Blahalla

EDR-Redir V2 Evades Detection on Windows 11 by Faking Program Files

gbhackers.com · 9 months ago

A security researcher named TwoSevenOneT released EDR Redir V2, an evasion tool that exploits Windows bind link functionality added in Windows 11 24H2 to redirect parent directories of EDR installations without requiring kernel privileges. The tool mirrors subfolders from a target parent directory into a controlled folder, creates bidirectional bind links that loop normal applications to the mirrors while isolating the EDR subfolder to an attacker controlled location, and enables DLL hijacking or file drops that can blind endpoint detection and response products. A demonstration against Windows Defender showed Defender viewing the attacker folder as its operational parent and becoming effectively blind to original files, prompting recommendations to monitor bind link usage in critical directories and add integrity checks for EDR paths.
OpenAI Introduces Aardvark, an AI Security Agent Powered by GPT-5

gbhackers.com · 9 months ago

There is an agentic security researcher named Aardvark powered by GPT 5 that is available in private beta and continuously analyzes source code repositories to identify, validate, and propose fixes for vulnerabilities. Its pipeline builds a threat model, scans commits and repository history, attempts to reproduce exploits in an isolated sandbox, and attaches Codex generated patches for human review, and in benchmark testing it identified ninety two percent of known and seeded vulnerabilities. When applied to open source projects it uncovered multiple real flaws, with ten of those findings receiving Common Vulnerabilities and Exposures identifiers, and the service integrates with GitHub and is being offered to select partners and for pro bono scans of some non commercial projects.
Proton Warns of 300 Million Stolen Login Details Circulating on Dark Web

gbhackers.com · 9 months ago

There are more than 300 million stolen login records circulating on the dark web in 2025 according to Proton's Data Breach Observatory, which has verified 794 distinct breach incidents. About half of the exposed records include passwords and around 70 percent of incidents affect small and medium sized businesses, with retail, technology, and media among the top targeted sectors. Proton says the observatory monitors underground forums and uses partners to validate leaks, will notify affected organizations, and recommends using unique passwords, multi factor authentication, and email aliases to reduce risk.
Steal MS Teams app cookies

www.reddit.com · 9 months ago

A Beacon Object File tool can run inside the Microsoft Teams process to locate the SQLite cookie store and recover the encryption key protected by the current user DPAPI, allowing decryption of Teams cookies without requiring SYSTEM privileges. Because Teams embeds Chromium via msedgewebview2 but relies on the user DPAPI master key rather than a COM-based elevation service used by browsers, the tool duplicates handles to webview child processes to read locked cookie files and decrypt their contents. Stolen Teams cookies allow attackers to interact with Teams, Skype, and Microsoft Graph APIs to read and send messages as the victim, and the lightweight Cookie Monster based BOF is intended to execute from the ms-teams.exe context and may be detected by unusual processes opening handles to Teams webview processes.
Penn hacker claims to have stolen 1.2 million donor records in data breach

www.bleepingcomputer.com · 9 months ago

A hacker claimed responsibility for mass fraudulent emails and said they accessed multiple University of Pennsylvania systems, exfiltrating data on about 1.2 million students, alumni, and donors plus internal documents. The attacker reported they gained full access to an employee PennKey single sign on account and used it to reach Penn's VPN, Salesforce, Qlik analytics, SAP business intelligence, SharePoint, and Salesforce Marketing Cloud, then sent offensive messages to roughly 700,000 recipients. The breach was claimed to have occurred on October 30 with downloads completed by October 31, and the threat actor published a 1.7 gigabyte archive of spreadsheets and files while saying the donor database may be released in a month or two. The university is investigating and donors are advised to be vigilant for targeted phishing and social engineering and to verify unexpected donation requests directly with the university.
Alleged Jabber Zeus Coder ‘MrICQ’ in U.S. Custody

krebsonsecurity.com · 9 months ago

A Ukrainian man indicted in 2012 for conspiring with a prolific hacking group to steal tens of millions of dollars from U.S. businesses was arrested in Italy and is now in custody in the United States. Authorities say Yuriy Igorevich Rybtsov, 41, known online as MrICQ, was a developer for the Jabber Zeus crew who handled incoming notifications of compromised victims, helped launder proceeds, and worked with a custom ZeuS banking trojan that used a component called Leprechaun to intercept one time passcodes and bypass multi factor authentication. Italian courts denied his appeal in April 2025, sources say he arrived in Nebraska on October 9, 2025, and remains held under an FBI arrest warrant while U.S. prosecutors review the 2012 indictment that named him as John Doe number three.
Open VSX rotates access tokens used in supply-chain malware attack

