Blahalla

New Herodotus Android malware fakes human typing to avoid detection

www.bleepingcomputer.com · 9 months ago

Herodotus is a new Android malware family offered as malware as a service and believed to be run by the same operators behind Brokewell, with early campaigns delivered via smishing against Italian and Brazilian users. The attack uses a custom dropper that opens Accessibility settings, tricks users with a fake loading overlay to obtain permission, and then interacts with the Android interface to tap, swipe, paste, type, capture screens, and steal SMS two factor codes. To evade behavior based detection, the malware includes a humanizer that injects random delays of approximately 0.3 to 3 seconds between text input events so typing mimics human cadence, and an admin panel lets operators configure SMS text, overlays, and data exfiltration. Users are advised to avoid installing APKs from outside official app stores, keep Play Protect enabled, and scrutinize or revoke Accessibility permissions for newly installed or untrusted apps.
Cybersicherheit ist größte Herausforderung für die Finanzbranche

www.csoonline.com · 9 months ago

Systemkritische Branchen wie die Finanzindustrie geraten immer häufiger ins Visier von Cyberkriminellen, die Anzahl der Angriffe hat sich seit 2021 etwa versechsfacht nach einer Umfrage von PPI unter 50 Banken und 53 Versicherungen. 64 Prozent der Befragten sehen Cyberattacken als größte Herausforderung, noch vor Digitalisierung und der Verschlechterung der Kreditqualität bei Banken beziehungsweise zunehmender Regulierung bei Versicherungen. Viele Institute haben Probleme mit Sensibilisierung und Erkennung: 68 Prozent der Banken und 49 Prozent der Versicherer finden es schwierig, bei Mitarbeitenden ein Bewusstsein für Cyberrisiken zu schaffen, und 56 Prozent geben an, dass ihnen die Echtzeiterkennung von Angriffen schwerfällt. Angriffe werden komplexer und zielen auf Schwachstellen in Systemen und Prozessen, wobei Schadsoftware am häufigsten genannt wird und die Unterbrechung von IT Systemen an zweiter Stelle steht, weshalb stärkere Cyberresilienz, bessere Governance, interne Kontrollen und Automatisierung empfohlen werden.
New GhostGrab Android Malware Silently Steals Banking Login Details and Intercept SMS for OTPs

gbhackers.com · 9 months ago

GhostGrab is a sophisticated Android malware family actively targeting mobile users with a dual monetization strategy that combines covert cryptocurrency mining and comprehensive financial data theft. It systematically harvests banking credentials, debit card details, and personal identification information and intercepts SMS messages to steal one time passwords. Analysis by CYFIRMA indicates the threat uses multiple capabilities to exfiltrate data and monetize infections.
BlueNoroff Shifts Tactics: Targets C-Suite and Managers with New Infiltration Methods

gbhackers.com · 9 months ago

There is a shift in BlueNoroff tactics toward targeting C level executives, managers, and blockchain developers with more sophisticated infiltration methods. Two campaigns named GhostCall and GhostHire use impersonation on platforms such as Telegram and fake meeting or recruitment sites to stage deepfake or staged video calls and trick victims into running malicious updates or GitHub repositories, leading to system compromise. Operators deploy multi stage execution chains and customized payloads including crypto stealers and credential stealers while leveraging generative AI to accelerate malware development and expand operations against Web3 and cryptocurrency targets across multiple countries.
Critical QNAP .NET Flaw Lets Attackers Bypass Security Protections

gbhackers.com · 9 months ago

There is a critical flaw in Microsoft ASP.NET Core that enables HTTP request smuggling and is tracked as CVE-2025-55315. The vulnerability can be present in systems running QNAP NetBak PC Agent because the agent installs or depends on ASP.NET Core, allowing attackers to bypass security controls, gain unauthorized access, modify data or files, and potentially cause denial of service. QNAP and security vendors advise applying Microsoft ASP.NET Core patches, reinstalling or updating NetBak PC Agent to obtain the patched runtime, and prioritizing updates or redeployments for externally reachable services and applications.
404 to arbitrary file read in WSO2 API Manager (CVE-2025-2905)

www.reddit.com · 9 months ago

There is an XML External Entity vulnerability in the WSO2 API Manager gateway that allows unauthenticated remote attackers to read files from the server and to cause denial of service. The issue is tracked as CVE-2025-2905, has been assigned a critical CVSS v3.1 base score around 9.1, and affects WSO2 API Manager versions 2.0.0 and earlier. On systems running JDK 7 or early JDK 8 full file contents may be exposed while later JDK 8 and newer typically allow only the first line to be read, and operators are advised to apply vendor patches or upgrade to fixed versions such as 2.1.0 to mitigate the flaw.
Chrome Zero-Day Exploited to Deliver Italian Memento Labs' LeetAgent Spyware

