Blahalla

University of Phoenix discloses data breach after Oracle hack

www.bleepingcomputer.com · 8 months ago

The University of Phoenix (UoPX) has joined a growing list of U.S. universities breached in a Clop data theft campaign targeting vulnerable Oracle E-Business Suite instances in August 2025.

Examining the Risk of AI-Assisted MedusaLocker Ransomware Attacks

gbhackers.com · 8 months ago

Researchers at Cato CTRL have demonstrated that the feature, designed to streamline AI workflows, can be easily weaponized to deploy MedusaLocker ransomware without the user’s knowledge. A new cybersecurity investigation has revealed a critical oversight in Anthropic’s rapidly growing “Claude Skills” ecosystem. Launched in October 2025, Claude Skills enables users to create and share custom

Microsoft Confirms Windows 11 25H2 UI Features Broken also Along With 24H2 Following Update

gbhackers.com · 8 months ago

Microsoft has acknowledged a significant issue affecting Windows 11 versions 24H2 and 25H2. Where critical user interface components break following the installation of monthly cumulative updates released on or after July 2025. The problem impacts XAML-dependent modern applications, including core Windows components such as File Explorer, the Start menu, System Settings, Taskbar, and Windows Search.

New Calendly-Inspired Phishing Attack Aims to Steal Google Workspace Credentials

gbhackers.com · 8 months ago

A long-running phishing campaign is abusing Calendly-branded job invitations to compromise Google Workspace and Facebook Business accounts, with a particular focus on hijacking ad management platforms used by agencies and large brands. The operation, uncovered by Push Security, combines Attacker‑in‑the‑Middle (AiTM) and Browser‑in‑the‑Browser (BITB) techniques with targeted controls to evade detection and maximize the value

Let’s Encrypt Cutting Certificate Lifespan from 90 Days to 45 Days

gbhackers.com · 8 months ago

Let’s Encrypt, the nonprofit certificate authority serving millions of websites, announced a significant shift in how it issues digital certificates. Starting in 2026, the organization will reduce the validity period of its SSL/TLS certificates from 90 days to 45 days, with complete implementation expected by February 2028. The move aligns Let’s Encrypt with broader industry

Arizona Attorney General Sues Chinese Online Retailer Temu Over Data Theft Claims

www.securityweek.com · 8 months ago

Arizona is the latest state to sue Temu and its parent company PDD Holdings over allegations that the Chinese online retailer is stealing customers’ data.

ServiceNow to Acquire Identity Security Firm Veza in Reported $1 Billion Deal

www.securityweek.com · 8 months ago

Veza Security was recently valued at more than $800 million after raising $108 million in Series D funding.

Shai-Hulud 2.0 Cyberattack Compromises 30,000 Repos and Exposes 500 GitHub Accounts

gbhackers.com · 8 months ago

The Shai-Hulud 2.0 supply chain attack has proven to be one of the most persistent and destructive malware campaigns targeting the developer ecosystem. Since the incident first emerged on November 24, 2025, Wiz Research and Wiz CIRT have been tracking the active spread, which continues to evolve, even as infection rates have slowed to a

Penn and Phoenix Universities Disclose Data Breach After Oracle Hack

www.securityweek.com · 8 months ago

The University of Pennsylvania and the University of Phoenix confirm that they are victims of the recent Oracle EBS hacking campaign.

Malicious Rust “evm-units” Impersonator Deploys OS-Specific Payloads

gbhackers.com · 8 months ago

A malicious Rust crate masquerading as an Ethereum Virtual Machine (EVM) utility has been caught delivering silent, OS-specific payloads to developers’ machines. The package, named evm-units and authored by “ablerust,” was hosted on Crates.io for roughly eight months and accumulated over 7,000 all-time downloads before being swiftly removed following a report from the Socket Threat

re:Invent 2025: AWS and Security Vendors Unveil New Products and Capabilities

www.securityweek.com · 8 months ago

AWS and cybersecurity vendors have made several announcements at the cloud giant’s re:Invent 2025 event.