www.bleepingcomputer.com · 9 months ago

Open VSX rotated and revoked access tokens after developers accidentally exposed over 550 secrets in public repositories, a leak that allowed threat actors to publish malicious extensions and create a significant supply chain risk. The leaked tokens were used in a campaign dubbed GlassWorm that concealed malware using invisible Unicode characters to steal developer credentials and exfiltrate cryptocurrency wallet data from multiple extensions. All malicious extensions were removed and associated tokens were rotated by October 21, the incident was declared contained with no ongoing impact, and the registry plans security measures including shorter token lifetimes, faster revocation workflows, automated extension scans, and intelligence sharing with other marketplaces.
Knee-jerk corporate responses to data leaks protect brands like Qantas — but consumers are getting screwed

www.theguardian.com · 9 months ago

There is a growing playbook among large Australian companies to call in lawyers and obtain court injunctions that ban access to leaked customer data after cyber-attacks, a tactic Qantas used after a breach that exposed five million frequent flyer records. Cybersecurity experts say these injunctions prevent lawful organisations and journalists from verifying breaches and warning affected customers while doing nothing to stop scammers or stop data from later appearing on the dark web. The tension was underscored when third parties including Equifax and security vendors notified customers despite the injunction, prompting criticism that the legal approach protects corporate reputations more than consumers.
open source CVE scanner for project dependencies. VSCode extension.

www.reddit.com · 9 months ago

VulScan MCP scans project dependency manifest files for known vulnerabilities by checking NVD and OSV databases. It integrates with Visual Studio Code and GitHub Copilot so a simple prompt can trigger a scan and it reports only confirmed CVEs rather than flagging deprecated packages or merely outdated versions. The tool does not automatically apply patches; it reports findings and provides remediation guidance, and both source code and a Visual Studio Code marketplace extension are available.
China-linked hackers exploited Lanscope flaw as a zero-day in attacks

www.bleepingcomputer.com · 9 months ago

China-linked cyber espionage actors tracked as Bronze Butler exploited a zero-day in Motex Lanscope Endpoint Manager to gain remote code execution and deploy an updated Gokcpdoor backdoor across compromised environments. The flaw is tracked as CVE-2025-61932, affects on-premises Lanscope client and detection agent versions 9.4.7.1 and earlier, has been patched in multiple 9.3 and 9.4 releases, and was added to CISA’s Known Exploited Vulnerabilities catalog with a three week remediation directive for federal civilian agencies. Operators used loaders and legitimate administration tools to establish persistence, move laterally, and exfiltrate data, at times substituting Gokcpdoor with the Havoc framework and abusing utilities such as remote desktop tools and 7-Zip.
ASD Warns of Ongoing BADCANDY Attacks Exploiting Cisco IOS XE Vulnerability

thehackernews.com · 9 months ago

The Australian Signals Directorate warns of ongoing attacks using a previously undocumented implant called BADCANDY that targets unpatched Cisco IOS XE devices by exploiting CVE-2023-20198, a critical remote unauthenticated flaw with a CVSS score of 10.0. BADCANDY is a low equity Lua based web shell first seen in October 2023 that is non persistent but has been repeatedly reintroduced to vulnerable devices, with as many as 400 devices in Australia estimated compromised since July 2025, including 150 infections in October 2025, and China linked actors such as Salt Typhoon observed exploiting the vulnerability. Operators are urged to apply available patches, limit public exposure of device web user interfaces, follow Cisco hardening guidance, review and remove unexpected privilege 15 accounts and accounts with names like cisco tac admin or cisco support, check for unknown tunnel interfaces, and enable TACACS plus accounting to monitor configuration changes.
New Email Security Technique Prevents Phishing Attacks Behind NPM Breach

gbhackers.com · 9 months ago

A large scale compromise of the NPM ecosystem in September 2025 saw attackers compromise multiple high profile developer accounts through a sophisticated phishing campaign, inserting malicious code into 20 popular packages that together had nearly 2.8 billion downloads. The incident renewed focus on email security as the critical first line of defense against supply chain attacks and prompted the introduction of a new email security technique designed to block the phishing tactics used to seize those accounts. Organizations are advised to harden email defenses and account protections to prevent similar supply chain compromises.
EDR-Redir V2: Blind EDR With Fake "Program Files"

