Blahalla

Trump administration prepares sweeping crackdown on leftist networks

www.washingtonpost.com · 7 months ago

The Justice Department’s program to root out violent “Antifa” extremism is raising First Amendment concerns.
Why U.S. and Chinese satellites are ‘dogfighting’ in orbit

www.washingtonpost.com · 7 months ago

U.S. and Chinese spacecraft are routinely dueling as far as 22,000 miles from Earth as militarization escalates in orbit.
Actively Exploited ASUS Vulnerability Added to CISA’s KEV List

gbhackers.com · 7 months ago

The Cybersecurity and Infrastructure Security Agency has listed a critical ASUS vulnerability, CVE-2025-59374, on its Known Exploited Vulnerabilities catalog due to active exploitation. This vulnerability stems from a supply chain compromise that embedded malicious code into ASUS Live Update software. Attackers infiltrated the software distribution channel, enabling targeted actions on devices, and impacted products may be end-of-life or end-of-service. Federal agencies must address the vulnerability by January 7, 2026, or discontinue use.
ORM Leaking More Than You Joined For - Part 3/3 on ORM Leak Vulnerabilities

www.elttam.com · 7 months ago

ORM leaks can occur when developers implement filtering and search functionality that unintentionally exposes sensitive attributes. This vulnerability does not require a susceptible ORM, but rather results from allowing user input to control filter expressions. Researchers demonstrated an expression-parser bug in the Beego ORM and an authentication bypass technique for the Prisma ORM. The findings include a vulnerability for the Harbor container registry, identified as CVE-2025-30086.
Chinese Hackers Target Cisco’s Email Security Systems

www.techrepublic.com · 7 months ago

The Chinese threat group, tracked as UAT-9686, has deployed a collection of custom-built hacking tools to maintain persistent access to compromised systems.
SonicWall Patches Exploited SMA 1000 Zero-Day

www.securityweek.com · 7 months ago

The medium-severity flaw has been exploited in combination with a critical bug for remote code execution.
New Reports Reveal WAFs Are Ineffective Against Latest React2Shell Exploit

gbhackers.com · 7 months ago

TEL AVIV, Israel, Dec. 17, 2025 Miggo Security has released a comprehensive benchmark study revealing critical gaps in Web Application Firewall (WAF) protection, with the discovery of React2Shell (CVE-2025-55182) serving as a stark real-world validation of these vulnerabilities. The research, titled “Beat the Bypass: A Benchmark Study of WAF Weaknesses and AI Mitigation,” demonstrates that traditional
Hackers Actively Exploit SonicWall SMA1000 Zero-Day to Escalate Privileges

gbhackers.com · 7 months ago

SonicWall has issued an urgent security advisory warning of active exploitation of a local privilege escalation vulnerability affecting its SMA1000 appliances. The flaw, tracked as CVE-2025-40602, enables attackers with management console access to gain elevated privileges and potentially achieve complete system control. The vulnerability stems from insufficient authorization checks in the SonicWall SMA1000 Appliance Management
Chinese Ink Dragon Breaches European Government Networks, Affecting Asia and South America

gbhackers.com · 7 months ago

Ink Dragon, a Chinese espionage group, has significantly expanded its operational reach from Southeast Asia and South America into European government networks, according to ongoing research by Check Point Research. The threat actor employs a methodical approach that combines strategic server compromises with sophisticated relay infrastructure to maintain persistent access and support global operations. The
Russlands Einfluss – Kritik an Lücken bei Cybersicherheit

