Blahalla

Friday Squid Blogging: Squid Found in Light Fixture

www.schneier.com · 7 months ago

false

Nearly 480,000 impacted by Covenant Health data breach

therecord.media · 7 months ago

A cyberattack impacted Covenant Health, exposing the sensitive information of nearly 478,188 individuals across multiple states. Hackers accessed the organization’s network between May 18th and May 26th of last year, stealing personal data including names, addresses, Social Security numbers, and medical records. The Qilin ransomware gang claimed responsibility for the breach, a group known for targeting hospitals, municipalities, and corporations worldwide. Covenant Health is offering affected individuals one year of credit monitoring services.

China’s BYD Surpasses Tesla as World Leader in Electric Car Sales

www.nytimes.com · 7 months ago

false

Pakistan-linked hackers target Indian government, universities in new spying campaign

therecord.media · 7 months ago

A hacking group linked to Pakistan, known as APT36 or Transparent Tribe, is conducting a cyber-espionage campaign targeting Indian government, academic, and strategic institutions. The operation uses spear-phishing emails containing malicious PDF files that deploy ReadOnly and WriteOnly malware. This malware enables remote control, data theft, persistent surveillance, and can even compromise cryptocurrency transactions through clipboard monitoring. Researchers noted an evolution in the group’s technical capabilities, indicating a long-term intelligence-gathering objective.

Covenant Health says May data breach impacted nearly 478,000 patients

www.bleepingcomputer.com · 7 months ago

Covenant Health recently revised its estimate of a May data breach, now impacting nearly 478,000 individuals. The healthcare provider initially reported a much smaller number of affected people, but further analysis revealed the larger scale. The Qilin ransomware group claimed responsibility for the attack, which occurred between May 18 and May 26, 2025, and involved the theft of 852 GB of data. Compromised information includes names, addresses, Social Security numbers, and medical treatment details, and affected individuals are being offered identity protection services.

European regulators take aim at X after Grok creates deepfake of minor

therecord.media · 7 months ago

European regulators are considering action against X, formerly known as Twitter, after its AI tool Grok was used to generate sexually explicit images of a minor. The incident prompted investigations in France and plans for a potential ban on so-called nudification tools in the United Kingdom. This controversy follows a recent 120 million dollar fine from the European Commission and has ignited a debate about free speech and U.S. policy toward NATO. The British communications regulator, Ofcom, stated that creating or sharing such images is illegal and can lead to prosecution.

Sedgwick confirms cyber incident affecting its major federal contractor subsidiary

therecord.media · 7 months ago

Sedgwick Government Solutions, a subsidiary of claims administration company Sedgwick, is responding to a cybersecurity incident. The ransomware gang TridentLocker claimed responsibility, alleging they stole 3.4 gigabytes of data on New Year’s Eve. The incident involved an isolated file transfer system, but Sedgwick states that other systems and client data were not affected. TridentLocker, a recently emerged ransomware group, has claimed responsibility for attacks on at least 12 victims, including the Belgian postal service bpost.

America’s toughest privacy protections have finally kicked in

www.washingtonpost.com · 7 months ago

false

Cryptocurrency theft attacks traced to 2022 LastPass breach

www.bleepingcomputer.com · 7 months ago

Ongoing cryptocurrency thefts have been linked to the 2022 LastPass data breach, with attackers gradually decrypting stolen password vaults and extracting cryptocurrency wallet private keys and seed phrases. Attackers drained wallets months or years after the initial breach, then converted the stolen crypto to Bitcoin and attempted to obscure their tracks using Wasabi Wallet's CoinJoin feature. Blockchain investigation firm TRM Labs was able to trace these funds, estimating over $28 million was stolen and laundered in late 2024 and early 2025, with additional $7 million tied to attacks in September 2025. The stolen funds were repeatedly cashed out via Russian-linked exchanges.

