Blahalla

LinkPro Linux Rootkit Uses eBPF to Hide and Activates via Magic TCP Packets

thehackernews.com · 9 months ago

An investigation into the compromise of an Amazon Web Services (AWS)-hosted infrastructure has led to the discovery of a new GNU/Linux rootkit dubbed LinkPro, according to findings from Synacktiv. "This backdoor features functionalities relying on the installation of two eBPF [extended Berkeley Packet Filter] modules, on the one hand to conceal itself, and on the other hand to be remotely
F5 Hit by ‘Nation-State’ Cyberattack

www.techrepublic.com · 9 months ago

A highly sophisticated nation state actor maintained long term access to certain F5 systems, with an intrusion detected in August 2025 and disclosed in October 2025 that affected BIG-IP product development and engineering knowledge management platforms. The attacker downloaded files including portions of BIG-IP source code and details of vulnerabilities under development, while F5 reports no knowledge of undisclosed critical or remote code vulnerabilities or active exploitation and no evidence of access to CRM, financial, support case management, or iHealth systems. F5 enlisted CrowdStrike, Mandiant, NCC Group, and IOActive, released updates for BIG-IP, F5OS, BIG-IP Next for Kubernetes, BIG-IQ, and APM clients, and urged customers to install the latest releases, rotate credentials, and follow its threat hunting and hardening guidance.
Extortion and ransomware drive over half of cyberattacks

blogs.microsoft.com · 9 months ago

There are signs that in 80 percent of cyber incidents investigators found attackers sought to steal data, with extortion and ransomware driving at least 52 percent of attacks while espionage only accounted for about four percent. Daily telemetry shows massive scale with more than 100 trillion signals processed, roughly 4.5 million new malware attempts blocked, 38 million identity risk detections analyzed, and five billion emails screened, and attackers are increasingly using off the shelf tools and automation. The use of generative AI has accelerated attacker capabilities by automating phishing, scaling social engineering, producing synthetic media, and creating adaptive malware, while defenders are also deploying AI to close detection gaps. Identity attacks are overwhelmingly password attacks at more than 97 percent and surged 32 percent in the first half of 2025, and phishing resistant multifactor authentication can block over 99 percent of identity based attacks.
North Korean hackers use EtherHiding to hide malware on the blockchain

www.bleepingcomputer.com · 9 months ago

North Korean state linked hackers have been using EtherHiding, embedding malicious payloads in smart contracts on public blockchains to host and deliver malware in social engineering campaigns aimed at stealing cryptocurrency and conducting espionage. Google Threat Intelligence Group attributes the activity to a DPRK group tracked as UNC5342 and says campaigns since February use fake job interviews to trick developers into running a JavaScript downloader called JADESNOW that fetches a JavaScript version of InvisibleFerret from Ethereum or the BNB Smart Chain, enabling credential theft and remote commands. Researchers warn EtherHiding provides anonymity, resistance to takedown, and low cost flexible updates that complicate tracking and disruption, and recommend caution with unsolicited job related downloads and strict browser download and script execution controls.
AISLE Emerges From Stealth With AI-Based Reasoning System to Remediate Vulnerabilities on the Fly

www.securityweek.com · 9 months ago

AISLE has emerged from stealth with an AI native cyber reasoning system that autonomously identifies, triages, and remediates known and zero day application vulnerabilities while verifying fixes against a continuously updated twin of an enterprise software stack. Founded by Ondrej Vlcek, Jaya Baloo, and Stanislav Fort and backed by prominent AI and industry figures, the system discovered more than 100 new vulnerabilities in foundational software including the Linux kernel, OpenSSL, cURL, and the Apache stack during its first weeks. The platform creates code patches, validates them with a Verifier Agent that can build on the fly docker images to test patch candidates, and can push validated changes to Git, with configurable human oversight from copilot mode to full autonomy. With over 40,000 new vulnerabilities discovered in 2024, critical flaws taking an average 45 days to fix and attackers exploiting vulnerabilities in five days, AISLE aims to collapse remediation from weeks or months to days or minutes to reduce exploitable zero days.
China’s Rare Earth Restrictions Aim to Beat U.S. at Its Own Game

www.nytimes.com · 9 months ago

China has expanded export controls on rare earth elements and permanent magnets, requiring companies worldwide to obtain Chinese government approval to export products containing even trace amounts of Chinese origin rare earths. The rules are modeled on American technology export controls and extend licensing requirements to foreign made magnets and selected semiconductor materials that contain as little as 0.1 percent controlled metals. U.S. officials denounced the measures as economic coercion and warned of possible retaliation while analysts say the moves threaten defense and high technology supply chains. The changes have already raised concerns about pauses and bottlenecks in exports and have accelerated efforts by companies and governments to diversify sources and build alternative processing capacity.
Organizations Warned of Exploited Adobe AEM Forms Vulnerability