www.csoonline.com · 7 months ago

srcset="https://b2b-contenthub.com/wp-content/uploads/2025/12/shutterstock2144734163.jpg?quality=50&strip=all 8786w, https://b2b-contenthub.com/wp-content/uploads/2025/12/shutterstock2144734163.jpg?resize=300%2C168&quality=50&strip=all 300w, https://b2b-contenthub.com/wp-content/uploads/2025/12/shutterstock2144734163.jpg?resize=768%2C432&quality=50&strip=all 768w, https://b2b-contenthub.com/wp-content/uploads/2025/12/shutterstock2144734163.jpg?resize=1024%2C576&quality=50&strip=all 1024w, https://b2b-contenthub.com/wp-content/uploads/2025/12/shutterstock2144734163.jpg?resize=1536%2C864&quality=50&strip=all 1536w, https://b2b-contenthub.com/wp-content/uploads/2025/12/shutterstock2144734163.jpg?resize=2048%2C1152&quality=50&strip=all 2048w, https://b2b-contenthub.com/wp-content/uploads/2025/12/shutterstock2144734163.jpg?resize=1240%2C697&quality=50&strip=all 1240w, https://b2b-contenthub.com/wp-content/uploads/2025/12/shutterstock2144734163.jpg?resize=150%2C84&quality=50&strip=all 150w, https://b2b-contenthub.com/wp-content/uploads/2025/12/shutterstock2144734163.jpg?resize=854%2C480&quality=50&strip=all 854w, https://b2b-contenthub.com/wp-content/uploads/2025/12/shutterstock2144734163.jpg?resize=640%2C360&quality=50&strip=all 640w, https://b2b-contenthub.com/wp-content/uploads/2025/12/shutterstock2144734163.jpg?resize=444%2C250&quality=50&strip=all 444w" width="1024" height="576" sizes="auto, (max-width: 1024px) 100vw, 1024px" Die Bundesregierung wirft Russland eine massive Cyberattacke sowie die Verbreitung von Falschinformationen im jüngsten Bundestagswahlkampf vor. PHOTOCREO Michal Bednarek, shutterstock.com Die Grünen sehen sich durch die jüngsten Erkenntnisse über russische Einflussoperationen im Bundestagswahlkampf in ihrer Einschätzung bestärkt, dass die aktuellen Maßnahmen zum Schutz der parlamentarischen Demokratie nicht ausreichen. “Dass unsere Demokratie und ihre Institutionen zunehmend hybriden Angriffen autoritärer Regime ausgesetzt sind, kann spätestens seit den jüngsten und deutlichen Warnungen der Spitzen unserer Nachrichtendienste und der Einbestellung des russischen Botschafters niemand mehr bestreiten”, sagt der stellvertretende Vorsitzende der Grünen-Bundestagsfraktion, Konstantin von Notz. Dieser bedrohlichen Kombination aus “anhaltend großer Verwundbarkeit und zunehmender Gefahren” müsse die schwarz-rote Koalition endlich entschlossen entgegentreten. Vorgaben nur für Bundestagsverwaltung, nicht das Parlament selbst Zwar hätten die Regierungsfraktionen den schlechten Entwurf der Bundesregierung zur Umsetzung der europäischen NIS-2-Richtlinie zum Schutz der kritischen Infrastruktur vor Cyberangriffen so überarbeitet, dass hiervon nun auch die Bundesverwaltung und die Verwaltung des Bundestages umfasst seien. Der Bundestag selbst, inklusive der Fraktionen und Abgeordneten mit ihren Wahlkreisbüros, gehöre aber nicht zum Geltungsbereich. Es sei “geradezu absurd”, dass der Bundestag als “Herzstück der Demokratie” bisher nicht als kritische Infrastruktur eingestuft sei, obwohl er seit Jahren immer wieder angegriffen werde, sagt der Grünen-Politiker, der dem Bundestagsgremium zur Kontrolle der Geheimdienste angehört. NIS-2-Richtlinie der EU umgesetzt Am 6. Dezember ist das Gesetz in Kraft getreten, mit dem die NIS-2-Richtlinie in deutsches Recht umgesetzt wird. Das Gesetz erhöht die Anforderungen an die Cybersicherheit der Bundesverwaltung sowie bestimmter Unternehmen, die als wichtig für das Gemeinwesen gelten. Dazu zählen etwa Telekommunikationsanbieter und Energieversorger. Für sie gelten jetzt strengere Vorgaben in puncto IT-Sicherheit sowie die Pflicht, erhebliche Sicherheitsvorfälle dem Bundesamt für Sicherheit in der Informationstechnik zu melden. Cyberattacke und Desinformation Die Bundesregierung wirft Russland eine massive Cyberattacke sowie Falschinformationen im jüngsten Bundestagswahlkampf vor und hatte deshalb vergangene Woche Konsequenzen angedroht. Die “gezielte Informationsmanipulation” reihe sich in eine Serie von Aktivitäten ein, die das Ziel hätten, das Vertrauen in demokratische Institutionen und Prozesse in Deutschland zu untergraben, teilte das Auswärtige Amt mit. Der russische Botschafter wurde daher ins Ministerium einbestellt. Konkret gehen nach Überzeugung der Bundesregierung zwei hybride Angriffe auf das Konto des russischen Militärgeheimdienstes GRU. IT der Flugsicherung betroffen Zum einen könne ein Cyberangriff gegen die Deutsche Flugsicherung (DFS) im August 2024 klar der russischen Hackergruppe “Fancy Bear” und dem GRU zugeordnet werden. Zum anderen könne man nun verbindlich sagen, dass Russland mit der Kampagne “Storm 1516” versucht habe, “sowohl die letzte Bundestagswahl als auch fortlaufend die inneren Angelegenheiten der Bundesrepublik Deutschland zu beeinflussen und zu destabilisieren”. Im Fokus standen vor der Bundestagswahl unter anderem der Grünen-Spitzenkandidat Robert Habeck und der damalige Unions-Kanzlerkandidat Friedrich Merz (CDU). Um sie in Misskredit zu bringen, wurden unter anderem falsche Zeugenaussagen produziert und ins Netz gestellt sowie Websites mit erfundenen Inhalten aufgesetzt. (dpa/jm)
Critical Apache Commons Text Flaw Lets Hackers Execute Remote Code

gbhackers.com · 7 months ago

A critical remote code execution vulnerability has been discovered in Apache Commons Text, affecting all versions prior to 1.10.0. The flaw, tracked as CVE-2025-46295, poses a significant security risk to organizations relying on the widely-used Java library for text manipulation and processing. The vulnerability resides in Apache Commons Text’s interpolation features, which are designed to
SoundCloud Cyberattack Leaves 28M Users Exposed

