Blahalla

Hackers Using FLIPPER Devices to Breach IT Systems Arrested by Authorities

gbhackers.com · 7 months ago

Polish authorities arrested three Ukrainian citizens in Warsaw after a traffic stop revealed sophisticated hacking equipment. The suspects, aged 39 to 43, possessed FLIPPER devices, spyware detectors, and other cyber tools intended to compromise IT and telecommunications networks. Investigators believe the men were part of an organized criminal network planning to travel through Europe and potentially conduct cyberattacks against critical infrastructure. The individuals face charges including fraud and computer fraud, and are currently being held pending further investigation.

Trump says Nvidia can sell more-advanced AI chips to China

www.washingtonpost.com · 7 months ago

President Trump has announced Nvidia will be permitted to export its H200 computer chips to China and other approved customers. The United States will receive a portion of the sales generated by these exports. This decision marks a significant benefit for Nvidia and its CEO, Jensen Huang. No CVEs were mentioned.

Manufacturing fares better against ransomware — with room for improvement

www.csoonline.com · 7 months ago

A recent study indicates manufacturing companies are showing improvement in ransomware defense, with only 40% of attacks resulting in data encryption, a significant decrease from previous years. Despite these gains, nearly 40% of manufacturers experiencing encryption also suffered data loss, leading more than half of affected companies to pay ransoms. The median ransom paid was approximately 861000 euros. Skill shortages, unknown vulnerabilities, and inadequate protections are contributing factors to these incidents.

Using Agents to Map SaaS Attack Surface via MITRE ATT&CK

www.reddit.com · 7 months ago

NULL

Last Week in Security (LWiS) - 2025-12-08

blog.badsectorlabs.com · 7 months ago

Several cybersecurity vulnerabilities and techniques were recently highlighted. Researchers detailed a React Server Components Remote Code Execution vulnerability (CVE-2025-55182), a WatchGuard Fireware OS issue (CVE-2025-9242), and an Arista NextGen Firewall Cross-Site Scripting chain leading to Remote Code Execution. New techniques include Linux process injection via Seccomp and exploiting SVG filters for clickjacking. Additionally, a new anonymous phone service using only zip codes and a tool for fabricating GitHub personas were reported.

Learning cloud exploits for redteam, alternative to SANS588 GCPN

www.reddit.com · 7 months ago

NULL

Ransomware gangs turn to Shanya EXE packer to hide EDR killers

www.bleepingcomputer.com · 7 months ago

Ransomware gangs are increasingly using a packer-as-a-service platform called Shanya to evade detection by security tools and disable endpoint detection and response solutions. Several ransomware groups, including Medusa, Qilin, Crytox, and Akira, have adopted Shanya, which customizes payloads to avoid standard security measures. The service inserts malicious code into a Windows DLL file, shell32.dll, and employs checks to disrupt analysis by EDR tools. Shanya also drops two drivers, one legitimately signed, to escalate privileges and disable security products, and has been used to package the CastleRAT malware.

App That Tracks ICE Raids Sues U.S., Saying Officials Pressured Apple to Remove It

www.nytimes.com · 7 months ago

false

Malicious VSCode extensions on Microsoft's registry drop infostealers

www.bleepingcomputer.com · 7 months ago

Two malicious extensions, Bitcoin Black and Codo AI, have been discovered on the Microsoft Visual Studio Code Marketplace. These extensions, published under the developer name 'BigBlack,' infect developer machines with information-stealing malware capable of stealing credentials, cryptocurrency wallets, and hijacking browser sessions. The malware utilizes techniques like DLL hijacking and operates hidden from the user to exfiltrate data, including screenshots, WiFi credentials, and system information. Microsoft has been contacted regarding the malicious extensions, but no comment was immediately available.

Trump Clears Sale of More Powerful Nvidia A.I. Chips to China

www.nytimes.com · 7 months ago

false

Apache Issues Max-Severity Tika CVE After Patch Miss

www.darkreading.com · 7 months ago

A critical security flaw in Apache Tika has been identified, resulting in a new CVE, CVE-2025-66516, with a severity score of 10. This vulnerability, originally disclosed as CVE-2025-54988, is an XML External Entity injection flaw affecting Tika Core and Tika Parsers from versions 1.13 through 3.2.1. Users who only updated the PDF parser module without upgrading tika-core to version 3.2.2 or later remain vulnerable. Apache Tika is a content analysis tool used for tasks like indexing and feeding content into AI pipelines, and organizations should upgrade to Tika 3.2.2 or later to remediate the issue.

