Blahalla

PureHVNC RAT Distributed via Weaponized Judicial Documents

gbhackers.com · 9 months ago

There is a phishing campaign that leverages judicial document themes to deliver a Hijackloader executable which subsequently deploys the PureHVNC remote access trojan, and this combination was observed for the first time against Spanish speaking users in Latin America. The infection chain commonly starts with a spoofed document preview or a malicious LNK file that executes PowerShell and a cascade of obfuscated stages including ZIP archives, DLL sideloading, HTA and script loaders, ultimately leading to PureHVNC execution. The activity was observed between August and October 2025 targeting likely Colombian recipients, uses Hijackloader as a modular loader with evasion and persistence, and recommended mitigations include enabling file extension display and careful scrutiny of downloads from cloud previews.
New ‘Gentlemen’ RaaS Appears on Hacking Forums, Targeting Windows, Linux and ESXi

gbhackers.com · 9 months ago

Threat intelligence researchers report a new ransomware as a service operation called The Gentlemen RaaS that is being actively advertised on underground hacking forums by an operator using the handle zeta88. The cross platform threat offers specialized encryption lockers for Windows, Linux, and ESXi and is written in both Go and C. Active recruitment and multi operating system tooling signal an evolution in ransomware capabilities that could increase risk for mixed enterprise environments.
Google Wear OS Flaw Lets Any App Send Texts on Behalf of Users

gbhackers.com · 9 months ago

A misconfiguration in Google Messages on Wear OS lets any installed app invoke ACTIONSENDTO intents using the sms, smsto, mms, or mmsto URI schemes to send SMS, MMS, or RCS messages on the user s behalf without requiring permissions, confirmation, or user interaction. The issue is tracked as CVE-2025-12080, was discovered by Gabriele Digregorio, and can be abused by benign looking apps or other intent triggers to silently transmit messages to arbitrary recipients, creating stealthy privacy and financial risks. A proof of concept was published and a fix was reported after disclosure, but users are advised to confirm their Wear OS device and Google Messages app have received the update.
Cybercriminals Launch Flood of Fake Forex Platforms to Harvest Logins

gbhackers.com · 9 months ago

Fraudulent investment platforms impersonating legitimate cryptocurrency and forex exchanges have surged across Asia, run by organized crime groups operating at unprecedented scale. These scams use social engineering, fake profit dashboards, and cloned exchange sites to harvest logins and trick victims into transferring funds to attacker controlled systems. The fraud ecosystem includes marketplaces that sell fake websites and targeting data, money laundering services, and scam centers that coerce people to run the operations, enabling massive crypto flows to illicit actors. Authorities have begun arrests and investigations, but victims continue to suffer large losses as platforms fabricate returns and freeze withdrawals.
Hackers Allegedly Leak HSBC USA Customer and Financial Information

gbhackers.com · 9 months ago

There are claims that a threat actor breached HSBC USA and posted an extensive customer database for sale on underground forums. The dataset allegedly contains full names, addresses, dates of birth, Social Security numbers, phone numbers, email addresses, bank account numbers, transaction histories, and stock order details, and researchers say a provided sample appears legitimate and recent. HSBC USA says it has found no indication that its systems or service providers were compromised and is investigating the claims. Security experts warn the exposed details could be used for identity theft, fraudulent account openings, spearphishing, social engineering, and could cause reputational and financial harm to clients.
Preparing for the Digital Battlefield of 2026: Ghost Identities, Poisoned Accounts, & AI Agent Havoc

thehackernews.com · 9 months ago

There are three critical identity based threats forecast to shape the cyber battlefield in 2026: agentic AI emerging as a powerful attack vector, large scale account poisoning in financial systems, and lingering ghost identities from historic breaches. Agentic AI tools that are granted routine privileges can be manipulated via the confused deputy problem to exfiltrate data, deploy code, or escalate privileges, so organizations are urged to treat AI agents as machine identities and enforce strict least privilege, context aware access controls, command filtering, and real time auditing. Account poisoning is expected to rise as attackers automate the insertion of fraudulent payees and billers, exploiting weak secrets management and high velocity automated changes, which requires tighter diligence and identity confidence checks for any automated financial modifications. Historic undetected compromises and privilege sprawl will surface as IAM programs modernize, making identity governance, identity graphing tools, least privilege, and zero trust fundamental defensive requirements.
Russian Hackers Target Ukrainian Organizations Using Stealthy Living-Off-the-Land Tactics