thehackernews.com · 9 months ago

There was a zero day in Google Chrome that was exploited to deliver an espionage tool called LeetAgent developed by Italian provider Memento Labs, the flaw being CVE-2025-2783 with a CVSS score of 8.3. Attackers used targeted spear phishing with personalized short lived links to a forum that, when opened in Chrome or Chromium based browsers, triggered the sandbox escape to achieve remote code execution and drop a loader that launched LeetAgent against media, universities, research centers, government bodies, and financial institutions in Russia and Belarus. LeetAgent communicates with an HTTPS command and control server to run commands, execute processes, read and write files, inject shellcode, and harvest documents, and in several incidents directly launched or handed off to the more sophisticated Dante spyware, showing shared tradecraft and code overlaps.
Sweden’s Power Grid Operator Admits Data Breach Linked to Everest Ransomware Gang

gbhackers.com · 9 months ago

Svenska kraftnät confirmed on October 26, 2025 that it suffered a significant data breach that exposed certain information to unauthorized parties. The incident has been linked to the Everest ransomware gang. The breach is part of a wider wave of cyberattacks targeting critical infrastructure operators across Europe.
Water Saci Hackers Use WhatsApp to Deploy Persistent SORVEPOTEL Malware

gbhackers.com · 9 months ago

Researchers identified a self propagating campaign called Water Saci that delivers the SORVEPOTEL trojan via phishing ZIP attachments on WhatsApp, with 477 reported infections of which 457 occurred in Brazil. Infection starts with a ZIP containing a disguised LNK that launches PowerShell and batch scripts to download payloads, copy persistence scripts into the Windows Startup folder, and load a.NET infostealer that can create full screen overlay phishing interfaces to harvest banking credentials. SORVEPOTEL hijacks active WhatsApp Web sessions by dropping Selenium and a matching Chromedriver plus a JavaScript bundle to automate sending the same malicious ZIP to all contacts and groups, enabling rapid automatic spread and often causing accounts to be disabled for spamming.
Crafting self masking functions using LLVM

www.reddit.com · 9 months ago

There is a technique to customize LLVM and Clang so compiled binaries contain selected user functions that remain XOR masked at runtime and are unmasked only when invoked via injected prologue, epilogue, and a central masking handler. The build adds two custom PE sections.funcmeta to store an XOR key and per-function metadata registered via a REGISTERFUNCTION macro and REG naming convention, and.stub containing startup shellcode and an initialization phase that computes function sizes. The prologue and epilogue preserve calling convention and nonvolatile registers, communicate target addresses and initialization state via TEB.UserReserved slots, and the handler uses VirtualProtect plus XOR encode/decode to mask and unmask function bodies without altering original control flow or argument handling.
Unterstützung für Dobrindts Pläne zu aktiver Cyberabwehr

www.csoonline.com · 9 months ago

There is cross-party support for Interior Minister Alexander Dobrindt's plan to introduce a law enabling active cyber defense against attacks when attackers' servers are located abroad. A government spokesperson said active cyber defense would use technical measures to manipulate or disrupt the information technology systems or data traffic used in an attack to stop or mitigate it. The proposal is explicitly distinguished from broad digital retaliation against an adversary's entire IT infrastructure and the government rejects the imprecise notion of hackback as potentially unlawful. Dobrindt is preparing the legislative change and intends to present it to the cabinet in the coming year.
WSO2 #2: The many ways to bypass authentication in WSO2 products (CVE-2025-9152, CVE-2025-10611, CVE-2025-9804)

www.reddit.com · 9 months ago

NULL
Do CISOs need to rethink service provider risk?

www.csoonline.com · 9 months ago

Nearly half of organizations reported a cyberattack or data breach involving a third party in the 12 months to mid 2025, and increasing reliance on service providers for cloud infrastructure, managed security, data platforms, and AI is expanding exposure. Vetting processes have become more complex and now require comprehensive evaluations of leadership, governance, data protection, vulnerability management, incident response, resilience, service level agreements, and contractual obligations, sometimes taking many months for projects such as managing a Snowflake environment. Experts say effective third party risk management depends on dialogue, transparency, and shared responsibility rather than checkbox questionnaires, and they recommend focused questions on leadership accountability, framework alignment, testing and assurance, and continuous improvement. Generative AI both increases vendor risk and offers new ways to assess providers, leading organizations to add AI governance to evaluations and to monitor emerging certifications such as ISO 42001.
CISA Alerts on Critical Veeder-Root Flaws Allowing Attackers to Execute System Commands