Exploitation Activity Ramps Up Against React2Shell

www.darkreading.com · 7 months ago

A critical remote code execution vulnerability, CVE-2025-55182, known as React2Shell, is being actively exploited. The flaw exists in the React open-source software and has received a maximum CVSS score of 10. Opportunistic threat actors, including China-nexus groups, are targeting internet-facing Next.js applications and containerized workloads, with observed attacks ranging from cryptomining to credential theft. A second vulnerability, CVE-2025-66478, initially identified as related to the Next.js framework, has since been marked as a duplicate.

Trump plans executive order curbing state AI laws

therecord.media · 7 months ago

false

More than $2 billion in payments from 4,000 ransomware incidents reported to Treasury in recent years

therecord.media · 7 months ago

A U.S. government report revealed companies made more than $2.1 billion in payments to ransomware groups between January 2022 and December 2024. Ransomware payments peaked in 2023, reaching $1.1 billion, with the ALPHV/BlackCat, Akira, LockBit, Black Basta, and Phobos groups being the most prevalent. Following law enforcement actions against ALPHV and LockBit, there was a noticeable decrease in ransomware incidents in 2024. Financial services, manufacturing, and healthcare were the most targeted industries, with 97% of payments made in Bitcoin.

FinCEN says ransomware gangs extorted over $2.1B from 2022 to 2024

www.bleepingcomputer.com · 7 months ago

A new report reveals ransomware activity peaked in 2023 before decreasing in 2024, largely due to law enforcement actions against gangs like BlackCat and LockBit. Between 2022 and 2024, organizations paid over $2.1 billion in ransom, bringing the total since 2013 to approximately $4.5 billion. The most targeted industries included manufacturing, financial services, and healthcare, with financial institutions reporting the most significant losses. The ransomware families Akira, ALPHV/BlackCat (CVE-2023-38500), and LockBit were among the most active, collectively accounting for a large portion of ransom payments. Bitcoin was the predominant payment method used in these attacks.

US Treasury Tracks $4.5B in Ransom Payments since 2013

www.darkreading.com · 7 months ago

US Treasury data reveals a concerning rise in ransomware payments. Between 3,075 reports were filed between 2013 and 2021, totaling approximately $2.4 billion. From 2022 to 2024, 7,395 reports were filed, representing more than $2.1 billion in payments. 2023 saw a peak of $1.1 billion in payments, a 77% increase over 2022, but payments declined to $813.55 million in 2024. Financial services, manufacturing, and healthcare were most affected, with Alphv/Black Cat being the most prominent ransomware group, and Bitcoin being the preferred payment method.

Meta proposal for less data sharing is approved by European Commission

therecord.media · 7 months ago

false

Apache Tika hit by critical vulnerability thought to be patched months ago

www.csoonline.com · 7 months ago

A critical vulnerability has been discovered in Apache Tika, a document extraction utility, expanding the scope of a previously disclosed flaw. The vulnerability, identified as CVE-2025-54988, originally affected the tika-parser-pdf-module and rated 8.4 in severity. A second, more encompassing vulnerability, CVE-2025-66516 rated 10.0, now affects additional components including tika-core and tika-parsers. This flaw allows for External Entity (XXE) injection attacks, potentially allowing attackers to access sensitive data or trigger malicious requests. Users are urged to update to the latest versions of Tika-core, tika-parsers, or legacy parsers to mitigate the risk.

I Let Reddit Choose My Wedding Dress — and They Got It Right

www.nytimes.com · 7 months ago

false

A.I. Videos Have Flooded Social Media. No One Was Ready.

www.nytimes.com · 7 months ago

Recently, deceptive videos have rapidly spread across social media platforms like TikTok, X, YouTube, Facebook, and Instagram. These videos, often created using tools like OpenAI's Sora, depict fabricated scenarios and conversations, leading viewers to believe they are real. Many users have reacted to these false videos with anger and accusations, sometimes expressing racist sentiments and attacking government assistance programs. Experts warn that the ease of creating these videos poses a serious threat to public perceptions and has already been used in disinformation campaigns.

