Blahalla

CISA Warns of Actively Exploited Windows SMB Vulnerability

gbhackers.com · 9 months ago

CISA has added a critical Microsoft Windows Server Message Block SMB Client vulnerability to its Known Exploited Vulnerabilities catalog after observing active exploitation, tracked as CVE-2025-33073. The flaw stems from improper access control and can allow an attacker to coerce a victim to connect to an attacker controlled SMB server, authenticate, and result in privilege escalation to SYSTEM on affected Windows 10, Windows 11, and Server systems, and Microsoft assigned a CVSS score of 8.8 with patches released in June 2025. CISA requires remediation under its KEV guidance with an action due date of November 10, 2025, and recommends applying Microsoft updates and mitigations such as enabling SMB signing and restricting outbound SMB traffic.
New LOSTKEYS Malware Tied to Russian State-Sponsored Hacker Group COLDRIVER

gbhackers.com · 9 months ago

Russian state sponsored threat actor COLDRIVER, also tracked as UNC4057, Star Blizzard, and Callisto, has been linked to a rapidly evolving malware campaign following the public disclosure of LOSTKEYS in May 2025. After details of LOSTKEYS surfaced, the group pivoted away from the compromised malware and deployed a new LOSTKEYS variant that is actively targeting high profile nongovernmental organizations, policy advisors, and dissidents. The campaign leverages updated persistence and evasion techniques and continues to adapt to avoid detection while focusing on high value civil society and policy related networks.
Over 71,000 WatchGuard Devices Exposed to Remote Code Execution Attacks

gbhackers.com · 9 months ago

There are over 71,000 WatchGuard Firebox devices observed exposed on the public internet to a critical IKEv2 out of bounds write vulnerability tracked as CVE-2025-9242 that can allow unauthenticated remote code execution. Daily scans from the Shadowserver Foundation published October 18, 2025 report this global exposure and show the highest concentrations in the United States and parts of Europe. WatchGuard has released patched Fireware OS updates and mitigation guidance, but many appliances remain unpatched so organizations are urged to apply the fixes or disable IKEv2 where not needed to prevent potential device takeover and lateral network compromise.
Microsoft Windows Cloud Minifilter Flaw Enables Privilege Escalation

gbhackers.com · 9 months ago

A critical security vulnerability in Microsoft Windows Cloud Minifilter has been patched after researchers found a race condition that allowed attackers to escalate privileges and create files anywhere on the system. The flaw is tracked as CVE-2025-55680. It was discovered by security researchers at Exodus Intelligence in March 2024. Microsoft issued a patch in October 2025 to remediate the issue.
Last Week in Security (LWiS) - 2025-10-20

blog.badsectorlabs.com · 9 months ago

There is a WatchGuard Fireware IKEv2 out-of-bounds write that can lead to remote code execution, tracked as CVE-2025-9242. Security researchers demonstrated a BadSuccessor technique with an accompanying BOF for account takeover, detailed a ClubWPT back-office breach that exposed customer data, and reported weaknesses in Microsoft Defender for Endpoint cloud communication that remain unpatched and allow querying of cloud exclusions. A proof of concept for an Agere Systems driver vulnerability was released and is tracked as CVE-2025-24990.
US NSA alleged to have launched a cyber attack on a Chinese agency

www.csoonline.com · 9 months ago

There are claims from China that the US National Security Agency launched a cyber attack on the National Time Service Center that could disrupt Beijing Time and critical sectors such as communications finance power transportation and space operations. The Chinese post alleges the NSA exploited an SMS service vulnerability beginning on March 25 2022 to gain control of multiple staff mobile phones and steal sensitive data and the Chinese embassy confirmed the post while the NSA said it does not confirm or deny such allegations. Security experts say the scenario is technically plausible but lacks public evidence and would mark a serious escalation because time services are critical to authentication and the operation of national infrastructure. Advisers recommend treating time infrastructure as a national level dependency by defining internal time servers synchronized to trusted sources deploying cryptographic attestation disabling SMS based logins for privileged access enforcing out of band multifactor authentication monitoring for timing drift and running red team exercises to test resilience.
Amazon’s AWS Disruption Creates Outages for Hundreds of Websites for Hours

www.nytimes.com · 9 months ago

On October 20, 2025, a widespread internet outage disrupted gaming and entertainment websites. Coinbase and other companies reported service problems they attributed to Amazon Web Services. The cause of the disruptions remained unclear. Amazon did not immediately comment.
The Golden Scale: Notable Threat Updates and Looking Ahead