www.securityweek.com · 9 months ago

CISA warned that an Adobe Experience Manager Forms vulnerability tracked as CVE-2025-54253 with a CVSS score of 10.0 is being exploited in the wild. Researchers said the flaw is a misconfiguration combining an authentication bypass and Struts development mode left enabled, allowing attackers to execute Object Graph Navigation Language expressions and achieve remote code execution, and Adobe patched the issue in early August after a public proof of concept became available. Adobe also fixed CVE-2025-54254, an XML external entity vulnerability with a CVSS score of 8.6 that permits arbitrary file system reads, and CISA added CVE-2025-54253 to its Known Exploited Vulnerabilities catalog while urging organizations to apply the available updates and federal agencies were given three weeks under Binding Operational Directive 22-01 to remediate.
Fuji Electric HMI Configurator Flaws Expose Industrial Organizations to Hacking

www.securityweek.com · 9 months ago

Fuji Electric patched multiple vulnerabilities in its V SFT HMI configurator used with Monitouch HMIs, releasing fixes in version 6.2.9.0 and triggering a JPCERT advisory. Security researcher Michael Heinzl found flaws that can lead to information disclosure or arbitrary code execution due to lack of proper validation that allows reads past the end of allocated data. An attacker who persuades a V SFT user to open a malicious project file can execute code with the victim s privileges and potentially take control of affected systems. It took roughly four months for the vendor to ship these patches after notification, and more than twenty security holes in the HMI programmer have been addressed recently despite limited details in the vendor s release notes.
'Categorically untrue' that China hacked UK intelligence systems, say officials

therecord.media · 9 months ago

There are claims from former senior adviser Dominic Cummings that in 2020 China compromised the United Kingdom's Strap system and large amounts of extremely sensitive classified information, and former security minister Tom Tugendhat said the gist of those claims was correct. Government spokespeople and former National Cyber Security Centre leadership rejected those assertions, with the Cabinet Office saying it is untrue that the systems used to transfer the most sensitive government information were compromised and former NCSC chief Ciaran Martin calling the claim categorically untrue and noting there was no NCSC operation of the kind described.
Architectures, Risks, and Adoption: How to Assess and Choose the Right AI-SOC Platform

thehackernews.com · 9 months ago

There are around nine hundred sixty alerts per day for the average organization and more than three thousand for large enterprises, with nearly forty percent of alerts going uninvestigated and sixty one percent of security teams admitting to overlooking alerts that later proved critical, so AI has moved from experimentation to execution inside the SOC with eighty eight percent of organizations planning to evaluate or deploy an AI driven SOC within the next year. There are four architectural dimensions to evaluate in AI SOC platforms: functional domain, ranging from agentic automation and agentic alert triage to analyst co pilot and workflow replication; implementation model, either user defined and configurable or pre packaged and vendor managed; integration approaches that include integrated platforms, connected overlay, and browser based workflow emulation; and deployment options such as vendor hosted SaaS, bring your own cloud, or air gapped on premise. There are major risks to weigh including lack of standardized benchmarks, opaque decision making that limits explainability and auditability, data residency and compliance concerns, vendor lock in, skill shift and change management, integration complexity, over reliance on automation, model drift, and pricing models that can erode economic benefits. There is a recommended phased adoption path that begins with defining the AI strategy and selecting core capabilities, runs a proof of concept with real alert data, enters a one to two month trust building phase where AI operates in assist mode while analysts validate decisions, then gradually enables autonomous responses for low risk events and operationalizes continuous retraining while measuring outcomes such as reduced triage time, fewer false positives, and shorter mean time to respond.
Hackers Deploy Linux Rootkits via Cisco SNMP Flaw in 'Zero Disco' Attacks

thehackernews.com · 9 months ago

Cybersecurity researchers disclosed a campaign called Operation Zero Disco that exploited a stack overflow in the SNMP subsystem of Cisco IOS and IOS XE to deploy Linux rootkits on older, unprotected devices. The attackers weaponized CVE-2025-20352 with a CVSS score of 7.7 and also attempted to leverage a modified Telnet flaw based on CVE-2017-3881 to enable arbitrary memory read and write, targeting Cisco 9400, 9300, and legacy 3750G series devices. The implanted rootkits set a universal password containing the string disco, installed hooks into the IOSd process to achieve remote code execution and persistence, and used fileless components that disappear after reboot while ASLR on newer models reduced but did not eliminate intrusion success. Cisco released a patch in late September 2025, but older systems without endpoint detection remained vulnerable and intrusions were observed using spoofed IPs and MAC addresses.
Mehrheit sieht Bedrohung durch hybride Angriffe

www.csoonline.com · 9 months ago

Eine YouGov-Umfrage im Auftrag des Digitalpolitik-Briefings Digitalwende von Süddeutsche Zeitung Dossier ergab, dass 61 Prozent der mehr als 2.000 repräsentativ befragten Personen Deutschland durch hybride Angriffe als stark oder sehr stark bedroht einschätzen, 25 Prozent die Bedrohung als gering und 3 Prozent als nicht vorhanden bewerten. Hybride Angriffe kombinieren Cyberangriffe, militärische Aktionen und die Verbreitung von Desinformation über soziale Netzwerke, wobei das Verteidigungsministerium erklärt, dass das Ziel darin bestehe, Gesellschaften zu destabilisieren und die öffentliche Meinung zu beeinflussen. Bei der Parteizugehörigkeit sehen 72 Prozent der Grünen Anhänger, 71 Prozent der Union Anhänger und 67 Prozent der SPD Anhänger eine starke oder sehr starke Bedrohung, während dies bei AfD Anhängern nur 49 Prozent sind.
Cisco Routers Hacked for Rootkit Deployment

