Blahalla

AI/LLM Red Team Handbook and Field Manual

www.reddit.com · 8 months ago

NULL

Hackers Using CastleRAT Malware to Attack Windows Systems and Gain Remote Access

gbhackers.com · 8 months ago

A new Remote Access Trojan called CastleRAT has emerged, targeting Windows systems. The malware exists in both Python and compiled C variants, with the C version prioritizing stealth. CastleRAT establishes remote access, harvests data like keystrokes and screenshots, and maintains persistence using techniques such as clipboard hijacking and a User Account Control bypass. Attackers can download and execute files, and establish a hidden remote shell on compromised machines.

OpenAI Calls a ‘Code Red’ + Which Model Should I Use? + The Hard Fork Review of Slop

www.nytimes.com · 8 months ago

false

Whitebox (simulation) vs. blackbox (red team) phishing

www.reddit.com · 8 months ago

NULL

Intellexa Leaks Reveal Zero-Days and Ads-Based Vector for Predator Spyware Delivery

thehackernews.com · 8 months ago

A joint investigation revealed details about Intellexa, a company developing the Predator spyware tool. The spyware, marketed under several names including Helios and Nova, can covertly harvest data from Android and iOS devices. Attackers use various delivery methods, including malicious links exploiting vulnerabilities in Google Chrome and Apple Safari, with Google Threat Intelligence Group linking the attacks to several zero-day vulnerabilities, including CVE-2025-48543, CVE-2025-6554, CVE-2023-41993, CVE-2023-41992, CVE-2023-41991, CVE-2024-4610, CVE-2023-4762, CVE-2023-3079, CVE-2023-2136, CVE-2023-2033, CVE-2021-38003, CVE-2021-38000, CVE-2021-37976, CVE-2021-37973, CVE-2021-1048, and CVE-2021-37976. The investigation also found that Intellexa personnel may have remotely accessed surveillance data from their customers.

"Getting to Yes": An Anti-Sales Guide for MSPs

thehackernews.com · 8 months ago

false

Critical React2Shell flaw actively exploited in China-linked attacks

www.bleepingcomputer.com · 8 months ago

A critical vulnerability, CVE-2025-55182, known as React2Shell, is being actively exploited in attacks linked to China. This insecure deserialization flaw affects React and Next.js and allows for remote code execution without authentication. Threat actors, including Earth Lamia and Jackpot Panda, began exploiting the vulnerability within hours of its public disclosure, with attacks observed across multiple sectors and regions. Proof-of-concept exploits are readily available, and AWS researchers have observed attackers actively debugging and refining their techniques against live targets.

Russian Hackers Imitate European Events in Coordinated Phishing Campaigns

gbhackers.com · 8 months ago

Russian state-linked hackers, identified as UTA0355, are conducting sophisticated phishing campaigns targeting governments, think tanks, and policy organizations. The attackers impersonate high-profile European security conferences, such as the Belgrade Security Conference and the Brussels Indo-Pacific Dialogue, to compromise cloud email accounts. These campaigns involve creating realistic fake websites, building rapport with victims through multiple communication channels, and manipulating them into providing authentication codes via Microsoft OAuth and Device Code workflows. Researchers also found infrastructure prepared for the World Nuclear Exhibition in Paris, suggesting expansion of targeting is ongoing.

Cloudflare firewall reacts badly to React exploit mitigation

www.csoonline.com · 8 months ago

Cloudflare experienced a brief network outage Friday while attempting to mitigate a recently disclosed vulnerability in React Server Components. The issue stemmed from a change to how the Web Application Firewall parsed requests, impacting services like Shopify, Zoom, and Amazon Web Services. The vulnerability, CVE-2025-55182, allows for remote code execution on web servers using the React 19 library. This incident highlights the risk of relying on single service providers as single points of failure.

Lumia Security Raises $18 Million for AI Security and Governance

www.securityweek.com · 8 months ago

false

Russian Calisto Hackers Target NATO Research with ClickFix Malware

gbhackers.com · 8 months ago

Russian intelligence-linked cyber actors, known as Calisto, have intensified spear-phishing campaigns targeting NATO research organizations, defense contractors, and NGOs supporting Ukraine. The group uses sophisticated techniques like ClickFix malware and Adversary-in-the-Middle attacks to steal credentials and two-factor authentication codes, often impersonating trusted contacts and using ProtonMail infrastructure. Recent targeting of Reporters Without Borders highlights Russia's efforts to suppress international press freedom advocacy. The group continues to refine their social engineering despite public documentation of their tactics.