thehackernews.com · 9 months ago

Organizations in Ukraine were targeted by Russian origin threat actors aiming to siphon sensitive data and maintain persistent access, with a large business services organization compromised for two months and a local government entity for one week. The attackers favored living off the land tactics and dual use tools, deploying web shells such as LocalOlive to deliver next stage tools and using PowerShell and scheduled tasks to evade detection, perform memory dumps, and run backdoors. Observed activity included excluding the Downloads folder from Microsoft Defender scans, installing OpenSSH, modifying RDP settings, enumerating files and processes to harvest credentials, and attempting to access KeePass. A separate campaign abused a WinRAR path traversal vulnerability tracked as CVE 2025 8088 with a CVSS score of 8.8 to deliver HTA malware into Startup folders without additional user interaction.
New TEE.fail Exploit Steals Secrets from Intel & AMD DDR5 Trusted Environments

gbhackers.com · 9 months ago

Researchers have demonstrated an attack called TEE.fail that uses a DDR5 memory bus interposer to read encrypted DRAM traffic and extract cryptographic material, including ECDSA attestation keys from Intel TDX and keys from AMD SEV-SNP with Ciphertext Hiding, enabling forged attestation quotes and impersonation of confidential virtual machines. The attack is practical and inexpensive to build from off the shelf electronic components and portable logic analyzers, and it exploits deterministic memory encryption so identical plaintexts produce identical ciphertexts that can be matched and used to recover secrets. Consequences include breaking GPU confidential computing and compromising cloud and cryptocurrency services, and the primary mitigations advised are stronger physical security and service designs that assume possible TEE compromise since vendors consider interposer attacks out of scope.
BlueNoroff reemerges with new campaigns for crypto theft and espionage

www.csoonline.com · 9 months ago

North Korea aligned threat actor BlueNoroff, also known as APT38 and TA444, has resurfaced with two campaigns called GhostCall and GhostHire targeting executives, Web3 developers and blockchain professionals. The campaigns rely on social engineering via platforms such as Telegram and LinkedIn to send fake meeting invites or recruiter tasks that deliver multi stage modular malware to macOS and Windows hosts, with samples written in Go, Rust, Nim and AppleScript. GhostCall uses fake investor meetings to trick victims into installing malicious updates or plugins that deploy implants including DownTroy, CosmicDoor and Rootroy to harvest crypto wallet data, SSH keys and project credentials and exfiltrate sensitive files, while employing layered staging and dynamic command and control to hide activity. GhostHire uses fake job offers and coding challenges hosted on GitHub or shared via Telegram to deliver ZIP archives or repositories that execute reconnaissance modules and then fetch OS specific payloads to establish persistence and backdoors.
Ransomware-Attacke auf schwedischen Stromversorger

www.csoonline.com · 9 months ago

A ransomware group listed the Swedish state grid operator Svenska kraftnät as a victim on October 25, 2025, and threatened to publish roughly 280 gigabytes of stolen data. On October 26, Svenska kraftnät confirmed that attackers gained unauthorized access to certain sensitive information and said the intrusion affected an isolated external file transfer solution. Cem Göcgoren, head of information security, said investigations are ongoing, there is currently no indication the electricity grid itself was impacted, and the operator is working with police and national cybersecurity authorities. Svenska kraftnät, founded in 1992 and headquartered in Sundbyberg near Stockholm, operates about 16,000 kilometers of high voltage lines and maintains multiple cross border connections.
XWiki Vulnerability Exploited in Cryptocurrency Mining Operation

www.securityweek.com · 9 months ago

There is a critical vulnerability in the open source enterprise wiki XWiki being exploited to deploy a cryptocurrency miner, tracked as CVE-2025-24893 with a CVSS score of 9.8. The flaw allows unauthenticated remote code execution by sending a crafted request to the SolrSearch macro where improper sanitization of the text parameter in Groovy lets attackers inject code executed with web server privileges. The bug was reported in May 2024 and patched in June 2024 in XWiki versions 15.10.11, 16.4.1 and 16.5.0RC1, and proof of concept exploits have been available since early 2025. Observed attacks follow a two pass workflow that stages a downloader and then executes it roughly 20 minutes later, with traffic linked to an IP previously associated with malicious activity.
Ad and PR Giant Dentsu Says Hackers Stole Merkle Data