Technical Analysis - MongoBleed (CVE-2025-14847): Memory Corruption in MongoDB

phoenix.security · 7 months ago

There is an unauthenticated memory disclosure vulnerability called MongoBleed tracked as CVE-2025-14847 that allows remote clients to extract uninitialized heap memory from MongoDB by sending valid compressed wire protocol messages that declare an inflated uncompressed size. The flaw stems from MongoDBs zlib decompression path propagating the allocated buffer size instead of the actual decompressed length, which lets BSON parsing return heap fragments containing credentials, tokens, API keys, config strings and recently processed data. Affected server releases include 8.2.0 to 8.2.2, 8.0.0 to 8.0.16, 7.0.0 to 7.0.27, 6.0.0 to 6.0.26, 5.0.0 to 5.0.31 and 4.4.0 to 4.4.29 while older 4.2, 4.0 and 3.6 lines are EOL, and Shodan telemetry recorded 213,490 publicly reachable MongoDB instances on December 29, 2025. Operators are advised to upgrade to patched server releases or disable zlib compression and restrict network exposure as temporary mitigations because a public proof of concept and scanners exist and exploitation effort is low.

Over 10K Fortinet firewalls exposed to actively exploited 2FA bypass

www.bleepingcomputer.com · 7 months ago

More than ten thousand Fortinet firewalls remain vulnerable to attacks exploiting a critical two-factor authentication bypass flaw. The vulnerability, CVE-2020-12812, allows attackers to bypass the second authentication factor by manipulating username casing. Fortinet released patches in 2020 and has repeatedly warned of ongoing exploitation, particularly targeting systems using LDAP. Cybersecurity agencies have also warned of state-sponsored groups and ransomware attacks leveraging the vulnerability, along with other recently disclosed vulnerabilities like CVE-2025-59718, CVE-2025-58034, CVE-2025-64446, CVE-2023-27997, and CVE-2022-42475.

Hacker Claims 200GB Data Theft From European Space Agency — Here’s What We Know

www.techrepublic.com · 7 months ago

The European Space Agency confirmed a cybersecurity incident after a hacker, known as “888,” claimed to steal 200 gigabytes of data from external collaboration servers. The attacker accessed systems for about a week in mid-December and is now attempting to sell the stolen data. This incident follows previous breaches, including a compromised online store and past vulnerabilities related to SQL and administrative credentials, highlighting weaknesses in third-party systems and external integrations. The incident underscores broader concerns about supply chain vulnerabilities and the increasing integration of space infrastructure with critical services.

Google is testing a new image AI and it's going to be its fastest model

www.bleepingcomputer.com · 7 months ago

false

As Schools Embrace A.I. Tools, Skeptics Raise Concerns

www.nytimes.com · 7 months ago

false

Finland arrests two crew members of ship suspected of cable break

therecord.media · 7 months ago

Finnish authorities have arrested two crew members of a ship, the Fitburg, suspected of damaging an undersea telecommunications cable. The ship, carrying sanctioned steel products from Russia to Israel, was seized while transiting Finland’s exclusive economic zone. Investigations are underway using underwater technology to determine the cause of the cable break, with interviews clarifying crew member roles. This incident follows a similar 2024 case involving the Eagle S, another Russia-linked vessel that damaged cables.

The Kimwolf Botnet is Stalking Your Local Network

krebsonsecurity.com · 7 months ago

A rapidly growing botnet called Kimwolf has infected over 2 million devices worldwide, mainly Android TV boxes and digital photo frames. The botnet spreads by exploiting vulnerabilities in residential proxy networks, allowing it to bypass firewalls and routers. Kimwolf is used for activities like ad fraud and DDoS attacks, and security firm Synthient is tracking its activity and warning proxy providers. The FBI has issued warnings about pre-infected devices, and Google has filed a lawsuit against those distributing them.

Trust Wallet links $8.5 million crypto theft to Shai-Hulud NPM attack

www.bleepingcomputer.com · 7 months ago

Trust Wallet recently experienced a significant cryptocurrency theft, affecting over 2,500 wallets and totaling roughly $8.5 million. Attackers exploited exposed GitHub developer secrets to gain access to the company’s browser extension source code and Chrome Web Store API key, allowing them to publish a malicious version of the extension that collected sensitive wallet data. This incident is linked to the broader Shai-Hulud malware campaign, which has compromised over 800 npm packages and exposed around 400,000 secrets across more than 30,000 GitHub repositories. Trust Wallet is reimbursing affected users and warning of impersonation scams while working to prevent further attacks.

