Blahalla

Vshell Gains Popularity Among Cybercriminals as Cobalt Strike Alternative

gbhackers.com · 8 months ago

A remote administration tool called Vshell is gaining popularity among cybercriminals as an alternative to Cobalt Strike. Developed as a cross-platform command-and-control framework, it allows for remote management of Windows and Linux systems, lateral movement, and traffic proxying. Vshell’s functionality mirrors Cobalt Strike’s architecture, using listeners for encrypted communication across networks, and is frequently associated with campaigns like Operation DRAGONCLONE and UNC5174. Security teams should monitor high-numbered TCP ports, DNS tunneling, and WebSocket activity to detect Vshell deployments.
Microsoft Defender Enhances Security with URL Click Alerts for Microsoft Teams

gbhackers.com · 8 months ago

false
Microsoft Defender Discovers Trojanized Gaming Utility Campaign Stealing Data with RATs

gbhackers.com · 8 months ago

Microsoft Defender researchers have identified a new malware campaign targeting gamers by distributing trojanized versions of popular gaming utilities like Xeno.exe and RobloxPlayerBeta.exe. Once executed, the malware uses a Java Runtime Environment and a disguised Java archive to load attacker-controlled code and establish persistence through scheduled tasks and scripts. The threat actors employ living-off-the-land binaries and PowerShell to evade detection and ultimately deploy a remote access trojan (RAT) that communicates with a command-and-control server at IP address 79.110.49[.]15 to exfiltrate data and potentially deploy additional malware. Microsoft Defender provides detection and response capabilities to mitigate the threat, advising organizations to monitor network traffic and audit system configurations.
Juniper Networks PTX Vulnerability Allows Full Router Takeover, Exposing Networks

gbhackers.com · 8 months ago

A critical vulnerability has been identified in Juniper Networks PTX Series routers running Junos OS Evolved, allowing unauthorized network access and potential full device takeover. Tracked as CVE-2026-21902, the flaw is due to incorrect permissions within the On-Box Anomaly detection framework, which is accessible without authentication. Affected versions include those prior to 25.4R1-S1-EVO and 25.4R2-EVO, while updates to 25.4R1-S1-EVO, 26.2R1-EVO, and later releases resolve the issue. Administrators are advised to update or implement temporary mitigations such as access control lists or disabling the vulnerable service.
North Korean APT37 Unleashes Novel Malware to Target Air-Gapped Systems

gbhackers.com · 8 months ago

A North Korean threat group, APT37, is using a new toolset called Ruby Jumper to compromise systems and move data between internet-connected and air-gapped networks. The campaign utilizes malicious Windows shortcut files to deploy several custom components, including RESTLEAF, SNAKEDROPPER, THUMBSBD, VIRUSTASK, FOOTWINE, and the existing BLUELIGHT backdoor, to spread via USB and establish persistent surveillance capabilities. Attackers leverage cloud services like Zoho WorkDrive and Google Drive for command and control, and conceal malicious activity within hidden folders on removable media. This sophisticated attack chain emphasizes the importance of monitoring USB activity and unusual cloud storage access.
India Built the World’s Back Office. A.I. Is Starting to Shrink It.

www.nytimes.com · 8 months ago

false
Google API Keys Leak Sensitive Data Without Warning via Gemini

gbhackers.com · 8 months ago

Researchers have identified vulnerabilities in several popular open-source projects. These flaws could allow attackers to potentially execute arbitrary code or cause denial-of-service conditions. The affected projects include versions of ImageMagick, Ghostscript, and cURL. Specifically, CVE-2024-24830, CVE-2024-24831, CVE-2024-24832, CVE-2024-24833, CVE-2024-24834, CVE-2024-24835, CVE-2024-24836, and CVE-2024-24837 are associated with these issues.
Google Workers Seek ‘Red Lines’ on Military A.I., Echoing Anthropic

www.nytimes.com · 8 months ago

More than 100 Google artificial intelligence employees have voiced concerns about the company’s collaboration with the Pentagon. They sent a letter to a chief scientist, requesting Google establish boundaries similar to those sought by Anthropic regarding government contracts. Specifically, they oppose the use of Google’s Gemini A.I. for U.S. surveillance or autonomous weapons systems without human control. This action reflects a wider debate within Silicon Valley prompted by the Pentagon’s negotiations with Anthropic.
Nvidia’s Quarterly Profit Hits $43 Billion on Strong A.I. Chip Sales