unit42.paloaltonetworks.com · 9 months ago

There was an extortion deadline of 11:59 PM Eastern on October 10, 2025 after which threat actors leaked data allegedly from six companies in aviation, energy and retail containing personally identifiable information such as names, dates of birth, emails, phone numbers and frequent flyer numbers. The actors advertised an extortion as a service program modeled on ransomware as a service but without file encryption, and they posted recruitment ads seeking insider access at call centers, gaming firms, hosting providers, SaaS and telecom organizations in the United States, United Kingdom, Australia, Canada and France. They also claimed to be developing a new ransomware named SHINYSP1D3R while their public leak site showed a defacement message and posts signaled a possible pause in operations until early next year. Organizations are advised to prepare incident response playbooks tailored to extortion as a service events, plan for reputational risk and stolen data verification, and line up third party experts to assist with negotiations and assessments.
ColdRiver Drops Fresh Malware on Targets

www.darkreading.com · 9 months ago

A sweeping cyber espionage campaign has targeted NATO governments, former diplomats, and high-profile NGO figures using a rapidly developed toolkit tied to the Russia-linked ColdRiver group. Within five days of Google Threat Intelligence Group publicly disclosing LOSTKEYS in May, ColdRiver abandoned that platform and rolled out a new infection chain centered on a downloader called NOROBOT that uses a fake ClickFix CAPTCHA lure to trick targets into running malicious files. NOROBOT variants split their encryption key to frustrate analysis and initially fetched a Python backdoor named YESROBOT before ColdRiver moved to a lightweight PowerShell backdoor tracked as MAYBEROBOT to maintain persistent remote control. Google published indicators of compromise and YARA rules to help organizations detect and block activity related to this campaign.
International Sting Takes Down SIM Box Criminal Network

www.darkreading.com · 9 months ago

Law enforcement agencies in Austria, Estonia, and Latvia, working with Europol and Eurojust, dismantled a large SIM box cyber as a service operation known as SIMCARTEL and arrested seven suspects. Authorities say the network enabled creation of roughly 49 million malicious online accounts, was linked to more than 3,200 cyber fraud cases, and investigators seized five servers, 1,200 SIM box devices, 40,000 active SIM cards, and froze accounts holding euros 431,000 and US dollars 333,000. The service supplied telephone numbers from over 80 countries that criminals used to mask identities for scams, phishing, smishing, fraud, extortion, migrant smuggling, impersonation of police, and distribution of child sexual abuse materials, and the disruption was conducted under the EMPACT program with support from the Shadowserver Foundation.
Is Your Car a BYOD Risk? Researchers Demonstrate How

www.darkreading.com · 9 months ago

Researchers demonstrated a proof of concept at a security conference showing a parked car can serve as an initial access vector into corporate networks by targeting an employee phone. Using inexpensive hardware to jam vehicle Bluetooth, a spoofed Bluetooth signal from a FlipperZero enticed Android phones to connect, then BadUSB emulation and a malicious APK delivered a Metasploit shell, enabled ADB over the air, and used Termux to solidify control. Despite Android 15 foreground service timeouts briefly limiting the shell, the exploit escalated quickly and attackers were able to laterally move from the compromised phone to corporate domain controllers and ESXi hypervisors. Mitigations include mobile device management, robust phone security and monitoring, diligent network segmentation, and a holistic approach that addresses gaps between security controls.
Better-Auth Critical Account Takeover via Unauthenticated API Key Creation (CVE-2025-61928)

www.reddit.com · 9 months ago

An unauthenticated API key creation flaw in the better-auth API keys plugin lets an attacker supply a user identifier in a request body and cause the server to mint privileged API keys for arbitrary users by bypassing normal session checks and server only validation. The vulnerability enables scripted account takeover and MFA bypass for installations that enabled the plugin and affects releases up to version 1.3.25, with a fix available in better-auth version 1.3.26 or later; tracked as CVE 2025 61928. Organizations should rotate any API keys issued during the exposure window, review create and update API key activity for unauthenticated requests that set user identifiers or privileged fields, and apply the patch.
Microsoft: October updates break USB input in Windows Recovery

www.bleepingcomputer.com · 9 months ago

Microsoft confirmed that the October 14, 2025 security update KB5066835 disables USB mice and keyboards in the Windows Recovery Environment, preventing navigation of WinRE options while those devices continue to work in the main Windows operating system. The issue impacts Windows 11 24H2 and 25H2 client builds and Windows Server 2025, rendering WinRE unusable for users who rely on USB wired input devices. Until Microsoft issues a fix, users are advised to use Bluetooth wireless mice and keyboards or PS two connected devices as a workaround, and Microsoft said the Windows team is working on a patch expected in the coming days.
AI Data Centers Create Fury From Mexico to Ireland