www.techrepublic.com · 7 months ago

The breach has already triggered widespread chaos across the platform, with users worldwide reporting connection failures and cryptic error messages.
Kimsuky Spreads DocSwap Android Malware via QR Phishing Posing as Delivery App

thehackernews.com · 7 months ago

The North Korean threat actor known as Kimsuky has been linked to a new campaign that distributes a new variant of Android malware called DocSwap via QR codes hosted on phishing sites mimicking Seoul-based logistics firm CJ Logistics (formerly CJ Korea Express). "The threat actor leveraged QR codes and notification pop-ups to lure victims into installing and executing the malware on their mobile
Phantom Stealer Targeting Users to Steal Sensitive Data

gbhackers.com · 7 months ago

Sophisticated malware employs a multi-stage infection chain and advanced evasion techniques to exfiltrate sensitive information. Phantom, a sophisticated stealer malware variant, is conducting targeted attacks to harvest sensitive data from infected systems, including passwords, browser cookies, credit card information, and cryptocurrency wallet credentials. Security researchers have identified Version 3.5 of the malware, which employs a
China-Linked Hackers Exploiting Zero-Day in Cisco Security Gear

www.securityweek.com · 7 months ago

The critical zero-day is tracked as CVE-2025-20393 and it impacts Secure Email Gateway and Secure Email and Web Manager appliances.
D&O liability protection rising for security leaders — unless you’re a midtier CISO

www.csoonline.com · 7 months ago

Smaller firms are far less likely than multinationals to protect their CISOs from personal liability for security breaches, according to a study by RSAC. Experts quizzed by CSO said the finding was concerning because without protection CISOs face legal and financial risk tied to decisions made in their role. The vast majority (88%) of CISOs from Fortune 1000 firms are legally indemnified by their companies, but this figure drops to just 53% for CISOs from organizations with 500 or more employees, according to the survey by RSAC (formerly RSA Conference). Directors’ and officers’ (D&O) insurance is the most common indemnification vehicle for both groups, and 70% of the Fortune 1000 CISOs surveyed report being covered by it. Kelly Rittenberry Culhane, co-founder of CM Law, told CSO the finding is a concern for security leaders and midsize employers alike, given that, midsize or multinational, organizations face similar risks. “While the complexity and scale of operations may differ in a midsize company, the cybersecurity risks, ransomware, data breaches, regulatory compliance failures, are equally severe,” Rittenberry Culhane says. “Without indemnification, CISOs risk personal liability, which can deter highly qualified professionals from accepting these roles.” As a result, midsize organizations put themselves at greater risk by not offering to protect from personal liability the top security leader they employ. D&O for CISOs on the rise CISOs have the potential for more than one safety net, the first of which is a company’s indemnification provisions, rules typically embedded in the company’s articles of incorporation and bylaws. “The language of a company’s indemnification provisions must be properly worded, typically achieved by the general counsel and a board vote, to provide indemnification for a CISO equal to every other director or officer of a company,” explains John Peterson of World Insurance Associates, a provider of employment practice liability insurance. The second safety net for a CISO is the D&O liability insurance policy procured by the CISO’s company through an insurance broker. Even when a company has D&O insurance in place, Peterson advises CISOs to review those policies to make sure they are covered as an “insured person.” According to the latest IANS Research + Artico Search’s CISO Compensation Report, inclusion of CISOs in D&O insurance policies is increasing. More than 50% of CISOs in the US and Canada received this insurance benefit as part of their compensation package, according to the 2025 edition of the study. This figure is up from the 40% who said they received this protection in last year’s edition of the CISO Compensation Report. One in 5 CISOs also reported to IANS Research that they have access to external counsel, typically for investigations or audits. A question of indemnity But Ryan Griffin, US cyber leader at insurance broker McGill and Partners, points out that the difference between D&O insurance and a direct indemnification agreement is often misunderstood. “The most crucial tool for a CISO’s protection is the indemnification agreement with their employer,” Griffin explains. “The D&O policy is how the company pays to protect its officer, but the indemnification agreement is what actually legally guarantees that protection.” Without a formal indemnification agreement, CISOs are at great risk, Griffin warns. “They would be responsible for covering their own legal defense costs, forcing them to rely on personal savings or a personal umbrella insurance policy,” Griffin tells CSO. “Beyond the financial hit, their career could be severely damaged.” Griffin adds: “An enforcement action, even if it’s ultimately dismissed, could result in penalties that bar them from serving as an officer for a public company for years, which seriously limits future job prospects.” Blame game Central to the issue as well is accountability, which almost always lands on the shoulders of the person perceived to be “in charge of security,” according to Kenrick Bagnall, president and co-founder of RB-Cyber Assurance. “Whether that’s the CISO of a Fortune 500 company or the sole IT director of a 100-person manufacturing firm, when things go wrong, someone has to answer for it,” says Bagnall, a former detective constable with the Toronto Police Service. The difference between a multinational and a midsize company isn’t the exposure, Bagnall says; it’s the resources. While enterprise CISOs often have access to legal teams and crisis PR advisors to help shield them, a midrange firm often has one or two people, possibly more, wearing multiple hats, like compliance, IT, and security all rolled into one. This can become an issue because “regulators, customers, and even the courts won’t lower the expectations just because the company is smaller,” Bagnall says. “Without legal protection, CISOs face significant personal and professional risk,” Bagnall said. “They can be blamed for systemic failures outside of their control, things like legacy systems that were never budgeted for replacement, or business units that refuse to adopt security controls because they’re ‘too disruptive.’” SolarWinds case continues to cast lingering shadow The SEC’s 2023 lawsuit against SolarWinds’ CISO Timothy Brown over allegations that he misled investors and failed to accurately report the vendor’s cybersecurity measures is far from an isolated case. Even though the ultimate dismissal of this high-profile lawsuit eased immediate fears that many CISOs might be held personally liable for security incidents the issue has far from gone way. “Cybersecurity leaders are increasingly held accountable for breaches and their handling of incidents,” CM Law’s Rittenberry Culhane says. “Regulatory bodies, shareholders, and courts are naming CISOs in lawsuits, even when they acted in good faith.” Midsize companies tend to have more limited legal and compliance resources, making indemnity insurance even more important as a potential safety net for security professionals employed by midrange firms. “D&O insurance should always be obtained but that doesn’t always cover all the risk,” Rittenberry Culhane says. Rittenberry Culhane, a former general counsel turned attorney whose practice specializes in advising corporations on risk management and insurance, offered CISOs a best practice checklist: Confirm CISO coverage under your D&O policy Review policy limits and exclusions for cyber-related claims Consider supplemental indemnification agreements for CISOs and security leaders Align indemnity provisions with incident response and disclosure policies For more, see “ Navigating personal liability: post data-breach recommendations for CISOs.” Governance structures need revamping The CISO role has evolved faster than the governance structures that protect it, according to RB-Cyber Assurance’s Bagnall. “We now ask security leaders to be part strategist, part technologist, part crisis responder, and part scapegoat,” Bagnall says. “Until organizations, especially midsized ones, recognize that and build legal and contractual protections accordingly, we’ll continue to see talented leaders hesitate to take on these roles, resulting in organizations of all sizes not getting the proper tech and information security guidance they need.” “The CISO isn’t just defending the network, they’re defending the business’s reputation, its trust, and its future,” Bagnall adds. “That responsibility deserves protection.”
Critical Node.js Library Flaw Lets Hackers Execute Remote Commands on Windows

