Blahalla

Samourai Wallet Founders Jailed for $237M Crypto Laundering

gbhackers.com · 8 months ago

Two cofounders of Samourai Wallet were convicted of money laundering and conspiracy and sentenced to prison, with Keonne Rodriguez receiving five years on November 6, 2025 and William Lonergan Hill receiving four years on November 19, 2025. Samourai ran two services, Whirlpool a Bitcoin mixer and Ricochet which added intermediate hops, and more than 80,000 Bitcoin valued at over 2 billion dollars at the time passed through them, with roughly 237 million dollars in illicit proceeds tied to the operation and about 6 million dollars collected in fees. Prosecutors showed evidence that the founders actively promoted the services to criminal users on darknet forums and social media and that internal messages acknowledged the mixing was used to launder Bitcoin. Judicial orders include three years of supervised release, 250,000 dollars in fines, forfeiture payments of about 6,367,139.69 dollars toward a 237,832,360.55 dollar forfeiture, and the prosecution relied on international law enforcement cooperation including a 2024 extradition.
API-Exploit für AI-Browser Comet entdeckt

www.csoonline.com · 8 months ago

Security vendor SquareX disclosed an undocumented MCP API in the Comet AI browser that allows embedded extensions to execute arbitrary commands and launch applications that mainstream browsers normally block. The API can be triggered directly from perplexity.ai, creating a covert execution channel that attackers could exploit via compromised extensions, extension stomping, cross site scripting, phishing, or simple man in the middle network attacks. In a proof of concept researchers installed a malicious extension posing as Comet’s Analytics extension, injected a script into perplexity.ai, used the Agentic extension to invoke the MCP API, and executed the WannaCry malware on a device, and the Analytics and Agentic extensions are hidden in Comet’s extension dashboard so users cannot disable them. Advised mitigations include documenting and exposing system level APIs, subjecting AI browsers to independent security audits, and giving users the ability to disable embedded third party extensions to prevent browsers from gaining implicit authority over end devices.
TV streaming piracy service with 26M yearly visits shut down

www.bleepingcomputer.com · 8 months ago

Photocall, a TV piracy streaming platform with more than 26 million annual visitors, has ceased operations following a joint investigation by the Alliance for Creativity and Entertainment and DAZN. The service provided unauthorized access to 1,127 television channels from 60 countries, including live sports such as MotoGP, Formula 1, Serie A, the NFL, the NHL, and WTA events, and hosted club channels like Real Madrid TV and Barça TV. Operators agreed to transfer the domains to ACE and redirect them to ACEs Watch Legally website as part of a settlement. The shutdown follows a Europol coordinated operation that identified dozens of piracy sites, referred illegal IPTV services for cryptocurrency disruption, linked fifty five million dollars in cryptocurrency to illegal streaming, and initiated multiple new investigations.
Over 50,000 Asus Routers Hacked in ‘Operation WrtHug’

www.securityweek.com · 8 months ago

There are over 50,000 Asus routers compromised worldwide in Operation WrtHug, forming a persistent network used for global espionage with most affected devices in Taiwan and additional clusters in the United States, Russia, Southeast Asia and Europe. The China linked actor exploited known AiCloud vulnerabilities including CVE-2023-41345, CVE-2023-41346, CVE-2023-41347, CVE-2023-41348, CVE-2023-39780, CVE-2024-12912 and CVE-2025-2492 to achieve command execution and bypass authentication on mostly discontinued models. Compromised devices have a shared self signed TLS certificate issued in April 2022 with a 100 year expiration that can serve as an indicator of compromise, and the campaign is part of an Operational Relay Box facilitation effort similar to earlier activity. Users are urged to apply available patches or replace unsupported Asus models such as 4G-AC55U, 4G-AC860U, DSL-AC68U, GT-AC5300, GT-AX11000, RT-AC1200HP, RT-AC1300GPLUS and RT-AC1300UHP.
Sturnus Malware Hijacks Signal and WhatsApp, Taking Full Device Control

gbhackers.com · 8 months ago

There is a new Android banking trojan called Sturnus that targets users financial and personal data and provides attackers with extensive device control and operational stealth. Sturnus captures decrypted content from WhatsApp, Telegram, and Signal by abusing Android Accessibility features to perform screen capture and UI event monitoring, effectively sidestepping end to end encryption guarantees. It harvests credentials using convincing HTML overlay phishing templates, employs two redundant screen streaming mechanisms including pixel based VNC and an interface mapping protocol to execute clicks text input permission changes and can black out the screen to conceal activity. Campaigns have primarily targeted financial institutions in Southern and Central Europe and the malware communicates over a custom protocol using RSA and AES while relying on Device Administrator privileges multiple internal receivers and constant security checks to resist removal and forensic analysis.
CISA Alerts Users to Active Attacks on Chrome 0-Day Vulnerability

gbhackers.com · 8 months ago

CISA has added a critical Chromium V8 type confusion vulnerability tracked as CVE-2025-13223 to its Known Exploited Vulnerabilities catalog after confirming active exploitation. The flaw allows heap memory corruption that can lead to arbitrary code execution and affects Google Chrome and other Chromium based browsers including Edge, Opera and Brave. CISA added the flaw to the KEV catalog on November 19, 2025 and set a remediation deadline of December 10, 2025, urging users and organizations to apply vendor supplied patches or mitigations immediately or discontinue use until fixes are available. Security teams are advised to enable automatic updates, deploy enterprise browser controls and endpoint detection solutions, monitor network logs for exploitation attempts, and assume widespread scanning and attacks are underway.
Emerging Ransomware Variants Exploit Amazon S3 Misconfigurations