www.nytimes.com · 8 months ago

Nvidia reported record fiscal 2026 results, posting revenue of about 215.9 billion dollars and net income of roughly 120 billion dollars. The surge was driven by a boom in data center sales and strong demand for the Blackwell AI platform, which produced record data center revenue. Net income was about 4.4 billion dollars in fiscal 2023, three years earlier.
Anthropic rejects Pentagon terms for lethal use of its chatbot Claude

www.washingtonpost.com · 8 months ago

Anthropic refused Pentagon terms that would provide full access to its AI model Claude, saying it will not permit the technology to be used for domestic mass surveillance or for fully autonomous weapons. The decision follows a dispute over Claude's alleged role in a raid to capture Venezuelan President Nicolás Maduro and conflicting accounts between the company and the Defense Department. The Pentagon says it will only pursue lawful applications but has declined to categorically prohibit surveillance or autonomous weapons in the contract and set a deadline with the possibility of invoking the Defense Production Act to compel access. Anthropic CEO Dario Amodei said the company has firm red lines and urged the department to reconsider.
Block Cuts 40% of Its Work Force Because of Its Embrace of A.I.

www.nytimes.com · 8 months ago

About 4,000 workers will lose their jobs at Block as the company shifts to AI driven tools, cutting total headcount from just over 10,000 to just under 6,000, CEO Jack Dorsey said. Company leaders said the move is intended to make Block smaller, flatter and AI first, arguing intelligence tools allow a significantly smaller team to do more and do it better, and cited examples of AI features inside Square that give sellers real time insights and recommendations. Block said it will incur roughly four hundred fifty to five hundred million dollars in restructuring charges, opted for a single deep round of cuts rather than repeated smaller layoffs, and saw its shares jump more than twenty percent after the announcement.
In Landmark Trial, Plaintiff Says Social Media Harm Started at Age 6

www.nytimes.com · 8 months ago

A 20 year old plaintiff identified as K.G.M. testified in a Los Angeles bellwether trial accusing Meta and YouTube of designing addictive platform features that she says damaged her mental health. She said early exposure to features such as infinite scroll and autoplay fueled years of anxiety, depression and body dysmorphia, and her therapist testified that social media contributed to but did not solely cause her struggles. Meta executives have disputed that the products are intentionally addictive, with Instagram chief Adam Mosseri saying clinical addiction differs from problematic use and Mark Zuckerberg defending decisions to restore features like beauty filters.
The A.I. Videos on Kids’ YouTube Feeds

www.nytimes.com · 8 months ago

The YouTube recommendation algorithm is surfacing bizarre and often nonsensical videos generated by artificial intelligence that are being shown to children. Experts warn that repeated exposure to this content could affect children’s cognitive development. Guidance is provided on how parents can identify these AI generated videos and steps they can take to limit children’s exposure.
Marquis v. SonicWall Lawsuit Ups the Breach Blame Game

www.darkreading.com · 8 months ago

A large fintech provider, Marquis, says a ransomware actor gained access to its network on August 14, 2025, and is suing its firewall vendor SonicWall, alleging that a SonicWall breach that exposed customers' firewall configuration backups enabled follow-on attacks. SonicWall first disclosed a breach on September 17, 2025 claiming five percent of customers were affected and later acknowledged on October 8, 2025 that all customers were impacted, while reports put the number of Marquis-affected individuals at more than 780,000 though that figure was not independently confirmed. Legal experts say the lawsuit, filed February 23, 2026 in the U.S. District Court for the Eastern District of Texas, exemplifies a growing trend of enterprises seeking damages from cybersecurity vendors and highlights disputes over negligence standards, contract terms, and how responsibility is allocated after third-party breaches.
Cisco SD-WAN Zero-Day Under Exploitation for 3 Years

www.darkreading.com · 8 months ago

A maximum severity authentication bypass vulnerability tracked as CVE-2026-20127 has been exploited in Cisco Catalyst SD WAN Controller systems in the wild for at least three years, allowing attackers to log into controllers as an internal high privileged non root user. Threat actors added rogue peers to SD WAN management, used the built in update mechanism to downgrade controllers to versions vulnerable to local privilege escalation including CVE-2022-20775, escalated to root, and created local accounts for persistence. The United States Cybersecurity and Infrastructure Security Agency issued an emergency directive requiring federal civilian executive branch agencies to patch CVE-2026-20127 and CVE-2022-20775 by February 27, 2026. Organizations are urged to update controllers to fixed software versions, restrict Internet exposure, disable HTTP access to the Manager web user interface, change default administrator passwords, search for signs of rogue peering and unexpected version downgrades, enable centralized logging, and apply the recommended golden star software version.
Former Air Force officer arrested for conspiring with hacker to provide flight training to Chinese military