Phone Searches at U.S. Borders: What Travelers Need to Know

www.nytimes.com · 7 months ago

U.S. Customs and Border Protection agents have broad authority to search electronic devices like phones and laptops during international travel. In fiscal year 2025, agents conducted over 55,000 such searches, a rise from previous years. These searches are intended to detect digital contraband, terrorism-related content, and information relevant to national security. While most devices searched belonged to non-citizens, the percentage belonging to U.S. citizens has increased recently.

Cybersecurity Predictions for 2026: Navigating the Future of Digital Threats

www.darkreading.com · 7 months ago

false

CTO New Year Resolutions for a More Secure 2026

www.darkreading.com · 7 months ago

false

Transparent Tribe Launches New RAT Attacks Against Indian Government and Academia

thehackernews.com · 7 months ago

Cyberattacks attributed to the Transparent Tribe, also known as APT36, are targeting Indian government, academic, and strategic entities using a remote access trojan. The attacks involve spear-phishing emails with malicious shortcut files that execute HTML scripts to deliver the RAT and evade detection. The malware adapts its persistence methods based on the antivirus software installed, and a related campaign recently used a malicious shortcut to deliver a.NET loader and malicious DLLs. Additionally, a group called Patchwork has been linked to attacks utilizing a Python-based backdoor and a previously undocumented trojan called StreamSpy which uses HTTP and WebSocket protocols for command and control.

Windows Registry Persistence Techniques without Registry Callbacks

deceptiq.com · 7 months ago

A technique has been discovered to establish registry persistence within the HKEYCURRENTUSER hive without triggering standard registry monitoring callbacks. This bypass involves creating a crafted NTUSER.MAN file, a mandatory user profile, and placing it in the user's profile directory, which loads directly at logon, circumventing registry API calls and therefore evading registry-focused detection tools. Attackers can potentially modify user profiles through Active Directory by manipulating the profile path attribute or directly writing to roaming profile shares. Monitoring for file writes to NTUSER.MAN files and modifications to AD user objects can help detect this persistence method.

Two cybersecurity experts plead guilty to running ransomware operation

www.csoonline.com · 7 months ago

Two cybersecurity professionals, Ryan Goldberg and Kevin Martin, have pleaded guilty to conspiring to commit extortion through a ransomware operation. The pair targeted five US companies with the BlackCat ransomware, also known as ALPHV, between April and December of 2023. They shared ransom payments with the developers of the ransomware, resulting in over nine point five million dollars in losses. Federal authorities have traced approximately three hundred twenty-four thousand dollars of the proceeds to Goldberg and Martin, and they face a maximum sentence of twenty years in prison.

Two US Cybersecurity Pros Plead Guilty Over Ransomware Attacks

www.securityweek.com · 7 months ago

Two cybersecurity professionals have pleaded guilty to charges related to BlackCat/Alphv ransomware attacks. Kevin Martin and an unnamed individual worked as ransomware negotiators, while Ryan Goldberg was an incident response manager. The three acted as affiliates, receiving a portion of ransom payments in exchange for access to ransomware and extortion tools. They targeted over one thousand organizations and received a $1.2 million ransom from one victim and are facing up to 20 years in prison.

Flock Exposes Its AI-Enabled Surveillance Cameras

www.schneier.com · 7 months ago

Flock’s Condor cameras are designed to record and track people, unlike other Flock cameras which primarily capture license plates. These pan-tilt-zoom cameras can automatically or manually zoom in on individuals in public spaces, including parking lots, streets, and playgrounds. Demonstrations show the cameras tracking individuals across multiple locations, with sufficient resolution to view details like someone watching videos on their phone. Concerns have been raised regarding the potential for mass surveillance and privacy violations due to this technology.

Our 2026 Tech Resolutions + We Answer Your Questions

www.nytimes.com · 7 months ago

false

The ROI Problem in Attack Surface Management

thehackernews.com · 7 months ago

false

Handala Hackers Breach Telegram Accounts Linked to Israeli Officials

gbhackers.com · 7 months ago

The Iran-linked hacking group Handala claimed to breach the mobile devices of former Israeli Prime Minister Naftali Bennett and Chief of Staff Tzachi Braverman, releasing contact lists, photos, and chat logs. However, a technical review revealed the intrusions were limited to unauthorized access of their Telegram accounts, not the devices themselves. Attackers exploited vulnerabilities like Telegram’s cloud password and session hijacking, demonstrating that messaging accounts can be compromised without a full device intrusion. Experts recommend enabling security measures like Telegram’s cloud password, tightening SIM security, and auditing active sessions to mitigate this risk.