gbhackers.com · 9 months ago

There is a critical CISA alert warning of serious vulnerabilities in the Veeder-Root TLS4B Automatic Tank Gauge system deployed worldwide in the energy sector. One vulnerability tracked as CVE-2025-58428 enables authenticated attackers to exploit the system SOAP web services handler to execute system level commands, gain a full shell, and move laterally within networks. A second vulnerability tracked as CVE-2025-55067 stems from improper handling of Unix time values that will trigger on the 2038 epoch rollover and can cause denial of service, administrative lockout, and corrupted logs. CISA recommends applying vendor mitigations and updates for affected TLS4B versions prior to 11.A to reduce the risk of exploitation.
Gamaredon Phishing Campaign Exploits WinRAR Vulnerability to Target Government Agencies

gbhackers.com · 9 months ago

Researchers uncovered a sophisticated Gamaredon phishing campaign targeting government entities that leverages a critical WinRAR path traversal vulnerability identified as CVE-2025-8088. The attackers deliver weaponized RAR archives that exploit the vulnerability to extract and execute malicious payloads silently, requiring little or no user interaction beyond opening the archive. The path traversal flaw enables files to be placed outside expected directories, allowing covert deployment of malware to compromised systems.
Apache Tomcat Flaws Allow Remote Code Execution on Vulnerable Servers

gbhackers.com · 9 months ago

Two vulnerabilities were disclosed in Apache Tomcat that affect versions across Tomcat 9, 10, and 11 and include a remote code execution condition when the default servlet is write enabled on case insensitive file systems. The flaws are tracked as CVE-2024-50379 and CVE-2024-56337, with CVE-2024-56337 resulting from an incomplete mitigation for CVE-2024-50379 and both capable of enabling remote code execution under the specified conditions. Administrators are urged to upgrade to fixed releases such as Tomcat 11.0.2, 10.1.34, or 9.0.98 or later and, where the default servlet must be write enabled on case-insensitive systems, to follow the advisories which include setting the sun.io.useCanonCaches property appropriately for the Java version in use.
Beware of Free Video Game Cheats that Deliver Infostealer Malwares

gbhackers.com · 9 months ago

Cybercriminals are distributing free game cheats that actually deliver infostealer malware which harvests usernames, passwords, cookies, payment data and cryptocurrency wallet information. The infections are spread via YouTube videos, Discord links and repositories that host password protected archives or fake installers which can disable or bypass security protections and maintain persistence on victims systems. Researchers warn the campaigns sometimes pressure users to disable antivirus or recruit friends to install the tools, and recommend avoiding unofficial cheats, enabling two factor authentication, changing compromised passwords and keeping security software up to date.
OpenAI Atlas Browser Vulnerability Lets Attackers Execute Malicious Scripts in ChatGPT

gbhackers.com · 9 months ago

A critical vulnerability in OpenAI's ChatGPT Atlas browser allows attackers to use a cross site request forgery to inject hidden instructions into ChatGPT's persistent memory and trigger remote code execution. The flaw can impact ChatGPT users on any browser but is especially hazardous for Atlas because users are typically logged in by default and Atlas lacks effective anti phishing protections, making testers find it up to ninety percent more exposed than mainstream browsers. Once an account's memory is tainted the malicious instructions persist across devices and sessions and can cause malware installation, privilege escalation, or data exfiltration when invoked by ordinary prompts. Researchers demonstrated a proof of concept targeting collaborative vibe coding, reported the issue to OpenAI, and withheld technical details to prevent replication.
SideWinder Adopts New ClickOnce-Based Attack Chain Targeting South Asian Diplomats

thehackernews.com · 9 months ago

A European embassy in New Delhi and organizations in Sri Lanka Pakistan and Bangladesh were targeted by the SideWinder threat actor in spear phishing campaigns conducted in four waves from March through September 2025. The campaigns used malicious PDF and Microsoft Word lures that prompt victims to install what appears to be Adobe Reader, triggering a ClickOnce application that sideloads a malicious DLL which decrypts and launches a.NET loader named ModuleInstaller. ModuleInstaller downloads next stage payloads including the StealerBot implant which can open reverse shells and harvest screenshots keystrokes passwords and files, while the attackers used signed legitimate binaries region locked C2 servers and dynamically generated payload paths to evade detection and analysis.
Last Week in Security (LWiS) - 2025-10-27