Aisuru Botnet Powers Record DDoS Attack Peaking at 29 Tbps

www.securityweek.com · 8 months ago

The Aisuru botnet has launched a record-breaking distributed denial-of-service attack, peaking at 29.7 terabits per second. This attack, utilizing UDP carpet-bombing techniques, surpasses the previous record of 22.2 terabits per second, also attributed to Aisuru. The botnet, comprised of compromised routers, cameras, and DVRs, operates as a DDoS-for-hire service and has also been used for residential proxy activities. Aisuru was responsible for the largest ever DDoS attack on Microsoft’s Azure cloud service, peaking at over 15.7 terabits per second.

Hackers Exploiting ArrayOS AG VPN Vulnerability to Deploy Webshells

gbhackers.com · 8 months ago

A critical command injection vulnerability in Array Networks’ ArrayOS AG systems has become the focus of active exploitation campaigns, with Japanese organizations experiencing confirmed attacks since August 2025. According to alerts from JPCERT/CC, threat actors are leveraged the vulnerability to install webshells and establish persistent network access, marking a significant escalation in targeting enterprise VPN infrastructure. The

NCSC Launches Proactive Notification Service to Alert System Owners of Vulnerabilities

gbhackers.com · 8 months ago

The UK’s National Cyber Security Centre has launched a new Proactive Notification Service to protect organizations from cyber threats. This service, developed in partnership with Netcraft, identifies outdated software with known vulnerabilities by scanning publicly available information. Targeted emails are then sent to affected organizations, urging them to install security updates. The service operates legally, relies on external observations, and is part of the agency's Active Cyber Defence strategy.

ChatGPT started the AI race. Now its lead is looking shaky.

www.washingtonpost.com · 8 months ago

false

Helmet Security Emerges From Stealth Mode With $9 Million in Funding

www.securityweek.com · 8 months ago

false

Cloudflare Outage Triggers Widespread 500 Internal Server Errors

gbhackers.com · 8 months ago

Cloudflare is currently experiencing a significant outage impacting its Dashboard and Cloudflare API services. Users are reporting 500 Internal Server Errors and disruptions to tools that rely on Cloudflare's backend systems. The outage primarily affects the management side of Cloudflare’s services, preventing users from logging in or updating settings. While the core network functions, including the CDN and security features, remain operational.

Cloudflare down, websites offline with 500 Internal Server Error

www.bleepingcomputer.com · 8 months ago

false

China-Nexus Hackers Target VMware vCenter Systems to Deploy Web Shells and Malware Implants

gbhackers.com · 8 months ago

A China-nexus adversary known as WARP PANDA has been targeting U.S.-based entities throughout 2025, compromising VMware vCenter environments to deploy malware and steal data. The group uses sophisticated techniques to maintain persistent, covert access, including exploiting vulnerabilities in edge devices and VMware systems. They have deployed malware such as BRICKSTORM, Junction, and GuestConduit, and have accessed sensitive data from Microsoft 365 environments. Exploited vulnerabilities include CVE-2024-21887, CVE-2023-46805, CVE-2024-38812, CVE-2023-46747, CVE-2023-34048, and CVE-2021-22005.

Hackers Abuse Microsoft Teams Notifications to Launch Callback Phishing Attacks

gbhackers.com · 8 months ago

Hackers are using Microsoft Teams notifications to launch callback phishing attacks, sending deceptive emails from a legitimate Microsoft address. The emails invite users to Teams groups with names resembling common phishing scenarios, such as fraudulent invoices, and instruct victims to call a specific support number for unauthorized charges. Threat actors then socially engineer victims into providing sensitive information or granting remote access. Callback numbers used in the attacks include 1-983-220-2463, 1-810-221-5391, and 1-805-331-8539.

Cacti Command Injection Flaw Allows Remote Execution of Malicious Code

gbhackers.com · 8 months ago

A security vulnerability has been identified in the Cacti monitoring platform, tracked as CVE-2025-66399. The flaw allows authenticated attackers to execute arbitrary commands on vulnerable servers, versions up to and including 1.2.28. This occurs due to improper input validation within the SNMP device configuration workflow, specifically the snmpcommunity field. The issue has been resolved in Cacti version 1.2.29, and users are strongly advised to upgrade immediately.