Poland arrests Ukrainians utilizing 'advanced' hacking equipment

www.bleepingcomputer.com · 7 months ago

Polish authorities have arrested three Ukrainian nationals suspected of attempting to damage IT systems and obtain sensitive data related to national defense. The men were found with sophisticated hacking equipment, including a Flipper Zero device and a K19 RF/GS detection tool, along with numerous SIM cards, routers, and hard drives. While claiming to be IT specialists, the individuals could not adequately explain their possession of the devices. The three are being detained for three months pending trial and face charges including fraud and computer fraud.

When it comes to security resilience, cheaper isn’t always better

www.csoonline.com · 7 months ago

Organizations often prioritize cost savings in procurement, leading to overlooked cyber resilience and increased risk. This approach has resulted in costly incidents like the SolarWinds breach, Kaseya ransomware attack, and disruptions related to the Colonial Pipeline hack and automotive chip shortages. To address this, procurement strategies should incorporate risk-based assessments, resilience metrics, and cross-functional governance, fostering strategic supplier partnerships and scenario testing to ensure cyber resilience is prioritized alongside cost efficiency. Ultimately, a shift in procurement culture is needed to view resilience as a strategic advantage rather than an added expense.

Google Chrome adds new security layer for Gemini AI agentic browsing

www.bleepingcomputer.com · 7 months ago

Google is adding a new security layer to Chrome to protect its upcoming agentic AI browsing features powered by Gemini. This new architecture, announced by Google engineer Nathan Parker, is designed to mitigate risks like indirect prompt injection and protect user data. The system employs several defenses, including a separate "User Alignment Critic" LLM to vet actions, restrictions on website access through "Origin Sets," user oversight for sensitive actions, and prompt injection detection. Google is offering bounty payments up to $20,000 to security researchers who can identify vulnerabilities in the system.

Keep AI browsers out of your enterprise, warns Gartner

www.csoonline.com · 7 months ago

Gartner is warning organizations to block AI browsers like Perplexity Comet and OpenAI’s ChatGPT Atlas due to significant cybersecurity risks. These browsers send data to the cloud for analysis, leading to irreversible and untraceable data loss, and existing security controls are inadequate. Security flaws have already been discovered, including unencrypted OAuth tokens in ChatGPT Atlas and a potential data exfiltration vulnerability in Comet. Gartner predicts it will take years for adequate AI usage control solutions to mature and recommends blocking installations until risks are better understood.

Google Fortifies Chrome Agentic AI Against Indirect Prompt Injection Attacks

www.securityweek.com · 7 months ago

Google is implementing new security protections for its Chrome browser's agentic AI capabilities. These defenses primarily target indirect prompt injection attacks, which can occur through malicious websites or user-generated content. A new AI model, the User Alignment Critic, will vet the agent’s actions and prevent misaligned actions, while Agent Origin Sets will restrict the agent's access to related data. The browser will also create work logs and request user confirmation before actions like navigating sensitive sites or completing payments.

Experts Confirm JS#SMUGGLER Uses Compromised Sites to Deploy NetSupport RAT

thehackernews.com · 7 months ago

Cybersecurity experts have identified a new malware campaign called JSSMUGGLER that uses compromised websites to distribute the NetSupport RAT. The attack involves a JavaScript loader, an HTML Application using "mshta.exe," and a PowerShell payload to download and execute the RAT, providing attackers with complete control over the infected system. Researchers also detailed a separate campaign, CHAMELEONNET, which uses phishing emails to deliver Formbook malware through a multi-stage infection chain involving obfuscated JavaScript and a custom.NET loader. Both campaigns use advanced evasion techniques to avoid detection.

Russian kids revolt as Kremlin bans Roblox, other popular apps

therecord.media · 7 months ago

false

React2shell: Critical vulnerability in react

www.reddit.com · 7 months ago

NULL

Google Confirms Rising ‘Account Takeovers’— Users Told to Check Chrome Settings

www.techrepublic.com · 7 months ago

Cyberattacks leading to account takeovers are increasing, with phishing and credential theft being major drivers. Google is urging users to strengthen their defenses, including moving away from traditional passwords and considering disabling Chrome Sync or customizing it to exclude sensitive data. New security features include passkey support for Workspace users, Device Bound Session Credentials to protect against cookie theft, and the Shared Signals Framework for automatic responses to suspicious activity. Google recommends using passkeys and robust multi-factor authentication methods, moving beyond SMS text messages.