blog.badsectorlabs.com · 9 months ago

A weekly security roundup covering October 20 to October 27 2025 highlights high profile incidents including widespread WSUS attacks and an F5 security incident with alleged long term access and stolen source code, alongside reporting on an ex L3Harris executive accused of selling trade secrets. Researchers published tools and exploits such as a WSUS exploit proof of concept tied to CVE-2025-59287 and related defensive honeypots, and DumpGuard which extracts NTLMv1 hashes from modern Windows sessions. Technical write ups and tooling emphasized GitLab to cloud pivot techniques via permissive runners, Function Peekaboo for temporally self masking functions using LLVM, and multiple other offensive and defensive research releases.
'Jingle Thief' Highlights Retail Cyber Threats

www.darkreading.com · 9 months ago

A Morocco based cybercrime group dubbed Jingle Thief is running a large scale gift card fraud campaign that targets global retailers and consumer services by using stolen Microsoft 365 credentials to operate within cloud environments and generate high value gift cards for resale. The attackers start with tailored phishing and smishing to harvest credentials, then search SharePoint and OneDrive for gift card workflows, use internal phishing to escalate privileges, and exploit Microsoft Entra ID self service features to register rogue authenticator apps and enroll attacker controlled devices for long term persistence. Researchers observed intrusions where attackers remained undetected for ten months and compromised more than 60 employee accounts, and investigators warn that gift card systems are often inadequately protected and widely accessible internally making such identity based attacks easy to monetize. Recommended defenses include moving to phishing resistant authentication such as passkeys or secure password storage, enforcing multifactor authentication and privileged access management, and running regular employee awareness training to counter increasingly realistic phishing and AI enabled social engineering.
Google disputes false claims of massive Gmail data breach

www.bleepingcomputer.com · 9 months ago

There are claims that a collection of 183 million compromised credentials included Gmail accounts, but Google says Gmail did not suffer a breach and that users remain protected. The dataset was a compilation of information stolen by infostealer malware, data breaches, credential stuffing, and phishing across thousands of sites, with Have I Been Pwned reporting that 91 percent of the 183 million credentials had been previously seen and about 16.4 million addresses were previously unseen. Companies use such collections to warn affected users and force password resets, and anyone listed should run an antivirus scan and immediately change their passwords.
Memento Spyware Tied to Chrome Zero-Day Attacks

www.darkreading.com · 9 months ago

A zero-day vulnerability in Google's Chrome browser was exploited earlier this year by commercial spyware from Memento Labs and is tracked as CVE-2025-2783. Kaspersky Lab researchers found the exploit enabled a Chrome sandbox escape by abusing Windows pseudo handles and the Duplicate Handle API, allowing sandbox functionality to be disabled without obvious malicious actions. The exploit was used in a nation-state campaign called Operation ForumTroll against government and private sector targets in Russia and Belarus, and deeper analysis linked a heavily obfuscated spyware product named Dante from Memento Labs to attacks dating back to 2022, prompting warnings that similar flaws may exist in other Windows services.
X: Re-enroll 2FA security keys by November 10 or get locked out

www.bleepingcomputer.com · 9 months ago

X warns users to re enroll security keys or passkeys for two factor authentication by November 10, 2025 or they will be locked out of their accounts until they do so. This affects only users who use passkeys or hardware security keys such as YubiKeys because the keys are tied to the legacy twitter domain and will stop working after the company completes its domain migration. Users can re enroll an existing key or enroll a new one through their account login verification settings, and enrolling a new key will cause other keys to stop working unless they are also re enrolled; the process requires entering the account password. After November 10, locked accounts can regain access only by re enrolling a key, switching to another two factor method such as an authenticator app, or disabling two factor authentication.
Ransomware profits drop as victims stop paying hackers

www.bleepingcomputer.com · 9 months ago

Ransomware payment rates hit a new low with just twenty three percent of breached companies paying extortion demands in the third quarter of 2025. Data exfiltration was involved in more than seventy six percent of observed attacks, and incidents that only stole data without encrypting it had a record low payment rate of nineteen percent. Average and median ransom payments fell to three hundred seventy seven thousand dollars and one hundred forty thousand dollars respectively, while threat groups such as Akira and Qilin accounted for forty four percent of recorded attacks and shifted focus to medium sized firms. Attackers increasingly rely on remote access compromise and software vulnerabilities for initial access and are pursuing greater precision through social engineering and insider recruitment as ransomware profits decline.
Sweden’s power grid operator confirms data breach claimed by ransomware gang

therecord.media · 9 months ago

Sweden's state-owned grid operator Svenska kraftnät is investigating a data breach after a ransomware group threatened to leak hundreds of gigabytes of purportedly stolen internal data. Svenska kraftnät said the incident affected a limited external file transfer solution, that mission-critical systems and the electricity supply have not been affected, and that it has taken immediate action while working with police and national cybersecurity authorities. Ransomware group Everest claimed responsibility on its leak site and alleged about 280 gigabytes of exfiltrated data, saying it would publish the files unless demands were met, though those claims could not be independently verified.
Attackers Sell Turnkey Remote Access Trojan 'Atroposia'