CISA Reports PRC Hackers Using BRICKSTORM for Long-Term Access in U.S. Systems

thehackernews.com · 8 months ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) reports that Chinese state-sponsored hackers are using a custom backdoor named BRICKSTORM to maintain long-term access to U.S. systems. Written in Golang, BRICKSTORM provides interactive shell access, facilitates command-and-control, and enables lateral movement. The activity is attributed to threat actors UNC5221 and Warp Panda, and initial access often involves exploiting vulnerabilities like CVE-2023-46805, CVE-2024-21887, CVE-2024-38812, CVE-2023-46747 and CVE-2021-22005. The Chinese embassy denies the accusations, but the attacks demonstrate a focus on intelligence collection and persistence in cloud environments.

New Anonymous Phone Service

www.schneier.com · 8 months ago

false

China-Nexus Hackers Exploiting React2Shell Vulnerability in Active Attacks

gbhackers.com · 8 months ago

Threat actors linked to China, including Earth Lamia and Jackpot Panda, are actively exploiting the React2Shell vulnerability, identified as CVE-2025-55182, in React and Next.js applications. This critical vulnerability allows for unauthenticated remote code execution and affects React version 19.x and Next.js versions 15.x and 16.x. Exploitation began immediately after the vulnerability was publicly disclosed, and attackers are using both automated tools and flawed proof-of-concept exploits. Organizations are urged to prioritize patching to remediate this critical vulnerability, as protective measures alone are not sufficient.

Chinese Hackers Exploiting React2Shell Vulnerability

www.securityweek.com · 8 months ago

Chinese-linked threat actors are actively exploiting a critical vulnerability in React, identified as CVE-2025-55182, also known as React2Shell. This vulnerability allows for unauthenticated remote code execution and impacts a wide range of systems due to React’s widespread use. Attack groups Earth Lamia and Jackpot Panda are suspected of conducting these exploitation attempts, which include both automated scans and refined techniques. Security companies have observed exploitation attempts and are providing indicators of compromise to aid detection.

15 years in, zero trust remains elusive — with AI rising to complicate the challenge

www.csoonline.com · 8 months ago

false

JPCERT Confirms Active Command Injection Attacks on Array AG Gateways

thehackernews.com · 8 months ago

A command injection vulnerability in Array Networks AG Series secure access gateways has been actively exploited since August 2025. The flaw, affecting versions 9.4.5.8 and earlier, resides within the DesktopDirect remote desktop access solution and allows attackers to execute arbitrary commands. Recent attacks originating from the IP address 194.233.100[.]138 have involved dropping web shells on vulnerable devices. An authentication bypass vulnerability, CVE-2023-28461, was previously exploited by a China-linked group, but no link to the current attacks has been established.

CISA, NSA Alert on BRICKSTORM Malware Targeting VMware ESXi and Windows Systems

gbhackers.com · 8 months ago

Cybersecurity and Infrastructure Security Agency and National Security Agency officials have issued a joint warning about a sophisticated malware campaign called BRICKSTORM, attributed to state-sponsored Chinese cyber actors. This malware targets VMware ESXi and Windows systems, allowing attackers to infiltrate networks for espionage purposes and remain undetected for extended periods, such as between April 2024 and September 2025. BRICKSTORM disguises its activity and has a self-reinstalling feature to avoid detection and ensure persistent access. Organizations are urged to update VMware products, restrict access to management systems, and actively search for signs of this threat.

New Stealthy Linux Malware Merges Mirai-based DDoS Botnet with Fileless Cryptominer

gbhackers.com · 8 months ago

A new Linux malware campaign is combining Mirai-derived denial-of-service capabilities with a stealthy, fileless cryptocurrency mining operation. The malware uses a multi-stage infection chain that begins with a shell script, downloads architecture-specific binaries, and employs process masquerading and raw socket scanning to evade detection. The botnet utilizes a TCP listener on 127.0.0.1:63841 for internal communication and resolves the command-and-control domain www.baojunwakuang[.]asia through repeated Google DNS queries. The malware deploys an XMRig-based Monero miner that receives its configuration dynamically at runtime.

New SVG Technique Enables Highly Interactive Clickjacking Attacks

gbhackers.com · 8 months ago

A new web exploitation technique called SVG clickjacking allows attackers to create complex and interactive fake interfaces that sit on top of legitimate websites. This method leverages SVG filters, typically used for visual effects, to create logic gates and analyze pixels from embedded websites, allowing the fake interface to react to the user's actions. Researchers demonstrated how this could trick users into performing actions on sensitive applications like Google Docs, and also showed a method for data exfiltration by encoding data into QR codes. Google awarded a bug bounty of three thousand one hundred thirty-three dollars and seventy cents for the discovery.