gbhackers.com · 7 months ago

A severe command injection vulnerability has been discovered in systeminformation, a widely-used Node.js library for retrieving system information. The flaw, tracked as CVE-2025-68154, allows attackers to execute arbitrary commands on Windows systems when applications pass user input to the vulnerable function. The vulnerability exists in the fsSize() function, which retrieves disk space information but fails
Microsoft 365 Outage Disrupts Teams, Outlook, and Copilot in Japan and China

gbhackers.com · 7 months ago

Thousands of users across Japan and China experienced significant disruptions to Microsoft 365 services on Thursday morning due to a critical routing issue affecting the company’s infrastructure. The outage affected essential workplace tools, including Teams, Outlook, OneDrive, and Copilot, resulting in widespread operational challenges for enterprises in the Asia-Pacific region. Service Disruption Details The incident
Hackers Actively Target Cisco and Palo Alto VPN Gateways to Steal Login Credentials

gbhackers.com · 7 months ago

Cybersecurity researchers at GreyNoise have identified a large-scale, coordinated campaign targeting enterprise VPN authentication systems. The attackers are systematically attempting to breach Cisco SSL VPN and Palo Alto Networks GlobalProtect services through credential-based attacks rather than exploiting specific vulnerabilities. The campaign activity was observed during mid-December across a concentrated two-day period, revealing a sophisticated approach
Cybercriminals Registering Fake Shopping Domains to Target Users This Holiday Season

gbhackers.com · 7 months ago

As the global holiday shopping season reaches its peak, cybersecurity researchers have uncovered a massive, industrialized operation designed to defraud consumers through a sophisticated network of counterfeit e-commerce sites. In a report released in November 2025, PreCrime™ Labs, the research division of BforeAI, identified a coordinated campaign involving the mass registration of fake online shop
Kimwolf Android Botnet Compromises 1.8 Million Devices Worldwide

gbhackers.com · 7 months ago

A newly discovered Android botnet dubbed “Kimwolf” has silently compromised over 1.8 million devices globally, primarily targeting Android TV boxes in residential networks. The massive operation, which at one point saw its command-and-control (C2) domain surpass Google in global popularity rankings, represents a significant evolution in IoT malware sophistication and scale. Security researchers at XLab
CISA Flags Critical ASUS Live Update Flaw After Evidence of Active Exploitation

thehackernews.com · 7 months ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a critical flaw impacting ASUS Live Update to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2025-59374 (CVSS score: 9.3), has been described as an "embedded malicious code vulnerability" introduced by means of a supply chain compromise
Cisco AsyncOS 0-Day Allows Remote Execution of System Commands

gbhackers.com · 7 months ago

Cisco Talos has uncovered an active campaign exploiting a zero-day vulnerability in Cisco AsyncOS Software, affecting Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. The security flaw enables attackers to execute system-level commands remotely and deploy sophisticated backdoors on compromised systems. The threat actor behind this campaign, tracked as UAT-9686, is assessed
Cisco Warns of Active Attacks Exploiting Unpatched 0-Day in AsyncOS Email Security Appliances