gbhackers.com · 8 months ago

Ransomware is shifting from on premise systems to cloud environments, with attackers exploiting Amazon S3 misconfigurations and cloud native features to delete, overwrite, or exfiltrate data. Security researchers have documented five S3 ransomware variants: one abusing default KMS keys and scheduled key deletion, one using server side encryption with customer supplied keys attributed to Codefinger, one focused on exfiltration and deletion, one abusing BYOK to import attacker key material with short expirations, and one leveraging KMS external key stores and proxies to keep keys outside AWS. Detection relies on CloudTrail visibility and variant specific rules such as unusual encryption configurations, bulk download and deletion patterns, and suspicious IAM privilege escalations, with platforms like Trend Vision One offering dedicated detections. Defensive measures include enforcing least privilege and multi factor authentication, hardening KMS governance and cross account restrictions, enabling S3 Object Lock and versioning, isolating backups with cross account replication and separate customer managed keys, and conducting continuous monitoring and recovery testing.
US and Allies Sanction Russian Bulletproof Hosting Service Providers

www.securityweek.com · 8 months ago

The United States, the United Kingdom, and Australia announced sanctions against Russian bulletproof hosting providers Media Land and Hypercore, their sister entities, and several executives and employees for allegedly supporting ransomware groups Lockbit, BlackSuit, and Play and for facilitating DDoS attacks and criminal marketplaces. OFAC designated Media Land subsidiaries Media Land Technology and Data Center Kirishi, and named Media Land director Aleksandr Volosovik, employee Kirill Zatolokin, and associate Yulia Pankova for roles in advertising and operating BPH services, collecting payments, and managing finances used by threat actors. The UK and US also targeted Hypercore as a front for the previously sanctioned Aeza Group and designated Maksim Vladimirovich Makarov and Ilya Vladislavovich Zakirov for attempting to evade sanctions through new companies and payment methods, with Aeza alleged to rely on firms registered in Serbia and Uzbekistan to skirt restrictions. Five Eyes partners and the Netherlands issued a joint advisory urging ISPs and network defenders to use curated malicious resource lists, dynamic ASN and IP filtering, traffic analysis, automated reviews, event logging, threat intelligence sharing, and secure by design providers to mitigate risks, and Australia imposed financial penalties and travel bans on the named parties.
TamperedChef Campaign Exploits Everyday Apps to Deploy Malware and Enable Remote Access

gbhackers.com · 8 months ago

There is a global malvertising campaign called TamperedChef, uncovered by the Acronis Threat Research Unit, that disguises malware as legitimate everyday applications and uses social engineering and search engine optimization to trick victims into installing trojanized, code signed installers. The operation uses a network of disposable shell companies to obtain fraudulent certificates, registers short lived download domains with privacy protections, and has primarily impacted organizations in the Americas with about eighty percent of victims in the United States, concentrating on healthcare, construction, and manufacturing. Infections drop an XML file that creates a scheduled task for persistence, deploy a heavily obfuscated JavaScript backdoor that enables remote code execution, system fingerprinting, and encrypted command and control communications, and may be used for initial access brokering, ransomware deployment, data theft, or espionage. Operators continuously adapt by replacing revoked credentials quickly and shifting from long lived certificates and random domain generation to short lived certificates and human readable domains by mid 2025 to evade takedowns.
ThreatsDay Bulletin: 0-Days, LinkedIn Spies, Crypto Crimes, IoT Flaws and New Malware Waves

thehackernews.com · 8 months ago

There are warnings that Chinese operatives are using LinkedIn to recruit and cultivate contacts on behalf of state intelligence services to gather political and technical information. Security researchers reported malicious browser extensions siphoning browsing data, a phishing campaign abusing Microsoft Entra guest invites to fuel voice phishing, the arrest of an alleged Russian cyber operative in Thailand, and guilty pleas and prison terms in large scale crypto laundering cases. Critical vulnerabilities disclosed include Oracle Identity Manager CVE-2025-61757, a pre authentication remote code execution with a CVSS score of 9.8 that can allow full system takeover; Shelly Pro 4PM CVE-2025-11243, which can be abused to trigger repeat device reboots with a CVSS score of 8.3; and glob CLI CVE-2025-64756, a command injection flaw in the CLI that can lead to arbitrary code execution. Vendors and law enforcement are issuing patches, updates, arrests, and policy proposals as defenses ramp up.
Massive Hacking Operation WrtHug Compromises Thousands of ASUS Routers Worldwide