www.securityweek.com · 9 months ago

Threat actors are exploiting CVE-2025-20352, a Cisco SNMP stack overflow zero day with a CVSS score of 7.7 that was patched in late September, to deploy a Linux rootkit on older unpatched Cisco devices including 9400, 9300, and legacy 3750G series. The campaign, tracked as Operation ZeroDisco, also used a modified exploit for CVE-2017-3881 to obtain memory read and write, set a universal password containing the word disco, and deploy a fileless backdoor while connecting VLANs for lateral movement. The rootkit monitors UDP packets, modifies IOSd memory to install the universal password, hides running-config items, bypasses ACLs for VTY, disables log history, and resets timestamps, and defenders are advised to contact Cisco TAC for low-level firmware and ROM investigation because automated detection tools are not universally reliable.
Cryptocurrency ATMs

www.schneier.com · 9 months ago

Cryptocurrency ATMs are being used to scam people out of their money. The fees charged at these machines are described as usurious, and scammers commonly direct victims to them to purchase cryptocurrency on their behalf. Companies operating the ATMs prioritize profit over preventing harm, allowing these scams to persist.
US Charges Cambodian Executive in Massive Crypto Scam and Seizes More Than $14 Billion in Bitcoin

www.securityweek.com · 9 months ago

The U.S. government seized more than fourteen billion dollars in bitcoin, about one hundred twenty seven thousand two hundred seventy one coins, and charged Prince Holding Group chairman Chen Zhi with wire fraud conspiracy and money laundering in an indictment unsealed October sixteenth, two thousand twenty five. Prosecutors say Chen and unnamed co conspirators ran a sprawling pig butchering investment fraud that exploited forced labor in Cambodian compounds where workers were held captive, beaten, and forced to contact victims to transfer cryptocurrency, with the scheme reportedly bringing in as much as thirty million dollars a day. U.S. and British authorities imposed sanctions on Chen and his company, the Treasury Department designated Prince Holding Group a transnational criminal organization, and prosecutors say laundered proceeds were used to buy yachts, private jets, rare artwork and luxury goods. If convicted, Chen faces up to forty years in prison, and officials noted that Americans lost at least ten billion dollars to Southeast Asia based scams in the previous year.
Operation Heracles strikes blow against massive network of fraudulent crypto trading sites

www.bitdefender.com · 9 months ago

German authorities, working with Europol and Bulgarian law enforcement, seized 1,406 bogus trading platforms on October 3, 2025 as part of Operation Heracles. Within ten days about 866,000 attempts to access the seized domains were recorded and visitors now see warning banners instead of the fake trading sites. The fraud network lured victims with professional looking platforms, fabricated profit displays, and call center pressure to extract and launder funds. Authorities warn scammers may be using artificial intelligence to mass produce convincing sites and advise watching for red flags such as unrealistic returns, high pressure tactics, escalating deposit requests, and difficulty withdrawing funds.
yIKEs (WatchGuard Fireware OS IKEv2 Out-of-Bounds Write CVE-2025-9242) - watchTowr Labs

www.reddit.com · 9 months ago

There is an out of bounds write vulnerability in the WatchGuard Fireware OS iked process affecting IKEv2 that can allow remote unauthenticated code execution, tracked as CVE-2025-9242 and rated critical with a CVSS 4.0 score of 9.3. It affects the mobile user VPN and branch office VPN when configured with a dynamic gateway peer and impacts Fireware OS versions 11.10.2 up to 11.12.4Update1 and 12.0 up to 12.11.3 and 2025.1, and a device may remain vulnerable after deleting certain VPN configurations if a static gateway branch office VPN is still present. The root cause is a stack based buffer overflow in the ike2ProcessPayloadCERT function where an identification field is copied into a fixed stack buffer without a length check, reachable pre authentication during the IKESAINIT followed by IKESAAUTH exchange. A patch adds an explicit length check and adjusts the buffer handling to mitigate CVE-2025-9242, and administrators are advised to apply updates and review VPN configurations.
US and UK Lead Record Cybercrime Operation in Southeast Asia

www.techrepublic.com · 9 months ago

The United States and the United Kingdom led their largest joint action to date against cybercriminal networks in Southeast Asia, imposing sanctions and restrictions aimed at groups running large scale online scams and laundering billions of dollars. One set of sanctions targeted 146 individuals and entities tied to the Prince Group transnational criminal organization led by Cambodian national Chen Zhi, and U K authorities also sanctioned Prince Holding Group and associates while a U S indictment was unsealed in the Eastern District of New York. FinCEN finalized a rule cutting Huione Group off from the U S financial system for laundering more than four billion dollars in virtual currency, investigators described alleged human trafficking and forced labor used to operate pig butchering scams, and designated assets were frozen with U S persons prohibited from transactions.
Four-Year Prison Sentence for PowerSchool Hacker