www.securityweek.com · 9 months ago

Japan based Dentsu disclosed that its subsidiary Merkle suffered a data breach after abnormal activity was detected on the Merkle network, and some systems were shut down in response. Attackers stole files that include information on suppliers, clients, and current and former employees, with compromised data believed to include personal contact details, salary information, bank and payroll data, and National Insurance numbers. Impacted individuals are being notified and offered free dark web monitoring, and Dentsu said its systems in Japan were not affected while a financial impact is expected but will be determined later. It is unclear whether the incident involved ransomware, and Dentsu said it has taken measures to prevent public disclosure of the stolen data which could suggest a ransom was paid, though no cybercrime group had claimed responsibility at the time of the report.
How EY's cloud went public. 4TB Time Bomb - Neo Security Labs

www.reddit.com · 9 months ago

A publicly accessible four terabyte SQL Server backup tied to ey.com was found exposed in an Azure storage bucket, containing full database contents including schemas, stored procedures, API keys, session tokens, and credentials. The discovery began with a HEAD request reporting a four terabyte Content-Length and inspection of the file magic bytes confirmed an unencrypted BAK SQL Server backup. Responsible disclosure to Ernst and Young prompted a professional incident response and full remediation within a week. The case demonstrates how cloud misconfigurations can expose terabytes of sensitive data to automated scanners in seconds and underscores the need for continuous external attack surface management to find and secure exposed backups and assets.
Docker Compose Flaw Lets Attackers Overwrite Arbitrary Files

gbhackers.com · 9 months ago

There is a path traversal vulnerability in Docker Compose that trusts path information embedded in remote OCI compose artifacts and can be abused to write or overwrite arbitrary files on the host. The flaw can be triggered via layer annotations such as com.docker.compose.extends and com.docker.compose.envfile and can be exploited even by running read only commands like docker compose ps or docker compose config, affecting Docker Desktop, standalone Compose binaries, CI CD runners, and cloud development environments. The issue is tracked as CVE-2025-62725 with a CVSS 4.0 score of 8.9 and was fixed in Docker Compose version 2.40.2 released on October 27, 2025, so users should upgrade promptly.
Massive Tata Motors Data Leak Exposes 70+ TB of Sensitive Information

gbhackers.com · 9 months ago

There was a catastrophic data exposure at Tata Motors revealing over seventy terabytes of sensitive information due to multiple security failures. Breaches discovered in 2023 involved exposed AWS credentials on public facing websites, encrypted keys that were easily decrypted, and a Tableau backdoor that required no authentication. The incident exposed vast internal data and highlights failures in credential management, encryption practices, and access control that enabled large scale data exfiltration.
Suspected Nation-State Threat Actor Uses New Airstalk Malware in a Supply Chain Attack

unit42.paloaltonetworks.com · 9 months ago

A new Windows based malware family named Airstalk is being used in a likely supply chain attack by a suspected nation state actor and is tracked as threat activity cluster CL-STA-1009. Airstalk is available in PowerShell and.NET variants, employs a multithreaded command and control protocol with versioning, and uses a likely stolen certificate to sign some samples. Both variants misuse the AirWatch mobile device management API now called Workspace ONE Unified Endpoint Management to establish a covert command and control channel by storing messages as device custom attributes and uploading blobs. The malware is designed to exfiltrate browser data including cookies browsing history bookmarks and screenshots, and the.NET variant targets Microsoft Edge and Island Browser in addition to Google Chrome.
'Living off the land' allowed Russia-linked group to breach Ukrainian entities this summer

therecord.media · 9 months ago

Suspected Russian hackers this summer breached two Ukrainian organizations, a large business services firm and a local government agency, using ordinary administrative tools to steal data while remaining largely undetected. Researchers say the intruders relied on living off the land tactics with minimal custom malware, deployed suspicious executables and PowerShell backdoors, and gained initial access by planting webshells on public facing servers likely via unpatched vulnerabilities. One of the webshells, known as Localolive, has been previously linked to Sandworm, and Ukrainian cyber authorities report over three thousand attacks in the first half of 2025.
CISA Issues Alert on Active Exploitation of Dassault Systèmes Security Flaws