AI Bolsters Python Variant of Brazilian WhatsApp Attacks

www.darkreading.com · 8 months ago

Water Saci has upgraded its self-propagating malware to compromise banks and cryptocurrency exchanges by targeting enterprise users of the popular chat app.

Longwatch RCE Flaw Allows Attackers to Run Remote Code with Elevated Privileges

gbhackers.com · 8 months ago

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an advisory warning about a critical remote code execution vulnerability affecting Industrial Video & Control’s Longwatch video surveillance and monitoring system. The flaw enables unauthenticated attackers to execute arbitrary code with SYSTEM-level privileges, posing significant risks to organizations using the affected platform. Critical Vulnerability Details The

Microsoft Silently Mitigated Exploited LNK Vulnerability

www.securityweek.com · 8 months ago

Windows now displays in the properties tab of LNK files critical information that could reveal malicious code.

AI, automation, and integration: The foundation for cyber protection in 2026

www.csoonline.com · 8 months ago

Cyber protection grew more complex in 2025 as more threat actors turned to artificial intelligence (AI) to increase their speed, scale, and precision. These autonomous ransomware, phishing, and data exfiltration attacks outpaced legacy tools and exploited gaps between security and backup solutions. In 2026, organizations will have to evolve just as quickly, using AI and automation to unify their prevention, detection, response, and recovery strategies. 2287651215 shutterstock/Gorodenkoff Escalating AI threats AI-driven threats surged in the first half of 2025, according to the Acronis Cyberthreats Report. Attackers commonly employed deepfake-based social engineering, automated scripts, and AI-generated lures to increase their reach with less manual effort. The number of publicly disclosed ransomware victims increased by nearly 70% compared to 2023 and 2024. And phishing remained the top initial vector, accounting for more than 73% of all incidents. These attacks hit the financial services, healthcare, and professional services industries particularly hard. Meanwhile, malware developers accelerated their efforts, releasing variants at a record pace. Malware samples averaged a 1.4-day lifespan in early 2025, compared to 2.3 days in late 2023. Tactics such as zero-day exploitation and quieter data theft extortion further challenged manufacturing, retail, and technology organizations. All told, these threats overwhelmed siloed data protection tools, which lacked the speed and context to counter AI-enhanced attacks. The response In 2025, some defenders began to respond in kind. By using AI to improve detection and automate responses, they reduced dwell time while accelerating containment and recovery. Others turned to integrated cybersecurity and data protection platforms, which simplified IT operations, consolidated alerting, and helped close the gaps attackers had exploited. Although managed service providers (MSPs) remained prime targets because of their privileged access to multiple environments, the number of initial access incidents reported declined by more than 25%, a sign that MSPs using consolidated security solutions were better able to detect and neutralize threats before they spread. 2026 priorities To remain resilient in 2026, organizations must eliminate silos between cybersecurity, backup, and recovery. Critical priorities include: automation to reduce manual burdens and offset talent shortages; zero-trust frameworks, which restrict lateral movement and enforce least-privilege access; and unified platforms that reduce tool sprawl and integrate detection, response, and remediation. Additionally, new regulations such as the European Union Network and Information Security 2 (NIS2) Directive, plus stricter incident reporting and business continuity requirements, will further push organizations to modernize and centralize their cyber protection. Building a unified defense Acronis Cyber Protect Cloud enables this unified approach through a single AI-powered platform. It combines native endpoint detection and response (EDR) with extended detection and response (XDR), offers multitenant management for MSPs and managed security service providers, and integrates backup and recovery to minimize data loss and downtime. By optimizing security management, simplifying compliance, and cutting recovery times across diverse environments, Acronis helps organizations respond to today’s threats while preparing for tomorrow’s challenges. For a deeper look at the latest threat trends and defense strategies, read the Acronis Cyberthreats Report, H1 2025.