www.reddit.com · 9 months ago

EDR-Redir V2 uses Windows bind links to create looped redirections of parent folders such as Program Files and ProgramData so that applications continue to run while antivirus and EDR folders are selectively redirected or blocked. The technique creates matching folders in a controlled location, makes bind links from original subfolders to the controlled folders and back to form a loop, then redirects the parent folder while omitting the EDR folder so the EDR is forced to operate against the attacker controlled location. In testing on Windows 11, redirecting the ProgramData Microsoft folder to a temporary directory while exempting the Windows Defender subfolder reportedly caused Defender to see the temporary directory as its parent and enabled DLL hijacking opportunities. Defenders are advised to monitor and detect unexpected use of bind links on critical parent folders to prevent attackers from undermining EDR protections.
Akira Ransomware Strikes Apache OpenOffice, Allegedly Exfiltrates 23GB of Data

gbhackers.com · 9 months ago

The Akira ransomware gang announced on October 29, 2025, that it penetrated Apache OpenOffice systems and exfiltrated 23 gigabytes of sensitive corporate data. The group posted details on its dark web leak site and threatened to release the stolen information unless a ransom demand is met.
Hackers Hide SSH–Tor Backdoor Inside Weaponized Military Documents

gbhackers.com · 9 months ago

In October 2025 cybersecurity researchers uncovered a campaign that distributed weaponized ZIP archives disguised as military documents and targeted Belarusian military personnel. One lure file was titled TLG for departure for retraining dot PDF and the archives concealed a stealthy SSH and Tor backdoor that provided covert remote access and command and control over the Tor network. Evidence indicates the operation aimed to collect intelligence from compromised hosts and maintain persistent, anonymized access for data exfiltration.
CISA Alerts on Linux Kernel Vulnerability Exploited in Ransomware Attacks

gbhackers.com · 9 months ago

The U.S. Cybersecurity and Infrastructure Security Agency added a critical Linux kernel vulnerability to its Known Exploited Vulnerabilities catalog and warned that threat actors are actively exploiting it in ransomware campaigns targeting organizations worldwide. The vulnerability is tracked as CVE-2024-1086. It represents a significant threat to Linux-based systems and requires immediate attention from cybersecurity teams to apply patches and mitigations.
Cisco IOS XE Vulnerability Being Abused in the Wild to Plant BADCANDY

gbhackers.com · 9 months ago

Cybersecurity authorities warn that threat actors are exploiting a critical Cisco IOS XE vulnerability to deploy a malicious implant known as BADCANDY across networks worldwide. The Australian Signals Directorate confirmed that over 150 IOS XE devices in Australia remained compromised as of late October 2025 despite ongoing remediation efforts. Investigations and remediation are continuing.
🔍 [Project] I built a Telegram bot for automated pentesting & recon — looking for feedback!

www.reddit.com · 9 months ago

A new Telegram-based pentest assistant named WebSecAnalyst Bot automates common reconnaissance and vulnerability checks including subdomain enumeration, directory brute-force of common paths, non-intrusive port scanning, SSL and security header analysis, WAF and CMS detection, and broken link and SEO audits. Scans are performed via controlled, rate-limited API calls and the project includes a credit system with Stripe integration offering a free daily scan. The developer is soliciting feedback from bug bounty hunters, pentesters, and web security researchers on accuracy, response clarity, desired features, and performance, and testers who provide useful feedback will receive free credits and early access to new features such as asynchronous scans and vulnerability checks. Users are reminded to run tests only on domains they own or have permission to test.
Cyber agencies produce ‘long overdue’ best practices for securing Microsoft Exchange Server

www.csoonline.com · 9 months ago

Cybersecurity agencies in the United States, Australia and Canada issued best practices for protecting on prem Microsoft Exchange Server after persistent threat activity and widespread outdated or misconfigured installations. The guidance highlights active threats including injected keyloggers and a high severity mixed deployment vulnerability tracked as CVE-2025-53786 that can allow privilege escalation, and it notes Microsoft Exchange Server Subscription Edition is the sole supported on prem version since October 14, 2025. Key recommendations include running the latest cumulative updates, enabling the Emergency Mitigation Service, establishing security baselines, hardening authentication and encryption, restricting administrative access to dedicated workstations, deploying malware and application control protections, and enabling HTTP Strict Transport Security and protections against header spoofing. Agencies also urge continuous monitoring, incident readiness and quarterly configuration reviews because patches and upgrades can change security settings and many deployments lack basic logging and endpoint defenses.
A.I. Is Making Death Threats Way More Realistic