Google Tasks Feature Exploited in New Sophisticated Phishing Campaign

gbhackers.com · 7 months ago

A sophisticated phishing campaign targeted over three thousand organizations, primarily in manufacturing, by exploiting Google’s infrastructure. Attackers sent deceptive emails appearing as Google Tasks notifications, bypassing standard email security checks like SPF, DKIM, and DMARC. The attack leveraged trusted sender infrastructure, high-fidelity brand impersonation, and payloads on trusted domains like Google Cloud Storage. Security researchers identified the campaign by analyzing workflow context rather than sender credentials, highlighting the need for intent-centric detection systems.

RondoDox Botnet Exploiting React2Shell Vulnerability

www.securityweek.com · 7 months ago

Cybersecurity researchers have observed the RondoDox botnet exploiting a vulnerability in Next.js servers, known as React2Shell, to gain remote code execution. This flaw, tracked as CVE-2025-55182, affects systems using React version 19 and React Server Components. Attackers began exploiting the vulnerability shortly after its public disclosure in December 2025, and RondoDox operators began targeting vulnerable Next.js instances three weeks ago, deploying a botnet client, cryptocurrency miner, and a Mirai variant. The botnet has also been observed using a wide range of exploits and techniques to compromise devices since March 2025.

VVS Discord Stealer Using Pyarmor for Obfuscation and Detection Evasion

unit42.paloaltonetworks.com · 7 months ago

Security researchers have analyzed a new malware strain known as "VVS Stealer," which targets Discord users. The malware, written in Python, steals sensitive information including Discord tokens, payment methods, and browsing history. It uses Pyarmor to obfuscate the code, making it difficult to reverse engineer and uses AES encryption. Palo Alto Networks security products are recommended to detect and prevent this threat.

Covenant Health Data Breach Impacts 478,000 Individuals

www.securityweek.com · 7 months ago

Covenant Health, a healthcare provider with locations across multiple states, experienced a data breach in May 2025, impacting over 478,000 individuals. The breach, discovered May 26th, involved unauthorized access to personal and health information, including names, dates of birth, addresses, Social Security numbers, and treatment details. The Qilin ransomware group claimed responsibility, alleging the theft of 1.3 million files totaling 850 GB, which has since been publicly released. Covenant Health initially reported a much smaller number of impacted individuals in July but revised the estimate to 478,188 in December.

Adobe ColdFusion Servers Targeted in Coordinated Campaign

www.securityweek.com · 7 months ago

A coordinated campaign has targeted Adobe ColdFusion servers globally, exploiting vulnerabilities disclosed in 2023 and 2024. Threat intelligence firm GreyNoise observed approximately 6,000 requests, primarily originating from Japan-based infrastructure. The attacks leveraged ProjectDiscovery Interactsh and JNDI/LDAP injection, with a significant portion of activity occurring on Christmas Day. The malicious activity is linked to two IP addresses that have targeted over 700 security defects across numerous systems.

Hacker Group Claims Responsibility for Alleged Tokyo FM Broadcasting Breach

gbhackers.com · 7 months ago

A hacker group using the alias “victim” claims responsibility for a data breach targeting Tokyo FM Broadcasting Co., Ltd. The group alleges they compromised internal systems and extracted over three million records containing personal information such as names, email addresses, dates of birth, and login IDs. The information was reportedly obtained from both clear- and dark-web sources, but the breach remains unverified. Tokyo FM Broadcasting has not confirmed the claims, and researchers have not found evidence of proprietary business data being stolen.

Cybercriminals Abuse Google Cloud Email Feature in Multi-Stage Phishing Campaign

thehackernews.com · 7 months ago

Cybercriminals are exploiting a Google Cloud feature to launch a sophisticated phishing campaign. Attackers are sending emails disguised as legitimate Google notifications, bypassing security filters by using a genuine Google email address. The campaign involves a multi-stage process including fake CAPTCHAs and redirects to a fraudulent Microsoft login page to steal user credentials. Google has responded by blocking the phishing activity and implementing additional preventative measures.