Massive Phishing Attack Uses Parking Ticket and Medical Test Themes, Attributed to Storm-0900

gbhackers.com · 8 months ago

In a brazen attempt to exploit the chaotic pre-holiday rush, Microsoft Security has detected and dismantled a large-scale phishing campaign launched on Thanksgiving Eve. The attack, orchestrated by a threat actor tracked as Storm-0900, flooded inboxes across the United States with tens of thousands of malicious emails designed to panic or trick recipients into clicking

Threat Actors Using Matanbuchus Downloader to Deliver Ransomware and Maintain Persistence

gbhackers.com · 8 months ago

Threat actors are increasingly abusing the Matanbuchus malicious downloader as a key enabler for hands-on-keyboard ransomware operations, using its backdoor-like capabilities to deliver secondary payloads, move laterally, and maintain long-term persistence on compromised systems. Initially observed in 2020 and offered as Malware-as-a-Service (MaaS), Matanbuchus has steadily evolved, with version 3.0 identified in the wild in

How Palantir shifted course to play key role in ICE deportations

www.washingtonpost.com · 8 months ago

“The truly progressive position on immigration” is “extreme skepticism,” says Alex Karp, a longtime Democrat and the data-mining company’s chief executive.

PyTorch Users at Risk: Unveiling 3 Zero-Day PickleScan Vulnerabilities

www.reddit.com · 8 months ago

Three zero-day vulnerabilities were disclosed, placing PyTorch users at risk. These flaws include issues stemming from improper data type handling and vulnerabilities within the serialization process. The identified weaknesses require immediate attention to prevent potential exploits. Users are advised to review current security best practices to mitigate these risks.

Chopping AI Down to Size: Turning Disruptive Technology into a Strategic Advantage

thehackernews.com · 8 months ago

Most people know the story of Paul Bunyan. A giant lumberjack, a trusted axe, and a challenge from a machine that promised to outpace him. Paul doubled down on his old way of working, swung harder, and still lost by a quarter inch. His mistake was not losing the contest. His mistake was assuming that effort alone could outmatch a new kind of tool. Security professionals are facing a similar

Authorities Seize Domains Linked to Tai Chang Cryptocurrency Investment Scam

gbhackers.com · 8 months ago

The United States Justice Department has seized a website domain used to steal money from Americans through fake cryptocurrency investments. The domain, tickmilleas.com, was operated by the Tai Chang scam compound located in Kyaukhat, Burma. This action comes less than three weeks after the launch of Washington D.C.’s new “Scam Center Strike Force” and the

New Stealth K.G.B RAT Marketed by Threat Actors on Underground Forums

gbhackers.com · 8 months ago

Threat actors on an underground cybercrime forum are allegedly promoting a new remote access Trojan (RAT) bundle dubbed “K.G.B RAT + Crypter + HVNC,” claiming it is “fully undetectable” by security solutions.

Picklescan Bugs Allow Malicious PyTorch Models to Evade Scans and Execute Code

thehackernews.com · 8 months ago

Three critical security flaws have been disclosed in an open-source utility called Picklescan that could allow malicious actors to execute arbitrary code by loading untrusted PyTorch models, effectively bypassing the tool's protections. Picklescan, developed and maintained by Matthieu Maitre (@mmaitre314), is a security scanner that's designed to parse Python pickle files and detect suspicious

Critical Elementor Plugin Flaw Allows Attackers to Seize WordPress Admin Control

gbhackers.com · 8 months ago

A severe privilege escalation vulnerability in the King Addons for Elementor WordPress plugin has exposed thousands of websites to complete administrative compromise. The flaw, tracked as CVE-2025-8489 with a critical CVSS score of 9.8, allows unauthenticated attackers to register with administrator-level privileges, granting threat actors complete control of the site. Field Details CVE ID CVE-2025-8489

Chrome 143 Patches High-Severity Vulnerabilities

www.securityweek.com · 8 months ago

Chrome 143 stable was released with patches for 13 vulnerabilities, including a high-severity flaw in the V8 JavaScript engine.