www.nytimes.com · 9 months ago

There is growing backlash as the rapid buildout of AI focused data centers has contributed to blackouts and water shortages in vulnerable communities from Mexico to Ireland. In parts of Mexico, towns near hyperscale campuses report dried reservoirs, weeks of rationing and reliance on trucked water while operators have at times used diesel generators and delayed full grid connections, and in Europe residents have mobilized protests over the power and water demands of planned facilities. The expansion is being driven by soaring AI demand, and experts warn that without stricter siting rules, shifts to low water cooling and coordinated energy planning the growth of these centers risks worsening local energy and water insecurity and provoking further community resistance.
Five New Exploited Bugs Land in CISA's Catalog — Oracle and Microsoft Among Targets

thehackernews.com · 9 months ago

There are five security flaws added to CISA's Known Exploited Vulnerabilities Catalog on October 20, 2025, including a weaponized Oracle E Business Suite vulnerability CVE-2025-61884 described as a server side request forgery in the Runtime component of Oracle Configurator that can be exploited remotely without authentication. CVE-2025-61884 has a CVSS score of 7.5 and joins CVE-2025-61882 with a CVSS score of 9.8, a critical unauthenticated remote code execution bug that investigators from Google Threat Intelligence Group and Mandiant say may have impacted dozens of organizations and is likely connected to extortion activity. CISA also added CVE-2025-33073 affecting Microsoft Windows SMB Client, CVE-2025-2746 and CVE-2025-2747 affecting Kentico Xperience CMS, and CVE-2022-48503 in Apple's JavaScriptCore, and federal civilian agencies were required to remediate these vulnerabilities by November 10, 2025.
South Korea Seeks to Arrest Dozens of Online Scam Suspects Repatriated From Cambodia

www.securityweek.com · 9 months ago

Sixty four South Koreans repatriated from Cambodia were detained on arrival as police investigate whether they voluntarily joined or were forced into overseas online scam organizations. Prosecutors have requested arrest warrants for 58 of the returnees on accusations of online fraud including romantic scams, bogus investment pitches and voice phishing, while five were released as investigations continue. Authorities say some returnees reported being beaten at scam centers, public pressure is rising for stronger protections after a national was found dead in Cambodia, and officials estimate about one thousand South Koreans remain in Cambodian scam centers amid U N estimates that at least one hundred thousand people have been trafficked to scam centers in Cambodia alone.
Retail giant Muji halts online sales after ransomware attack on supplier

www.bleepingcomputer.com · 9 months ago

Japanese retailer Muji has taken its online store offline after a ransomware infection at its delivery partner Askul caused system failures. Customers in Japan are unable to browse or purchase on Muji online stores, view order histories in the Muji app, or see some web content, and an update said purchases and applications for a monthly flat rate service remained impacted. Askul said it has suspended orders, shipping, product returns, receipt mailing, catalog shipping and collection services, its customer service lines are unreachable, and it is investigating the scope of operational impact and potential leakage of personal and customer data. The disruption is limited to Muji Japan because Askul handles only Japan sales, other Muji stores abroad are operating normally, and no ransomware gang has publicly listed Askul on extortion sites so far.
Amazon cloud outage disrupts service of major apps

www.washingtonpost.com · 9 months ago

On October 20, 2025, Amazon Web Services reported widespread outages beginning shortly after midnight Pacific time that caused many internet apps and websites worldwide to fail to load. There were reports, including outage monitoring sites, of users encountering problems with Snapchat, WhatsApp, Signal, Zoom, Roblox, Fortnite, Xbox, Google and YouTube. AWS attributed the disruption to an underlying DNS issue that affected roughly 82 of its services and said engineers had fully resolved the underlying problem by 6:30 a.m. Eastern while warning that a backlog of requests could still produce errors for some users.
Flawed Vendor Guidance Exposes Enterprises to Avoidable Risk

www.darkreading.com · 9 months ago

A newly disclosed Oracle E-Business Suite zero day, tracked as CVE-2025-61882, enables unauthenticated remote code execution with an easily exploitable CVSS score of 9.8 and was used to gain interactive reverse shell access and exfiltrate data from victims. Conflicting Oracle guidance that suggested Web Application Firewalls could protect exposed E-Business Suite instances contradicted official deployment documentation that recommends placing instances behind bastion hosts or separate subnets, a discrepancy that likely led some organizations to leave systems Internet accessible. The vulnerability was reportedly under active exploitation for more than eight weeks before disclosure, prompting calls for vendors to correct deployment guidance and for organizations to proactively review and isolate sensitive business applications rather than rely solely on vendor defenses.
Massive AWS Outage Halt The Internet – Disrupting Snapchat, Prime Video, Canva, and More

gbhackers.com · 9 months ago

A catastrophic Amazon Web Services outage struck on October 20, 2025, beginning in the US East 1 region in Northern Virginia and triggering widespread service disruptions. A DNS resolution failure affecting DynamoDB and related endpoints produced high error rates and latencies that took down major platforms including Snapchat, Amazon Prime Video and Canva and disrupted gaming, banking and other online services. The incident exposed the internet's heavy dependence on a single cloud provider while engineers worked for hours to mitigate the DNS problem and restore normal operations.
Over 75,000 WatchGuard security devices vulnerable to critical RCE