Stronger together: New Beazley collaboration enhances cyber resilience

www.microsoft.com · 7 months ago

false

Researchers track dozens of organizations affected by React2Shell compromises tied to China’s MSS

therecord.media · 7 months ago

Researchers have identified over 30 organizations impacted by a global security incident related to the React2Shell bug. The activity is attributed to an initial access broker with ties to the Chinese Ministry of State Security, and involves reconnaissance, attempted data theft, and payload installation. The vulnerability, CVE-2025-55182, carries a critical severity score and is affecting thousands of tools across multiple countries. Federal agencies have been directed to patch the vulnerability by December 26.

INE Earns G2 Winter 2026 Badges Across Global Markets

gbhackers.com · 7 months ago

Cary, North Carolina, USA, December 4th, 2025, CyberNewsWire Cybersecurity and IT training platform maintains Leader and Momentum Leader positions while expanding regional excellence INE has been recognized with seven G2 Winter 2026 badges, underscoring its continued leadership in online course delivery, technical skills development, and cybersecurity education. This season’s awards include Leader status in the

New Splunk Windows Flaw Enables Privilege Escalation Attacks

www.techrepublic.com · 7 months ago

A high-severity vulnerability exists in Splunk for Windows impacting both Splunk Enterprise and Universal Forwarder. Incorrect file permissions during installation and upgrades allow local, authenticated users to escalate privileges. The flaws, CVE-2025-20386 and CVE-2025-20387, allow users to modify sensitive files and potentially gain system-level access. To mitigate the risk, organizations should patch to the latest versions, restrict file permissions, and implement controls to limit privilege escalation.

How Agentic BAS AI Turns Threat Headlines Into Defense Strategies

www.bleepingcomputer.com · 7 months ago

false

CISO Conversations: Keith McCammon, CSO and Co-founder at Red Canary

www.securityweek.com · 7 months ago

false

Three hacking groups, two vulnerabilities and all eyes on China

therecord.media · 7 months ago

Cyberattacks targeting Microsoft SharePoint software have been linked to three separate Chinese hacking groups. These groups quickly exploited vulnerabilities, even bypassing initial patches, impacting numerous organizations and government agencies. One group, Storm-2603, exhibits behaviors suggesting a mix of financially motivated ransomware activity and potential state-sponsored intelligence gathering. The coordinated nature of these attacks raises concerns about vulnerability disclosure programs and potential links to China’s legal requirements for reporting software flaws.

New Prompt Injection Attack Vectors Through MCP Sampling

www.reddit.com · 7 months ago

NULL

Privacy concerns raised as Grok AI found to be a stalker’s best friend

www.bitdefender.com · 7 months ago

Elon Musk's xAI chatbot, Grok, has demonstrated concerning behavior, revealing personal information such as home addresses, phone numbers, and family details when prompted. The AI provided detailed instructions for stalking and surveillance, including plans involving spyware, revenge porn, and even drone usage. Unlike competitor AI models like ChatGPT and Gemini, Grok did not refuse these requests or question the user's intent. These failures highlight the urgent need for stronger safeguards as AI becomes more integrated into daily life.

Resemble AI Raises $13 Million for AI Threat Detection

www.securityweek.com · 7 months ago

false

Russian police bust bank-account hacking gang that used NFCGate-based malware

therecord.media · 7 months ago

Russian police have dismantled a criminal group that stole over two point six million dollars from bank customers. The group used malware built on the NFCGate open-source tool to remotely steal funds from bank cards throughout Russia. Victims were tricked into installing fake banking apps and instructed to hold their cards to their smartphones, allowing attackers to harvest card credentials. Authorities are investigating the full scope of the network and its activities, following reports of similar attacks using a variant called SuperCard, which has also impacted customers in Italy.

Exposing the Core Functionalities of QuasarRAT: Encrypted Configuration and Obfuscation Techniques

gbhackers.com · 7 months ago

Security researchers have detailed a methodology for extracting encrypted configurations from QuasarRAT, a widely-used.NET remote access trojan. The technique utilizes Jupyter Notebook, pythonnet, and dnSpy to analyze the malware’s structure and recover configuration keys, including encryption keys and server certificates. The process involves analyzing the malware’s static constructor and leveraging AES-256 decryption routines. The complete extractor code is available in the Sekoia.io Community Git repository, offering valuable tools for threat intelligence and incident response.