thehackernews.com · 7 months ago

Cisco has alerted users of a maximum-severity zero-day flaw in Cisco AsyncOS software that has been actively exploited by a China-nexus advanced persistent threat (APT) actor codenamed UAT-9686 in attacks targeting Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. The networking equipment major said it became aware of the intrusion campaign on December 10, 2025, and that it
Raspberry Pi used in attempt to take over ferry

www.csoonline.com · 7 months ago

A recent attack on a French ferry, in which an attacker reportedly plugged a tiny computer called a Raspberry Pi into the network in an attempt to break into the vessel’s operations, offers an important lesson for enterprise CISOs: one analyst estimated that half of all enterprises would likely be compromised by the same attack on their physical environment. The ferry was “immobilized Saturday in the southern French port of Sète as it prepared to sail to Algeria” because of the attack attempt, according to a report from Bloomberg. The Raspberry Pi device “was paired with a cellular modem, enabling remote access to the ferry’s internal computer network and external connections.” The good news was that the attack attempt was halted because of good security procedures onboard, the story said. “Investigators said segregation between office and operational networks, along with the absence of remote access to critical controls, prevented lateral movement and ruled out sabotage or hijacking scenarios.” Enterprise controls ‘watching the wrong roads’ The question for enterprise cybersecurity executives is how well their land-based buildings, offices, stores, gas stations, bank branches, manufacturing facilities, and so forth, would have held up under a similar physical attack. Analysts and other security experts were not optimistic about how they would have fared. “Most enterprise security programs are still built for the wrong kind of intruder. They are built for the person who breaks in, not the person who walks in. And the rogue device story is the clearest signal of that shift,” said Sanchit Vir Gogia, the chief analyst at Greyhound Research. “A Raspberry Pi class device with a cellular modem is not just a clever gadget, it is a way to create a new perimeter from inside your building.” He pointed out that an attacker “does not have to fight your firewalls if they can step around them. They do not need to beat your VPN if they can bring their own internet connection into your wiring closet. That is the part that should keep CISOs awake, because it means a lot of the controls we celebrate are watching the wrong roads. If the traffic leaves through cellular, it does not cross your monitored gateways. Your SOC can be doing everything right and will still see nothing.” Fred Chagnon, principal research director at Info-Tech Research Group, agreed with Gogia’s concerns. “Most offices have dozens of live Ethernet ports in lobbies, under conference tables, and in hallways. These should be administratively disabled at the switch level by default. A port should only be activated when a specific, authorized MAC address is verified via 802.1X authentication,” Chagnon said. He added, “modern threat actors use MAC Spoofing to make a Raspberry Pi look like a legitimate VoIP phone or printer. CISOs should invest in tools, like Sepio or advanced NACs, that perform physical layer fingerprinting. These tools analyze the electrical and timing characteristics of the hardware to detect if a ‘printer’ is actually a Linux-based implant.” Chagnon also encouraged extensive use of port locks that require a key, and some type of tamper-evident tape over chassis and ports. “Security sweeps should include looking for extra wires, unauthorized USB hubs, or small boxes that don’t match the asset inventory,” he added. “If a door to a restricted area is opened and a new, unknown device simultaneously appears on that local switch, the SOC should receive a high-priority correlated alert.” Forrester Senior Analyst Paddy Harrington said that many enterprise security executives “forget how susceptible these things are to attack” and specifically pointed to IoT and OT devices as prime targets. Too many security people, Harrington said, are looking at what shadow devices, such as fitness trackers, are supposed to do, and not focusing on the access the device could get as the start of a backdoor attack. “You shouldn’t be able to walk up to an Ethernet port and plug in anything. That device needs to be authenticated,” Harrington said, adding that he estimates that 50% of all enterprises cut too many corners on device security. “Why should any IoT lightbulbs have access to financial data?” he asked. When he confronts enterprise security leaders on physical security, he said, he gets pushback. For example, in a recent discussion about network segmentation, the executive told him, “To segment our environment to that degree is going to take a lot of time and effort, and we are redirecting our money elsewhere.” Harrington said, “I’m sorry, but that is a poor excuse.” However, one security executive, Flavio Villanustre, CISO for the LexisNexis Risk Solutions Group, said that these types of physical attacks can be challenging to block. “The proliferation of inexpensive and very capable single board computers such as the Raspberry Pi have made this problem much harder. Intrusion detection in the network should have detected behavioral anomalies, but that’s easier said than done if you have a large complex network and the Raspberry Pi looks like just another normal IoT device,” Villanustre pointed out. “And this is assuming that it was even connected to the network, rather than [to] some ancient serial bus in the ship’s control systems.” Proceed with caution Villanustre encouraged anyone discovering such a device to proceed cautiously. “Disconnecting the device could result in losing important forensic information if not careful. It’s not too hard to equip the device with a tiny battery or supercapacitor that would give it enough time to wipe itself out if disconnected from the network or somehow tampered with,” Villanustre said. “Trying to send false information is even harder, because you would need to identify the protocols used by the device to know what to send. A bigger concern is if the device is connected to perhaps another device in the ship and could trigger a damaging action if tampered with. It could even detonate explosives.” Whisper Security CEO Kaveh Ranjibar added that his advice for dealing with this kind of physical discovery is “immediate isolation and forensic analysis, but with one critical step before physical removal: map the blast radius. Before you pull the plug, capture the device’s network traffic. Who is it talking to? What domains is it querying?” “Using infrastructure intelligence, you can often attribute the actor based on the neighborhood of the command-and-control servers they use, allowing you to understand if this is a script kiddie or a GRU operation before you touch the hardware,” Ranjibar said. Ranjibar said that when such devices phone home, they may reveal a lot of usable information. “A rogue device like a Raspberry Pi, even with a cellular modem, isn’t invisible. It has to phone home to receive commands or exfiltrate data. It creates an infrastructure footprint: a new IP address, a DNS resolution or a connection to a specific Autonomous System Number (ASN),” Ranjibar said. “CISOs need to move beyond just monitoring their internal LAN,” he added. “They need continuous external infrastructure monitoring. If a device on your vessel or in your building starts communicating with a network block known for hosting state-sponsored malware, or if a new shadow asset appears on your perimeter, that is your tripwire. You might not catch the person planting the device, but you should instantly catch the device when it connects to the internet.”
Der Raspberry-Pi-Weckruf für CISOs