www.bleepingcomputer.com · 9 months ago

There are nearly 76,000 WatchGuard Firebox appliances exposed on the public web that remain vulnerable to a critical unauthenticated remote code execution flaw tracked as CVE-2025-9242. The vulnerability is an out-of-bounds write in the Fireware OS iked process that handles IKEv2 VPN negotiations and can be triggered by specially crafted IKEv2 packets. It affects Firebox versions 11.10.2 through 11.12.4Update1, 12.0 through 12.11.3, and 2025.1, and the vendor recommends upgrading to fixed releases such as 2025.1.1, 12.11.4, 12.5.13, or 12.3.1Update3 while noting version 11.x is end of support. Scans from The Shadowserver Foundation show most vulnerable devices are in Europe and North America with the United States hosting about 24,500 endpoints, and although no active exploitation has been reported administrators are urged to apply the patch immediately.
131 Malicious Chrome Extensions Discovered Targeting WhatsApp Users

gbhackers.com · 9 months ago

Security researchers uncovered 131 malicious Chrome extensions that are rebranded clones of a WhatsApp Web automation tool which injects JavaScript into the WhatsApp Web interface to automate bulk messaging and scheduling and is being used to run large scale spam campaigns targeting Brazilian users. The extensions share the same codebase, design patterns, and infrastructure, account for at least 20,905 active users across listings, and are distributed via a reseller franchise model using lookalike sites and social channels. Socket filed takedown requests with the Chrome security team and recommends inventorying and allowlisting extensions, restricting installs to approved extension IDs, tracking permission creep, and applying network controls to block risky updates.
CISA: High-severity Windows SMB flaw now exploited in attacks

www.bleepingcomputer.com · 9 months ago

There is active exploitation of a high severity Windows SMB privilege escalation vulnerability that can grant SYSTEM privileges on unpatched systems. The flaw is tracked as CVE-2025-33073, impacts all Windows Server and Windows 10 versions and Windows 11 through 24H2, and was patched by Microsoft during the June 2025 Patch Tuesday because of an improper access control weakness that enables network privilege elevation. An attacker can exploit it by convincing a victim to connect to an attacker controlled SMB server or by executing a specially crafted script to coerce the victim machine to connect back and authenticate, resulting in elevation of privilege. CISA added the flaw to its Known Exploited Vulnerabilities Catalog and ordered federal agencies to secure systems by November 10, 2025 under Binding Operational Directive 22-01 while urging all organizations to apply the patch immediately.
Winos 4.0 Malware Uses Weaponized PDFs Posing as Government Departments to Infect Windows Machines

gbhackers.com · 9 months ago

A high severity campaign uses weaponized PDF files masquerading as government and finance ministry documents to trick Windows users into opening links or attachments, a tactic first observed in early 2025 and since expanded from Taiwan into Japan and Malaysia. The malicious PDFs embed links to download ZIP archives or fake installer pages that deploy Winos 4.0 and related remote access trojans such as HoldingHands through multi stage loaders like Catena and DLL sideloading. The campaign relies on techniques including reflective DLL injection, anti virtual machine checks, process enumeration and termination of security products, scheduled task persistence, and the use of cloud hosting or custom domains to evade detection. Security researchers link the operations to actors associated with Winos 4.0 or Silver Fox and warn the activity remained active during 2025, posing a significant threat to organizations in the region.
Japanese retailer Askul halts online orders, shipments after ransomware attack

therecord.media · 9 months ago

On October 20, 2025, Japanese office and household goods retailer Askul halted online orders and suspended product shipments after a ransomware attack discovered over the weekend crippled its systems. The company suspended new orders and user registrations, canceled existing shipments, and made customer inquiries unavailable while investigating the extent of the impact and a possible leak of personal and customer data. The disruption rippled through Japan's retail sector, prompting Muji to suspend its domestic online shopping service and parts of its mobile app and causing other chains including Loft and Sogo and Seibu to halt some online orders and shipments tied to Askul's logistics systems. The incident follows other recent cybersecurity incidents in Japan, including a ransomware attack this month on Asahi and reports of unauthorized logins at Sagawa Express.
Judge bars NSO from targeting WhatsApp users with spyware, reduces damages in landmark case

therecord.media · 9 months ago

A federal judge ordered that the NSO Group be barred from targeting WhatsApp and its users with spyware. The judge reduced damages NSO must pay to Meta from 168 million dollars to 4 million dollars. The ruling stems from a 2019 hack in which NSO used its zero click Pegasus spyware to target about 1,400 WhatsApp users and found that circumventing WhatsApp end to end encryption causes irreparable injury. NSO said it will review the decision and asserted the ruling will not apply to its customers, while WhatsApp leadership and victim advocates said the ban prevents unlawful access to messages going forward.
Self-spreading GlassWorm malware hits OpenVSX, VS Code registries