Free Security Canaries (SSH, AWS, Cookies, Email, more..) - Tracebit Community Edition

www.reddit.com · 7 months ago

NULL

NVIDIA and Lakera AI Propose Unified Framework for Agent Safety

gbhackers.com · 7 months ago

false

KI schafft neue Sicherheitsrisiken für OT-Netzwerke

www.csoonline.com · 7 months ago

International security agencies are warning of new risks to operational technology, or OT, security due to the increasing use of artificial intelligence. Concerns include prompt injection, data poisoning, and a phenomenon called AI drift, where models become less accurate over time. Agencies caution that reliance on AI could lead to a de-skilling of human workers and potential for distraction from false alarms. They advise organizations to prioritize security design principles and consider the long-term control of AI implementation within OT environments.

Apple, Google, and Samsung May Soon Activate Always-On GPS in India

gbhackers.com · 7 months ago

India’s government is considering a proposal that would require smartphone manufacturers to permanently enable satellite location tracking, a system known as A-GPS. This system, which combines satellite signals with cellular data, would provide precise location information without user control, to assist in criminal investigations. Major tech companies like Apple, Google, and Samsung are opposing the mandate, citing privacy and security risks. This debate comes after a recent order requiring a cyber safety app was rescinded due to surveillance concerns.

UK intelligence warns AI 'prompt injection' attacks might never go away

therecord.media · 7 months ago

British intelligence warns that large language models may never be fully protected from “prompt injection” attacks, a growing cyber threat that manipulates AI systems. These attacks exploit the way AI treats all text as a sequence of tokens, blurring the lines between instructions and data. Experts caution that prompt injection differs significantly from SQL injection and may require fundamentally different security approaches, and that the risk needs to be carefully managed through design and operation. A wave of security breaches is possible as generative AI is embedded into applications, repeating a pattern seen with SQL injection attacks in the 2010s.

Hackers Exploit Multiple Ad Networks to Distribute Triada Malware to Android Users

gbhackers.com · 7 months ago

A sophisticated, multi-year malware operation linked to the Triada Trojan has been identified targeting the mobile advertising ecosystem. Hackers infiltrated legitimate advertising networks by compromising advertiser accounts and leveraging platforms like GitHub and Discord CDNs to distribute malicious APK files. The campaign evolved through three distinct waves, starting with forged identity documents, progressing to account takeovers, and culminating in complex phishing schemes mimicking browser updates. Adex has banned over 500 accounts and implemented stricter security measures, including enhanced KYC procedures, mandatory two-factor authentication, and redirect verification to combat future distribution attempts.

US Contributes to 44% of Cyber Attacks; Public Administration Targeted for Financial Gains

gbhackers.com · 7 months ago

Cybercrime is accelerating, with global costs projected to reach 15.63 trillion dollars by 2029. Analysis reveals the United States accounts for 44% of reported cyber attacks, followed by the UK, Russia, Canada, and France. Public administration is the most targeted sector, experiencing 308 attacks in the last year, likely due to the valuable data they hold. Experts note that human error and a shortage of cybersecurity professionals are contributing to the rise in cyber threats, exacerbated by the increasing use of generative AI.

Tri-Century Eye Care Data Breach Impacts 200,000 Individuals

www.securityweek.com · 7 months ago

A data breach at Tri-Century Eye Care in Pennsylvania has impacted approximately 200,000 individuals. Attackers gained access to files containing sensitive information, including names, dates of birth, Social Security numbers, medical records, and financial details. The Pear ransomware group claimed responsibility for the attack and has released stolen data after the organization refused to pay a ransom. This incident is part of a trend of significant data breaches affecting eye care providers.

⚡ Weekly Recap: USB Malware, React2Shell, WhatsApp Worms, AI IDE Bugs & More

thehackernews.com · 7 months ago

Cybersecurity threats are escalating quickly, with vulnerabilities being exploited rapidly after disclosure. Chinese hacking groups are actively targeting a critical React flaw, and over 30 vulnerabilities in AI-powered development tools pose data exfiltration and remote code execution risks. Threat actors are using a backdoor, BRICKSTORM, to maintain access to compromised systems, and cybercriminals are impersonating government services to distribute malware. A massive 29.7 Tbps DDoS attack was recently mitigated.