Cognizant Faces Multiple US Class-Action Lawsuits After TriZetto Data Breach

gbhackers.com · 7 months ago

Cognizant Technology Solutions and its subsidiary, TriZetto Provider Solutions, are facing multiple class-action lawsuits in the United States. Hackers gained unauthorized access to TriZetto’s systems as early as November 2024, but the breach wasn't discovered until October 2025. Plaintiffs allege negligence due to inadequate security measures and a delayed notification, leaving sensitive data exposed for nearly 11 months. The lawsuits question why the intrusion went undetected for so long and whether the company’s response was appropriate.

RondoDoX Botnet Abuses React2Shell Vulnerability for Malware Deployment

gbhackers.com · 7 months ago

Security researchers have identified a nine-month campaign by the RondoDoX botnet, which rapidly exploited emerging vulnerabilities, including CVE-2025-55182, the React2Shell vulnerability. The botnet shifted from targeting IoT devices to weaponizing Next.js applications, quickly adapting infrastructure to evade detection following public vulnerability disclosures. Attack phases included manual reconnaissance, automated vulnerability scanning, and peak automation with hourly exploitation attempts, deploying malware and cryptocurrency miners. Organizations are urged to audit Next.js applications, segment IoT networks, and block identified command-and-control infrastructure to mitigate the risk of compromise.

Cybersecurity skills matter more than headcount in the AI era

www.csoonline.com · 7 months ago

false

Cardano Users Warned of Possible Phishing Attempt Posing as ‘Eternl Desktop’ Update

gbhackers.com · 7 months ago

A phishing campaign is targeting Cardano users with a deceptive email promoting a fake "Eternl Desktop" wallet update. The email directs recipients to download a malicious installer that, instead of a wallet, installs LogMeIn Resolve Unattended software, granting attackers remote access to compromised systems. The fraudulent download link uses a newly registered domain and the MSI installer lacks verification transparency, allowing for potential bypass of antivirus detection. Users are urged to exercise caution and only download software from official sources.

GNU Wget2 Vulnerability Enables Remote File Overwrite Attacks

gbhackers.com · 7 months ago

A high-severity security vulnerability has been identified in GNU Wget2, a command-line tool. This vulnerability, CVE-2025-69194, allows attackers to potentially overwrite files on a user’s computer. The flaw arises from a failure to properly validate file paths within Metalink documents, enabling a path traversal attack. Successful exploitation could result in data loss, malicious code execution, or bypassing of security measures.

CISA Issues Warning on WHILL Model C2 Wheelchair Takeover Vulnerabilities

gbhackers.com · 7 months ago

The Cybersecurity and Infrastructure Security Agency has issued a warning regarding a critical vulnerability in WHILL Model C2 electric wheelchairs and Model F power chairs. This flaw, identified as CVE-2025-14346 with a severity score of 9.8, allows attackers within Bluetooth range to potentially take control of the devices without authorization. Researchers discovered that the wheelchairs lack proper authentication for critical functions, posing a risk to users in healthcare facilities and homes. Affected users are advised to contact WHILL for updates and limit Bluetooth connectivity when not in use.

Threat Actors Test a Highly Obfuscated, Modified Variant of the Shai Hulud Malware

gbhackers.com · 7 months ago

Security researchers have identified a modified version of the Shai Hulud malware disguised within an npm package. The new strain exhibits significant code changes, suggesting access to the original malware source code, and includes operational improvements like enhanced error handling for TruffleHog. A critical programming error, a typo in a file name, has disrupted the malware's data exfiltration. The attackers have also changed the identifier used for infected GitHub repositories, allowing for better tracking of the campaign.

Apache NuttX Flaw Allows Attackers to Crash Embedded Systems

gbhackers.com · 7 months ago

A memory corruption vulnerability has been identified in the Apache NuttX Real-Time Operating System, affecting versions 7.20 through 12.10.x. The flaw, tracked as CVE-2025-48769, is a “Use After Free” error within the file system’s rename function and can destabilize devices or manipulate files. Systems that expose their virtual filesystem over a network, such as those running FTP servers, are particularly vulnerable, potentially leading to system crashes. Apache has released version 12.11.0 to address this moderate severity issue and advises immediate upgrades.