New “Executive Award” Scam Exploits ClickFix to Deliver Stealerium Malware

gbhackers.com · 8 months ago

A sophisticated new phishing campaign is targeting company executives with a double-pronged attack that steals credentials and deploys information-stealing malware in a single coordinated strike. The “Executive Award” scam, identified by cybersecurity researchers at Trustwave MailMarshal, represents an evolution in social engineering tactics by combining credential harvesting with advanced malware deployment. The campaign begins with

Malicious Rust Crate Delivers OS-Specific Malware to Web3 Developer Systems

thehackernews.com · 8 months ago

Cybersecurity researchers have discovered a malicious Rust package that's capable of targeting Windows, macOS, and Linux systems, and features malicious functionality to stealthily execute on developer machines by masquerading as an Ethereum Virtual Machine (EVM) unit helper tool. The Rust crate, named "evm-units," was uploaded to crates.io in mid-April 2025 by a user named "ablerust,"

MuddyWater Targets Critical Infrastructure With Custom Malware and Evolving Tactics

gbhackers.com · 8 months ago

ESET researchers have uncovered a sophisticated campaign by MuddyWater, an Iran-aligned cyber-espionage group, targeting critical infrastructure across the Middle East with a newly refined toolkit that demonstrates significant operational evolution. The campaign, which ran from September 2024 through March 2025, primarily focused on organizations in Israel with one confirmed victim in Egypt, marking a departure

Cybersicherheit für viele Nebensache

www.csoonline.com · 8 months ago

Laut einer Umfrage informieren sich lediglich 54 Prozent der Deutschen regelmäßig über das Thema Cybersicherheit. Summit Art Creations, shutterstock.com Fake-Shops, Datendiebstahl, gefälschte Angebote auf Social-Media-Plattformen, vier von zehn Befragten halten es für sehr wahrscheinlich (9 Prozent) oder wahrscheinlich (32 Prozent), Opfer eines Betrugs oder eines Betrugsversuchs über das Internet zu werden. Doch nur etwas mehr als die Hälfte (54 Prozent) der 1.057 für den Bundesverband deutscher Banken (BdB) zum Thema Cybersicherheit befragten Erwachsenen informieren sich regelmäßig oder zumindest gelegentlich über das Thema Online-Sicherheit. Fast ein Viertel war schon Opfer von Online-Betrug “Jede unserer digitalen Aktivitäten kann inzwischen ein Einfallstor für Online-Kriminelle sein”, warnt Heiner Herkenhoff, Hauptgeschäftsführer des Bankenverbandes. “Wer die empfohlenen Schutzmaßnahmen umsetzt und Warnungen ernst nimmt, schützt sich am besten vor Betrug.” Wer schon einmal von einer Betrugsmasche gehört habe, falle nicht so leicht darauf herein. Ein knappes Viertel (23 Prozent) der im Zeitraum 23. Oktober bis 4. November Befragten ist nach eigenen Angaben in den vergangenen beiden Jahren Opfer von Online-Betrug geworden. Dennoch haben nur wenige Bedenken, ihre Bankgeschäfte am heimischen PC oder per Smartphone zu erledigen: 82 Prozent der Befragten sehen Online-Banking als sehr sicher oder sicher an. (dpa/jm)

Angular Platform Vulnerability Lets Attackers Execute Code Through Malicious SVG Animations

gbhackers.com · 8 months ago

The Angular team has released high security updates to address a high-severity vulnerability in the Angular Template Compiler. Tracked as CVE-2025-66412, this flaw allows attackers to bypass built-in security protections and execute malicious code inside a user’s browser. The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue. It stems from an incomplete security schema

Water Saci Hackers Exploit AI Tools to Target WhatsApp Web Users

gbhackers.com · 8 months ago

The Water Saci campaign targeting Brazilian users has escalated significantly, with threat actors demonstrating remarkable technical sophistication by employing artificial intelligence to enhance their malware propagation capabilities. Security researchers have identified a critical shift in the group’s attack methodology: the transition from PowerShell-based scripts to Python variants. This transformation has been accelerated through the use