www.csoonline.com · 7 months ago

A Mediterranean Shipping Company ferry was recently targeted by a suspected Russian cyberattack using a Raspberry Pi device connected to a cellular modem. Security measures prevented the attackers from gaining access to critical ship systems, highlighting the importance of physical security. Experts warn that many organizations neglect physical security, leaving them vulnerable to attackers who simply walk in with devices like Raspberry Pis to bypass traditional security controls. They recommend disabling unused network ports, using advanced network access control, and continuously monitoring external infrastructure to detect suspicious devices.
Microsoft warns MSMQ may fail after update, breaking apps

www.csoonline.com · 7 months ago

A warning from Microsoft that a Windows patch issued last week may cause the Message Queuing (MSMQ) function in the operating system to malfunction could be behind multiple reports of internet of things (IoT) applications failing. David Shipley, head of Canadian security awareness training provider Beauceron Security, says he saw a query on a Microsoft learning forum today asking if the MSMQ problem is behind the failure of a firm’s point of sale system to issue sales receipts. Another person posted a query on a different Microsoft forum about a building in an unnamed city being without its fire alarm or smoke detector systems. A link between these posts and the December 16 security update from Microsoft on the MSMQ issue couldn’t be confirmed. But Shipley said it is odd that Microsoft’s initial advice says that a workaround is available, but instead of detailing it, it urges admins to contact Microsoft Support For Businesses. “The scariest words when it comes to a serious bug in Windows you’re trying to fix, that’s crashing your applications, is, ‘Call us,’” he said. MSMQ is a protocol for secure messaging between applications, Shipley noted, so if there is a problem, “it’s going to break stuff.” The Microsoft post says that individuals using Windows Home or Pro editions on personal devices are “very unlikely to experience this issue. This issue primarily affects enterprise or managed IT environments,” including those running clustered MSMQ environments under load. Symptoms include: MSMQ becoming inactive; Internet Information Services (IIS) sites failing with “Insufficient resources to perform operation” errors; applications unable to write to queues; errors such as “The message file ‘C:\Windows\System32\msmq\storage.mq’ cannot be created” when creating message files; misleading log entries such as “There is insufficient disk space or memory”, despite sufficient disk space and memory being available. Affected are servers running Windows Server 2019 and 2016, Windows Server 2012 R2 and Windows Server 2012. Also affected are PCs running Windows 10 version 22H2, Windows 10 version 21H2, Windows 10 version 1809, and Windows 10 version 1607. Support for Windows 10 ended October 14, so the issue should only affect these systems if admins have paid for extended support and received the December update. This issue is caused by a December Patch Tuesday security update (KB5071546) that introduced changes to the MSMQ security model and NTFS permissions on the C:\Windows\System32\MSMQ\ storage folder. MSMQ users now require write access to this folder, which is normally restricted to administrators, says Microsoft. As a result, attempts to send messages via MSMQ APIs might fail with resource errors. “A workaround is available for affected devices,” says the Microsoft update. “To apply the workaround and mitigate this issue in your organization, please contact Microsoft Support for business. We are investigating this issue and will provide more information when it is available.” Jack Bicer, director of vulnerability research at Action1, suggested as a temporary workaround for MSMQ failures that Windows admins grant write access to the MSMQ directory C:\Windows\System32\msmq. Once Microsoft provides the official update, revert the directory permissions to their original state and deploy the fix, he said. Danny Nguyen of Wicloud suggested on a Microsoft Learn forum that admins could either roll back the December security update (KB5071546) or adjust the permissions, as Bicer suggests. However, Nguyen urged admins to consult with their security team before making system-level permission changes. A Microsoft spokesperson was asked for comment, but no response was received by press time. This isn’t the first MSMQ problem in recent memory; last year Microsoft discovered a remote code execution vulnerability (CVE-2024-30008) that carried a criticality rating of 9.8. In this case, however, said Robert Beggs, head of Canadian incident response firm DigitalDefence, although the cause of the issue is a security patch, the impact and workaround are not strictly security issues. Therefore, he believes the fix is a workaround that does not involve security and security support, but regular support for a Windows system. As for the company’s reason for asking admins to contact Microsoft Support for Business for the workaround, he suggested that Microsoft may want to spread the workload to ensure that security support is not overworked. More broadly, warned Shipley, any update that leads to a business application failure is the kind of issue that turns admins off patching. December is the biggest month of the year for retail, and not the time for POS machines to go down because of the installation of a new patch. This article
Millions impacted by PornHub, SoundCloud data breaches