gbhackers.com · 8 months ago

There is a coordinated global espionage campaign known as Operation WrtHug that has infiltrated thousands of ASUS WRT routers to establish persistent network access and deep surveillance capabilities. The attackers exploited at least six known vulnerabilities, using OS command injection as a primary vector, including CVE-2023-39780 grouped with CVE-2023-41345 CVE-2023-41346 CVE-2023-41347 and CVE-2023-41348, and also deployed CVE-2024-12912 and CVE-2025-2492 to achieve arbitrary command execution and persistent access. Researchers identified over 50,000 unique compromised IPs in the last six months with 30 to 50 percent concentrated in Taiwan, observed a distinctive self-signed TLS certificate with a 100 year expiration as a detection indicator, and advised network segmentation monitoring for the certificate and urgent patching of ASUS devices.
China‑linked PlushDaemon hijacks DNS via ‘EdgeStepper’ to weaponize software updates

www.csoonline.com · 8 months ago

PlushDaemon a China linked APT group deploys a previously undocumented network implant named EdgeStepper to hijack DNS on compromised network devices and redirect traffic to attacker controlled infrastructure. EdgeStepper configures iptables rules on infected devices to redirect UDP port 53 DNS queries to a local proxy that responds with attacker controlled IP addresses for domains associated with software updates thereby routing legitimate update requests to malicious servers. Attackers use a payload chain beginning with LittleDaemon and DaemonicLogistics to deliver the SlowStepper backdoor which contains modules for browser data collection audio and video capture document theft and credential harvesting. ESET telemetry indicates PlushDaemon has operated since at least 2018 targeting organizations in the United States Taiwan Hong Kong and New Zealand and researchers advise monitoring unusual DNS redirection and validating update server resolution.
Scam USPS and E-Z Pass Texts and Websites

www.schneier.com · 8 months ago

Google filed a court complaint accusing a cybercriminal group in China of selling phishing for dummies kits that enable large scale phishing campaigns and trick people into disclosing passwords credit card numbers and banking information. The branded Lighthouse kits include two software versions for SMS and e commerce scams subscription licensing options and hundreds of fake website templates domain setup tools and other features designed to make victims believe they are entering sensitive information on legitimate sites. Scams typically start with a text about an overdue toll fee or a redelivery payment or appear as ads sometimes even using Google ads and direct victims to payment pages that claim to accept trusted wallets such as Google Pay.
Vulnerability Allowed Scraping of 3.5 Billion WhatsApp Accounts

www.securityweek.com · 8 months ago

Researchers from the University of Vienna demonstrated a technique that allowed enumeration and scraping of 3.5 billion WhatsApp accounts by generating possible phone number combinations and querying WhatsApp servers. They say the scraping proceeded at rates above 100 million numbers per hour and returned timestamps and public keys that allowed inference of account age, operating system, and number of linked devices, and for some publicly configured profiles also profile pictures and about text. Meta said messages, contacts, and other non public data were not exposed, that researchers reported findings gradually from late 2024 into 2025, that the company received full technical details in August 2025, and that mitigations began in early September 2025 with further measures in October 2025. Meta added it found no evidence of malicious abuse and the researchers securely deleted the collected data, while the team noted nearly half of the phone numbers in a 2021 Facebook leak were currently associated with WhatsApp accounts.
Authorities Sanction Russia-Based Bulletproof Hosting Provider for Aiding Ransomware

gbhackers.com · 8 months ago

There are coordinated sanctions by the United States, Australia, and the United Kingdom against Media Land, a Russia based bulletproof hosting provider, and related entities for supporting ransomware operations and other cybercrimes. OFAC, working with international partners and the FBI, designated Media Land leaders including Aleksandr Volosovik, Kirill Zatolokin, and Yulia Pankova, and sanctioned subsidiaries such as Media Land Technology and Data Center Kirishi and related companies used to facilitate criminal infrastructure. Media Land’s infrastructure is reported to have provided hosting and technical support to major ransomware groups including LockBit, BlackSuit, and Play and to have supported distributed denial of service attacks, while entities tied to Aeza Group attempted to rebrand and relocate IP infrastructure to evade sanctions. All property and assets of the designated individuals and entities within the United States are blocked, and U.S. persons and financial institutions are prohibited from transacting with them, with violations subject to significant civil and criminal penalties.
CTM360 Exposes a Global WhatsApp Hijacking Campaign: HackOnChat

thehackernews.com · 8 months ago

There is a rapidly expanding WhatsApp account hijacking campaign called HackOnChat that uses deceptive authentication portals and impersonation pages to trick users into compromising their accounts. Investigators identified thousands of malicious URLs hosted on inexpensive top level domains and rapidly generated through website building platforms, with hundreds of incidents in recent weeks and a surge across the Middle East and Asia. Two main techniques are in use: Session Hijacking that misuses the linked device functionality to seize active WhatsApp Web sessions, and Account Takeover that deceives victims into surrendering authentication keys via fake security alerts, lookalike portals, and spoofed group invites. Once accounts are compromised, attackers target victims and their contacts for money or sensitive data and harvest messages, media, and documents for fraud, impersonation, or extortion.
New Sturnus Android Trojan Quietly Captures Encrypted Chats and Hijacks Devices

thehackernews.com · 8 months ago

There is a new Android banking trojan named Sturnus that steals credentials and can take full control of devices to carry out financial fraud. It captures decrypted messaging content by recording the device screen and leveraging accessibility services and the display capture framework to monitor and reconstruct chats from WhatsApp, Telegram, and Signal while also enabling remote control via WebSocket and VNC style sessions. The trojan stages fake overlays over banking apps to harvest login details, displays a full screen fake system update to hide activity, prevents uninstallation and ADB removal until administrator rights are revoked, and collects device and sensor data to adapt attacks to region specific targets in Southern and Central Europe. The malware is assessed to be privately operated and currently in an evaluation stage.
Crypto mixer founders sent to prison for laundering over $237 million