www.securityweek.com · 9 months ago

A Massachusetts college student named Matthew D. Lane was sentenced to four years in prison and three years of supervised release after pleading guilty in May 2025 to hacking and extorting two companies, including PowerSchool. Court documents say Lane and co conspirators extorted roughly three million dollars, obtained about two hundred thousand dollars from a telecommunications provider between April and May 2024, and accessed the school software provider network in September and December 2024 to steal names, addresses, dates of birth, phone numbers, email addresses, Social Security numbers, medical information and other data before demanding a 2.85 million dollar ransom in Bitcoin. Lane returned roughly one hundred sixty thousand dollars of illicit funds but most remains unaccounted for, and he was ordered to pay 14 million dollars in restitution and a 25 thousand dollar fine.
ThreatsDay Bulletin: $15B Crypto Bust, Satellite Spying, Billion-Dollar Smishing, Android RATs & More

thehackernews.com · 9 months ago

U.S. authorities seized fifteen billion dollars in cryptocurrency tied to an alleged forced labor scam network operating in Cambodia, Myanmar, and Laos and unsealed indictments and sanctions against entities and individuals linked to the scheme. Academics demonstrated that consumer grade satellite dishes can intercept unencrypted geostationary communications carrying military, corporate, and consumer data, leading some providers to begin encrypting their satellite links. Active threats include a WhatsApp worm linked to a banking trojan targeting Brazilian users, new Android RATs called GhostBat and HyperRat, fake Homebrew sites distributing stealers, and expansive smishing campaigns that have generated over one billion dollars in fraud. Vendors issued fixes for several disclosed vulnerabilities, including NVIDIA Display Driver for Linux CVE-2025-23280 and CVE-2025-23330 and Adobe Experience Manager CVE-2025-54246 through CVE-2025-54252.
F5 Hack: Attack Linked to China, BIG-IP Flaws Patched, Governments Issue Alerts

www.securityweek.com · 9 months ago

F5 disclosed a nation state cyberattack linked to China that used Brickstorm malware and a threat actor tracked as UNC5221, with attackers dwelling in F5 networks for at least twelve months and exfiltrating some files including BIG-IP source code and vulnerability information. Mandiant and CrowdStrike are assisting F5, which rotated signing certificates and keys, released patches for a large batch of BIG-IP vulnerabilities including more than two dozen rated high severity, and noted that most remotely exploitable flaws are denial of service issues while others require authentication or elevated privileges, with no evidence of supply chain tampering or access to NGINX or F5 Distributed Cloud and Silverline systems. U.S and U.K. cybersecurity agencies warned that the stolen source code and vulnerability data pose an imminent threat to organizations using F5 devices and issued guidance including a CISA emergency directive to inventory BIG-IP installations, install available patches no later than October thirty first, harden internet facing appliances, and disconnect end of support devices.
CISA Flags Adobe AEM Flaw with Perfect 10.0 Score — Already Under Active Attack

thehackernews.com · 9 months ago

On October 16, 2025 the U.S. Cybersecurity and Infrastructure Security Agency added a critical Adobe Experience Manager vulnerability to its Known Exploited Vulnerabilities catalog after evidence of active exploitation. The flaw, tracked as CVE-2025-54253 with a CVSS score of 10.0, stems from an exposed adminui debug servlet that evaluates attacker supplied OGNL expressions as Java code without authentication, enabling execution of arbitrary system commands with a single crafted HTTP request. Adobe says it affects AEM Forms on JEE versions 6.5.23.0 and earlier and was patched in version 6.5.0 0108 released in early August 2025 alongside CVE-2025-54254 rated 8.6, and federal civilian agencies are advised to apply fixes by November 5, 2025.
Smashing Security podcast #439: A breach, a burnout, and a bit of Fleetwood Mac

grahamcluley.com · 9 months ago

A critical infrastructure hack involved devices left with default passwords, perpetrators boasting about their access on Telegram, and a climactic takedown that left several cyber criminals publicly exposed and humiliated. The episode also highlights the human cost of defending organisations, noting stress and burnout among security staff and calling for better leadership culture to make security teams safer and more resilient.
Cisco IOS XE Software Secure Boot Bypass Vulnerabilities

sec.cloudapps.cisco.com · 9 months ago

Multiple vulnerabilities in Cisco IOS XE Software could allow an authenticated, local attacker with level-15 privileges or an unauthenticated attacker with physical access to an affected device to execute persistent code at boot time and break the chain of trust. These vulnerabilities are due improper validation of software packages. An attacker could exploit these vulnerabilities by placing a crafted file into a specific location on an affected device. A successful exploit could allow the attacker to execute persistent code on the underlying operating system. Because these vulnerabilities allow an attacker to bypass a major security feature of a device, Cisco has raised the Security Impact Rating (SIR) of this advisory from Medium to High. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-secboot-UqFD8AvC This advisory is part of the September 2025 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: September 2025 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication. <br/Security Impact Rating: High <br/CVE: CVE-2025-20313,CVE-2025-20314
'Mysterious Elephant' Moves Beyond Recycled Malware