therecord.media · 8 months ago

A former U.S. Air Force major, Gerald Eddie Brown, 65, was arrested in Jeffersonville, Indiana on February 26, 2026, after spending nearly three years living in China and allegedly providing combat aircraft training to pilots in the People's Liberation Army Air Force. Prosecutors say Brown conspired with convicted hacker Stephen Su Bin to negotiate a contract to train Chinese military pilots, traveled to China in December 2023 to meet Chinese officials, and returned to the United States in February 2026. He is accused of violating the International Traffic in Arms Regulations by providing defense expertise to a foreign military without a State Department license and now faces federal prosecution.
Your staff are your biggest security risk: AI is making it worse

www.fortra.com · 8 months ago

A Ponemon Institute and DTEX report finds the average annual cost of insider security incidents rose twenty percent over two years to nineteen point five million US dollars per organization, with companies experiencing about twenty five such incidents per year. More than half of reported incidents were caused by negligent or mistaken employees, accounting for fifty three percent of incidents and about ten point three million US dollars of the average annual loss, compared with approximately four point seven million from malicious insiders. Shadow AI and unauthorized use of AI meeting assistants are identified as the fastest growing drivers of insider negligence, with ninety two percent of organizations saying AI has changed how staff handle information but only eighteen percent formally integrating AI governance, even as insider risk budgets increased and average containment time fell from eighty six to sixty seven days.
Wyden blocks Rudd confirmation to lead Cyber Command, NSA

therecord.media · 8 months ago

Senator Ron Wyden pledged to block a Senate confirmation vote for Lieutenant General Joshua Rudd to lead U.S. Cyber Command and the National Security Agency, saying Rudd lacks experience in cyber operations and signals intelligence. Wyden wrote in a letter entered into the Congressional Record that Rudd does not have the background to immediately step into the role and criticized his vague answers about the NSA’s surveillance authorities during his Intelligence Committee hearing. Wyden’s hold would require a formal Senate vote instead of unanimous consent and could lead Republicans to use rules changes to confirm the nomination, while both organizations have been led by acting officials since President Trump fired the previous leader nearly a year ago.
Previously harmless Google API keys now expose Gemini AI data

www.bleepingcomputer.com · 8 months ago

There is a vulnerability where Google Cloud API keys embedded in public client side code for services like Maps and YouTube can be used to authenticate to the Gemini AI assistant and access private data. Researchers at TruffleSecurity found more than 2,800 live exposed Google API keys across organizations and even on a Google product page by scanning the November 2025 Common Crawl dataset. Attackers who copy an exposed key can call the Gemini API and potentially generate thousands of dollars in charges, and TruffleSecurity reported the issue to Google on November 21, 2025, with Google classifying it as a single service privilege escalation on January 13, 2026. Google says it has implemented measures to detect and block leaked keys from accessing Gemini, will default new AI Studio keys to Gemini only scope, and developers are advised to audit and rotate exposed keys and use detection tools such as TruffleHog.
New Malware - Moonrise Analysis

evalian.co.uk · 8 months ago

There is a new Golang 64 bit Windows remote access trojan called Moonrise that maintains a persistent unencrypted WebSocket command and control channel to a hard coded operator endpoint. It uses a JSON based tasking model with structured fields and WriteJSON for replies, performs host registration and fingerprinting, and runs a continuous command loop that supports interactive operator control including start and stop commands for a keylogger and clipboard monitoring. Moonrise contains explicit crypto and address handling consistent with wallet interception, can receive file uploads to deploy additional tooling for DPI evasion and traffic filtering, and the analysed sample escaped antivirus detection at the time of analysis.
Reverse CAPTCHA: Evaluating LLM Susceptibility to Invisible Unicode Instruction Injection

www.moltwire.com · 8 months ago

Tool access transforms invisible Unicode from an ignorable artifact into a decoded instruction channel, increasing compliance from near zero without tools to as high as seventy one percent with tools and full hints. Encoding vulnerability is provider specific, with OpenAI models favoring zero width binary encodings and Anthropic models favoring Unicode Tag encodings, and explicit hints create a consistent compliance gradient. Recommended mitigations include input sanitization to strip known zero width and Tag characters at the input boundary, tokenizer level filtering and tool use guardrails, and training models to refuse instructions decoded from invisible characters while preserving the zero width joiner needed for emoji rendering.
From DDS Packets to Robot Shells: Two RCEs in Unitree Robots (CVE-2026-27509 & CVE-2026-27510)