How CISOs can prepare for the new era of short-lived TLS certificates

www.csoonline.com · 8 months ago

For years, organizations used SSL/TLS certificates with long lifespans, reviewing and renewing them only occasionally. That is about to change. On 15 March 2026, the maximum lifespan of a TLS certificate will be cut from 398 days to 200 days. Then, a year later, the limit will drop again to 100 days, and by 2029 it’ll fall to just 47 days. This shift, meant to increase security, began with a proposal from Apple, which was approved in April 2025 by the CA/Browser Forum, a consortium of certificate authorities. The idea received backing from the other three major browser makers: Google, Mozilla, and Microsoft. “Shorter certificate lifespans are a gift,” says Justin Shattuck, CSO at Resilience. “They push people toward better automation and certificate management practices, which will later be vital to post-quantum defense.” Risks of shorter certificate lifespan But this gift, intended to strengthen security, could turn into a curse if organizations are unprepared. Many still rely on manual tracking and renewal processes, using spreadsheets, calendar reminders, or system admins who “just know” when certificates are due to expire. With so little time until the March 2026 deadline, organizations may find themselves scrambling to modernize certificate management. Some CISOs have begun accelerating automation projects, centralizing certificate inventories, and reassessing where responsibility for certificate lifecycle management sits within their teams. “As the CISO of a major US bank managing $40 billion in assets, my primary concerns with shrinking SSL/TLS certificate lifespans revolve around operational resilience and the amplification of risks in an already complex financial ecosystem,” says Clint Lawson, CISO at MidFirst Bank. “With lifespans set to drop, the frequency of renewals heightens the potential for human error, certificate sprawl, and undetected expirations that could lead to service disruptions.” In banking and other sectors, mistakes in handling this issue can be costly and can translate into loss of revenue or customer trust. “What keeps me up at night is the nightmare scenario of a cascading outage,” Lawson adds. “An expired certificate halting online banking portals during peak hours, exposing us to regulatory scrutiny from bodies like the FDIC or OCC, or worse, providing a foothold for adversaries to exploit unencrypted channels.” As the window for preparation is narrowing, companies need to shift gears now and rethink their procedures. How CISOs are preparing for shorter certificates lifespan In many organizations, CISOs have already started to rethink their approach. The first step for most is simply figuring out what they actually have. That means getting a clear view of every certificate across the environment, instead of relying on scattered notes or pieces of information that different people appear to have. Visibility should be “the absolute first priority,” says Pete Clay, CISO at Aireon. Without a complete and continuously updated inventory of certificates, knowing exactly what certificates exist, where they’re deployed, and what systems depend on them, no amount of automation or tooling will prevent outages. “We’re investing in a living cryptographic inventory that doesn’t just track SSL/TLS certificates, but also keys, algorithms, identities, and their business, risk, and regulatory context within our organization and ties all of that to risk,” he says. “Every cert is tied to an owner, an expiration date, and a system dependency, and supported with continuous lifecycle-based communication with those owners. That inventory drives automated notifications, so no expiration sneaks up on us.” The second priority should be automation. Clay argues that as certificate lifespans shrink, manual renewal cycles are no longer realistic. His team is moving toward centralized certificate management with automated issuance and renewal, and he recommends others do the same. Ideally, that means using APIs or workflows that leverage the Automatic Certificate Management Environment (ACME) protocol. ACME is an open standard that enables automated interactions between certificate authorities and servers, allowing certificates to be requested, issued, renewed, and replaced programmatically. “Certificates are issued, deployed, and validated automatically across environments, whether that’s cloud load balancers, Kubernetes clusters, or on-prem gateways,” Clay says. “The goal is to make renewal a background process, not an emergency project, but always supported by communication and accountability.” Vira Tkachenko, chief technology and innovation officer at MacPaw, agrees. She explains that her team is using ACME to automate certificate renewals in environments where it is supported, such as their Cloudflare setup and virtual servers with Let’s Encrypt. In areas where ACME is not yet available, they are in the process of establishing a centralized certificate inventory to maintain visibility and prevent unexpected expirations. Lawson follows a similar approach at the bank he works for. “First, we deployed enterprise-grade certificate lifecycle management (CLM) platforms with AI-driven automation to handle issuance, renewal, and revocation seamlessly across our hybrid cloud environments,” he says. “Second, we conducted comprehensive audits and built a centralized PKI dashboard that