gbhackers.com · 9 months ago

CISA has added critical vulnerabilities in Dassault Systèmes DELMIA Apriso to its Known Exploited Vulnerabilities catalog after observing active exploitation of the platform. The flaws include CVE-2025-5086, a deserialization of untrusted data vulnerability enabling remote code execution in DELMIA Apriso releases 2020 through 2025, CVE-2025-6204, a code injection vulnerability that can execute arbitrary code, and CVE-2025-6205, a missing authorization vulnerability that can grant privileged application access. Exploitation attempts have been observed delivering malicious SOAP requests with Base64 encoded and compressed.NET payloads and automated scanning activity has been traced to specific IPs, prompting CISA to direct federal agencies and customers to apply vendor mitigations or patches immediately.
Chrome to Turn HTTPS on by Default for Public Sites

www.securityweek.com · 9 months ago

Starting October 2026, Chrome will enable the Always Use Secure Connections setting by default for all public websites when Chrome 154 ships, and the browser will warn users and ask for explicit permission before navigating to sites that do not use HTTPS. The setting was introduced as an opt in feature in 2022 and tested on a small percentage of users in Chrome 141, and Google will enable it earlier in April 2026 in Chrome 147 for users who opt in to Enhanced Safe Browsing ahead of the full rollout. Google says HTTPS prevents attackers from hijacking navigation and exposing users to malware or social engineering, notes that more than ninety five percent of sites already use encrypted connections and that testing showed warnings on under three percent of navigations, and expects a local network access permission and site migrations to reduce warnings further.
10 NPM Packages That Automatically Run on Install and Steal Credentials

gbhackers.com · 9 months ago

There is a sophisticated supply chain attack involving ten malicious npm packages that execute automatically when installed and initiate a credential theft campaign targeting developers. The malicious packages use heavy obfuscation, social engineering, and cross platform techniques to harvest environment variables, authentication tokens, and wallet credentials from Windows, Linux, and macOS systems. The malware also incorporates surveillance capabilities such as keylogging, screen and webcam capture, and covert exfiltration channels, and developers are advised to remove affected packages, rotate credentials, and audit dependency chains.
We checked DHS’s videos of chaos and protests. Here’s what they leave out.

www.washingtonpost.com · 9 months ago

There are findings that official videos intended to show the success of recent immigration operations used footage filmed months earlier or thousands of miles away, with clips from Los Angeles, West Palm Beach, Nantucket, and Broadview presented as events in Washington DC, Portland, Memphis, and Chicago. At least six videos posted over three months mixed footage from unrelated operations and dates, sometimes removing watermarks or recropping images, and several clips have been viewed millions of times on social media. DHS did not dispute the errors and said they represented a small percentage of its posts, while critics warn that such misleading content can erode public trust and turn government channels into propaganda tools.
Is your perimeter having an identity crisis?

www.csoonline.com · 9 months ago

Organizations are facing an identity crisis as generative AI and large volumes of breached personal data enable convincing digital doppelgangers that can mimic executives and employees across email, voice, and text. Threat actors now use AI to craft hyper-personalized phishing, synthesize trust with voice cloning, and orchestrate multi-channel campaigns that exploit contextual awareness drawn from social and internal data. Defenses must shift from default trust to assuming compromise, emphasizing radical visibility across endpoints and networks, rapid detection and response, and phishing-resistant authentication such as FIDO2. Autonomous agentic AI can independently plan and execute adaptive multi-step attacks, so organizations must apply least privilege to AI agents, enforce strict guardrails and monitoring, keep human oversight, and regularly red team both infrastructure and autonomous systems.
10 npm Packages Caught Stealing Developer Credentials on Windows, macOS, and Linux

thehackernews.com · 9 months ago

Researchers discovered ten typosquatted npm packages uploaded on July 4, 2025 that collectively had about 9,900 downloads and were designed to deliver an information stealer targeting Windows, Linux, and macOS. Each package triggers a postinstall hook that spawns a new terminal window to run an obfuscated JavaScript payload, displays a fake CAPTCHA and authentic looking installation output while fingerprinting victims and downloading a 24 megabyte PyInstaller packaged information stealer. The malware uses four layers of obfuscation to hide its payload, extracts credentials from system keyrings, browsers, authentication services, SSH keys and configuration files, compresses findings into a ZIP archive and exfiltrates them to a remote server. The operation impersonated popular libraries including TypeScript, discord dot js, ethers dot js, nodemon, react router dom and zustand to increase the chance of developer installs.
CISA Warns of Exploited DELMIA Factory Software Vulnerabilities