www.darkreading.com · 9 months ago

Atroposia is a modular remote access Trojan being sold on underground forums as a turnkey RAT offering encrypted command channels, an invisible remote desktop capability, credential and cryptocurrency theft, DNS hijacking, vulnerability scanning, persistence, user account control bypass, and clipboard access. Operators sell the malware and its control panel for approximately two hundred dollars per month, five hundred dollars per three months, or nine hundred dollars per six months, and delivery methods include phishing, malicious websites, exploitation of unpatched software, or post compromise installation. Defenders are advised to maintain strong anti phishing hygiene, patch systems, harden email, enforce multifactor authentication, and strengthen endpoint and data security visibility to detect stealthy activity such as invisible remote sessions and fileless bulk exfiltration.
Windows will soon prompt for memory scans after BSOD crashes

www.bleepingcomputer.com · 9 months ago

There is a new Windows 11 feature being tested that prompts users to run a memory scan when signing in after a blue screen of death caused by a bugcheck. The notifications appear after a bugcheck and are designed to proactively detect and mitigate memory issues that could lead to system instability. If the user accepts, the system schedules a Windows Memory Diagnostic to run at the next reboot, a process Microsoft says takes five minutes or less on average and will display a notification after reboot if an issue was found. The feature is not available on ARM64 devices or on systems with Administrator Protection or BitLocker without Secure Boot and is currently rolling out to Windows Insiders in the Dev and Beta channels with Windows 11 Insider Preview Build 26220.6982 and Build 26120.6982 associated with KB5067109, while Microsoft plans to refine which bugcheck codes trigger the prompt.
Italian-made spyware spotted in breaches of Russian, Belarusian systems

therecord.media · 9 months ago

Dante spyware developed by Memento Labs was identified in attacks against organizations in Russia and Belarus linked to a hacking group known as ForumTroll. The discovery grew out of investigations into phishing campaigns that used malicious links exploiting a zero day in Google Chrome tracked as CVE-2025-2783, which has been patched. The campaigns targeted media outlets, universities, research centers, government institutions, and financial organizations, and at times used a custom loader called LeetAgent to deliver more advanced Dante capabilities. Researchers reported no evidence of active Dante infections among their customers and said it remains unclear who commissioned the operations or whether Memento Labs knew of the deployments.
Cities reverse course on automated license plate reader cameras amid privacy concerns

therecord.media · 9 months ago

Cities including Cambridge, Eugene, Austin and Evanston have paused, disabled, or ended contracts for Flock Safety automated license plate reader cameras after reports that the company shared license plate data from local partners with federal immigration authorities. Officials cited an Illinois state audit and the company's admission that it failed to establish distinct permissions and protocols to prevent outside access, while councilors and residents raised concerns about broad surveillance, AI tracking of travel patterns, reproductive privacy, and immigration enforcement. Some police departments defended the cameras as critical investigative tools in cases such as burglaries, and cities are reviewing contracts and data practices to decide whether to permanently end partnerships.
QNAP warns of critical ASP.NET flaw in its Windows backup software

www.bleepingcomputer.com · 9 months ago

There is a critical ASP.NET Core vulnerability tracked as CVE-2025-55315 in the Kestrel ASP.NET Core web server that allows low privilege attackers to hijack other users' credentials or bypass front-end security controls via HTTP request smuggling. QNAP warned that its NetBak PC Agent for Windows may contain affected ASP.NET Core components because the installer depends on those runtimes, putting unpatched systems at risk. Successful exploitation could let attackers log in as another user, bypass CSRF checks, perform injection attacks, access or modify sensitive data, or cause limited denial of service. Users are advised to reinstall NetBak PC Agent to obtain updated runtime components or manually install the latest ASP.NET Core Runtime Hosting Bundle and ensure all Microsoft updates are applied.
Italian spyware vendor linked to Chrome zero-day attacks

www.bleepingcomputer.com · 9 months ago

A Chrome sandbox escape zero day tracked as CVE-2025-2783 was used in Operation ForumTroll to deliver malware linked to the Italian spyware vendor Memento Labs. The campaign used personalized Primakov Readings invitations to redirect targets to a malicious site where a loader installed a DLL that decrypted a modular spyware called LeetAgent and in some cases introduced Dante spyware attributed to Memento Labs and the legacy of Hacking Team. Google patched CVE-2025-2783 in Chrome version 134.0.6998.178 and Mozilla addressed a related issue tracked as CVE-2025-2857 in Firefox version 136.0.4.
X Warns Users With Security Keys to Re-Enroll Before November 10 to Avoid Lockouts