www.bleepingcomputer.com · 8 months ago

Two founders of the Samourai Wallet cryptocurrency mixing service were sentenced to prison after pleading guilty to operating a money laundering scheme that handled traceable criminal proceeds of roughly 237.8 million dollars. Samourai CEO Keonne Rodriguez was sentenced to five years on November 6, 2025 and Chief Technology Officer William Lonergan Hill received four years on November 19, 2025, and both were also ordered to serve three years of supervised release and pay 250,000 dollars in fines. The defendants were arrested in April 2024, pleaded guilty in August 2025 to operating an unlicensed money transmitting business and money laundering, and agreed to forfeit approximately 237.8 million dollars. Investigators say the Samourai app used Whirlpool and Ricochet features to obfuscate transactions, enabling the processing of more than 80,000 Bitcoins valued at over 2 billion dollars between 2015 and February 2024, and authorities seized servers and domains while app storefronts removed the mobile application.
Recent 7-Zip Vulnerability Exploited in Attacks

www.securityweek.com · 8 months ago

There is a high severity remote code execution vulnerability in 7-Zip that mishandles symbolic links in ZIP files, allowing crafted archives to write files outside the intended extraction folder and potentially enable arbitrary code execution. The issue is tracked as CVE-2025-11001 with a CVSS score of 7.0, and an identical defect is tracked as CVE-2025-11002. A proof of concept exploit is available and active exploitation has been observed in the wild, with the flaw affecting 7-Zip versions 21.02 through 24.09 and patched in 7-Zip version 25.00 released in July 2025. Successful exploitation requires user interaction and 7-Zip running with elevated service or administrative privileges on Windows because symlink creation is a privileged operation.
Milvus Proxy Flaw Lets Attackers Forge Headers and Skip Authorization

gbhackers.com · 8 months ago

There is a critical authentication bypass in the Milvus vector database that allows attackers to gain administrative access without credentials, tracked as CVE-2025-64513. The flaw stems from the Milvus Proxy treating a user controlled HTTP header as a trusted internal credential by base64 decoding and comparing it to a hardcoded constant named milvus-member, enabling an attacker with network access to forge the header and skip authorization. Multiple Milvus versions are affected, including 2.4.0 through 2.4.24, 2.5.0 through 2.5.21, and 2.6.0 through 2.6.5, and the issue carries a CVSS score of 9.8. Organizations are urged to apply the official security update immediately or implement network segmentation and rate limiting on Milvus endpoints as temporary mitigations.
Wind farm worker sentenced after turning turbines into a secret crypto mine

www.bitdefender.com · 8 months ago

A technical manager at a Dutch wind farm operator was sentenced to 120 hours of community service and ordered to pay 4,155.65 euros to the company and the same amount to the state after he secretly installed three cryptocurrency mining rigs and two Helium network nodes at two sites between August and November 2022. The mining rigs were plugged into a router at a substation in Gieterveen while the Helium hotspots were installed inside turbines at the Waardpolder site. Nordex discovered the unauthorized equipment shortly after recovering from a Conti ransomware attack, and a court in Assen heard that the unnamed employee in his forties showed no concern for potential disruption to turbine operations. The case underscores the risk of insider threats when technical staff have privileged access to operational systems.
Multi-threat Android malware Sturnus steals Signal, WhatsApp messages

www.bleepingcomputer.com · 8 months ago

A new Android banking trojan named Sturnus can capture messages from Signal, WhatsApp and Telegram by scraping decrypted content from the device screen. The malware abuses Android Accessibility services to read on screen text, capture inputs, detect app launches, and perform actions, and it supports real time remote control via an AES encrypted WebSocket channel for VNC sessions and HTML overlays to harvest banking credentials and perform transactions. Sturnus gains Android Device Administrator privileges to block removal, uses a mix of plaintext, RSA and AES encrypted channels to communicate with its command and control infrastructure, and has been observed in low volume targeting European banking accounts using region specific overlay templates. Users are advised to avoid downloading APKs from outside official stores, keep Play Protect enabled, and avoid granting Accessibility permissions unless absolutely necessary.
Smashing Security podcast #444: We’re sorry. Wait, did a company actually say that?

grahamcluley.com · 8 months ago

There is a refreshingly honest breach response in which a company publicly apologized and donated the ransom to cybersecurity research, and the discussion highlights how legacy systems continue to exacerbate breach impact. There is coverage of a large hotel booking phishing and malware campaign that exploits trust in apps and CAPTCHAs, involving ClickFix style phishing and PureRAT, alongside discussion of autonomous penetration testing and AI turbocharged cybercrime. The show, hosted by Graham Cluley with guest Tricia Howard, includes an interview with Snehal Antani from Horizon3 and practical discussion of what CISOs should be asking on Monday morning.
Critical Twonky Server Flaws Let Hackers Bypass Login Protection