provides real-time visibility into every certificate, correlated with threat intelligence feeds to prioritize high-risk assets.” Additionally, the bank partnered with leading certificate authorities to pilot post-quantum cryptography integrations. By doing this, they aim to future-proof their infrastructure against emerging quantum threats. Adapting to shorter certificate lifespans shouldn’t be treated as a one-off technical chore, adds Lawson. These changes need to be woven into the larger digital transformation strategies shaping how organizations secure and operate their systems. Just as importantly, the business impact should be communicated clearly, so leadership understands that certificate automation is a must. “An expired certificate isn’t a tech glitch, it’s downtime, lost revenue, and brand damage,” says Clay. “CISOs who frame this as resilience and trust management, not just compliance, get the investment and executive attention they need before the next outage happens.” Pro tips for CISOs Although the deadline is approaching, some organizations still do not have a full certificate management strategy in place. “They will be the first to feel the effects of unexpected downtime,” says Jason Soroko, senior fellow at Sectigo. Luckily, though, there are things they can pay attention to prevent an outage. While automation is important as certificates expire more quickly, how it is implemented matters. Renewing a certificate a fixed number of days before expiration can become unreliable as lifespans change. The alternative is renewing based on a percentage of the certificate’s lifetime, and this method has an advantage: the timing adjusts automatically when the lifespan shortens. “Hard-coded renewal periods are likely to be too long at some point, whereas percentage renewal periods should be fine,” says Josh Aas, executive director of the Internet Security Research Group (ISRG), the nonprofit entity behind Let’s Encrypt. “For example, an ACME client that renews every 60 days will eventually wait too long once certificate lifetimes are less than that, whereas a client that renews at 70% of a certificate’s lifetime should be fine.” Another important step is to set up alerts, adds Clay. Use continuous scanning to detect certificates that are getting close to expiring and send automatic notifications when they need attention. Connect those alerts to your team’s ticketing or chat tools, so they are seen immediately. “It’s not glamorous, but it’s the difference between staying ahead of the problem and getting the 2AM outage call,” Clay says. It also helps to have a clearly designated person to oversee certificate lifecycle, ideally, someone in security with responsibility for cryptography or public key infrastructure (PKI). “Fragmented responsibility is what causes outages and finger-pointing,” adds Clay. “Build a single policy that defines how certificates are requested, purchased, approved, renewed, and revoked. Even a lightweight governance model will reduce chaos immediately and reduce your risks.” Pete Nicoletti, global field CISO at Check Point, adds that CISOs should also make sure everyone is on the same page. That means making sure DevSecOps teams know the basics of good certificate hygiene. He also recommends running expiration tabletop exercises, so rapid response becomes second nature. Lastly, certificate health needs to be tracked just like any other governance metric. “Include metrics for renewals completed on time, expiring certificates, and key rotation compliance,” Clay adds. “When executives see those numbers trending in the right direction, it reinforces that crypto isn’t just a technical function, it’s a core part of operational resilience.” Mistakes CISOs can make As certificate lifespans shorten, the pressure to adapt can lead to missteps or blind spots. One of the biggest is assuming the change only affects public-facing websites. “Internal TLS, mTLS, brokers, and device certificates can cause nasty outages because they are not observable [in Certificate Transparency (CT) logs] and often lack ACME paths,” Shattuck says. Another common mistake is underestimating the value of tabletop exercises. Soroko recommends scenarios like: ‘We have to revoke and replace all of our certificates in 24-hours due to mis-issuance’, or ‘We have to revoke and replace all of our RSA certificates because RSA has just been deprecated.’ By running these exercises, CISOs can quickly find out if their organization is truly prepared. A third trap is treating shorter certificate lifespans as a purely technical issue, which can be solved by automation alone. This is risky because the cultural and workflow shift required to support continuous renewal is often the hardest part, says Nicoletti. “Without investing in team upskilling and change management, resistance to automation could stall progress, leaving your organization exposed in a landscape where agility is non-negotiable,” he adds. Finally, as March 15 approaches, perhaps the biggest mistake CISOs can make is assuming there is still plenty of time to adjust. This isn’t a future problem. The shift is already underway, and organizations that delay will face a much harder transition later. “Certificates do not expire unexpectedly,” says Soroko. “They have a stated lifetime that does not change after the certificate is issued.” Taking early action can be the difference between managing certificates predictably and risking an avoidable outage.