thehackernews.com · 9 months ago

X is urging users who enrolled in two factor authentication using passkeys or hardware security keys to re enroll their security key by November 10, 2025 to avoid being locked out. After that date accounts without a re enrolled key will be locked until the user re enrolls, chooses a different two factor method, or elects to stop using two factor authentication. Re enrollment is required because keys are currently tied to the old Twitter domain and must be associated with X, the change does not affect users who use authenticator apps, and the setup requires deleting existing keys, confirming a password and email code, inserting the hardware key and touching it.
Qilin Targets Windows Hosts With Linux-Based Ransomware

www.darkreading.com · 9 months ago

Qilin deployed a Linux based ransomware binary on Windows hosts by abusing legitimate remote management and file transfer tools including AnyDesk, ATERA remote monitoring and management, WinSCP, ScreenConnect, and Splashtop to evade Windows centric endpoint detections. Attackers targeted Veeam backup infrastructure to harvest credentials, delivered an infostealer through convincing fake CAPTCHA pages hosted on Cloudflare R2, bypassed multifactor authentication using harvested tokens and sessions, and used a bring your own vulnerable driver technique to neutralize endpoint defenses. Qilin is a Russian speaking ransomware as a service group that emerged in July 2022, has affected more than seven hundred organizations across sixty two countries since January with most victims in the United States, France, Canada, and the United Kingdom, and has formed an alliance with LockBit and DragonForce. Defensive recommendations include restricting and monitoring remote access and RMM tools, hardening backup infrastructure and credential protections, extending EDR and SOC telemetry to cover both Windows and Linux, and enforcing phishing resistant multifactor authentication.
What we’ve learned from scanning thousands of smart contracts with SolidityScan

www.reddit.com · 9 months ago

There are recurring vulnerability patterns in Ethereum smart contracts identified after scanning thousands with an automated tool, with reentrancy ranking highest. Access control flaws, unchecked external calls, and unsafe proxy upgrade logic are increasing in frequency and pose significant risk even among experienced development teams. Automated analysis can find many of these issues, but effective security still relies on developer habits, thorough testing, and a strong review culture.
Louvre Jewel Heist

www.schneier.com · 9 months ago

Four thieves disguised as maintenance workers used a lift to reach a second floor window, employed power tools including angle grinders to breach display cases, and completed the raid in about seven minutes before fleeing on motorbikes. Significant security lapses were exposed: the Apollo Gallery exterior wall lacked active camera coverage, at least one outdoor camera was angled away from the only entry point so there is no usable surveillance footage of the break in, and guards were reported to be protecting visitors rather than valuables. Eight historic pieces from the French crown jewels were stolen, losses were estimated at about eighty eight million euros with one crown later recovered damaged, and the robbery has prompted a criminal investigation and urgent government and museum reviews of security.
Hackers Target 81% of Routers with Default Admin Passwords

gbhackers.com · 9 months ago

There are alarming findings from a 2025 router security survey showing that 81 percent of respondents have not changed their router administrator password, leaving devices vulnerable to takeover. The survey of 3,242 users found 47 percent have never adjusted factory settings, 73 percent do not know why they should change their settings, and 79 percent know how to change settings, indicating an awareness action gap. Researchers warn that leaving default credentials and neglecting firmware updates exposes home networks and connected devices to automated attacks and recommend immediately updating admin and Wi Fi passwords and installing firmware updates.
New ChatGPT Atlas Browser Exploit Lets Attackers Plant Persistent Hidden Commands

thehackernews.com · 9 months ago

There is a newly discovered vulnerability in OpenAI ChatGPT Atlas browser that can let attackers inject hidden instructions into the assistant s persistent memory and execute arbitrary code on affected systems. The exploit uses a cross site request forgery to write tainted memories that persist across sessions and devices, enabling code fetches, privilege escalation, and data exfiltration when legitimate prompts later invoke the corrupted memory. Researchers warn Atlas lacks robust anti phishing controls and detected only about five point eight percent of malicious web pages in tests, and that users must explicitly delete tainted memories in settings to remove the threat.
The State of Exposure Management in 2025: Insights From 3,000+ Organizations