gbhackers.com · 8 months ago

There are two critical authentication bypass vulnerabilities in Twonky Server version 8.5.2, tracked as CVE-2025-13315 and CVE-2025-13316, that allow unauthenticated attackers to obtain administrator credentials and take full control of the media server. Attackers can retrieve application log files from an unprotected API endpoint that contain encrypted admin passwords, then decrypt those passwords because the application uses Blowfish encryption with twelve hardcoded keys embedded in the binary. A public Metasploit module demonstrates the complete exploit chain, roughly 850 instances are exposed on the internet, and the vendor has refused to issue patches. Operators should assume admin credentials are compromised, restrict or isolate Twonky Server traffic to trusted IP addresses, disconnect internet-exposed instances, or migrate to supported media server solutions.
The Rise of AI-Enhanced Cyber Scams: How GenAI Empowers Criminals

gbhackers.com · 8 months ago

Generative artificial intelligence has removed the barrier of poor scam quality, enabling criminals to produce professionally polished messages, realistic branded product images, hyperrealistic voices, and lifelike videos in minutes, democratizing sophisticated fraud to operators with minimal skills. A simulated n8n automation workflow demonstrated six automated stages from image generation to synchronized video with AI cloned voices, and Trend Micro telemetry from June to September 2025 recorded 346,206 monthly detections for romance impostor scams and 73,635 monthly detections for merchandise scams, showing rapid scaling and high prevalence. Recommended defenses include multi layered strategies such as AI powered threat detection, deepfake screening, rigorous verification protocols, and increased user awareness, noting that 84 percent of consumers expressed concern about AI fraud in 2023 while 67 percent admitted they would purchase from unfamiliar websites.
Third-party failures are becoming the real threat to your security

www.reddit.com · 8 months ago

A security discussion warns that major incidents increasingly originate from third party failures rather than direct attackers. Notes from a Cloudflare outage analyze what went wrong and identify how vendor dependencies create accumulating blind spots in organizational security. Organizations are urged to broaden vendor risk assessments to include the systems their vendors in turn rely upon.
Iran-Linked Hackers Mapped Ship AIS Data Days Before Real-World Missile Strike Attempt

thehackernews.com · 8 months ago

Threat actors with ties to Iran mapped a ship's Automatic Identification System data days before an attempted missile strike, exemplifying cyber enabled kinetic targeting. Amazon threat intelligence linked the activity to the Imperial Kitten group, which between December 2021 and January 2024 targeted AIS platforms, gained access to vessel CCTV, and on January 27, 2024 queried AIS location data for a specific ship that was targeted days later by an unsuccessful missile attack carried out by Iranian backed Houthi militants. A separate case involved MuddyWater, tied to Iran's Ministry of Intelligence and Security, which established infrastructure in May 2025 and later used it to access live CCTV streams in Jerusalem to collect real time visual intelligence amid widespread missile attacks in June 2025. Threat actors routed traffic through anonymizing VPN services to obscure origins, underscoring that digital reconnaissance is increasingly being combined with physical attacks against maritime and urban targets.
SolarWinds Patches Three Critical Serv-U Vulnerabilities

www.securityweek.com · 8 months ago

SolarWinds patched three critical vulnerabilities in its Serv-U enterprise file transfer solution that can be exploited for remote code execution. The flaws are tracked as CVE-2025-40549, CVE-2025-40548 and CVE-2025-40547 and can be abused by an attacker with administrator privileges to execute arbitrary code. The issues affect Serv-U version 15.5.2.2.102 and were fixed in version 15.5.3, with SolarWinds noting that on Windows the severity is rated medium due to path handling differences and services often running under less privileged accounts. Administrators are advised to upgrade to 15.5.3 to mitigate these vulnerabilities.
When Updates Backfire: RCE in Windows Update Health Tools

www.reddit.com · 8 months ago

There is a remote code execution vulnerability in Microsoft Update Health Tools caused by the service querying predictable, abandoned Azure blob storage accounts that attackers could claim and use to deliver malicious JSON that triggers arbitrary code execution. The Update Health Service executable uhssvc.exe polls tenant specific blobs for JSON including an EnterpriseActionType ExecuteTool which can instruct a Microsoft signed binary such as explorer.exe to run attacker supplied parameters, and although version 1.1 moved to a web service it retained a registry flag that can reenable the old blob based behavior. Researchers registered ten storage accounts and logged 544,386 HTTP requests over seven days from 9,976 tenants and 40,973 unique devices, demonstrating measurable reach, and the issue was responsibly disclosed to Microsoft in July 2025 after which ownership of the accounts was transferred to Microsoft. Recommended mitigations include reserving or disabling public access to storage accounts, avoiding reliance on externally claimable resources, and signing messages so commands cannot be trusted solely because they came from a provider controlled endpoint.
The Rise of Hybrid Threat Actors: Digital Meets Physical

gbhackers.com · 8 months ago

There is a growing trend of cyber enabled kinetic targeting in which nation state actors systematically leverage cyber operations to enable and enhance physical military attacks, based on investigations that leverage cloud provider visibility. One documented case attributed to Imperial Kitten shows compromise of a vessel Automatic Identification System in December 2021, expansion to CCTV access aboard naval vessels by August 2022, targeted searches for specific vessel location data on January 27, 2024, and a Houthi missile strike on February 1, 2024 that matched the tracked vessel. Another case attributed to MuddyWater shows the group provisioning server infrastructure on May 13, 2025, exploiting servers to access live CCTV feeds from Jerusalem on June 17, 2025, and missile attacks on June 23, 2025 while compromised cameras were used to gather real time targeting intelligence. These incidents indicate that maritime systems and urban surveillance can become targeting aids for kinetic operations and that defenders must expand threat models and increase intelligence sharing between private sector organizations, government agencies, and international partners.
Hackers Launch 2.3 Million Attacks on Palo Alto GlobalProtect VPN Portals