www.nytimes.com · 9 months ago

Harassers are using synthetic images and audio to create realistic simulations of victims in violent situations. These multimodal deepfakes are being deployed as threats and intimidation, increasing victims psychological trauma and the risk of real world harm. Platforms and authorities are struggling to detect and remove such content, prompting calls for stronger detection tools, faster moderation, and clearer legal remedies.
University of Pennsylvania investigating offensive email sent through graduate school system

therecord.media · 9 months ago

The University of Pennsylvania is investigating a fraudulent email sent from an address tied to the Graduate School of Education that used offensive language and threatened to leak stolen university data, and the Office of Information Security says its Incident Response team is actively addressing the situation. The message accused the school of favoring unqualified affirmative action admits and referenced the Supreme Court’s 2023 ruling on race based admissions, echoing themes seen in recent cyberattacks on other universities. The university did not confirm a systems breach and urged recipients to disregard the message, delete it, and contact local IT support if they receive further concerning communications.
UNC6384 Targets European Diplomatic Entities With Windows Exploit

www.darkreading.com · 9 months ago

UNC6384, a China-linked threat actor, has been targeting European diplomatic entities in Hungary and Belgium since September and is expanding to Italy, the Netherlands and Serbia. The campaign begins with spear-phishing emails using fake European Commission and NATO-themed lures that deliver malicious LNK files which exploit the high-severity Windows vulnerability CVE-2025-9491 and run obfuscated PowerShell to deploy a malware chain. The malware chain culminates in deployment of the PlugX remote access Trojan, enabling command execution, persistence, keylogging and data exfiltration, and researchers warn success could lead to surveillance of diplomatic activities and theft of sensitive documents. Researchers recommend blocking the campaign command and control infrastructures, conducting endpoint searches for indicators of compromise, and continuing security awareness training to mitigate the threat.
Ribbon Communications Breach Marks Latest Telecom Attack

www.darkreading.com · 9 months ago

Nation state actors reportedly gained unauthorized access to the IT network of Ribbon Communications, with initial access traced to December 2024 and the intrusion discovered in early September 2025. Investigators found the intruders remained in the environment for months and accessed several customer files stored outside the main network on two laptops, affecting at least three smaller customers and four older files. Ribbon says it has terminated the unauthorized access, engaged third party cybersecurity experts and law enforcement, is hardening its networks, and to date has not found evidence that any material information was stolen.
FCC plans vote to remove cyber regulations installed after theft of Trump info from telecoms

therecord.media · 9 months ago

The FCC announced plans to rescind a January declaratory ruling that would have required telecommunications carriers to implement specific cybersecurity controls and submit annual certifications attesting to a cybersecurity risk management plan, calling the measure legally erroneous and unduly burdensome. The agency said carriers have taken voluntary steps and are subject to other cybersecurity requirements, and described the prior ruling as an ineffective response to the Salt Typhoon intrusions. Salt Typhoon was a China linked campaign that breached at least nine US telecom giants including Verizon, AT&T, T Mobile and Lumen, exfiltrated call detail records and in some cases intercepted audio and text from roughly 150 high profile targets. The FCC plans to vote to rescind the ruling at its November 20, 2025 open Commission meeting.
‘We got hacked’ emails threaten to leak University of Pennsylvania data

www.bleepingcomputer.com · 9 months ago

On October 31, 2025, the University of Pennsylvania experienced a security incident in which students and alumni received offensive emails sent from multiple Penn email addresses, including accounts tied to the Graduate School of Education. The messages claimed data had been stolen and criticized the university, and were sent via Penn's mailing list platform hosted on Salesforce Marketing Cloud, though investigators have not confirmed whether Penn's account on that service was compromised. Penn's Office of Information Security confirmed it was aware of the fraudulent messages, added a banner to the university website advising recipients to disregard or delete the emails, and said its incident response team is investigating.
Chinese hackers scanning, exploiting Cisco ASA firewalls used by governments worldwide

therecord.media · 9 months ago

China based hackers are scanning for and exploiting Cisco Adaptive Security Appliance firewalls used by governments and large organizations worldwide. Palo Alto Networks Unit 42 attributes the campaign to Storm 1849 and observed targeting of U.S. federal, state, and international government IP addresses during October 2025. CISA issued an emergency directive ordering federal civilian agencies to patch CVE-2025-30333 and CVE-2025-20362 after finding attackers chaining the two vulnerabilities to gain persistent access that survives reboots and system upgrades.
OpenAI Unveils Aardvark: GPT-5 Agent That Finds and Fixes Code Flaws Automatically