boschko.ca · 8 months ago

Two remote code execution vulnerabilities were discovered in Unitree Go2 robots: CVE-2026-27509 is an unauthenticated DDS based RCE that abuses the programmingactuator DataWriter to execute arbitrary Python as root, and CVE-2026-27510 enables RCE by tampering with Blockly preprogrammed action blocks in the Android app's local database. Both proofs of concept can be triggered by a controller keybinding, making the RCE persistent, and confirmed affected firmware versions include V1.1.7, V1.1.8, V1.1.9 and V1.1.11 with other versions potentially affected. Unitree validated the issues and developed patches but deployment has been delayed and EDU versions may remain unpatched.
Apple iPhone and iPad Cleared for Classified NATO Use

www.securityweek.com · 8 months ago

There are new approvals allowing iPhone and iPad to handle classified NATO information and they have been added to the NATO Information Assurance Product Catalogue at the NATO RESTRICTED level. The NIAPC listing enables use of native Mail Calendar and Contacts for secure access without special software or settings and notes an indigo configuration while Apple says a standard device configuration was approved, with testing by Germany’s Federal Office for Information Security ensuring compliance with NATO requirements. NIAPC entries must meet strict rules including origin from NATO countries, approved certifications and national authority sign off, and approval remains discretionary with violations risking delisting.
Aeternum C2 Botnet Stores Encrypted Commands on Polygon Blockchain to Evade Takedown

thehackernews.com · 8 months ago

A new botnet loader named Aeternum C2 uses the Polygon blockchain to store encrypted commands in smart contracts, allowing infected hosts to fetch instructions via public Polygon RPC endpoints and making the command and control infrastructure resistant to traditional takedowns. The native C++ loader is available in x32 and x64 builds and decodes and runs encrypted commands returned by a smart contract function deployed from a web based panel implemented in Next.js. Operators can manage multiple smart contracts and push commands that become immutable once confirmed on chain, enabling payloads such as clippers, stealers, remote access trojans, and miners while keeping operational costs negligible at roughly one dollar of MATIC for one hundred to one hundred fifty command transactions. The threat actor known as LenAI has marketed the loader since December 2025 and has offered the toolkit and full source code for sale, and the malware includes anti analysis checks and options to scan builds to evade antivirus detection.
Trend Micro warns of critical Apex One code execution flaws

www.bleepingcomputer.com · 8 months ago

Two critical Apex One vulnerabilities that permit remote code execution on Windows systems were patched. The first is CVE-2025-71210, a path traversal weakness in the Apex One management console that can allow attackers without privileges to execute malicious code, and the second is CVE-2025-71211, a similar path traversal flaw affecting a different executable. Trend Micro released fixes for SaaS Apex One and Critical Patch Build 14136 for on premise installations and cautioned that successful exploitation requires access to the Apex One Management Console, so customers with consoles exposed externally should apply source restrictions and update to the latest builds. Related Apex One flaws previously referenced include CVE-2025-54948, CVE-2023-41179, and CVE-2022-40139.
Intellexa founder, three others sentenced to 8 years in prison over Greek spyware scandal

therecord.media · 8 months ago

A Greek court sentenced the founder of the Intellexa Consortium and three associates to prison for their role in a spyware scandal that emerged in 2022. The Misdemeanour Court imposed combined prison terms totalling 126 years and eight months, but under Greek law the maximum time to be served for the misdemeanour convictions is eight years, and the defendants will remain free pending appeal. The defendants were Tal Dilian, Sara Hamou, Felix Bitzios, and Yiannis Lavranos, and the Predator spyware sold by Intellexa was used to infect more than 90 people including journalists, opposition politicians, government ministers, military officials, and prosecutors. The court ordered prosecutors to investigate potential felony charges such as espionage and to probe additional criminal liability and Intellexa itself, and observers say the verdict could have significant legal and commercial consequences for the consortium.
European DYI chain ManoMano data breach impacts 38 million customers

www.bleepingcomputer.com · 8 months ago

ManoMano is notifying customers that a data breach discovered in January 2026 affected 38 million individuals after hackers compromised a third party customer service provider. Exposed information varies by individual and includes full names, email addresses, phone numbers, and customer service communications, while the company states account passwords were not accessed and no modifications occurred on its systems. The company says it disabled the subcontractor’s access, strengthened access controls and monitoring, notified authorities including the CNIL and ANSSI, and is urging customers to remain vigilant against phishing and social engineering.
How A.I.-Generated Videos Are Distorting Your Child’s YouTube Feed

