infrastructure after OPSEC failures, and shared the intelligence with law enforcement.

ShinyHunters claims Resecurity hack, firm says it’s a honeypot

www.bleepingcomputer.com · 7 months ago

The hacking group ShinyHunters claims to have breached Resecurity's systems and stolen sensitive data, including employee information, internal communications, and client details. Resecurity refutes these claims, stating that the accessed systems were a deliberately deployed honeypot designed to monitor threat actor activity. The honeypot contained fake data, including over 28,000 synthetic consumer records and 190,000 synthetic payment transaction records, to lure and analyze attackers. Resecurity reported the attacker’s infrastructure and activity to law enforcement after observing automated data exfiltration attempts.

President Trump Orders Divestment in $2.9 Million Chips Deal to Protect US Security Interests

www.securityweek.com · 7 months ago

President Trump has ordered the divestment of a two point nine million dollar computer chips deal, citing concerns about U.S. security interests. The deal, initially approved during the Biden administration, involved Emcore Corp. selling its operations to HieFo Corp., founded by Dr. Genzao Zhang and Harry Moore. Trump’s executive order mandates HieFo divest the technology within 180 days, due to concerns about the company’s ownership being linked to China. The technology is intended for innovative solutions, including artificial intelligence applications.

Finnish Authorities Arrest Two Sailors in Probe Into Undersea Cable Disruption

gbhackers.com · 7 months ago

Finnish authorities have arrested the crew of a cargo ship suspected of damaging an undersea telecommunications cable connecting Finland and Estonia. The vessel, named Fitburg, was traveling from Russia to Israel and had a multinational crew. Investigations are underway, examining the incident as criminal damage and interference with telecommunications. A second cable outage was also reported in Estonia, raising concerns about potential hybrid warfare targeting critical infrastructure in the Baltic Sea region.

Friday Squid Blogging: Squid Found in Light Fixture

www.schneier.com · 7 months ago

false

Nearly 480,000 impacted by Covenant Health data breach

therecord.media · 7 months ago

A cyberattack impacted Covenant Health, exposing the sensitive information of nearly 478,188 individuals across multiple states. Hackers accessed the organization’s network between May 18th and May 26th of last year, stealing personal data including names, addresses, Social Security numbers, and medical records. The Qilin ransomware gang claimed responsibility for the breach, a group known for targeting hospitals, municipalities, and corporations worldwide. Covenant Health is offering affected individuals one year of credit monitoring services.

China’s BYD Surpasses Tesla as World Leader in Electric Car Sales

www.nytimes.com · 7 months ago

false

Pakistan-linked hackers target Indian government, universities in new spying campaign

therecord.media · 7 months ago

A hacking group linked to Pakistan, known as APT36 or Transparent Tribe, is conducting a cyber-espionage campaign targeting Indian government, academic, and strategic institutions. The operation uses spear-phishing emails containing malicious PDF files that deploy ReadOnly and WriteOnly malware. This malware enables remote control, data theft, persistent surveillance, and can even compromise cryptocurrency transactions through clipboard monitoring. Researchers noted an evolution in the group’s technical capabilities, indicating a long-term intelligence-gathering objective.