www.bleepingcomputer.com · 9 months ago

In 2025 organizations face expanding attack surfaces from shadow IT, supply chain risk, and sprawling cloud infrastructure while generative AI is accelerating attacks and enabling adversaries to weaponize older vulnerabilities and back catalog CVE entries. Data from more than three thousand small and midsize businesses shows the average number of critical vulnerabilities per organization remained steady but high severity issues rose by about twenty percent year on year, increasing pressure on understaffed security teams. Despite the squeeze, remediation improved: eighty nine percent of resolved critical vulnerabilities were fixed within thirty days, up from seventy five percent in 2024, and small and mid sized firms cut average time to fix critical flaws to about fourteen and seventeen days respectively.
Critical Chrome 0-Day Under Attack: Mem3nt0 Mori Hackers Actively Exploiting Vulnerability

gbhackers.com · 9 months ago

In March 2025 a sophisticated espionage campaign dubbed Operation ForumTroll used personalized phishing links to deliver advanced spyware to high profile Russian targets including media outlets, universities, research centers, government agencies and financial institutions. The attack exploited a previously unknown Chrome sandbox bypass tracked as CVE-2025-2783 that allowed compromise of Chromium based browsers with a single click as part of a multi stage exploit chain that included a separate remote code execution component. Google released a patch on March 25, 2025 and investigators noted the malicious links were extremely short lived and often redirected to the legitimate event site once the exploit was mitigated.
Risiken bei der Wiederherstellung nach Ransomware-Angriffen

www.csoonline.com · 9 months ago

Eine Hiscox-Umfrage unter 1.000 mittelständischen Unternehmen zeigt, dass zwei von fünf Firmen, die Lösegeld zahlen, ihre Daten nicht wiederherstellen können; 27 Prozent meldeten im vergangenen Jahr einen Angriff und 80 Prozent der Betroffenen zahlten. Nur rund 60 Prozent der zahlenden Opfer konnten Daten ganz oder teilweise wiederherstellen, während eine CrowdStrike-Studie 2025 berichtet, dass 93 Prozent trotz Zahlung Daten gestohlen wurden. Ursachen sind fehlerhafte oder inkompatible Verschlüsselungswerkzeuge, langsame oder zerstörerische Entschlüsselungsprozesse, kompromittierte oder ungetestete Backups sowie doppelte oder dreifache Erpressungsstrategien, sodass Zahlung allein das Gesamtproblem nicht löst. Experten raten zu geprüften Wiederherstellungsplänen mit forensischer Validierung, Incident Response Retainern, Cyberversicherungen und grundlegenden Sicherheitsmaßnahmen wie Multi Faktor Authentifizierung und konsequentem Patch Management.
Massive China-Linked Smishing Campaign Leveraged 194,000 Domains

www.securityweek.com · 9 months ago

There is a massive smishing campaign that has been active since April 2024 and has employed over 194,000 malicious domains since January 1, 2024 to impersonate toll and package delivery services, healthcare organizations, banks, cryptocurrency platforms and other reputable services in order to collect sensitive information including Social Security numbers. The operation is attributed to a Chinese speaking actor known as Smishing Triad, active since at least 2023, and appears to be supported by a phishing as a service supply chain that includes domain sellers, hosting providers, phishing kit developers, SMS spammers and data brokers. The campaign is highly decentralized and relies on short lived domains, with 82.6 percent of domains lasting two weeks or less and 29.19 percent active for two days or less, and while most targets are in the United States victims have been identified worldwide; people are advised to treat unsolicited urgent messages with suspicion and verify requests via official channels.
CISA orders feds to patch Windows Server WSUS flaw used in attacks

www.bleepingcomputer.com · 9 months ago

There is a critical Windows Server Update Services vulnerability tracked as CVE-2025-59287 that enables unauthenticated, low complexity remote code execution and can allow attackers to gain SYSTEM privileges on servers running the WSUS Server role. CISA added the flaw to its Known Exploited Vulnerabilities catalog and ordered U.S. federal civilian agencies to apply Microsoft out of band security updates or disable the WSUS Server role, with a compliance deadline of November 14, 2025 under Binding Operational Directive 22 01. Proof of concept exploit code was published and security firms observed scanning and exploitation attempts against WSUS default ports 8530 and 8531 while watchdog groups reported thousands of WSUS instances exposed online.
iOS 26 Overwrites ‘shutdown.log’ on Reboot, Erasing Forensic Evidence of Pegasus and Predator Spyware

gbhackers.com · 9 months ago

iOS 26 now overwrites the shutdown.log file on every reboot, effectively erasing the historical entries investigators relied on to detect Pegasus and Predator spyware. The shutdown.log inside sysdiagnose previously preserved reboot by reboot records that exposed anomalies and specific indicators of compromise, including a Pegasus 2022 indicator involving the path private var db com.apple.xpc.roleaccountd.staging com.apple.WebKit.Networking, but the new behavior makes a clean shutdown.log indistinguishable from normal device operation. Researchers advise saving a sysdiagnose snapshot before installing iOS 26 or delaying the update until Apple clarifies or reverses the change to avoid losing forensic evidence.
Europol has put an end to network behind 49 million fake accounts