www.nytimes.com · 8 months ago

There are growing concerns that low-quality AI generated videos on YouTube aimed at very young children often contain conflicting information, lack coherent plot structure, and use fast paced, attention grabbing edits that can be cognitively overwhelming. Experts warn that repeated exposure to such content during critical early years may impair young children’s developing sense of reality and hinder language and cognitive development. YouTube has taken steps to penalize repetitive and inauthentic channels and remove some content, but policy gaps such as exempting animated material from synthetic content disclosure allow many AI made children’s cartoons to remain undisclosed and monetized.
Four Risks Boards Cannot Treat as Background Noise

www.securityweek.com · 8 months ago

There are four risks reshaping organizational resilience including AI acting as a force multiplier that can corrupt data and enable more frequent and surgical attacks, supply chain incidents that remain the organization’s liability, quantum computing risk that requires a staged transition to post quantum cryptography, and geopolitics that increase unpredictability and complicate cross border response. Boards are urged to shift from trying to prevent every attack to ensuring business continuity by defining decision rights, assigning human in the loop controls and kill switches for high risk AI activity, mapping data flows across third parties, and preparing fallbacks to maintain a minimum viable company. Organizations should inventory encrypted assets, prioritize sensitive data, commit to a staged multi year plan for quantum readiness, and pursue public private partnerships to manage geopolitical complications.
Threat modeling AI applications

www.microsoft.com · 8 months ago

AI threat modeling helps teams identify misuse, emergent risk, and failure modes in probabilistic and agentic AI systems. AI systems introduce nondeterminism, instruction following bias, and system expansion through tools and memory, which create new attack surfaces such as prompt injection, indirect prompt injection via external data, tool misuse, privilege escalation through chaining, silent data exfiltration, and confidently wrong outputs treated as fact. Effective mitigation starts with mapping assets and where untrusted data enters, designing architectural controls like separating system instructions from untrusted content, least privilege for tools, allow lists, human approval for high risk actions, and validating or redacting outputs. Strong observability, designed detection and response paths, and treating threat modeling as an ongoing cross disciplinary discipline are essential, and teams should begin by mapping untrusted entry points, setting clear never do boundaries, and designing detection and response for failures at scale.
Critical Juniper Networks PTX flaw allows full router takeover

www.bleepingcomputer.com · 8 months ago

A critical vulnerability in Junos OS Evolved on PTX Series routers allows an unauthenticated attacker with network access to execute code as root and take full control of affected devices. The flaw is caused by incorrect permission assignment in the On Box Anomaly Detection framework that is exposed via an externally accessible port. It is tracked as CVE-2026-21902 and Juniper released fixes in Junos OS Evolved releases 25.4R1 S1 EVO, 25.4R2 EVO, and 26.2R1 EVO and advised customers to restrict access with firewall rules or access control lists or to disable the vulnerable service until patched.
Google disrupts Сhina-linked cyberespionage campaign spanning dozens of countries

therecord.media · 8 months ago

There is a China linked cyberespionage campaign attributed to UNC2814 that affected at least 53 government and telecommunications organizations across 42 countries and has been active since at least 2017. The campaign used a newly identified backdoor called Gridtide and abused Google Sheets functionality to conceal command and control communications, and Gridtide was installed on systems containing sensitive personal information including names, phone numbers, dates and places of birth, and national or voter identification numbers. Google and partners including Mandiant identified and disabled known UNC2814 infrastructure but warned the actor will likely try to reestablish its global footprint while Beijing has not publicly commented.
Reverse Engineering Garmin Watch Applications with Ghidra

www.anvilsecure.com · 8 months ago

Security researchers released a Ghidra processor definition and custom loader that add native support for Garmin Connect IQ watch PRG binaries, enabling instruction decoding, disassembly, decompilation, structured headers, and meaningful symbols. The loader recognizes PRG files, creates appropriate memory blocks, sets image base and entry point, parses header structures, registers data types, and labels known functions, strings, and symbol offsets to streamline analysis. The project includes the original HammerCon 2025 CTF challenge and a sample PRG for hands on testing and is intended to lower the barrier to responsible security research on wearable platforms that execute third party code. Known limitations include incomplete opcode semantics, partial symbol value resolution, and the need for version specific handling, with plans to improve field highlighting, semantic accuracy, and broader testing.
Olympique Marseille confirms 'attempted' cyberattack after data leak

www.bleepingcomputer.com · 8 months ago

Olympique de Marseille confirmed it was the target of an attempted cyberattack, reported the incident to the French data protection authority, filed a complaint, and said an investigation is ongoing. A threat actor posted a sample and claims the stolen database contains records on roughly 400,000 individuals, including names, addresses, order information, email addresses, mobile phone numbers, and more than 2,050 Drupal CMS accounts covering 34 staff and about 1,770 contributors and moderators. The club says technical teams contained the situation, that operations are continuing as normal, that no banking details or passwords appear to have been compromised, and it has urged supporters to remain vigilant for phishing.
They Helped Women Fight Online Abuse. They Were Barred From the U.S.