gbhackers.com · 8 months ago

GreyNoise researchers uncovered a coordinated campaign that began on November 14, 2025 and launched approximately 2.3 million malicious sessions against Palo Alto GlobalProtect login portals targeting the /global-protect/login.esp URI. Attack intensity surged forty fold within 24 hours, reaching the highest activity level observed in the prior 90 days. About sixty two percent of malicious sessions originated from ASN 200373 in Germany with additional traffic from ASN 208885, and the United States, Mexico, and Pakistan were the primary target countries. GreyNoise assesses with high confidence the same actor or group orchestrated the campaign and warns that brute force spikes like this have historically preceded vulnerability disclosures, so security teams should remain vigilant.
Chinese APT Group Exploits DLL Sideloading to Breach Government and Media Targets

gbhackers.com · 8 months ago

A China nexus APT tracked as Autumn Dragon has run a sustained espionage campaign targeting government and media organizations across Southeast Asia including Indonesia, Singapore, the Philippines, Cambodia, and Laos with increasing activity in 2025. The attackers use a four stage attack chain beginning with spear phishing that delivers weaponized RAR archives exploiting CVE 2025 8088 in WinRAR to drop a batch script disguised as a Windows Defender update and establish persistence. Subsequent stages rely on DLL sideloading by pairing legitimate executables with modified DLLs for a lightweight Telegram based backdoor that supports shell command execution, screenshots, and file upload, later abusing mainstream applications and culminating in an HTTPS backdoor using XOR encrypted communications for shellcode execution and file operations. Indicators include multiple file hashes, staging in public folders, bespoke Cloudflare protections, and tailored command and control infrastructure, and defenders are advised to monitor for DLL sideloading and unusual cloud storage and network activity.
NSA Issues New Guidance to Help ISPs and Defenders Stop Malicious Activity

gbhackers.com · 8 months ago

There is new guidance issued by the National Security Agency together with CISA, the FBI, and international cybersecurity partners published November 19, 2025 to help internet service providers and network defenders combat bulletproof hosting providers. The framework defines bulletproof hosting as infrastructure intentionally marketed to cybercriminals and recommends that ISPs and defenders build high confidence malicious resource lists, run continuous traffic analysis, maintain baselines to avoid false positives, offer optional customer filters, implement know your customer practices, and develop sector wide standards and accountability. Practical recommendations include centralized event logging that tracks IP addresses and autonomous system numbers, audit trails for filter policies, and streamlined processes for handling inquiries about blocked resources to reduce collateral disruption. The guidance is intended to force cybercriminals toward legitimate providers that respond to abuse complaints and law enforcement and is supported by partners from the United States, Australia, Canada, the Netherlands, New Zealand, and the United Kingdom.
Researchers Detail Rhadamanthys Loader’s Advanced Anti-Sandboxing and Anti-AV Emulation Techniques

gbhackers.com · 8 months ago

Rhadamanthys is an information stealing malware active since 2022 whose native loader uses a complex obfuscation strategy combining jump target obfuscation, control flow flattening, and constant obfuscation to defeat static analysis. The loader performs extensive anti sandbox and anti emulation checks including wallpaper SHA1 comparison against a known sandbox hash, searching for common sandbox test files and usernames, validating dummy credential file contents, extracting MAC addresses via UUID version one, and querying hardware IDs through WMI, with advanced sandboxes such as CAPE and VMRay able to bypass some checks. It also employs timer based behavioral validation that collects cursor positions and foreground window telemetry over a mandatory forty five second observation period and requires natural mouse movement patterns and multiple distinct foreground windows before executing payloads. Payloads use a proprietary binary to string encoding referred to as Flutter combined with SM4 encryption, recent versions embed encrypted payloads directly in PNG pixel data rather than steganographic WAV or JPEG carriers, and configuration and mutex schemes were updated to use a hexadecimal marker BEEF with LZO decompression, seeded mutex names, and infections tied to hashed MachineGuid and volume serial identifiers.
Ollama Flaws Let Hackers Run Any Code Using Malicious Model Files

gbhackers.com · 8 months ago

Critical Out Of Bounds Write vulnerabilities in Ollama's GGUF model parsing can let attackers craft malicious model files to trigger remote code execution on systems running Ollama versions before 0.7.0. The flaw stems from unsafe handling of MLLAMA model metadata that permits out of bounds writes which can flip memory bits, overwrite function pointers and enable return oriented programming to execute arbitrary commands. Ollama maintainers rewrote the vulnerable mllama handling code from C plus plus to Go and users are urged to update to version 0.7.0 or later and to restrict API model loading to trusted accounts to mitigate the risk.
7-Zip RCE Vulnerability Actively Exploited by Hackers