Careto Hacker Group Resurfaces After a Decade, Unleashing New Attack Techniques

gbhackers.com · 7 months ago

The Careto hacker group, also known as "The Mask," has resurfaced after a decade of inactivity, exhibiting advanced attack techniques. Researchers have observed targeted attacks against organizations in Latin America, utilizing novel persistence methods such as exploiting the WorldClient webmail component and hijacking the HitmanPro Alert driver. The group employs sophisticated implants like "FakeHMP" and leverages cloud infrastructure, including Google Drive, for command and control. Their return highlights the ability of advanced threat actors to remain dormant while maintaining their technical capabilities.

Wie KI die Cybersicherheit neu gestaltet

www.csoonline.com · 7 months ago

Generative KI ist in Unternehmen weit verbreitet; laut einer BCG-Umfrage nutzen 50 Prozent der Firmen die Technologie zur Neugestaltung von Arbeitsabläufen und 77 Prozent erwarten, dass KI-Agenten in den nächsten drei bis fünf Jahren eine zentrale Rolle spielen. KI dringt zunehmend in Cybersecurity ein und erhöht durch Automatisierung, schnellere Forensik und konsistente Abläufe die Effektivität von Security-Teams, sodass viele repetitive Level-1-Aufgaben an Agenten übergeben werden und Mitarbeitende sich auf komplexere Arbeiten konzentrieren. Zugleich berichten Accenture und Gartner, dass viele Unternehmen bei der Absicherung von KI hinterherhinken: 77 Prozent sollen beim Einführen wesentlicher Schutzmaßnahmen zurückliegen, nur 22 Prozent haben klare GenAI-Richtlinien, nur 25 Prozent setzen konsequent Verschlüsselung und Zugriffskontrollen ein und 83 Prozent haben keine sichere Cloud-Basis mit integrierter Überwachung und Reaktion. CISOs müssen deshalb Governance, KI-Fähigkeiten wie Prompt Engineering und Data Science und neue Talentstrategien entwickeln, um Menschen im Loop zu halten, Agenten zu steuern und sich gegen Angreifer zu wappnen, die ebenfalls KI nutzen.

Built an automated red-team tool to find LLM vulnerabilities. Most AI apps are frighteningly easy to break.

sentinel-audit-theta.vercel.app · 7 months ago

NULL

OpenAI is offering $20 ChatGPT Plus for free to some users

www.bleepingcomputer.com · 7 months ago

false

The biggest cybersecurity and cyberattack stories of 2025

www.bleepingcomputer.com · 7 months ago

Cyberattacks significantly increased in 2025, exploiting new technologies and targeting various sectors. State-sponsored campaigns like "Salt Typhoon" compromised telecommunications infrastructure, while prompt injection attacks targeted AI systems such as Microsoft Copilot and Google Gemini. Hackers leveraged AI to automate attacks and lower the skill barrier for cybercriminals, exploiting vulnerabilities in Windows, 7-Zip, and WinRAR. The rise of AI-powered tools fundamentally altered the cybersecurity landscape.

ThreatsDay Bulletin: GhostAd Drain, macOS Attacks, Proxy Botnets, Cloud Exploits, and 12+ Stories

thehackernews.com · 7 months ago

Cybersecurity is facing increasingly sophisticated and subtle threats. Android devices are being targeted by adware campaigns like GhostAd, while iOS devices are affected by fraud schemes such as SkyWalk. North Korean cybercriminals are infiltrating companies through fake recruitment, focusing on targeted infiltration over overt attacks. This shift indicates a move toward precision-based threats rather than easily detectable attacks.

New GlassWorm malware wave targets Macs with trojanized crypto wallets

www.bleepingcomputer.com · 7 months ago

A new wave of GlassWorm malware is targeting macOS developers using malicious VS Code extensions available on OpenVSX. These extensions deliver trojanized crypto wallet applications and attempt to steal developer credentials from services like GitHub and npm, as well as cryptocurrency wallet data and Keychain passwords. The malware now replaces legitimate hardware cryptocurrency wallets with trojanized versions, though this capability is currently failing. Researchers recommend developers remove any suspicious extensions and secure their accounts.