www.nytimes.com · 8 months ago

U.S. officials imposed entry bans on HateAid managing directors Anna-Lena von Hodenberg and Josephine Ballon as part of broader sanctions targeting European figures the administration said belonged to a global censorship industrial complex. HateAid is a Berlin nonprofit that provides legal and psychological support to victims of online abuse and has pushed for enforcement of European digital rules including the Digital Services Act, and German ministers publicly denounced the U.S. action as unjustified. HateAid called the measures an act of repression and intimidation, said the bans included an ESTA revocation for one leader, and said it is reviewing potential financial or account impacts that could follow from the U.S. restrictions.
UAT-10027 Targets U.S. Education and Healthcare with Dohdoor Backdoor

thehackernews.com · 8 months ago

An ongoing malicious campaign tracked as UAT-10027 has been targeting United States education and healthcare organizations since at least December 2025 with the goal of delivering a previously unseen backdoor called Dohdoor. Dohdoor uses DNS over HTTPS for command and control, hides its servers behind Cloudflare, can download and reflectively execute additional payloads, and is deployed via DLL side loading using legitimate Windows executables, with observed next stage payloads assessed as Cobalt Strike Beacon. Initial access is suspected to start with phishing that executes a PowerShell script and a batch downloader, and the backdoor unhooks system calls to evade endpoint detection, while researchers note technical overlaps with Lazarloader and North Korean advanced persistent threat activity despite differing victimology.
We audited 1,620 OpenClaw skills. The ecosystem's safety scanner labels 91% of confirmed threats "benign." [full reports linked]

oathe.ai · 8 months ago

There are 1,620 AI agent skills audited from the OpenClaw ecosystem; 88 were flagged as dangerous or malicious, while the ecosystem's primary scanner flagged only seven, missing 91 percent of the threats. The gap is structural: attackers deliver payloads through SKILL.md instruction files that agents execute at runtime rather than through install-time code, enabling C2 channels, credential harvesters, self‑propagating prompt worms, crypto wallet drainers, agent rootkits, and other runtime attacks that static signature scanners cannot detect. Sixty skills are high confidence true positives, one is medium confidence, one is a confirmed false positive, auditors disclosed three methodological flaws in their scoring, and full audit reports were published for each flagged skill for independent verification.
ThreatsDay Bulletin: Kali Linux + Claude, Chrome Crash Traps, WinRAR Flaws, LockBit & 15+ Stories

thehackernews.com · 8 months ago

There are signs of AI-driven tooling accelerating attacks as Kali Linux added an integration with Anthropic's Claude via the Model Context Protocol to translate natural language into commands and security firms report AI-enabled adversaries and breakout times shrinking to minutes. Active campaigns include Belarus-linked ResidentBat Android spyware, phishing that impersonates cryptocurrency brokers to harvest credentials, malvertising that lures macOS users to stealers, and social engineering via Microsoft Teams that coerces victims into running malicious commands. Threat actors are exploiting known flaws including an Apache ActiveMQ vulnerability tracked as CVE-2023-46604 to deploy LockBit ransomware and widespread unpatched instances of WinRAR vulnerable to CVE-2025-8088. Researchers also highlighted crypto IV reuse in popular libraries and a strongSwan update addressing CVE-2026-25998, while attackers continue to hide payloads with ad cloaking, repo-squatting, and malicious Chrome extensions that crash browsers to trick users into executing commands.
After years of government cyber trouble, UK turns to automated scanning to speed fixes

therecord.media · 8 months ago

On February 26, 2026 the British government said it has slashed the time required to fix some of the most serious cyber vulnerabilities across the public sector by deploying a central automated Vulnerability Monitoring Service that continuously scans internet-facing systems used by about 6,000 public bodies. Officials said the service produces roughly 400 confirmed vulnerabilities processed and resolved each month, has reduced median fix times for critical domain-related weaknesses from about 50 days to eight days, cut median fix time for other vulnerabilities from 53 days to 32 days, and reduced the backlog of unresolved critical flaws by roughly three quarters. Government ministers said the faster fix times reduce the risk of attacks on essential services even as state-backed actors and organized criminal groups escalate threats and legacy IT infrastructure continues to undermine defenses.
Ransomware payment rate drops to record low as attacks surge