www.bleepingcomputer.com · 9 months ago

There is a new supply chain attack targeting developers on the OpenVSX and Microsoft Visual Studio marketplaces with self-spreading malware called GlassWorm that has been installed an estimated 35,800 times. The malware hides malicious code using invisible Unicode characters, steals credentials for GitHub npm and OpenVSX as well as cryptocurrency wallet data, and can spread using stolen account information to infect other extensions the victim can access. GlassWorm uses Solana blockchain transactions for command and control with Google Calendar and a direct IP as backups, deploys a SOCKS proxy and hidden VNC clients, and delivers a final obfuscated JavaScript payload named ZOMBI that turns infected developer workstations into nodes for criminal infrastructure. Researchers found at least eleven compromised extensions on OpenVSX and one on the VS Code Marketplace, with several compromises occurring on October 17 and silent automatic updates causing widespread infections while some malicious extensions remained available at publishing and the one on Microsofts marketplace was removed.
Inside the attack chain: Threat activity targeting Azure Blob Storage

www.microsoft.com · 9 months ago

Azure Blob Storage is a high value target because it stores massive amounts of unstructured data for AI, analytics, media, backups and IoT, and threat actors exploit misconfigurations and exposed credentials to impact data integrity and business continuity. Threat techniques include DNS and HTTP header probing, brute forcing container names with permutation scripts and language models, public indexers, and tools like Goblob and QuickAZ, while harvested storage account keys, shared access signatures and Entra principal credentials enable escalation and exfiltration. Attackers may create malicious resources, host spoofed sign in pages, and use Blob Storage for command and control, malware hosting and data exfiltration, so defenders should enforce least privilege with Entra role based access control and attribute based access control, restrict network access with private endpoints and virtual networks, and enable Defender for Cloud and Defender for Storage detections. Azure provides service side encryption using 256 bit AES, immutability settings, soft delete and versioning, and Microsoft recommends following security baseline recommendations and applying customer facing security capabilities mapped to the MITRE ATT&CK framework.
Microsoft fixes Windows Server Active Directory sync issues

www.bleepingcomputer.com · 9 months ago

Microsoft is rolling out a fix for Active Directory synchronization problems that affect some Windows Server 2025 systems after installing security updates released since September. The issue can cause incomplete synchronization of large AD security groups exceeding ten thousand members when using DirSync controls such as Microsoft Entra Connect Sync and occurs only on Windows Server 2025 after installing the September 2025 security update KB5065426 or later. IT administrators can mitigate the problem on managed devices by deploying the Known Issue Rollback Group Policy, and non-managed or most home users can apply a registry workaround by creating a REG DWORD named 2362988687 with value zero under HKEYLOCALMACHINE SYSTEM CurrentControlSet Policies Microsoft FeatureManagement Overrides until the fix is rolled out to all customers.
China claims it caught US attempting cyberattack on national time center

therecord.media · 9 months ago

Chinese authorities accused the United States of compromising the National Time Service Center, a research institute that provides timekeeping services for national security applications. The Ministry of State Security said it had ironclad evidence that the National Security Agency attempted to steal state secrets and preposition within the center's Accurate Ground-based Time Service System, a terrestrial backup to GPS, to disable or sabotage the system. The agency has not published supporting evidence and the claim lacks corroboration from allied governments or private sector reporting. Chinese cyber authorities said they secured evidence, cut off attack chains, guided the center's investigation and remediation, and upgraded defenses, while observers noted the allegation follows a pattern of reciprocal accusations between states.
Bombarding Cars With Lasers: Novel Auto Cyberattacks Emerge

www.darkreading.com · 9 months ago

Researchers are proposing that microchip manufacturers adopt fully depleted silicon on insulator technology called FD SOI to protect automotive and other devices from laser fault injection attacks by adding an insulating buried oxide layer that isolates transistors. Testing shows the layer limits energy spread so attackers need far more laser power and time to induce faults, with attacks that might take 10 minutes on standard chips requiring about 10 hours on FD SOI chips, pushing realistic attack scenarios toward elite actors with nation state resources. The technology also reduces electrical noise, leakage, and overheating, can lower die cost through simpler fabrication, and supports compliance with United Nations Regulation R155 and ISO SAE 21434 by raising the bar against fault injection while acknowledging it is not unhackable.
Self-Propagating GlassWorm Attacks VS Code Supply Chain