Privilege escalation with SageMaker and there's more hiding in execution roles

www.reddit.com · 8 months ago

NULL

Das CISO-Paradoxon: Innovation ermöglichen und Risiken managen

www.csoonline.com · 8 months ago

false

Coupang breach of 33.7 million accounts allegedly involved engineer insider

www.csoonline.com · 8 months ago

A significant data breach at Coupang, a major e-commerce company in South Korea, has exposed the personal information of approximately 33.7 million accounts. The breach stemmed from a prolonged lack of management of authentication keys, potentially exploited even after an employee’s departure. Leaked information includes names, email addresses, shipping addresses, and some order details, but not payment or login information. Investigations are underway to determine the full extent of the incident and assess whether Coupang violated data protection safety measures.

Suspicious traffic could be testing CDN evasion, says expert

www.csoonline.com · 8 months ago

Security experts have observed unusual internet traffic containing headers associated with Content Delivery Networks, such as Cloudflare, Fastly, and Akamai. This activity suggests threat actors are probing CDNs to potentially bypass defenses and launch attacks, possibly distributed denial of service attacks. Experts recommend organizations strengthen origin server security by implementing strict IP allowlists, validated tokens, or private network peering to prevent attackers from directly reaching web servers. Relying solely on the presence of CDN-specific headers is considered an inadequate security measure.

Scam Telegram: Uncovering a network of groups spreading crypto drainers

www.reddit.com · 8 months ago

NULL

How Agentic AI Can Boost Cyber Defense

www.darkreading.com · 8 months ago

Transurban head of cyber defense Muhammad Ali Paracha shares how his team is automating the triaging and scoring of security threats as part of the Black Hat Middle East conference.

Hackers are exploiting ArrayOS AG VPN flaw to plant webshells

www.bleepingcomputer.com · 8 months ago

Threat actors have been exploiting a command injection vulnerability in Array AG Series VPN devices to plant webshells and create rogue users.

SMS Phishers Pivot to Points, Taxes, Fake Retailers

krebsonsecurity.com · 8 months ago

China-based phishing groups blamed for non-stop scam SMS messages about a supposed wayward package or unpaid toll fee are promoting a new offering, just in time for the holiday shopping season: Phishing kits for mass-creating fake but convincing e-commerce websites that convert customer payment card data into mobile wallets from Apple and Google. Experts say these same phishing groups also are now using SMS lures that promise unclaimed tax refunds and mobile rewards points.

NCSC's ‘Proactive Notifications’ warns orgs of flaws in exposed devices

www.bleepingcomputer.com · 8 months ago

The UK's National Cyber Security Center (NCSC) announced the testing phase of a new service called Proactive Notifications, designed to inform organizations in the country of vulnerabilities present in their environment.

Meta Weighs Cuts to Its Metaverse Unit

www.nytimes.com · 8 months ago

Meta plans to direct its investments to focus on wearables like its augmented reality glasses but does not plan to abandon building the metaverse.

A Tale of Two CISOs: Why An Engineering-Focused CISO Can Be a Liability

www.darkreading.com · 8 months ago

false

CISA Warns of 'Ongoing' Brickstorm Backdoor Attacks

www.darkreading.com · 8 months ago

State-sponsored actors tied to China continue to target VMware vSphere environments at government and technology organizations.

CISA, NSA warn of China’s BRICKSTORM malware after incident response efforts

therecord.media · 8 months ago

The Cybersecurity and Infrastructure Security Agency (CISA), NSA and Canadian Centre for Cyber Security published an advisory on Thursday outlining the BRICKSTORM malware based off an analysis of eight samples taken from victim organizations.

Predator spyware uses new infection vector for zero-click attacks

www.bleepingcomputer.com · 8 months ago

The Predator spyware from surveillance company Intellexa has been using a zero-click infection mechanism dubbed "Aladdin" that compromised specific targets when simply viewing a malicious advertisement.

CISA Publishes Security Guidance for Using AI in OT

www.darkreading.com · 8 months ago

Global cybersecurity agencies published guidance regarding AI deployments in operational technology, a backbone of critical infrastructure.