thehackernews.com · 9 months ago

OpenAI unveiled Aardvark, an agentic security researcher powered by GPT‑5 that continuously analyzes source code to produce threat models, detect vulnerabilities, validate exploitability in sandboxed environments, and propose patches for human review. The agent embeds into software development pipelines to monitor commits and changes, prioritize severity, and leverage OpenAI Codex for patch generation while routing requests to the most appropriate model for complex reasoning. Aardvark is in private beta and has reportedly helped identify at least ten CVEs in open source projects, joining other tools aimed at automating continuous code analysis and remediation.
Microsoft Edge gets scareware sensor for faster scam detection

www.bleepingcomputer.com · 9 months ago

Microsoft is introducing a new scareware sensor in Microsoft Edge to detect tech support and scareware scam pages more quickly and to prompt Defender SmartScreen to index and block them faster. The sensor works with Edge's local AI based scareware blocker to exit full screen, stop loud audio, show a warning and page thumbnail, and can notify SmartScreen immediately without sharing screenshots beyond what SmartScreen already receives, with plans to add more anonymous detection signals later. The feature is rolling out in Microsoft Edge 142, will be disabled by default, and Microsoft plans to enable it for users who have SmartScreen turned on starting in November 2025.
What should you do with a router the government is considering banning?

www.washingtonpost.com · 9 months ago

Multiple U.S. government agencies and departments are backing a proposed ban on future sales of TP-Link routers over national security concerns. Experts say most users need not immediately discard existing TP-Link devices but should prioritize routers that receive automatic firmware updates, check with their internet provider that firmware patches are being applied, and consider replacing routers that are four or five years old or older. Consumer advocates and former officials urge stronger industry standards and government requirements, including upfront disclosure of how long products will receive security updates, six months notice before updates end, and a government seal of approval for secure connected devices.
Nation-State Hackers Deploy New Airstalk Malware in Suspected Supply Chain Attack

thehackernews.com · 9 months ago

A suspected nation-state cluster tracked as CL-STA-1009 is distributing new malware called Airstalk that misuses the AirWatch API in Workspace ONE Unified Endpoint Management to create a covert command and control channel using custom device attributes and blob uploads. Airstalk appears in PowerShell and more capable.NET variants that capture screenshots and exfiltrate browser cookies, history, bookmarks and files, target enterprise browsers including Edge and Island, and in some samples use a likely stolen certificate to sign artifacts. The PowerShell variant achieves persistence via a scheduled task while some.NET samples lack scheduled persistence and show a June 28, 2024 compilation timestamp, and analysts warn the MDM-based C2 and enterprise browser targeting point to a probable supply chain attack against business process outsourcing providers.
Australia warns of BadCandy infections on unpatched Cisco devices

www.bleepingcomputer.com · 9 months ago

There are ongoing cyberattacks in Australia targeting unpatched Cisco IOS XE routers to install the BadCandy Lua webshell that allows remote attackers to execute commands with root privileges. The attacks exploit CVE-2023-20198, a max severity flaw that Cisco fixed in October 2023, and public exploit code released shortly after has fueled mass exploitation and backdoor planting. Australian Signals Directorate assessments say over 400 devices were potentially compromised since July 2025 with more than 150 still infected in late October 2025, and the agency is notifying victims and urging patching, hardening, and incident response because attackers can reintroduce the webshell after a reboot if the web interface remains accessible.
In Other News: WhatsApp Passkey-Encrypted Backups, Russia Targets Meduza Malware, New Mastercard Solution

www.securityweek.com · 9 months ago

There are more than 70 countries that recently signed the United Nations Convention against Cybercrime, while the United States has not signed and continues to review the treaty, and digital rights groups warn it could be exploited by authoritarian regimes. Security firms warned of a surge in NFC relay malware and detailed new Android threats, including GhostGrab which mixes covert cryptocurrency mining with data theft and Herodotus which mimics human behavior as a device takeover banking trojan, and Russian authorities announced arrests of individuals accused of developing the Meduza credential and wallet stealing malware. Mastercard unveiled a threat intelligence solution following its acquisition of Recorded Future to combat payment fraud, and WhatsApp announced passkey encrypted chat backups for Android and iOS that use lockscreen codes, face or fingerprint authentication with a gradual rollout planned.
CFPB ends probe into Meta’s financial data advertising practices