www.darkreading.com · 9 months ago

A cyberespionage group tracked as Mysterious Elephant has shifted from recycling other groups' malware to deploying a compact, multistage toolkit of custom and open source code to target government and diplomatic entities across South Asia since early 2025. Initial access is gained through highly tailored spear-phishing and decoy documents that trigger a PowerShell downloader executed via legitimate tools such as curl and certutil, which then retrieves a C++ reverse shell called BabShell and subsequent in-memory loaders. The attackers use reflective PE loaders named MemLoader HidenDesk and MemLoader Edge to deploy backdoors and commercial implants including Remcos and VRAT, and they exfiltrate documents, images, and WhatsApp data using tools called Uplo, Stom, and ChromeStealer Exfiltrator while employing wildcard DNS to generate unique domains per victim to hinder tracking.
Capita to pay £14 million for data breach impacting 6.6 million people

www.bleepingcomputer.com · 9 months ago

The Information Commissioner’s Office fined Capita 14 million pounds for a 2023 data breach that exposed the personal information of 6.6 million people. Attackers linked to the Black Basta ransomware group gained access after a malicious file was downloaded on March 22, 2023, and although the breach was detected within ten minutes the infected device was not isolated for 58 hours, allowing lateral movement and the exfiltration of nearly one terabyte of data before ransomware was deployed. The ICO cited poor access controls, delayed response to security alerts, an understaffed security operations center, and a lack of regular penetration testing and risk management, and it reduced an initial proposed fine of 45 million pounds after Capita accepted liability, implemented security improvements, and offered protection services to affected individuals.
Cisco must share more information about effects of severe bugs on businesses, senator says

therecord.media · 9 months ago

There are two critical vulnerabilities, CVE-2025-30333 and CVE-2025-20362, affecting Cisco Adaptive Security Appliances that prompted the Cybersecurity and Infrastructure Security Agency to issue an emergency directive on September 25, 2025 ordering all federal civilian agencies to patch them. Senator Bill Cassidy asked Cisco CEO Chuck Robbins whether the company has identified specific threats to customers, how it is communicating security issues to the private sector, and whether the CISA guidance for federal agencies applies to private organizations after reports that at least one federal agency was breached. Cisco reported the campaign targeted ASA 5500-X Series devices, assessed with high confidence that the attacks were tied to actors behind the ArcaneDoor campaign, worked with multiple governments on the investigation, and declined to provide further comment.
PowerSchool hacker gets sentenced to four years in prison

www.bleepingcomputer.com · 9 months ago

A 19-year-old college student, Matthew D. Lane of Worcester, Massachusetts, was sentenced to four years in prison and ordered to pay 14 million dollars in restitution plus a 25,000 dollar fine after pleading guilty in May 2025 to federal charges including unauthorized access to protected computers, cyber extortion conspiracy, cyber extortion, and aggravated identity theft. Prosecutors say he and accomplices used credentials stolen from a subcontractor to breach PowerSchool's PowerSource customer support portal on December 19, 2024 and used a maintenance tool to download databases from 6,505 school districts, exposing personal data for 9.5 million teachers and 62.4 million students and demanding 2.85 million dollars in Bitcoin on December 28. PowerSchool paid a ransom to prevent a data leak though the amount paid is unclear, the attackers still attempted to extort individual districts, the company disclosed prior breaches in August and September 2024 using the same credentials, and the Texas attorney general filed suit alleging failure to protect data and misleading security practices.
Fake LastPass, Bitwarden breach alerts lead to PC hijacks

www.bleepingcomputer.com · 9 months ago

There is an ongoing phishing campaign impersonating LastPass and Bitwarden that sends fake breach alerts urging users to download a supposedly more secure desktop application. The distributed binary installs the Syncro MSP agent with a hidden tray icon and uses it to deploy ScreenConnect remote access, allowing attackers to control infected machines, deploy additional malware, steal data, and potentially access saved password vault credentials. The Syncro configuration disables Emsisoft, Webroot, and Bitdefender agents, Cloudflare is blocking the phishing landing pages, and users are advised to ignore such alerts, verify notices on official company channels, and never provide their master password.
F5 BIG-IP Environment Breached by Nation-State Actor

www.darkreading.com · 9 months ago

A nation state threat actor maintained long term persistent access to F5 product development and engineering knowledge management platforms for BIG-IP and exfiltrated files that included some BIG-IP source code and information about vulnerabilities F5 was mitigating. Some exfiltrated files contained configuration and implementation information for a small percentage of customers, while F5 found no evidence of access to its CRM, financial, support case management, iHealth systems, or NGINX source code or product development environment. F5 says it contained the incident, rotated credentials, strengthened access controls, improved inventory and patch management, enhanced monitoring and network security, advised customers to apply the latest BIG-IP updates, and CISA directed federal civilian agencies to inventory and update their BIG-IP products where necessary.
F5 releases BIG-IP patches for stolen security vulnerabilities

www.bleepingcomputer.com · 9 months ago

F5 released security updates on October 15, 2025 to address 44 BIG-IP and related vulnerabilities, including flaws stolen in a breach detected on August 9, 2025 after state-backed hackers exfiltrated source code and information on undisclosed issues. F5 said it has no evidence the stolen flaws have been exploited or disclosed and has not found modifications to its build or release pipelines, but urged customers to install updates for BIG-IP, F5OS, BIG-IP Next for Kubernetes, BIG-IQ, and APM clients immediately and to enable event streaming, remote syslog, and login monitoring for increased visibility. CISA issued an emergency directive requiring federal civilian agencies to apply patches by October 22 for core products and by October 31 for other F5 devices and to disconnect public facing devices that are end of support.
Meta Removes Facebook Group That Shared Information on ICE Agents