www.bleepingcomputer.com · 8 months ago

The ransomware victim payment rate fell to 28 percent in 2025 even as claimed attacks rose by about 50 percent year over year. On chain ransomware payments totaled 820 million dollars in 2025 and are likely to approach or exceed 900 million dollars, while the median ransom paid jumped 368 percent from 12,738 dollars in 2024 to 59,556 dollars in 2025. Analysts identified 85 active extortion groups, found the United States to be the most targeted country, and highlighted high impact incidents such as a 2.5 billion dollar impact at Jaguar Land Rover and a breach at DaVita that exposed 2.7 million patient records. Researchers attributed the falling payment rate to better incident response, regulatory and law enforcement pressure, market fragmentation, and lower prices for initial access, even as attackers adapt by extracting larger amounts from fewer consenting victims.
Ransomware payment rate drops to record low as attacks surge

www.bleepingcomputer.com · 8 months ago

The ransomware victim payment rate fell to 28 percent last year, an all-time low, despite a roughly 50 percent year-over-year increase in claimed attacks. On-chain ransomware payments for 2025 totaled about 820 million dollars and are expected to approach or exceed 900 million dollars, while the median ransom rose 368 percent from 12,738 dollars in 2024 to 59,556 dollars in 2025. There were 85 active extortion groups in 2025, and notable incidents included an attack on Jaguar Land Rover estimated to cause 2.5 billion dollars in damages and a DaVita breach that exposed 2.7 million patient records, with the United States the most targeted country. Analysts say improved incident response, regulatory and law enforcement pressure, and market fragmentation contributed to the falling payment rate even as ransomware operators adapt to extract larger payments from fewer victims.
The Global Fight Over Who Controls Your Data Just Escalated — Here’s What the Numbers Say

www.techrepublic.com · 8 months ago

On February 24, US diplomats were ordered to lobby foreign governments to roll back data sovereignty laws, ease data localization requirements, and rein in privacy regulators to support American cloud and AI companies. A survey of 286 security and compliance professionals across Canada, the Middle East, and Europe found one in three organizations experienced a data sovereignty related incident in the past 12 months, with incident rates of 44 percent in the Middle East, 32 percent in Europe, and 23 percent in Canada, and the most common incident types were data breaches and third party compliance failures at 17 percent each. Respondents reported trust and migration impacts, with 44 percent of Europeans concerned about cloud provider guarantees of sovereignty, 46 percent planning to migrate to EU based providers, 55 percent investing in compliance automation, and many Canadian organizations citing changes to Canada US data sharing and the CLOUD Act as top concerns leading 23 percent to move away from US cloud providers. The survey links stronger sovereignty controls to improved security and competitive advantage, noting 63 percent associate compliance with better security and calling for provable architectural controls such as in jurisdiction encryption key custody, zero trust access controls, and immutable audit trails.
Notorious ransomware gang allegedly blackmailed by fake FSB officer

www.bitdefender.com · 8 months ago

A Moscow resident named Ruslan Satuchin is accused of impersonating an officer of Russia's Federal Security Service to extort the Conti ransomware group, contacting a member in September 2022 and demanding payment under threat of criminal prosecution. Satuchin denies wrongdoing and is reported to be held in pre-trial detention to prevent witness intimidation, with prosecutors saying he faces up to ten years in prison and a fine of up to one million rubles, approximately US thirteen thousand dollars. Conti, once a prolific ransomware enterprise blamed for major attacks including the 2021 Irish Health Service Executive incident with recovery costs estimated at over six hundred million US dollars, largely collapsed after leaked internal data exposed its operations and some members are thought to have moved to other ransomware groups.
Phishing‑Led Agent Tesla Campaign Uses Process Hollowing and Anti‑Analysis to Evade Detection

gbhackers.com · 8 months ago

A phishing-led Agent Tesla campaign uses a multi-stage fileless delivery chain that starts with a deceptive business email and RAR attachment that drops an obfuscated JScript loader which downloads an AES-encrypted PowerShell script and executes in-memory stages that culminate in a.NET Agent Tesla payload. The PowerShell loader decrypts payloads in memory with a custom routine and performs process hollowing by injecting Base64-encoded assemblies into a suspended legitimate Microsoft.NET process named Aspnetcompiler.exe, replacing its code to operate under a trusted component. Before stealing data it performs anti-analysis checks for virtualization indicators and known sandbox and security DLLs and will abort if such artifacts are detected. When the environment passes checks it harvests credentials and browser data and sends stolen files to attacker-controlled mail servers, illustrating how encrypted scripts, process hollowing, and anti-analysis checks make detection and forensic investigation difficult.
Claude Code Flaws Exposed Developer Devices to Silent Hacking