CISA Alerts on Iskra iHUB Authentication Flaw Allowing Remote Device Reconfiguration

gbhackers.com · 8 months ago

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert regarding a severe authentication vulnerability affecting Iskra iHUB and iHUB Lite intelligent metering gateways worldwide. Assigned CVE-2025-13510 with a CVSS score of 9.3, this vulnerability represents a significant threat to critical infrastructure in the energy sector and beyond. The flaw, classified as missing

Multiple Django Vulnerability Expose Applications to SQL Injection and DoS Attacks

gbhackers.com · 8 months ago

The Django development team has released critical security patches for three major versions of the popular Python web framework, addressing two significant vulnerabilities that could expose applications to SQL injection attacks and denial-of-service conditions. The updates, issued on December 2, 2025, affect Django versions 5.2.9, 5.1.15, and 4.2.27, as well as the upcoming Django 6.0

Researchers Catch Lazarus Group’s Recruitment Workflow on Camera via Honeypot

gbhackers.com · 8 months ago

A groundbreaking collaborative investigation by Mauro Eldritch of BCA LTD, ANYRUN, and NorthScan has lifted the curtain on North Korean threat actors from the Lazarus Group, revealing their recruitment tactics and operational methods in unprecedented detail. The research team documented the complete attack cycle in real-time, capturing live footage of attackers actively working on compromised

BPFDoor and Symbiote: Advanced eBPF-Based Rootkits Target Linux Systems

gbhackers.com · 8 months ago

Extended Berkeley Packet Filter (eBPF) represents one of Linux’s most powerful kernel technologies, enabling users to load sandboxed programs directly into the kernel for network packet inspection and system call monitoring. Introduced in 2015 to modernize the 1992 BPF architecture, this capability has become a double-edged sword providing unprecedented observability while simultaneously offering sophisticated attackers

Chrome 143 Update Patches 13 Security Vulnerabilities Allowing Arbitrary Code Execution

gbhackers.com · 8 months ago

Google has released Chrome 143 to the stable channel, addressing 13 security vulnerabilities that could allow attackers to execute arbitrary code on affected systems. The update is now rolling out to Windows, Mac, and Linux users worldwide. The latest version, Chrome 143.0.7499.40 for Linux and Chrome 143.0.7499.40/41 for Windows and Mac, brings essential security fixes

Last Week in Security (LWiS) - 2025-12-02

blog.badsectorlabs.com · 8 months ago

Two weeks of news, techniques, tools, exploits, and more!

DOJ takes down Myanmar scam center website spoofing TickMill trading platform

therecord.media · 8 months ago

The FBI said several victims used the domain and told agents that they were shown lucrative returns on what they thought were legitimate investments.

Newly allocated CVEs on an ICS 5G modem

www.reddit.com · 8 months ago

New vulnerabilities have been identified affecting an industrial control system five G modem. These flaws include CVE-2024-12345 and CVE-2024-67890. The reported issues demonstrate potential risks for unauthorized device access and exploitation. Immediate patching of the modem firmware is recommended for system operators to maintain secure network integrity.

China Researches Ways to Disrupt Satellite Internet

www.darkreading.com · 8 months ago

While satellite constellations, such as Starlink, are resilient, 2,000 drones could cut communications to a region the size of Taiwan, researchers find.

The Browser Defense Playbook: Stopping the Attacks That Start on Your Screen

unit42.paloaltonetworks.com · 8 months ago

85% of daily work occurs in the browser. Unit 42 outlines key security controls and strategies to make sure yours is secure.

SVD-2025-1206: Incorrect permissions assignment on Splunk Universal Forwarder for Windows during new installation or upgrade