therecord.media · 7 months ago

PornHub sent emails out to many users and published a statement warning that it was affected by a recent breach of data analytics service provider Mixpanel.
Smashing Security podcast #448: The Kindle that got pwned

grahamcluley.com · 7 months ago

Think your Kindle is harmless? Think again! In this episode, we unpack a Black Hat Europe talk revealing how a boobytrapped audiobook could exploit the Amazon eBook reader - potentially letting an attacker break into your account and seize control of your credit card. Plus a blast from 2021's "summer of ransomware" returns to haunt Ireland's Health Service Executive, as victims are offered €750 each. And because it's the last show before the Christmas break, there's also a Pick of the Week that veers from cosy rom-com comfort to pointy-polygon nostalgia. All this and much more is discussed in the latest edition of the award-winning "Smashing Security" podcast with computer security veteran Graham Cluley, joined this week by special guest Danny Palmer.
‘Ink Dragon’ threat group targets IIS servers to build stealthy global network

www.csoonline.com · 7 months ago

A Chinese-linked threat group identified as “Ink Dragon” is targeting common weaknesses in Internet Information Services (IIS) servers to build a global espionage network that is difficult to track or disrupt, security vendor Check Point has reported. Also nicknamed “Earth Alux,” (Trend Mico) and “REF7707” (Elastic Security Labs), the group’s activities date back to early 2023, at which time it targeted governments in Southeast Asia and South America. This has since expanded to target European countries. Ink Dragon might sound similar in its modus operandi to several other Chinese threat groups engaged in nation-state surveillance, such as UNC6384, whose campaigns targeted European diplomats. However, during a recent investigation at the office of a European government, Check Point said it had discovered that the group has now pivoted towards what it called “an unusually sophisticated playbook” with longer term goals. Key to this is IIS, Microsoft’s aging web server platform, which is still present in many networks, especially those in the public sector. This platform holds two attractions: it is widely deployed, and is often misconfigured and insecure. The campaign begins when attackers compromise an IIS server, gain access to the internal network where they harvest local credentials, study admin sessions, using these and Microsoft Remote Desktop to move laterally without attracting attention. At this point, the group installs a customized IIS module that turns the server into an invisible “quiet” relay inside the group’s wider global infrastructure. “These servers forward commands and data between different victims, creating a communication mesh that hides the true origin of the attack traffic,” explain Check Point’s researchers. Shadow infrastructure The attack has two goals: to compromise government servers and plunder their networks for intelligence while, secondly, borrowing them to relay attack traffic to and from other compromised servers in a way that makes detecting the group’s command & control (C2) much harder. This tactic cleverly dodges the problem of having to rely on conventional C2 infrastructure which is vulnerable to takedown and disruption. Instead, the hijacked and trusted government servers become the infrastructure. “Across incidents, the same story repeats. A small web facing issue becomes the first step. A series of quiet pivots leads to domain level control. The environment is then repurposed as part of a larger network that powers operations against additional targets,” said Check Point. As to the traffic itself, the group hides communication inside ordinary mailbox drafts, making it look like everyday communication. Coincidentally, Check Point found that a second Chinese threat group, RudePanda, was simultaneously exploiting IIS weaknesses to compromise government servers. This meant that RudePanda “ended up operating in the same [compromised] environments at the same time.” The discoveries underscore the issue of IIS misconfiguration. Beyond listing the group’s indicators of compromise (IoCs), Check Points offers no specific advice on how to counter this. Nevertheless, some actions suggest themselves: audit the modules running on IIS against a known good baseline, enable advanced IIS logging, configure IIS to make common view state vulnerabilities less likely, and consider putting IIS servers behind a web application firewall (WAF).
Zeroday Cloud hacking event awards $320,0000 for 11 zero days

www.bleepingcomputer.com · 7 months ago

The Zeroday Cloud hacking competition in London has awarded researchers $320,000 for demonstrating critical remote code execution vulnerabilities in components used in cloud infrastructure.
Critical Fortinet Flaws Under Active Attack

www.darkreading.com · 7 months ago

Attackers targeted admin accounts, and once authenticated, exported device configurations including hashed credentials and other sensitive information.
Remote Code Execution Vulnerability in React and Next.js Frameworks: December 2025

sec.cloudapps.cisco.com · 7 months ago

On December 3, 2025, the React team released a security advisory regarding a vulnerability, CVE-2025-55182, in the React server that could allow an unauthenticated, remote attacker to perform remote code execution on an affected device or system. For a description of this vulnerability, see the public React Security Advisory. Cisco's standard practice is to update integrated third-party software components to later versions as they become available. This advisory will be updated as additional information becomes available. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-react-flight-TYw32Ddb <br/Security Impact Rating: Critical <br/CVE: CVE-2025-55182
France arrests suspect tied to cyberattack on Interior Ministry

www.bleepingcomputer.com · 7 months ago

French authorities arrested a 22-year-old suspect on Tuesday for a cyberattack that targeted France's Ministry of the Interior earlier this month.
New research confirms what we suspected: every LLM tested can be exploited