www.nytimes.com · 9 months ago

Meta removed a Facebook group used to track the location of Immigration and Customs Enforcement agents in Chicago after outreach from the Department of Justice, saying the group violated its policies against coordinated harm. Attorney General Pam Bondi said the page was being used to dox and target about 200 ICE agents and that the DOJ will continue engaging tech companies to eliminate platforms that could incite violence against federal law enforcement. The action follows recent removals of mobile apps by Apple and Google that flagged ICE activity, and neither Meta nor the DOJ provided detailed evidence about specific threats, prompting civil liberties advocates to raise free speech and transparency concerns.
Chinese Threat Group 'Jewelbug' Quietly Infiltrated Russian IT Network for Months

thehackernews.com · 9 months ago

There was a five month intrusion from January to May 2025 into a Russian IT service provider attributed to the China linked threat actor known as Jewelbug, signaling the group’s expansion beyond Southeast Asia and South America. Attackers accessed code repositories and software build systems and exfiltrated data to Yandex Cloud, while leveraging a renamed Microsoft Console Debugger executable to run shellcode and bypass application allowlisting, and also dumped credentials, established persistence via scheduled tasks, and cleared Windows event logs. The campaign reused known toolsets and malware families including FINALDRAFT also known as Squidoor, VARGEIT and COBEACON, abused legitimate cloud services and Microsoft Graph API for command and control, and leveraged bring your own vulnerable driver techniques with tools such as EchoDrv and KillAV to disable security software.
CISA warns of ‘significant’ threat to federal networks after nation-state hackers stole F5 source code, undisclosed bug info

therecord.media · 9 months ago

CISA has issued an emergency directive requiring all federal civilian agencies to apply the latest updates for at-risk F5 virtual and physical devices and downloaded software by October 22 and to report their F5 deployments by October 29, citing a significant threat after a nation-state actor obtained F5 BIG-IP source code and information on undisclosed vulnerabilities. F5 disclosed it discovered persistent unauthorized access beginning August 9, said files containing portions of BIG-IP source code and some customer configuration information were exfiltrated, and warned that the access could enable static and dynamic analysis to identify logical flaws and zero day vulnerabilities and the development of targeted exploits. F5 and CISA said F5 has removed the threat actors, found no evidence of software or supply chain modification, rotated credentials, deployed additional protections, and is offering supported customers a free CrowdStrike Falcon EDR subscription while stating they are not aware of active exploitation of undisclosed F5 vulnerabilities. The reporting also references prior exploitation of CVE 2023 46747 against BIG IP by China nexus actors, highlighting ongoing risks to widely deployed edge appliances.
F5 Says Nation-State Hackers Stole Source Code and Vulnerability Data

www.securityweek.com · 9 months ago

F5 was targeted by state sponsored hackers who maintained long term access to some systems and exfiltrated BIG-IP source code and information on undisclosed vulnerabilities. The company reports it is not aware of any non public vulnerabilities from the theft that are critical or that enable remote code execution and it has no evidence of active exploitation or of modification to its software supply chain, including NGINX or its cloud services. Some files taken from an engineering knowledge management platform contained configuration and implementation data for a small percentage of customers and those files are under review with affected customers to be notified if needed. F5 says it detected the intrusion on August 9, 2025, was given permission by the United States Department of Justice to delay disclosure, and disclosed the matter in an SEC filing dated October 15, 2025, with the attack profile pointing to China as the potential threat actor.
Webinar Today: Fact vs. Fiction – The Truth About API Security

www.securityweek.com · 9 months ago

A webinar on October 15, 2025 at 1 PM Eastern will present practical guidance to protect APIs and debunk common API security myths. Speakers will explain how attackers actually exploit API vulnerabilities, why legacy controls such as web application firewalls are often insufficient for modern API traffic, and which putative best practices are misleading. Attendees will receive actionable recommendations to strengthen API security for mobile apps and critical system integrations.
Human Risk Report Reveals Overconfidence in Phishing Defenses

www.techrepublic.com · 9 months ago

A survey of more than 1,700 IT leaders and end users found rising human driven cyber risk, with 68 percent of IT leaders reporting a breach in the past year and nearly two thirds of leaders and half of employees admitting to clicking malicious links. Generative AI use is widespread, with 80 percent of IT leaders and 63 percent of employees using AI for work and many admitting to entering confidential data, while only 54 percent of organizations enforce multifactor authentication for all users. Despite three quarters of leaders believing their organizations are safe, one in five leaders who clicked malicious links did not report the incident, senior leaders remain prime targets for phishing and malware, and punitive responses are increasing even though corrective training is associated with an 88 percent reduction in risk.
Mango says some customer information exposed in cyber incident

therecord.media · 9 months ago

Spain based fashion retailer Mango said an external marketing service provider suffered a data breach that exposed limited customer information while its own corporate systems were not compromised. The exposed information included customers first names, countries, postal codes, email addresses and phone numbers, and did not include last names, passwords or financial details such as credit card or banking information. Mango detected the incident over the weekend, activated security protocols, notified the Spanish Data Protection Agency and other authorities, and reported that its online operations were not disrupted. The company advised customers to watch for suspicious communications or requests for unusual actions.
How to spot dark web threats on your network using NDR