www.securityweek.com · 9 months ago

CISA warned that two vulnerabilities in DELMIA Apriso factory software, tracked as CVE-2025-6204 and CVE-2025-6205, have been exploited in the wild and affect releases from 2020 through 2025. CVE-2025-6204 is a code injection bug with a CVSS score of 8.0 that can enable arbitrary code execution, and CVE-2025-6205 is a missing authorization flaw with a CVSS score of 9.1 that can be used to obtain privileged access, and researchers say the two can be chained to create high privilege accounts and place executables into web served directories. Dassault Systèmes released patches and advisories on August 4 and ProjectDiscovery published technical details on September 23, and CISA added the flaws to its Known Exploited Vulnerabilities list, directing federal agencies to patch them within three weeks under Binding Operational Directive 22-01. Organizations running DELMIA Apriso are advised to hunt for newly created privileged accounts and scan web accessible directories for executables and webshells to detect potential compromise.
Beast Ransomware Targets Active SMB Connections to Infect Entire Networks

gbhackers.com · 9 months ago

Beast is a Ransomware as a Service that evolved from the Monster strain and is engineered to automatically scan active Server Message Block ports to find and infect shared folders and other systems across enterprise networks. Before encrypting data the ransomware stops numerous backup and database services and deletes Windows shadow copies to frustrate recovery, while using modern ciphers such as ChaCha20 and elliptic curve cryptography and offering options that wrap encrypted files into passworded archives. Distribution often involves phishing lures and pairing with the Vidar infostealer to gain initial access, and the malware checks system locale and IP to avoid infecting systems in Commonwealth of Independent States countries. Operators operate a Tor hosted data leak site to carry out double extortion and the group has been observed targeting sectors such as manufacturing, healthcare, and construction with a concentration of victims in the United States.
XWiki Remote Code Execution Flaw Actively Weaponized for Coinmining

gbhackers.com · 9 months ago

A critical template injection vulnerability in XWiki is being actively exploited to deploy cryptocurrency mining malware on vulnerable installations, and the flaw is tracked as CVE-2025-24893. The issue allows unauthenticated remote code execution through the SolrSearch feed macro by injecting Groovy code, and security researchers captured concrete exploitation evidence using canary sensors. Organizations running unpatched XWiki versions are advised to upgrade to the patched releases to prevent compromise and to check systems for signs of coinminer deployment.
New Attack Targets DDR5 Memory to Steal Keys From Intel and AMD TEEs

www.securityweek.com · 9 months ago

Researchers from Purdue University and Georgia Institute of Technology disclosed a new attack method named TEE.fail that uses a soldered interposer between CPU and DDR5 memory to capture DRAM bus traffic and extract cryptographic keys. The technique can recover keys from Intel TDX and AMD SEV-SNP trusted execution environments and can also extract attestation keys used by Nvidia GPU confidential computing. The researchers published interposer schematics and said the device can be built for under one thousand dollars using off the shelf components, but the attack requires physical access to the target system. Intel and AMD issued advisories and noted that attacks requiring physical access are not considered within their products threat models.
Active Exploits Hit Dassault and XWiki — CISA Confirms Critical Flaws Under Attack

thehackernews.com · 9 months ago

There are active exploit campaigns targeting Dassault Systèmes DELMIA Apriso and XWiki, confirmed by the U.S. Cybersecurity and Infrastructure Security Agency and VulnCheck. The affected vulnerabilities include CVE-2025-6204, a code injection flaw rated CVSS 8.0, and CVE-2025-6205, a missing authorization flaw rated CVSS 9.1, both impacting DELMIA Apriso, and CVE-2025-24893 in XWiki, an eval or template injection that allows unauthenticated remote code execution via the SolrSearch endpoint. Observers report a two stage attack that first stages a downloader and later executes it to fetch and run a cryptocurrency miner while killing competing miners, and organizations are advised to apply vendor updates immediately with certain federal agencies required to remediate the DELMIA flaws by November 18, 2025.
Gunra Ransomware Targets Windows and Linux with Dual Encryption

gbhackers.com · 9 months ago

Gunra ransomware emerged in April 2025 and now targets both Windows and Linux environments, combining file encryption with data exfiltration to support double extortion. The Windows build appends an ENCRT extension and drops ransom notes, while the Linux ELF variant is stealthier, accepts runtime options for threads paths and extensions, and in some analyses contains cryptographic weaknesses that may permit recovery. The Linux variant supports up to 100 concurrent encryption threads, offers partial file encryption based on configurable ratios or limits, and uses a hybrid RSA plus ChaCha20 scheme with configurable key storage, enabling very fast and highly configurable attacks. Gunra has been linked to multiple victims across healthcare manufacturing technology and financial sectors and has documented incidents in South Korea, indicating rapid operational scaling since first being observed.
Cybersecurity Firms See Surge in AI-Powered Attacks Across Africa