www.darkreading.com · 9 months ago

A self propagating worm named GlassWorm is targeting Visual Studio Code extensions and has infected approximately 35,800 developer machines. The malware hides malicious code using printable Unicode characters that do not render in editors, uses the Solana blockchain as its command and control with Google Calendar as a fallback, and harvests NPM GitHub and Git credentials to spread through the software supply chain. Infected systems are used to steal cryptocurrency wallets, deploy SOCKS proxy servers and hidden VNC servers, and convert developer workstations into nodes in a criminal infrastructure called ZOMBI for further distribution. Koi Security published indicators of compromise and advised rotating all secrets including tokens and passwords and reimaging compromised machines to ensure full removal.
From inbox clutter to costly compromise: Why email threats still matter

news.sophos.com · 9 months ago

Email based threats remain a leading attack vector, with CISA reporting that ninety percent of successful cyberattacks begin with phishing and recent data showing nineteen percent of ransomware victims trace incidents to malicious email while eighteen percent attribute attacks to phishing, up from eleven percent the prior year. Attackers are evolving spam into targeted phishing and business email compromise schemes that now cause more than three billion dollars in annual losses globally, and phishing was the initial access vector in forty three percent of emergency incident responses and involved in sixty five percent of managed detection and response investigations. Threat actors are increasingly using generative AI and custom GPTs to scale convincing phishing campaigns, exploiting QR code quishing and social engineering to bypass defenses including multifactor authentication, prompting adoption of layered AI powered email analytics and new monitoring systems that integrate with major platforms to detect and remediate threats.
Microsoft warns of Windows smart card auth issues after October updates

www.bleepingcomputer.com · 9 months ago

There are smart card authentication and certificate issues affecting Windows 10 Windows 11 and Windows Server after the October 2025 security updates because the updates enable a change that moves RSA based smart card certificates from Cryptographic Service Provider to Key Storage Provider. Affected systems can fail to sign documents see certificate based authentication fail report Event ID 624 and show errors such as invalid provider type specified and CryptAcquireCertificatePrivateKey error. The change was enabled to mitigate CVE-2024-30098 by setting the DisableCapiOverrideForRSA registry key to one and administrators can temporarily set that key to zero under HKEYLOCALMACHINE SOFTWARE Microsoft Cryptography Calais and restart the machine while vendors work on permanent fixes noting the key will be removed in April 2026.
WatchGuard VPN Flaw Gives Hackers Full Firewall Control

www.techrepublic.com · 9 months ago

A severe out of bounds write in WatchGuard Fireware tracked as CVE 2025 9242 allows remote unauthenticated attackers to execute arbitrary code by exploiting IKEv2 handling in the iked process and is rated CVSS 9.3. Exploitation leverages a stack buffer overflow in the ike2 ProcessPayload CERT function during IKE SA AUTH to gain control of the instruction pointer, spawn Python interactive shells over TCP, escalate to a full Linux shell, remount filesystems, and pull BusyBox binaries to pivot further into networks. A wide range of Firebox devices and Fireware OS lines are affected including versions 11.10.2 through 11.12.4 Update1, the 12.0 series up to 12.11.3, and 2025.1 with models from T15 and T35 to T115 W T125 and T185 cited, and patches are available in releases 12.3.1 Update3, 12.5.13, 12.11.4 and 2025.1.1 while administrators are advised to upgrade immediately or mitigate by disabling dynamic peer IKEv2 VPNs and tightening firewall policies.
Home security firm Verisure reports data breach at Swedish subsidiary

therecord.media · 9 months ago

There was unauthorized access to customer data linked to Alert Alarm, a Swedish subsidiary of Verisure. The intrusion was confined to Alert Alarm systems, which are managed separately and hosted by an external billing partner, and did not affect Verisure's broader operations in Europe and Latin America. Compromised data included names, addresses, email addresses and social security numbers for about 35,000 current and former Alert Alarm customers, Swedish police have opened an investigation into suspected blackmail and an aggravated data breach, and Verisure said forensic analysis found no signs of intrusion in its own network; the incident came a week after Verisure's 3.2 billion euro initial public offering and the company's shares fell more than 5 percent.
Find hidden malicious OAuth apps in Microsoft 365 using Cazadora

www.bleepingcomputer.com · 9 months ago

Security researchers warn that malicious OAuth applications are likely hiding in Microsoft 365 tenants and can install service principals that act with delegated access to user resources. An open source script called Cazadora helps hunt these rogue apps by scanning Enterprise Applications and Application Registrations for suspicious indicators such as apps named after user accounts, generic names like Test App, apps named after the tenant domain, non alphanumeric names, and anomalous reply URLs that use a local loopback on port 7823. Administrators are urged to audit OAuth apps immediately because Azure defaults allow users to consent to app permissions without review, creating an easy vector for attackers to gain persistent access.
SIM Farm Dismantled in Europe, Seven Arrested