www.bleepingcomputer.com · 9 months ago

There are four essential steps to spot dark web threats with Network Detection and Response: know gateways such as Tor, I2P, and Freenet; understand NDR capabilities including AI driven behavioral analytics and long term metadata collection; and deploy sensors at strategic network segments to monitor north south and lateral traffic. Detection and hunting rely on a 30 day baselining plus automated alerts for Tor default ports 9001, 9030, and 9050, monitoring I2P ports 7650 to 7659 and P2P ports 6881 to 6889, watching for dot onion DNS queries and unusual TLS or certificate anomalies, flagging non standard VPN usage, geolocation and impossible travel anomalies, lateral movement, and C2 beaconing patterns. Augment detections with threat intelligence feeds, file analysis using Yara, and logging of VPN and protocol metadata to uncover data exfiltration and unauthorized access, and note that NDR platform features and packages can provide Tor visibility, encrypted traffic collection, VPN insights, and C2 detection to support investigations.
Singularity: Deep Dive into a Modern Stealth Linux Kernel Rootkit – Kyntra Blog

www.reddit.com · 9 months ago

Singularity is a loadable kernel module rootkit targeting Linux 6.x that demonstrates advanced evasion and persistence techniques, using ftrace-based syscall hooking to avoid directly altering the system call table. It hides processes and files by intercepting syscalls, including a trigger that hides a process and escalates its privileges when it receives signal 59, filters proc and directory listings via getdents and stat hooks, and adjusts link counts to reduce forensic anomalies. Additional stealth capabilities include a hidden network layer, kernel log sanitization, module auto-hide, taint flag manipulation, and other anti-forensic mechanisms, and the full source code is published for research and defensive analysis.
Instagram Goes PG-13 as Meta Reshapes Teen Safety and AI Content Rules

www.techrepublic.com · 9 months ago

There is a new default PG-13 setting for all Instagram accounts for users under 18 that hides or does not recommend posts with strong language, drug references, or risky viral stunts and applies age appropriate limits across Feed, Reels, Explore, Stories, comments, search, and AI features. Automated tools now block a wider range of mature search terms including misspellings, prevent teens from following or seeing content from accounts that frequently post adult or suggestive material, and stop links to restricted content in direct messages from opening. Parents can enable a stricter mode that removes teens ability to see, leave, or receive comments under certain posts, and Meta plans additional restrictions on AI conversations for teens by next year. A survey commissioned by Meta reported high parental approval with most parents saying the familiar PG-13 standard and the new controls make it easier to protect and understand what their teens might see.
F5 says hackers stole undisclosed BIG-IP flaws, source code

www.bleepingcomputer.com · 9 months ago

F5 disclosed that suspected nation state hackers breached its systems in early August, maintained long term access to the BIG-IP product development environment and engineering knowledge management platform, and exfiltrated portions of BIG-IP source code, information about undisclosed BIG-IP vulnerabilities, and some customer configuration and implementation data. F5 says it became aware of the intrusion on August 9, 2025, has not found evidence that the stolen vulnerability information was exploited or publicly disclosed, and reports no signs of software supply chain tampering or compromise of other product codebases. The U S government requested a delay in public disclosure, F5 validated the safety of BIG-IP releases through independent reviews, and the company is reviewing which customers were affected and will notify them while stating the incident had no material impact on operations.
Customer Service Firm 5CA Denies Responsibility for Discord Data Breach

www.securityweek.com · 9 months ago

Discord informed users on October 3 that some account data may have been compromised in a cybersecurity incident involving a third party, with exposed information including names, usernames, email addresses, limited billing details, IP addresses, messages with customer service agents, limited corporate data, and a small number of government ID images. Discord later attributed the breach to 5CA, which supports its customer service, but 5CA denied responsibility and said none of its systems were involved, that it does not handle government IDs for Discord, and that preliminary findings suggest human error outside its systems. Reports indicate the attackers targeted a Zendesk instance and claimed to have obtained 1.5 terabytes of age verification photos containing more than 2.1 million government issued IDs while Discord says about 70,000 users had government IDs compromised, and the group sought to extort Discord.
New York secures $14 million in fines from 8 car insurance companies after data breaches

therecord.media · 9 months ago

Eight car insurance companies will pay a combined 14.2 million dollars in fines to New York state after data breaches exposed the private information of more than 825,000 people. Investigators found that consumer-facing quote tools and agent-only pre-fill systems auto-populated sensitive fields including driver license numbers vehicle identification numbers and dates of birth from data broker records and lacked basic security controls such as multifactor authentication logging and monitoring, enabling attackers to use the information to file fraudulent unemployment claims. American Family faces the largest fine of 2.8 million while Liberty Mutual State Auto Metromile and Infinity will pay 2 million each and Farmers and Hagerty will pay 1.3 million each, and all companies must implement comprehensive security programs provide data inventories and improve authentication and monitoring with affected consumers offered one year of credit monitoring.
Flax Typhoon exploited ArcGIS to gain long-term access