www.darkreading.com · 9 months ago

AI driven phishing, deepfakes, and impersonation are surging across Africa as attackers test techniques against governments and enterprises, with deepfake related fraud nearly tripling over the past year and voice scams driving much of the growth. Phishing is the most common attack, and AI generated phishing campaigns achieve a 54 percent click through rate, roughly 4.5 times higher than traditional methods, while the use of synthetic identities to bypass verification has nearly tripled. Business email compromise is disproportionately successful in the region, accounting for 21 percent of successful attacks in Africa despite representing just 2 percent of observed threats globally, and more than 150 attacks have been linked to nation state actors in countries including Egypt, South Africa, and Ethiopia.
Microsoft Issues Alert on ASP.NET Flaw Allowing HTTP Request Smuggling Attacks

gbhackers.com · 9 months ago

Microsoft issued a critical security update on October 14, 2025 addressing a security feature bypass in ASP NET Core's Kestrel web server that could enable HTTP request smuggling, tracked as CVE 2025 55315 and rated 9.9 on the CVSS scale. Organizations running affected versions are urged to apply the provided patches immediately to mitigate potential exploitation.
Attacker Target VSCode Extension Marketplace, IDE Plugins Face Higher Supply Chain Attack Risks

www.reddit.com · 9 months ago

A dozen malicious Visual Studio Code extensions were discovered in the extension marketplace targeting developers and cryptocurrency users by delivering info stealers, cryptominers, and backdoor capabilities. These extensions fetched and executed external payloads such as PowerShell scripts, captured keystrokes and source files, and exfiltrated credentials, session cookies, and cryptocurrency wallet data. Some of the malicious packages were removed from the official marketplace but were quickly republished under new names or remained available on alternative registries, underscoring an ongoing supply chain risk for developer tooling.
New Atroposia RAT Uses Hidden Remote Desktop, Vulnerability Scanning and Advanced Persistence

gbhackers.com · 9 months ago

A new remote access trojan named Atroposia has appeared in underground marketplaces offering hidden remote desktop access, credential and cryptocurrency wallet theft, DNS hijacking, file system control, and a built in local vulnerability scanner that helps attackers prioritize exploits. The RAT communicates with encrypted command and control channels, can bypass User Account Control to escalate privileges, spawns an invisible remote desktop session that leaves victims unaware, and provides an operator control panel and plugin builder to enable modular post exploitation. Operators are selling Atroposia as a malware as a service with subscriptions around two hundred dollars per month, increasing the accessibility of sophisticated attack capabilities to low skill actors and elevating the risk to corporate environments.
Ethical Prompt Injection: Fighting Shadow AI with Its Own Weapon

gbhackers.com · 9 months ago

AI language models are transforming business operations at lightning speed. They help generate documents, summarize meetings, and accelerate decision making. Rapid adoption has led to employees using unapproved AI tools on personal devices, risking sensitive company information leaking into ungoverned spaces. Ethical prompt injection is proposed as a defensive technique to detect and mitigate shadow AI by leveraging prompts to expose or control unsanctioned AI use.
Atroposia malware kit lowers the bar for cybercrime — and raises the stakes for enterprise defenders

www.csoonline.com · 9 months ago

There is a turnkey plug and play remote access toolkit called Atroposia being marketed on underground forums for about two hundred dollars a month, five hundred for three months, or nine hundred for six months that dramatically lowers the skill barrier for cybercriminals. It runs primarily in memory with encrypted command channels and provides hidden remote desktop takeover, user account control bypass for privilege escalation and persistence, built in vulnerability scanning, credential theft, DNS hijacking, clipboard monitoring, and bulk exfiltration via a grabber that compresses targeted files into password protected archives. Defenders are advised to hunt for unexplained shadow remote desktop sessions, unexpected DNS record changes, local vulnerability scans, and unusual clipboard or file access activity, and to enforce multifactor authentication, restrict admin accounts, isolate endpoints, maintain rapid patching, and add behavioral and network layer monitoring.
Hacking India's largest automaker: Tata Motors