www.csoonline.com · 9 months ago

On October 10 Europol, together with police authorities in Estonia, Finland, Latvia and Austria, raided a cybercrime as a service network and arrested seven people believed to have swindled millions of euros. Investigators seized five servers, forty thousand active SIM cards, four luxury cars, bank accounts and cryptocurrency wallets. The network is suspected of having created forty nine million fake accounts for users in about eighty countries.
New EDR-Redir Tool Bypasses EDRs by Exploiting Bind Filter and Cloud Filter Driver

gbhackers.com · 9 months ago

There is a new tool called EDR-Redir that bypasses Endpoint Detection and Response systems by exploiting Windows Bind Filter and Cloud Filter drivers. It leverages the Windows Bind Link feature and operates entirely in user mode without requiring kernel privileges. This technique represents a significant advancement in EDR evasion methods.
⚡ Weekly Recap: WSUS Exploited, LockBit 5.0 Returns, Telegram Backdoor, F5 Breach Widens

thehackernews.com · 9 months ago

There is active exploitation of a newly patched Microsoft WSUS remote code execution vulnerability CVE-2025-59287, which is being used to drop a.NET executable and a Base64 encoded PowerShell payload that runs arbitrary commands. LockBit reappeared with a new LockBit 5.0 variant that claims dozens of victims across Western Europe, the Americas, and Asia, adds multi platform support and stronger evasion, and is selling affiliate access for roughly 500 in Bitcoin while ransom notes give victims 30 days to negotiate. Malware using the Telegram Bot API as a command and control channel has been observed in multi function RAT campaigns that exfiltrate data and remotely control infected machines, and a major breach at F5 that exposed BIG IP source code began in late 2023 and is attributed to state sponsored actors. Trending vulnerabilities called out this week include CVE-2025-54957, CVE-2025-6950, CVE-2025-6893, CVE-2025-36727, CVE-2025-36728, CVE-2025-8078, CVE-2025-9133, CVE-2025-61932, CVE-2025-61928, CVE-2025-57738, CVE-2025-40778, CVE-2025-40780, CVE-2025-8677, CVE-2025-11411, CVE-2025-61865, CVE-2025-53072, CVE-2025-62481, CVE-2025-11702, CVE-2025-10497, CVE-2025-11447, CVE-2025-22167, CVE-2025-54918, and CVE-2025-52882.
CISA releases warning about Windows Server Update Service bug, orders agencies to patch

therecord.media · 9 months ago

CISA issued an urgent alert to federal agencies and businesses about CVE-2025-59287, a critical Windows Server Update Service remote code execution vulnerability rated 9.8, and ordered federal agencies to patch affected systems by November 14, 2025. Microsoft re-released an out-of-band update after determining the October 14, 2025 Patch Tuesday fix did not fully mitigate the issue and after proof of concept code was publicly disclosed, and the flaw affects WSUS on Windows Server 2012, 2016, 2019, 2022 and 2025. Security vendors and incident responders reported in-the-wild exploitation and indiscriminate attacks against internet-exposed WSUS instances and urged immediate installation of Microsoft’s out-of-band patch or temporary mitigations such as disabling the WSUS role or blocking inbound TCP ports 8530 and 8531.
Critical HashiCorp Vault Vulnerabilities Allow Authentication Bypass and DoS Attacks

gbhackers.com · 9 months ago

There are two critical vulnerabilities disclosed on October 23 2025 affecting Vault and Vault Enterprise that can allow authentication bypass and unauthenticated denial of service. One affects the AWS authentication method and can be bypassed when the configured bound principal IAM role is identical across accounts or uses a wildcard, tracked as CVE-2025-11621 and fixed in Vault Community Edition 1.21.0 and corresponding Vault Enterprise releases. The other is an unauthenticated denial of service caused by a regression that processes complex JSON payloads before rate limits are applied, tracked as CVE-2025-12044 and fixed in Vault Community Edition 1.21.0 and several Enterprise versions.
Dell Storage Manager Vulnerabilities Allow Full System Compromise

gbhackers.com · 9 months ago

There are three critical vulnerabilities in Dell Storage Manager that allow unauthenticated remote attackers to bypass authentication and fully compromise affected storage systems. Affected versions are prior to 2020 R1.21 and the issues are tracked as CVE-2025-43995, CVE-2025-43994, and CVE-2025-46425. The highest rated flaw is CVE-2025-43995 with a CVSS score of 9.8 and administrators are urged to install the 2020 R1.21 update or later immediately to mitigate full system compromise.