therecord.media · 9 months ago

There are reports that the Consumer Financial Protection Bureau has ended a probe into how Meta obtains and uses consumers' financial data for targeted advertising. The closure was disclosed in Meta's quarterly filing with the Securities and Exchange Commission and the agency notified Meta of the decision to close the investigation on September 25, 2025. The probe focused solely on advertising for financial products and services and the CFPB alleged the practices potentially violated the Consumer Financial Protection Act and could have led to legal action and penalties.
Sling TV settles with California for allegedly violating state consumer privacy law

therecord.media · 9 months ago

Sling TV will pay a five hundred thirty thousand dollar civil penalty to the state of California and agreed to simplify how consumers can opt out of the sale of their personal data after its practices were found to violate the California Consumer Privacy Act. The settlement requires the company to provide easier opt out mechanisms in apps and devices, give parents clearer disclosures and tools to limit data collection for children, and allow separate profiles and affirmative consent for users under sixteen. The enforcement followed an investigative sweep that found Sling TV combined cookie preferences with the CCPA opt out and buried an embedded webform that required users to reconfirm information to complete requests. The settlement is subject to court approval.
China-Linked Hackers Exploit Windows Shortcut Flaw to Target European Diplomats

thehackernews.com · 9 months ago

UNC6384 conducted a wave of attacks between September and October 2025 that targeted diplomatic organizations in Hungary, Belgium, Italy, and the Netherlands, and government agencies in Serbia. The campaign used spear phishing with embedded URLs to deliver malicious Windows shortcut LNK files that exploit ZDI CAN 25373 tracked as CVE-2025-9491 with a CVSS score of 7.0, triggering a multi stage chain that culminates in DLL side loading to deploy PlugX remote access malware. The LNK launches a PowerShell command to decode a TAR archive containing a legitimate Canon printer assistant binary that sideloads a malicious DLL named CanonStager which decrypts and runs an encrypted PlugX payload while displaying a decoy PDF. PlugX provides remote access capabilities including command execution, keylogging, file upload and download, registry persistence, and anti analysis measures, and observers reported a memory resident PlugX variant called SOGU.SEC, use of HTA files to load external JavaScript from cloud hosted storage, and CanonStager artifacts shrinking from about 700 kilobytes to 4 kilobytes indicating active development and a reduced forensic footprint.
Alleged Meduza Stealer malware admins arrested after hacking Russian org

www.bleepingcomputer.com · 9 months ago

Three individuals were arrested in Moscow who are believed to be the creators and operators of the Meduza Stealer information stealing malware, an action announced by Irina Volk of the Russian Ministry of Internal Affairs. Meduza is an infostealer sold under a malware as a service model that steals account credentials, cryptocurrency wallet data, and other information stored in web browsers, and it has been able since December 2023 to revive expired Chrome authentication cookies to facilitate account takeovers; researchers also link the same group to Aurora Stealer. Russian authorities say the suspects targeted an institution in Astrakhan in May, stealing confidential server data and prompting a criminal case under Part 2 Article 273 of the Russian Criminal Code, and investigators found the group also developed a botnet capable of disabling security protections while follow up operations continue to identify accomplices.
Attackers Exploit Windows Server Update Services Flaw to Steal Sensitive Organizational Data

gbhackers.com · 9 months ago

There is a critical remote code execution vulnerability in Windows Server Update Services tracked as CVE-2025-59287 that exploits unsafe deserialization of WSUS cookie and SOAP data to allow unauthenticated attackers to execute code as SYSTEM. Security researchers have observed active exploitation against internet exposed WSUS servers on default ports 8530 and 8531, with attackers harvesting sensitive organizational data and deploying infostealers and other post compromise tooling. Microsoft issued an out of band emergency update after the initial Patch Tuesday fix proved incomplete, and agencies including CISA have issued urgent guidance to patch or mitigate exposed WSUS instances.
China-Linked Tick Group Exploits Lanscope Zero-Day to Hijack Corporate Systems