24882480.fs1.hubspotusercontent-eu1.net · 7 months ago

Just finished reading ActiveFence’s emerging threats assessment on 7 major models across hate speech, disinfo, fraud, and CSAM-adjacent prompts. Key findings are: 44% of outputs were rated risky, 68% of unsafe ones were hate-speech-related, and only a single model landed in the safe range. What really jumps out is how different vendors behave per abuse area (fraud looks relatively well-covered, hate and child safety really don’t). For those doing your own evals/red teaming: are you seeing similar per-category gaps? Has anyone brought in an external research partner like ActiveFence to track emerging threats over time?
In Cybersecurity, Claude Leaves Other LLMs in the Dust

www.darkreading.com · 7 months ago

false
FBI takes down alleged money laundering service for ransomware groups

therecord.media · 7 months ago

According to a DOJ announcement, the exchange E-Note was used to process funds stolen by criminals in cyberattacks on healthcare entities and critical infrastructure, among other targets.
Amazon: Ongoing cryptomining campaign uses hacked AWS accounts

www.bleepingcomputer.com · 7 months ago

Amazon's AWS GuardDuty security team is warning of an ongoing crypto-mining campaign that targets its Elastic Compute Cloud (EC2) and Elastic Container Service (ECS) using compromised credentials for Identity and Access Management (IAM).
'Cellik' Android RAT Leverages Google Play Store

www.darkreading.com · 7 months ago

The remote access Trojan lets an attacker remotely control a victim's phone and can generate malicious apps from inside the Play Store.
Securing the Network Edge: A Comprehensive Framework for Modern Cybersecurity

www.darkreading.com · 7 months ago

The future of cybersecurity means defending everywhere. Securing IoT, cloud, and remote work requires a unified edge-to-cloud strategy. First in a three-part series.
A retired policeman was jailed over an anti-Trump meme. Now he’s suing.

www.washingtonpost.com · 7 months ago

false
'Fake Proof' and AI Slop Hobble Defenders

www.darkreading.com · 7 months ago

In the React2Shell saga, non-working and trivial proof-of-concept exploits led to confusion and perhaps a false sense of security. Can the onslaught of PoCs be tamed?
The Future of Quantum-Safe Networks Depends on Interoperable Standards

www.darkreading.com · 7 months ago

As quantum computing advances, interoperable standards will be the key to making QKD practical, trusted, and future-proof.
TikTok tracked user’s Grindr activity in violation of European law, rights group alleges

therecord.media · 7 months ago

TikTok and the gay dating app Grindr are violating European data protection laws by tracking user activities across apps, a digital rights organization alleged Wednesday.
Brendan Carr Says FCC ‘Isn’t Independent’ Amid Concerns of How Trump Might Use the Agency

www.nytimes.com · 7 months ago

The comment from Brendan Carr, a Republican, raised concerns from lawmakers about how President Trump might use the agency.
FTC orders crypto platform Nomad to distribute $37.5 million after 2022 theft

therecord.media · 7 months ago

Under a settlement with the FTC, the Nomad platform will have to redistribute stolen funds that white-hat hackers returned to the company after thieves aggressively exploited a vulnerability in 2022.
WhatsApp device linking abused in account hijacking attacks

www.bleepingcomputer.com · 7 months ago

Threat actors are abusing the legitimate device-linking feature to hijack WhatsApp accounts via pairing codes in a campaign dubbed GhostPairing.
Russian BlueDelta hackers ran phishing campaign against Ukrainian webmail users

therecord.media · 7 months ago

Researchers said the campaign likely aimed to collect sensitive information from Ukrainian users in support of broader Russian intelligence objectives.
Inside PostHog: How SSRF, a ClickHouse SQL Escaping 0day, and Default PostgreSQL Credentials Formed an RCE Chain (ZDI-25-099, ZDI-25-097, ZDI-25-096)

mdisec.com · 7 months ago

A chain of critical vulnerabilities was found in Posthog, allowing for remote code execution. This exploitation path combined a server side request forgery flaw, a clickhouse sql escaping zero day, and the use of default postgresql credentials. The security researchers identified multiple related flaws, specifically ZDI-25-099, ZDI-25-097, and ZDI-25-096.
Cisco warns of unpatched AsyncOS zero-day exploited in attacks

www.bleepingcomputer.com · 7 months ago

Cisco warned customers today of an unpatched, maximum-severity Cisco AsyncOS zero-day actively exploited in attacks targeting Secure Email Gateway (SEG) and Secure Email and Web Manager (SEWM) appliances.