www.securityweek.com · 9 months ago

Seven individuals were arrested in a coordinated law enforcement operation that dismantled a SIM farm and the cybercrime as a service platform it supported. The suspects ran a SIM box service that allowed customers to use phone numbers registered to other people to create fake social media accounts and hide identities for phishing, smishing, extortion, investment fraud, family impersonation scams, and fraudulent calls, and authorities seized 1,200 SIM box devices and 40,000 active SIM cards. Investigators in Austria, Estonia, and Latvia carried out 26 searches, seized hundreds of thousands more SIM cards and five servers, seized four luxury vehicles, and froze about 800,000 dollars in bank and cryptocurrency accounts. Europol says the service enabled over 3,200 cyber fraud cases in Austria and Latvia, caused roughly 5 million euros in losses, and was used to create more than 49 million online accounts.
Lumma Stealer Activity Drops After Doxxing

www.securityweek.com · 9 months ago

Activity by the Lumma Stealer information stealer has fallen sharply after an underground doxxing campaign exposed the alleged identities and personal and operational details of five core members, including passport numbers, bank account information, email addresses, and links to online profiles. Security firm Trend Micro observed a steep decline in the malware's command and control infrastructure after the group’s Telegram account was reportedly compromised and communications with customers were disrupted, though the accuracy of the doxed information has not been independently verified. The disruption prompted cybercriminals to migrate to alternative infostealers such as Vidar and StealC and disrupted distribution via the Amadey pay per install service, and analysts warn the vacuum may spur more aggressive marketing by other malware as a service operators and the emergence of stealthier variants.
ConnectWise Patches Critical Flaw in Automate RMM Tool

www.securityweek.com · 9 months ago

ConnectWise released Automate 2025.9 to patch two vulnerabilities in its Automate remote monitoring and management tool that could enable man in the middle attacks and allow interception or tampering of agent communications and updates. The critical flaw CVE-2025-11492 with a CVSS score of 9.6 allowed sensitive information to be transmitted in cleartext, while the high severity issue CVE-2025-11493 with a CVSS score of 8.8 involved missing integrity checks for downloaded code. ConnectWise warned that on premises agents configured to use HTTP or weak encryption could have traffic viewed or modified and that a threat actor could replace updates with malicious ones. Organizations running on premises Automate deployments are advised to update to Automate 2025.9, enforce HTTPS and TLS 1.2, and apply the patches immediately.
The Culture Wars Came for Wikipedia. Jimmy Wales Is Staying the Course.

www.nytimes.com · 9 months ago

Attacks on the site are piling up, prompting heightened defenses and increased scrutiny from volunteers and administrators. Its co-founder urges users to trust the process and be patient while the community and technical teams work to detect and mitigate the disruptions.
Evilginx’s creator reckons with the dark side of red-team tools

therecord.media · 9 months ago

A Polish developer named Kuba Gretzky built Evilginx in 2017 as an open source red team tool to show how multi factor authentication can be bypassed by intercepting session tokens. After the public release attackers and nation state groups including Scattered Spider and Russian gangs such as Void Blizzard also known as Laundry Bear adapted the tool, with one campaign tied to a 2023 operation that disrupted MGM Resorts and inflicted more than one hundred million dollars in losses. To limit misuse Gretzky published a stripped public version with embedded markers to detect abuse and now sells a vetted commercial Evilginx Pro to trusted security firms while urging that openness has also driven industry improvements in authentication.
Hacker verkaufen Daten von Geiger im Darknet

www.csoonline.com · 9 months ago

On October 17, the ransomware group Rhysida listed the German machinery maker Geiger on its darknet victim list and offered allegedly stolen corporate data for sale. The attackers demanded ten bitcoin, roughly one million euros at current exchange rates, and set a sale deadline of October 24, 2025, while Geiger has not issued an official statement. Security researchers say Rhysida is financially motivated, likely operating from Russia or the Commonwealth of Independent States, and has previously targeted organizations including Welthungerhilfe, the British Library, and multiple healthcare providers in the United States.
⚡ Weekly Recap: F5 Breached, Linux Rootkits, Pixnapping Attack, EtherHiding & More

thehackernews.com · 9 months ago

There are signs that threat actors maintained long term access to major vendors and infrastructure, including an intrusion into F5 that exfiltrated some BIG IP source code and undisclosed vulnerability information after attackers reportedly spent at least 12 months inside its network using BRICKSTORM attributed to UNC5221. Other incidents this week include North Korean groups using EtherHiding to deliver malware and steal cryptocurrency, discovery of a LinkPro Linux rootkit that hides via eBPF and activates on a magic TCP SYN, a campaign exploiting CVE-2025-20352 in Cisco IOS to install rootkits, and a Pixnapping side channel that can steal Android two factor codes tracked as CVE-2025-48561. A roster of trending CVEs was highlighted including CVE-2025-24990, CVE-2025-59230, CVE-2025-47827, CVE-2025-55315, CVE-2025-11577, CVE-2025-37729, CVE-2025-48983, CVE-2025-49201, CVE-2025-58325 and others, and the guidance urges organizations to inventory exposed devices, restrict access, patch promptly, and monitor for long term silent compromises.
Threat actors are spreading malicious extensions via VS marketplaces