AI creates new security risks for OT networks, warns NSA

www.csoonline.com · 8 months ago

The security of operational technology (OT) in critical infrastructure has been a recurring theme for years, but this week the US National Security Agency (NSA) and its global partners added a new concern to the mix: how the increasing use of AI in OT risks making things worse. The scope of these concerns, and guidance for addressing them, is outlined in the Principles for the Secure Integration of Artificial Intelligence in Operational Technology, authored by the NSA in conjunction with the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) and a global alliance of national security agencies. While the use of AI in critical infrastructure OT is in its early days, the guidance reads like an attempt by the NSA and its partners to get ahead of the problem before misuse or misapplication becomes entrenched. Although drafted for OT admins, the guidelines mirror concerns that also apply to IT administration. Currently, AI is being put to work in OT networks in the energy, water treatment, healthcare, and manufacturing sectors for the same reason it is being used elsewhere: to optimize and automate processes, thereby improving efficiency and uptime. The worry is that organizations are jumping into a new and far from battle-hardened technology without assessing its limitations, echoing what has been happening in IT. Measuring risk against the industrial control systems (ICS) Purdue Model hierarchy, the guidelines enumerate worries such as adversarial prompt injection and data poisoning, data collection leading to reduced safety, and “AI drift” in which models become less accurate as new data diverges from training data. Also mentioned: AI can lack the explainability necessary to diagnose errors, there are difficulties meeting compliance requirements as AI rapidly evolves, and there’s a human de-skilling effect caused by a creeping over-dependence on AI. Likewise, AI alerts might lead to distraction and cognitive overload among employees. Finally, the tendency of AI technologies such as chatbots and LLMs to hallucinate raises doubts about whether the technology is robust enough to be used in environments where safety is a priority. “AI may not be reliable enough to independently make critical decisions in industrial environments. As such, AI such as LLMs almost certainly should not be used to make safety decisions for OT environments,” said the authors. This underlines an important difference between using AI in an OT setting and an IT one, OT networks are by nature safety-critical. Although many of the issues are the same, the margin for error is much smaller. Struggling to unwind “The guidance raises the right questions: what risks are we introducing, what value does AI truly bring, who is accountable for oversight, and how do we respond when the technology misbehaves?” commented Sam Maesschalck, an OT engineer with cyber security training platform Immersive Labs. “We’ve already seen what happens when operational demands outpace secure design. IT/OT convergence brought efficiency, but it also exposed OT networks in ways the industry is still struggling to unwind.” According to Maesschalck, grafting AI systems onto OT infrastructure would fail if pre-existing issues aren’t addressed first. These include the inability of some OT devices to feed the required volumes of data to AI platforms, and a lack of asset inventories that make problem interactions more difficult to predict. Among the guidelines’ recommendations are for organizations to adopt CISA’s secure design principles, and to assess whether developing an AI-OT project inhouse would give organizations more control over AI design and implementation in the long run. “This kind of guidance is influential because operators are looking for clarity. Having government-backed principles to reference gives owners and engineers something concrete to point to when they push back on unsafe or rushed adoption. It also reinforces how essential education is,” said Maesschalck. The guidelines arrive on the heels of last year’s NSA and ACSC report listing the steps organizations should take to secure OT in critical infrastructure. But neither document addresses continuing concerns that OT security still doesn’t get the budget it warrants.

Phishing attempt against Reporters Without Borders attributed to Russia-linked group

therecord.media · 8 months ago

The journalism nonprofit Reporters Without Borders and another organization reported phishing attempts to cybersecurity researchers, who tied them to a Russia-linked group known as Callisto, ColdRiver or Star Blizzard.

British officials seek to expand facial recognition technology use

therecord.media · 8 months ago

Police have used facial recognition in Britain since 2017 and controversy has mounted as more aggressive deployments have been undertaken, including live facial recognition which involves processing real-time video footage of people passing a camera.

Russia blocks FaceTime and Snapchat for alleged use by terrorists

www.bleepingcomputer.com · 8 months ago

Russian telecommunications watchdog Roskomnadzor has blocked access to Apple's FaceTime video conferencing platform and the Snapchat instant messaging service, claiming they're being used to coordinate terrorist attacks.

India Rolls Back Order to Preinstall Cybersecurity App on Smartphones

www.securityweek.com · 8 months ago

The Ministry of Communications on had asked smartphone makers to install the government’s “Sanchar Saathi” app within 90 days and to prevent users from disabling it.