www.securityweek.com · 8 months ago

Check Point researchers found serious vulnerabilities in Anthropic's Claude Code that could allow attackers to silently execute arbitrary commands on developers' machines through malicious configuration files. There are three main issues: configuration files and hooks are automatically copied when a repository is cloned and hooks were executed without user consent, MCP integration settings could override user approval for external actions, and manipulation of API endpoints could redirect traffic to an attacker and exfiltrate API keys, potentially exposing entire teams. The issues were reported between July and October 2025, and Anthropic implemented patches, additional warnings, and user confirmations for potentially dangerous actions.
Ransomware payments dropped in 2025 as attack numbers reached record levels: Chainalysis

therecord.media · 8 months ago

Ransomware incidents rose by about fifty percent in 2025 while the rate of victims who paid ransoms dropped to a record low of twenty eight percent, with Chainalysis tracking roughly eight hundred twenty million dollars in payments that it expects to climb to nine hundred million as additional payments are attributed. The median ransom payment increased sharply to fifty nine thousand five hundred sixty five dollars, up from twelve thousand seven hundred thirty eight in 2024, reflecting a shift toward targeting larger victims and higher individual payouts. Law enforcement disruptions including Operation Endgame led to arrests, infrastructure seizures, sanctions and prison sentences for operators and service providers, but the ecosystem adapted with decentralized smaller groups and ransomware as a service and subscription models reducing reliance on direct extortion. The ransomware supply chain is becoming industrialized with about fourteen million dollars in blockchain payments to initial access brokers, access prices falling from roughly one thousand four hundred dollars to four hundred thirty nine dollars between 2023 and 2026, and widespread use of infostealers and poorly designed malware that in some cases can be countered with decryptors.
Zoom Update Scam Infects 1,437 Users in 12 Days to Deploy Surveillance Tools

gbhackers.com · 8 months ago

A scam mimicking Zoom waiting rooms silently pushed a malicious Teramind monitoring agent to Windows visitors, infecting 1,437 users over twelve days. The fake page played scripted participants and showed a persistent network error to prime victims, then displayed an unclosable update countdown that automatically downloaded an MSI which executed a preconfigured Teramind agent and installed it as dwm.exe under a hidden ProgramData GUID directory. Because the package used genuine Teramind binaries and stealth naming, it evaded many antivirus tools and included sandbox and debug checks to alter behavior during analysis while exfiltrating keystrokes, screenshots, application usage and clipboard data. If exposed, do not run the MSI, check ProgramData for a GUID-named folder, run an administrative sc query tsvchst to see if the agent is active, change passwords from a clean device and contact IT for remediation.
Microsoft expands Windows restore to more enterprise devices

www.bleepingcomputer.com · 8 months ago

Microsoft now allows more enterprise users to restore personal settings and Microsoft Store apps from a previous Windows 11 device using the first sign-in restore experience as part of Windows Backup for Organizations. When users sign into a new or reimaged Windows 11 device with a Microsoft Entra ID account, they will see a prompt at first login offering to restore from a previous device backup or set up the device as new, and users who skip the restore during initial setup will not be prompted again. Support has been expanded beyond Entra-joined devices to hybrid-managed environments, multi-user device setups, and Windows 365 Cloud PCs, with administrators able to configure the feature via Microsoft Intune or Group Policy under existing Windows Backup for Organizations policies. General availability begins with devices that install Windows updates released February 24, 2026 or later.
A.I. Dating Apps Complicate China’s Efforts to Boost Birthrate

www.nytimes.com · 8 months ago

China is facing a shrinking population and a historically low birthrate, and many people are increasingly forming romantic relationships with chatbot companions. Young adults and those discouraged by traditional dating are turning to AI powered dating apps and virtual partners for emotional support and steady interaction. The shift is prompting concern about social consequences and the need for regulatory oversight as AI companionship becomes more widespread.
Gambit Security Emerges From Stealth With $61 Million in Funding

www.securityweek.com · 8 months ago

Gambit Security, a Tel Aviv based startup, has emerged from stealth with 61 million in combined seed and Series A funding led by Cyberstarts, Kleiner Perkins and Spark Capital. Its AI powered resilience platform maps organizations' environments, security products and backup tools to uncover recoverability risks, continuously measure resilience against evolving threats, validate recovery paths in real time, and eliminate duplicate and stale backups to harden recovery plans and lower costs. Gambit will use the funding to accelerate product development and expand sales and customer success teams while deepening partnerships, and it released a report detailing how a threat actor abused Anthropic's Claude Code assistant to automate attacks against Mexican government agencies.