www.csoonline.com · 9 months ago

Researchers found that careless developers publishing Visual Studio Code extensions to two open marketplaces included access tokens and other hardcoded secrets that threat actors could exploit. The investigation validated over 550 secrets across more than 500 extensions, including AI provider keys and credentials for AWS, GitHub, Stripe, Auth0, Google Cloud, MongoDB, Postgres, and Supabase, with more than 100 leaked Azure DevOps personal access tokens representing over 85,000 installs and over 30 OpenVSX tokens representing over 100,000 installs. Marketplaces and researchers notified impacted publishers, Microsoft added prepublication secret scanning that blocks verified secrets, OpenVSX added token prefixes, and security guidance urges sanitizing code, limiting and allowlisting extensions, and maintaining IDE extension inventories.
Analysing ClickFix: 3 Reasons Why Copy/Paste Attacks Are Driving Security Breaches

thehackernews.com · 9 months ago

There are attacks called ClickFix, FileFix, and fake CAPTCHA that trick users into copying malicious code from a webpage and running it locally, often under the guise of solving a CAPTCHA or fixing an error. They are being used by Interlock ransomware and other threat actors including state sponsored groups, spread via SEO poisoning, malvertising, and other non email vectors, and evade detection through domain rotation, heavy obfuscation, bot protection, and conditional loading that hides malicious pages from scanners. Because the clipboard copy and user initiated execution occur inside the browser sandbox, endpoint detection and response is often the last and imperfect line of defense, so browser based detection of malicious copy and paste is recommended to stop these attacks earlier without disrupting user workflow.
How a fake AI recruiter delivers five staged malware disguised as a dream job

www.reddit.com · 9 months ago

There is a sophisticated multi staged malware campaign that uses fake LinkedIn recruiters offering an AI engineering role to lure developers into cloning a GitHub repository whose code contains a backdoor that executes when Node is run. The backdoor fetches and executes a heavily obfuscated JavaScript infostealer that harvests browser credentials and cookies, extracts dozens of crypto wallets and keychain data, scans for environment and secret files, monitors the clipboard and keystrokes, takes screenshots, and establishes persistent access via WebSocket based backdoors and remote control tools. That JavaScript stage then deploys an embedded Python runtime and a layered Python downloader and remote access trojan that broaden the attack surface and exfiltrate stolen data to attacker command and control infrastructure, and reverse engineering yielded indicators of compromise and infrastructure details for defenders to block and investigate.
Prosper Confirms Data Breach Impacting 17 Million Users

www.techrepublic.com · 9 months ago

Prosper Marketplace confirmed a cybersecurity breach that exposed personal data for about 17.6 million users. An unauthorized actor used compromised administrative credentials in early September to access internal systems and a database containing names, Social Security numbers, income details, and contact information while Prosper says no payment credentials or passwords were exposed. Prosper contained the incident, engaged external cybersecurity firms and law enforcement, began notifying affected individuals and regulators, and is offering free credit monitoring, but security analysts warn the data could be used for spear phishing and identity theft. The incident highlights persistent risks from credential misuse and reinforces recommendations for multi factor authentication, privileged access reviews, least privilege, zero trust, continuous monitoring, and automated incident response for fintech firms.
131 Chrome Extensions Caught Hijacking WhatsApp Web for Massive Spam Campaign

thehackernews.com · 9 months ago

Researchers uncovered a coordinated campaign that used 131 rebranded clones of a WhatsApp Web automation extension for Google Chrome to spam Brazilian users at scale, with the extensions collectively serving about 20,905 active users. The spamware extensions share the same codebase, design patterns, and infrastructure, were largely published under WL Extensão and variants as part of a reseller white label franchise tied to DBX Tecnologia, and are marketed as CRM and bulk messaging tools that aim to bypass WhatsApp anti spam controls. The activity has been ongoing for at least nine months with new uploads and updates observed as recently as October 17, 2025, and the cluster has been linked to wider campaigns involving a WhatsApp worm called SORVEPOTEL that is used to distribute a banking trojan named Maverick.
Websites Including Amazon, Coinbase and Roblox Report Outages After AWS Disruption

www.nytimes.com · 9 months ago

On October 20, 2025 a widespread outage at Amazon Web Services disrupted dozens of major websites and apps worldwide, centered in the US East One region. AWS reported increased error rates and latencies while investigators identified DNS resolution failures affecting the DynamoDB API as a potential root cause, which also impacted IAM updates and other global features that rely on that region. Gaming platforms, social apps, financial services and Amazon products such as Alexa and the shopping site reported downtime or degraded performance as engineers worked to mitigate the problem and restore services.