www.reddit.com · 9 months ago

Two exposed AWS key sets on public facing Tata Motors sites allowed access to hundreds of S3 buckets and more than 70 terabytes of sensitive data including customer databases, invoices, and internal reports. A client side decryptable AWS key in the FleetEdge service revealed a datalake with files dating back to 1996 and provided write access that could be used to modify websites or upload malicious content. A backdoor token mechanism in site code enabled logging into the company Tableau instance as any user without a password, including the server administrator, exposing dashboards, financial reports, and internal projects. An exposed Azuga API token on the test drive site granted access to fleet management data, and all four issues were reported to the national computer emergency response team and remediated after months of disclosure and AWS key rotation.
AI-Generated Code Poses Security, Bloat Challenges

www.darkreading.com · 9 months ago

Large language models are widely used to generate code and while developers report productivity gains, AI-generated code is amplifying existing flaws and expanding technical and security debt. Research from application security firms shows AI-produced code often contains known security flaws and tends to create duplicated, bloated, and brittle code that increases maintenance overhead. An analysis found the average developer checked in 75 percent more code since 2022, and Veracode reported that about 45 percent of AI-generated code had known vulnerabilities. The risks can be reduced by instituting processes, security guardrails, shift-left prevention, and prompting tools to review and optimize code, approaches that helped some teams achieve both higher throughput and lower instability.
Aisuru Botnet Shifts from DDoS to Residential Proxies

krebsonsecurity.com · 9 months ago

Aisuru, first identified in August 2024 and now estimated to have infected at least 700,000 Internet of Things devices, has been refocused from record smashing distributed denial of service attacks to renting compromised routers and cameras as residential proxies. Operators used Aisuru to launch DDoS attacks that reached 6.3 terabits per second in June and later demonstrated capabilities approaching 30 terabits per second, and outbound attacks exceeding one terabit per second from customer premise devices have disrupted ISPs and in some cases caused hardware failures. That shift, combined with a massive spike in available residential proxies driven by reseller ecosystems and SDKs that turn user devices into relays, is fueling large scale content scraping for artificial intelligence training and has prompted legal action such as Reddit's October 22 lawsuit against proxy providers while major proxy firms dispute the growth figures.
SVD-2025-1011: Third-Party Package Updates in Splunk Operator for Kubernetes Add-on - October 2025

advisory.splunk.com · 9 months ago

Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk Operator for Kubernetes Add-on version 3.0.0 and higher.
SVD-2025-1008: Third-Party Package Updates in Splunk AppDynamics Machine Agent - October 2025

advisory.splunk.com · 9 months ago

Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk AppDynamics Machine Agent version 25.7.0 and higher.
SVD-2025-1009: Third-Party Package Updates in Splunk AppDynamics Private Synthetic Agent - October 2025

advisory.splunk.com · 9 months ago

Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk AppDynamics Private Synthetic Agent version 25.7.0 and higher.
SVD-2025-1010: Third-Party Package Updates in Splunk AppDynamics Analytics Agent - October 2025

advisory.splunk.com · 9 months ago

Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk AppDynamics Analytics Agent version 25.7.0 and higher.
Bots, Bread and the Battle for the Web

unit42.paloaltonetworks.com · 9 months ago

There is a rise in AI powered malicious SEO that uses keyword stuffing, purchased backlinks, fake content, cloaking tools, content farms, and underground sellers to manipulate search rankings and bury legitimate sites. Threat actors can use AI to mass produce spam articles, create fake social accounts to build backlinks, and deploy AI tailored cloaking that deceives algorithms while remaining invisible to users. Recommended defenses include using AI to detect AI generated text and fake engagement, network level detection of link farms and coordinated bot activity, and proactive ecosystem monitoring with threat intelligence and pre release stress testing.
Advertising giant Dentsu reports data breach at subsidiary Merkle

www.bleepingcomputer.com · 9 months ago

Japanese advertising giant Dentsu disclosed that its U.S. subsidiary Merkle suffered a cybersecurity incident that exposed staff and client data, including bank and payroll details, salaries, National Insurance numbers, and personal contact information. Dentsu detected abnormal activity on part of Merkle's network, proactively took certain systems offline, reported the incident to relevant authorities, and engaged third party incident response services while investigating the scope and impact. The company stated that Japan based network systems were not impacted, the incident is expected to have some financial impact, and no ransomware group has claimed responsibility.
The AI Trust Paradox: Why Security Teams Fear Automated Remediation