gbhackers.com · 8 months ago

There is a critical file parsing directory traversal vulnerability in 7-Zip tracked as CVE-2025-11001 that enables remote code execution by abusing symbolic link handling during archive extraction. The flaw carries a CVSS score of 7.0, affects all 7-Zip versions prior to 25.00, has a publicly available proof of concept, and is being actively exploited in the wild prompting an NHS Digital alert on November 18, 2025. Users and organizations must update to 7-Zip version 25.00 or later immediately to mitigate the risk.
TamperedChef Malware Spreads via Fake Software Installers in Ongoing Global Campaign

thehackernews.com · 8 months ago

Threat actors are leveraging bogus installers masquerading as popular software in a global malvertising campaign called TamperedChef to establish persistence and deliver a JavaScript backdoor that enables remote access and control. Attackers lure victims with malicious ads, poisoned search results and SEO to booby-trapped domains hosting signed counterfeit installers, abusing code signing certificates issued to shell companies and rotating certificates when older ones are revoked. The installers drop an XML file that creates a scheduled task to launch an obfuscated JavaScript backdoor which connects to external servers and exfiltrates system metadata as encrypted Base64 JSON over HTTPS, with telemetry showing a concentration of infections in the United States and impacts to healthcare, construction and manufacturing. Some variants have been observed facilitating advertising fraud and the campaign is assessed to be part of a broader set of attacks codenamed EvilAI that uses AI related lures to propagate malware.
HelixGuard uncovers malicious "spellchecker" packages on PyPI using multi-layer encryption to steal crypto wallets.

www.reddit.com · 8 months ago

There is a campaign on the Python Package Index where actors published spellchecker packages that embed a heavily obfuscated, multi layer encrypted backdoor to steal cryptocurrency wallet credentials. Security researchers analyzed the campaign and reported that the payload uses multiple layers of encryption and obfuscation to hide its wallet theft functionality.
Breaking Oracle’s Identity Manager: Pre-Auth RCE (CVE-2025-61757)

www.reddit.com · 8 months ago

There is a pre authentication remote code execution vulnerability in Oracle Identity Manager tracked as CVE-2025-61757. Unauthenticated actors can bypass the central SecurityFilter by appending a WSDL query string or using matrix parameters to reach REST management endpoints and then exploit a Groovy script compilation endpoint to execute code at compile time via annotation processing. This discovery follows a January compromise of Oracle Cloud login that exploited an older flaw CVE-2021-35587 to achieve remote code execution and steal millions of records and many tenants.
Iranian APT hacks helped direct missile strikes in Israel and the Red Sea

www.csoonline.com · 8 months ago

Amazon Threat Intel linked activity by Iran linked APT Imperial Kitten to a Houthi missile attempt in the Red Sea, showing the group searched Automatic Identification System vessel location data days before the strike. Amazon also found that MuddyWater accessed a compromised server streaming live CCTV from Jerusalem days before Iranian missile strikes on Israeli cities, indicating the cameras were used for target reconnaissance. The findings illustrate a growing trend of cyber enabled kinetic targeting in which cyber espionage provides precise intelligence to improve the accuracy of physical attacks. Amazon urged operators of maritime systems, urban surveillance networks, and other critical infrastructure to expand threat modeling and defenses because compromised IT systems can be repurposed to support physical attacks.
LITE XL RCE (CVE-2025-12121)

www.reddit.com · 8 months ago

Two vulnerabilities affect the Lite XL text editor in versions 2.1.8 and earlier, tracked as CVE-2025-12120 and CVE-2025-12121. CVE-2025-12120 permits arbitrary code execution because the editor automatically executes project level Lua modules and the user init.lua with dofile and no sandboxing, exposing system level Lua functions. CVE-2025-12121 is a remote code execution risk caused by an insecure system.exec function that forwards filenames and other inputs to the shell without sanitization, which can be triggered by actions such as drag and drop, open in system, or opening a project folder. Proof of concept techniques include placing os.execute calls in the project or init Lua files or using filenames with shell meta characters to run commands or obtain a reverse shell, and users should update or apply available fixes.
Fortinet Woes Continue With Another WAF Zero-Day Flaw

www.darkreading.com · 8 months ago

A second zero-day in FortiWeb, CVE-2025-58034, is an OS command injection that allows authenticated attackers to execute code via crafted HTTP requests or CLI commands and has been observed being exploited in the wild alongside an earlier FortiWeb zero-day CVE-2025-64446. Rapid7 and other researchers noted Fortinet patched both flaws before public disclosure, observed multiple command injection fixes were added while only one CVE was assigned, and CISA added CVE-2025-58034 to its Known Exploited Vulnerabilities catalog with a recommended one week remediation timeframe. Trend Micro reported roughly two thousand detections of exploitation activity, and Orange Cyberdefense warned of multiple chained campaigns leveraging both CVEs. Organizations are advised to update FortiWeb to fixed versions 8.0.2, 7.6.6, 7.4.11, 7.2.12, and 7.0.12, avoid exposing FortiWeb management interfaces to the Internet, and monitor for newly created user accounts.
Do National Data Laws Carry Cyber-Risks for Large Orgs?