www.csoonline.com · 9 months ago

An advanced persistent threat group named Flax Typhoon gained persistent access to ESRI ArcGIS servers for more than a year by modifying a Java Server Object Extension into a web shell that accepted base64 encoded commands in the layer parameter gated by a hardcoded key and used those commands to create a hidden Bridge workspace. The actor used the web shell to run additional encoded PowerShell commands, discovered a compromised service account with local administrator privileges, scanned internal networks over SSH, SMB and RPC, and established long term access by uploading a renamed SoftEther VPN executable into the Windows System32 directory while the malicious SOE was also preserved in system backups. Any organization that exposes ArcGIS servers externally or links them to internal systems is at risk because compromised extensions can enable silent observation, lateral movement and exfiltration of sensitive mapping and infrastructure data. Recommended actions include inventorying ArcGIS servers and every Server Object Extension and Server Object Interceptor, comparing binaries to vendor hashes, hunting for anomalous SOE JAR files hardcoded tokens and web shell indicators, isolating affected servers, rotating service accounts and secrets, rebuilding systems from known good media, enforcing code signing for extensions and improving detections for SOE abuse.
Introducing MAESTRO: A framework for securing generative and agentic AI

www.csoonline.com · 9 months ago

Generative and agentic artificial intelligence is advancing faster than traditional security frameworks, prompting the Cloud Security Alliance to introduce MAESTRO in 2025 to address systemic risks in multi agent AI ecosystems used by banks. MAESTRO organizes risk into seven interdependent layers: foundation models, data operations, agent frameworks, deployment and infrastructure, evaluation and observability, security and compliance, and the agent ecosystem, and recommends baseline controls including input and output validation, signed datasets and data lineage, per agent role based access control and scoped tokens, infrastructure as code scanning and container image signing, drift monitoring and immutable audit logs. Practical banking threats include poisoned transaction histories that bias credit scoring, manipulated fraud detection that causes missed alerts or false positives, conversational assistants leaking account information, and multi agent feedback loops that can freeze payments, with mitigations such as allowlisting and sandboxing of APIs, circuit breakers, prompt injection testing, continuous monitoring and regulatory explainability.
Capita given record £14 million fine over ransomware attack security failings

therecord.media · 9 months ago

Capita was fined fourteen million pounds by the U.K. Information Commissioner’s Office after a 2023 ransomware incident that exposed personal data for approximately 6.6 million people. An initial malicious JavaScript downloaded on March 22, 2023 led to Qakbot and Cobalt Strike deployments, a failure to quarantine the compromised device for fifty eight hours, and nearly one terabyte of data exfiltration before ransomware was deployed. The compromised information included names, addresses, dates of birth, and financial data including card numbers and CVVs, and the attack was claimed by the Black Basta ransomware group. The voluntary settlement is less than a third of the ICO’s originally proposed forty five million pound penalty and is the largest fine the regulator has issued in a ransomware case.
TigerJack’s malicious VSCode extensions mine, steal, and stay hidden

www.csoonline.com · 9 months ago

A threat actor group called TigerJack has been publishing malicious extensions to Microsoft Visual Studio Code and the OpenVSX registry that steal source code, deploy cryptominers, and maintain persistent remote access. Security researchers found at least 11 malicious extensions across three publisher accounts, with two packages called C plus plus Payground and HTTP Format exceeding 17,000 downloads before removal while variants remain active on alternative marketplaces and are reuploaded under new accounts. The extensions perform distinct roles including silent source code exfiltration, local cryptomining, and dynamic remote JavaScript execution that lets attackers push new payloads without updating the visible extension, enabling long term supply chain compromise and evasion of static scanners.
Deutsche Logistik schlecht vor Cyberattacken geschützt

www.csoonline.com · 9 months ago

Nearly 80 percent of logistics companies in Germany have experienced a cyberattack, based on a recent Sophos survey. Attacks most often occur at the interfaces with customers and suppliers, and 40 percent of firms reported being affected by security gaps or outages in the supply chain. Human error and low security awareness are cited as the largest cyber risks by 81 percent of respondents, and three quarters say a shortage of IT security staff weakens their defenses. Two thirds of companies embed IT security requirements in partner contracts but many do not regularly verify compliance, and recommended measures include supplier audits, targeted employee training, regular testing of incident and backup plans, timely system updates, and making cybersecurity a management responsibility.
How Attackers Bypass Synced Passkeys

thehackernews.com · 9 months ago

Synced passkeys inherit the risk of the cloud accounts and recovery processes that protect them, expanding enterprise attack surface through cloud account takeover, recovery abuse, and inadvertent syncing to personal accounts. Adversary in the middle phishing proxies can force authentication downgrades by spoofing unsupported browsers or steering users to weaker methods like SMS or one time passwords, allowing attackers to capture credentials and reuse sessions. Compromised browser extensions, XSS, or malicious autofill techniques can hijack WebAuthn flows, manipulate passkey registration or sign in, and exfiltrate stored logins and one time codes. Enterprises are advised to require device bound hardware backed passkeys, eliminate fallback authentication methods, enforce extension allowlists, capture attestation metadata at registration, and bind sessions to continuous device posture to mitigate these risks.