www.darkreading.com · 9 months ago

Security teams are investing in AI to scale detection, prioritization, and automated remediation because human capacity cannot keep up with the explosion of vulnerabilities and automated attacks. There is a crisis of trust as practitioners fear opaque AI decisions and unintended consequences, so organizations limit automated fixes to low-risk areas and enforce human approval for critical actions. A recommended phased approach is to mandate explainability, move to supervised automation with human oversight, and then transition to policy driven autonomy where humans set guardrails and AI executes within them. The expected payoff is not headcount reduction but elevating human roles to orchestrate AI and focus on complex edge cases.
YouTube Ghost Network Utilizes Spooky Tactics to Target Users

www.darkreading.com · 9 months ago

Threat actors are compromising YouTube accounts and hijacking videos to distribute infostealers and loaders, with researchers uncovering more than 3,000 malicious videos. The operation has been active since 2021 and tripled its output in 2025, using coordinated roles such as video uploaders, post accounts, and interact accounts to generate likes and positive comments that create false trust. Content is tailored to gaming cheats and cracked software, notably targeting Roblox and pirated Adobe Photoshop, and victims are lured into downloading password protected archives that deliver families including Lumma, Rhadamanthys, StealC, RedLine, Phemedrone variants, and NodeJS loaders. Researchers warn the modular, resilient structure makes detection and disruption difficult and urge platform providers, security teams, and users to avoid unofficial downloads and follow proper cybersecurity hygiene.
Oracle EBS Attack Victims May Be More Numerous Than Expected

www.darkreading.com · 9 months ago

There are reports that numerous organizations including Schneider Electric, Pan American Silver, Cox Enterprises, Harvard University, and Envoy Air have been targeted in an extortion campaign tied to exploitation of Oracle E-Business Suite zero-day CVE-2025-61882. The flaw enables unauthenticated remote code execution against Oracle Concurrent Processing and has been actively exploited by actors linked to the CL0P extortion brand, with possible involvement from FIN11, resulting in data theft and public leak postings. Oracle has released emergency patches and indicators of compromise, and authorities including the FBI urged immediate patching of internet-facing EBS instances to prevent full compromise.
New TEE.Fail Side-Channel Attack Extracts Secrets from Intel and AMD DDR5 Secure Enclaves

thehackernews.com · 9 months ago

Researchers from Georgia Tech, Purdue University, and Synkhronix developed a side channel attack called TEE.Fail that can extract secrets from CPU trusted execution environments including Intel Software Guard Extensions, Trust Domain Extensions, and AMD Secure Encrypted Virtualization with Secure Nested Paging and Ciphertext Hiding. The technique relies on a physical interposition device assembled from off the shelf components costing under one thousand dollars to record DDR5 memory traffic, and it exploits deterministic AES XTS encryption to recover cryptographic material such as ECDSA attestation keys, OpenSSL private signing keys, and keys that can be used to undermine GPU confidential computing. There is no evidence of active exploitation in the wild, vendors say physical bus interposition is out of scope and are not planning mitigations, and researchers recommend expensive software countermeasures to mitigate the deterministic encryption weaknesses.
Qilin ransomware abuses WSL to run Linux encryptors in Windows

www.bleepingcomputer.com · 9 months ago

Qilin ransomware operators have been executing Linux ELF encryptors on Windows hosts by enabling or installing the Windows Subsystem for Linux and launching the encryptors within WSL, allowing Linux binaries to run natively on infected Windows machines and bypass many Windows focused security products. They have also used signed but vulnerable drivers, DLL sideloading, and tools that terminate or uninstall EDR to disable security software, and they deploy and run encryptors via remote management and file transfer tools such as Splashtop and WinSCP. The group, active since 2022 under the Qilin name, has attacked more than 700 victims across 62 countries this year and published over 40 new victims per month in the second half of 2025.
CISA warns of two more actively exploited Dassault vulnerabilities

www.bleepingcomputer.com · 9 months ago

There are two vulnerabilities in Dassault Systèmes DELMIA Apriso that are being actively exploited, a critical missing authorization flaw CVE-2025-6205 that can allow unauthenticated actors to remotely gain privileged access and a high severity code injection flaw CVE-2025-6204 that allows high privilege attackers to execute arbitrary code. Dassault patched both flaws in early August 2025 and confirmed they affect DELMIA Apriso releases 2020 through 2025. CISA added the two vulnerabilities to its Known Exploited Vulnerabilities Catalog and urged immediate patching while reminding federal agencies to comply with Binding Operational Directive 22-01 by November 18, 2025. CISA had earlier added a related critical remote code execution flaw CVE-2025-5086 to the catalog in September 2025.