www.darkreading.com · 8 months ago

National data localization laws that require citizen data to be stored domestically have proliferated since China enacted such rules in 2017 and the European Union followed in 2018, with countries including India, Russia, Saudi Arabia, and Nigeria adopting similar measures. When multinational companies must comply with competing national rules they often create parallel, fragmented IT systems and rely on extra third parties and government approved vendors, which increases complexity, hinders centralized oversight and incident response, and can introduce unmonitored data flows and contractual or maintenance related backdoors. A proposed dual jurisdiction assurance and compliance model would proactively audit for conflicts, enforce data flow transparency, and build resilience against systemic risks arising from geopolitical and regulatory misalignment.
WhatsApp flaw allowed discovery of the 3.5 billion mobile numbers registered to the platform

www.csoonline.com · 8 months ago

Researchers at the University of Vienna and SBA Research uncovered a WhatsApp contact discovery vulnerability that allowed global enumeration confirming 3.5 billion registered mobile numbers. They abused the contact discovery mechanism to query more than 100 million phone numbers per hour from a single IP and confirm accounts across 245 countries. While message contents remained end-to-end encrypted, the researchers retrieved publicly available data such as public encryption keys, timestamps, profile photos and About texts, and were able to infer metadata including device operating system, account age and number of linked devices. Meta implemented rate limiting and stricter visibility rules after disclosure, though the research notes Meta was slow to acknowledge the issue when first notified in September 2024.
Sneaky2FA PhaaS kit now uses redteamers' Browser-in-the-Browser attack

www.bleepingcomputer.com · 8 months ago

There are new Browser-in-the-Browser capabilities added to the Sneaky2FA phishing-as-a-service kit that present a fake Microsoft sign-in pop-up which dynamically mimics the victim's operating system and browser. The fake pop-up is implemented as an iframe on top of a reverse proxy phishing page that relays credentials and active session tokens to attackers via attacker in the middle techniques, enabling account access even when two factor authentication is active. The phishing flow uses preview links and Cloudflare Turnstile checks, employs heavy HTML and JavaScript obfuscation and conditional loading to evade detection, and victims can sometimes spot BitB fakes because the pop-up cannot be dragged outside the browser or appear as a separate taskbar window.
The AI Attack Surface: How Agents Raise the Cyber Stakes

www.darkreading.com · 8 months ago

Agentic AI tools can be hijacked to subvert their goals, carry out time based attacks, change how agents interact to compromise whole networks, operate outside system limits, leak sensitive data, and escalate privileges. There is a documented example in CVE-2025-53773 where VS Code and the GitHub Copilot Agent could be manipulated to create files without user authorization and fully compromise a developer machine via an auto approve command. Recommended mitigations include strict access controls and data minimization, input and output guardrails such as keyword filtering, and whitelists and blacklists to restrict which tools and APIs agents may call.
Lawmakers reintroduce bill to bolster cybersecurity at Securities and Exchange Commission

therecord.media · 8 months ago

There is bipartisan legislation introduced by Georgia representatives David Scott and Barry Loudermilk called the SEC Data Protection Act of 2025 to strengthen cybersecurity protections at the Securities and Exchange Commission. The bill would require the SEC to develop and update data protection and cybersecurity protocols consistent with federal and National Institute of Standards and Technology best practices, establish uniform policies for how the agency requests handles stores and protects sensitive information from investors advisers broker dealers and other market participants, and ensure the security of adviser provided information. As written the law would take effect one year after enactment and was introduced in the wake of recent breaches affecting government financial agencies including attacks on the Congressional Budget Office the Office of the Comptroller of the Currency email system and Treasury Department systems.
International operation traces $55 million crypto trail of digital piracy sites

therecord.media · 8 months ago

Investigators traced roughly fifty five million dollars in cryptocurrency linked to illicit streaming services during a five day operation in November 2025. Thirty investigators from fifteen countries targeted sixty nine digital piracy sites, including twenty five illegal streaming services, and used cryptocurrency purchases to map the operators financial infrastructure. Chainalysis provided blockchain intelligence, and both Coinbase and Binance took actions on the intelligence with support from cybersecurity firm Irdeto and England's Premier League.
RCE via a malicious SVG in mPDF

www.reddit.com · 8 months ago

There is a flaw in mPDF processing of embedded SVG images that allows a crafted xlink href starting with colon slash to pass a stream wrapper blacklist and then be transformed into phar or php wrappers, enabling code execution via phar on PHP versions below 8.0 and file read or SSRF style data leaks via php filters on PHP 8 and above. This attack class revisits the issue tracked as CVE-2019-1000005 and can be triggered when applications pass user controlled SVGs or unsanitized HTML to mPDF or accept SVG uploads, including smuggling SVG content as a PNG. The maintainer acknowledged the reports in May 2025 but a CVE request was rejected on October 29, 2025 with the determination that sanitizing or disallowing SVG is the responsibility of the calling application.
Exploiting A Pre-Auth RCE in W3 Total Cache For WordPress (CVE-2025-9501)

www.reddit.com · 8 months ago

A critical unauthenticated command injection vulnerability in the W3 Total Cache WordPress plugin allows remote code execution by submitting a malicious comment and is tracked as CVE-2025-9501. The flaw affects plugin versions before 2.8.13, carries a CVSS score of 9.0, and can enable full site takeover, data theft, installation of backdoors, or malware. Site operators are advised to update to version 2.8.13 or newer immediately and to review comments and logs for suspicious activity from the disclosure period beginning November 17, 2025.