thehackernews.com · 9 months ago

A critical vulnerability in Motex Lanscope Endpoint Manager is being actively exploited to execute arbitrary commands with SYSTEM privileges on on premise installations, tracked as CVE-2025-61932, and JPCERT/CC has confirmed abuse to drop a backdoor. The campaign has been attributed to the Tick cyber espionage group and observed delivering a backdoor called Gokcpdoor and using the Havoc post exploitation framework with DLL side loading and an OAED Loader to establish proxying, remote command execution, lateral movement and data exfiltration. Organizations are urged to apply Motex updates to patched Lanscope client versions and review internet facing Lanscope servers and detection agents to mitigate the threat.
Ukrainian Man Extradited From Ireland to US Over Conti Ransomware Charges

www.securityweek.com · 9 months ago

Oleksii Oleksiyovych Lytvynenko was extradited from Ireland to the United States after being arrested in July 2023 and held in custody while contesting extradition. U.S. authorities allege he was involved in Conti ransomware attacks from 2020 through June 2022 and continued cybercriminal activity until his 2023 arrest, and he faces charges in Tennessee including computer fraud conspiracy and wire fraud conspiracy with potential sentences of up to five years and up to twenty years respectively. The charges contend two Tennessee victims were extorted of more than five hundred thousand dollars in cryptocurrency and a third had data published, and FBI data show the Conti operation victimised over one thousand organisations and obtained at least one hundred fifty million dollars in ransom by January 2022.
Google Launches New AI Security Features on Android to Block Mobile Scams

gbhackers.com · 9 months ago

Google announced enhanced artificial intelligence protections on Android to block mobile scams affecting billions of users worldwide. The company reported that fraudsters stole over four hundred billion dollars globally in the past year using advanced AI powered schemes, prompting the new defenses. The Android updates add advanced fraud detection and prevention measures aimed at stopping AI enabled social engineering and reducing mobile financial losses.
CISA: High-severity Linux flaw now exploited by ransomware gangs

www.bleepingcomputer.com · 9 months ago

A high severity use after free privilege escalation flaw in the Linux kernel netfilter nftables component tracked as CVE-2024-1086 is being exploited in ransomware campaigns to escalate local access to root. The flaw was disclosed on January 31, 2024, was fixed via a January 2024 kernel commit, and traces back to a commit introduced in February 2014, affecting many distributions and kernel versions from 3.15 through 6.8-rc1. A public proof of concept exploit was published in late March 2024, and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and ordered federal agencies to remediate by June 20, 2024. Recommended mitigations include blocklisting nftables if it is not required, restricting access to user namespaces, or loading the Linux Kernel Runtime Guard module as a temporary defense.
Three suspected developers of Meduza Stealer malware arrested in Russia

therecord.media · 9 months ago

There are reports that Russian police detained three people in Moscow and its surrounding region suspected of developing and selling the Meduza Stealer malware, seizing computers, phones and bank cards and releasing a video of the raids. Meduza Stealer first appeared in 2023 and has been sold on Russian language hacking forums and Telegram channels to steal login credentials, cryptocurrency wallet data and other sensitive information, with infections observed in Russia and Poland and campaigns linked to Ukrainian government and military targets. Authorities say the suspects also created malware to disable antivirus protections and build botnets, they face up to four years in prison if convicted, and researchers note a shift in Moscow from passive tolerance to selective crackdowns on domestic cybercriminals.
Stolen Credentials Drive the Rise of Financially Motivated Cyberattacks

gbhackers.com · 9 months ago

FortiGuard Incident Response found that throughout the first half of 2025 financially motivated attackers increasingly abandoned malware heavy campaigns and instead simply logged in with stolen credentials and abused legitimate remote access to blend in with normal activity. Initial access frequently stemmed from credentials harvested via phishing or password reuse and sold by brokers, misuse of external remote services such as VPNs, and n day exploitation of public facing applications to install remote management tools. Once inside, operators deployed legitimate remote access and RMM tools including AnyDesk, Splashtop and Atera, moved laterally with RDP SMB and WinRM, exfiltrated data manually, and used credential theft tooling such as Mimikatz and Zerologon exploitation to escalate privileges. Investigations recommend shifting defenses to identity and behavior driven controls, enforcing multi factor authentication, monitoring and restricting remote access tooling, and focusing detection on anomalous account activity rather than only on endpoint malware.
Claude AI vulnerability exposes enterprise data through code interpreter exploit

www.csoonline.com · 9 months ago

A vulnerability in Anthropic's Claude AI lets attackers weaponize the code interpreter to silently exfiltrate enterprise data including chat histories, uploaded documents, and data accessed through integrated services. The exploit uses indirect prompt injection to get Claude to write sensitive data to a file in the code interpreter sandbox and then upload it to attacker controlled accounts by using the attacker ANTHROPICAPIKEY with the Files API, allowing up to 30 megabytes per file and no limit on the number of files. The attack bypasses safety controls by mixing malicious instructions with benign code and exploits a default network egress setting called Package managers only that nevertheless permits access to api.anthropic.com. The issue was disclosed to Anthropic on October 25, 2025 and was classified out of scope by the company, leaving mitigations limited to disabling network access, manually configuring domain allow lists, and monitoring or stopping execution while the researcher withheld full exploit code.
Open VSX Downplays Impact From GlassWorm Campaign

www.securityweek.com · 9 months ago

Open VSX says it fully contained the GlassWorm campaign that infected Visual Studio Code extensions on the Open VSX marketplace. On October 18 the campaign was reported to have distributed malicious extensions, estimated to have been downloaded nearly 36,000 times, with code hidden using Unicode variation selectors that could steal credentials, drain cryptocurrency wallets, deploy SOCKS proxy servers, and install hidden VNC servers. Open VSX says the malware was not a self replicating worm in the traditional sense because it could not autonomously propagate, and the team removed all malicious extensions and deemed the incident contained on October 21. The team revoked exposed tokens, introduced a token prefix format in collaboration with MSRC, shortened default token validity periods, improved revocation processes, and added automated security scanning of extensions.
Beware of Fake ChatGPT Apps That Spy on Users and Steal Sensitive Data

gbhackers.com · 9 months ago

There are hundreds of lookalike mobile apps claiming to provide ChatGPT, DALL E, and other AI services that appear in official app stores under polished branding. Security researchers report many of these fake apps spy on users, request excessive permissions, exfiltrate OpenAI API keys and personal files, install info stealing malware, or operate as fleeceware to coerce expensive subscriptions. Users are advised to access AI services only through official channels, verify developer details and permissions before installing, cancel unwanted subscriptions if already enrolled, and report suspicious apps to the app stores.
OpenAI launches Aardvark to detect and patch hidden bugs in code

www.csoonline.com · 9 months ago

OpenAI has unveiled Aardvark, a GPT 5 powered autonomous agent in private beta that mimics a human security researcher to scan, understand, and patch code by mapping repositories, building contextual threat models, and continuously monitoring commits. The agent validates exploitability in a sandbox before flagging issues, proposes patches via Codex, and reanalyzes fixes to ensure they do not introduce new problems, achieving ninety two percent detection of known and synthetic vulnerabilities in benchmark tests. Aardvark has already discovered multiple real world flaws in open source repositories, ten of which received official CVE identifiers, and OpenAI plans pro bono scanning for selected non commercial projects to help shift security left.
CISA Issues Advisory on XWiki Flaw Allowing Remote Code Execution

gbhackers.com · 9 months ago

CISA has added a critical vulnerability in XWiki Platform to its Known Exploited Vulnerabilities catalog. The flaw is an eval injection that can allow any guest to execute arbitrary remote code without authentication. This vulnerability presents a severe risk to organizations using the XWiki platform and requires urgent remediation.
Alleged Conti ransomware gang affiliate appears in Tennessee court after Ireland extradition

therecord.media · 9 months ago

Oleksii Oleksiyovych Lytvynenko, a Ukrainian national, was extradited from Ireland to the United States in October 2025 and appeared in a Tennessee federal court on allegations that he operated on behalf of the Conti ransomware gang. He was indicted in 2023 on computer fraud conspiracy and wire fraud conspiracy counts and faces a maximum penalty of 25 years in prison if convicted. U.S. authorities allege he deployed Conti ransomware from 2020 through June 2022, extorted about 500,000 dollars from two Tennessee victims, published stolen data from another organization, and helped carry out a conspiracy that sought approximately 150 million dollars in ransom payments. He was arrested in Cork, Ireland, in July 2023 and had been held pending extradition before being transferred to U.S. custody.
Windows zero-day actively exploited to spy on European diplomats

www.bleepingcomputer.com · 9 months ago

A China linked hacking group is exploiting a Windows zero day to spy on European diplomats in Hungary Belgium and other nations. Attackers use spearphishing to deliver malicious LNK shortcut files that exploit a high severity Windows LNK vulnerability tracked as CVE 2025 9491 to deploy the PlugX remote access trojan and maintain persistence. The campaign is attributed to UNC6384 and researchers warn Microsoft has not yet released a patch so defenders are advised to restrict or block.LNK files and block identified command and control infrastructure.