Blahalla

The Golden Scale: Bling Libra and the Evolving Extortion Economy

unit42.paloaltonetworks.com · 10 months ago

A cybercriminal conglomerate calling itself Scattered Lapsus Hunters, composed of groups including Bling Libra, Muddled Libra and LAPSUS, launched a data leak site and claims to have stolen more than one billion Salesforce records, demanding 989.45 million dollars with a deadline of October 10, 2025. Bling Libra is operating as an extortion as a service provider that takes roughly 25 to 30 percent of payments and is recruiting partners, including a newcomer called Crimson Collective which reportedly exfiltrated about 570 gigabytes from Red Hat GitLab repositories and is targeting AWS and other cloud environments. The FBI seized domains associated with BreachForums on October 9, 2025, disrupting the clearnet leak site while the actors assert core members were not arrested and that a darknet version remains, warning of a potential data release at 11 59 PM New York time on October 10, 2025. Retail and hospitality organizations face risks such as identity theft, social engineering, account takeover, returns and gift card fraud and loyalty rewards fraud, and are advised to scan code and repositories for exposed secrets, adopt zero trust controls including conditional access and least privilege, and participate in industry information sharing such as RH ISAC.
Houston suburb says some online services taken down by cyberattack

therecord.media · 10 months ago

On October 10, 2025 officials in Sugar Land Texas said a cyberattack caused technology outages and impacted several online services. The city said it experienced a cyber event and is working with state and federal law enforcement to investigate a breach of internal network infrastructure. Critical infrastructure and emergency services remain operational, but services including bill pay, the 311 contact center, utility billing, permit and inspection scheduling, permit payments and building applications were unavailable and an alternative number was provided for non emergency issues.
Windows 11 23H2 Home and Pro reach end of support in 30 days

www.bleepingcomputer.com · 10 months ago

Windows 11 version 23H2 Home and Pro editions will reach end of servicing on November 11, 2025, and the November 2025 monthly security update will be the last update available for those editions. Enterprise, Education, and IoT Enterprise editions of 23H2 will remain under mainstream support until November 2026, and users are advised to upgrade to Windows 11 24H2 or to the Windows 11 2025 Update known as 25H2. Devices not managed by IT will generally receive the 24H2 update automatically, but some PCs may be blocked from upgrading due to a safeguard hold for SenseShield Technology code obfuscation drivers.
Apple bumps RCE bug bounties to $2M to counter commercial spyware vendors

www.csoonline.com · 10 months ago

There are new CPU and OS memory safety features called Memory Integrity Enforcement on Apple A19 and A19 Pro chips that protect the kernel and more than seventy userland processes and make memory corruption exploits much harder to develop. As a result, Apple has raised bug bounty payouts, including two million dollars for zero click system level remote code execution, one million dollars for one click remote and proximity attack chains, and five hundred thousand dollars for application sandbox escapes and attacks requiring physical access, with additional bonuses for Lockdown Mode bypasses and beta reports that can push a maximum payout above five million dollars, the program introduces target flags to speed verification, and one thousand iPhone 17 devices will be provided to civil society organizations for distribution to high risk individuals. Apple has fixed multiple zero day exploits recently, including CVE-2025-43300 in ImageIO and CVE-2025-55177 in WhatsApp that were chained to target about two hundred individuals.
RondoDox Botnet: an 'Exploit Shotgun' for Edge Vulns

www.darkreading.com · 10 months ago

RondoDox takes a hit and run, shotgun approach to compromising internet exposed edge devices by trying many exploits until one succeeds. It began activity in May and has expanded to exploit 56 publicly known vulnerabilities across routers, DVRs, NVRs, web servers, CCTV systems and other networking devices worldwide. Fifty of those vulnerabilities are command injection flaws and thirty eight have been assigned Common Vulnerabilities and Exposures identifiers. RondoDox also functions as a loader for Mirai and Morte, uses multi architecture payloads for embedded devices, and focuses on unmanaged consumer gear that often never gets patched, increasing the potential scale of infections.
Hackers exploiting zero-day in Gladinet file sharing software

www.bleepingcomputer.com · 10 months ago

Threat actors are exploiting a zero day vulnerability CVE 2025 11371 in Gladinet CentreStack and Triofox that allows a local attacker to access system files without authentication. The flaw is a local file inclusion vulnerability affecting default installations and all versions including the latest release, and it was used to read the Web.config machine key which enabled remote code execution via a prior deserialization bug CVE 2025 30406. No patch is available yet, at least three companies have been targeted, and researchers and the vendor published a workaround that removes a temp handler line from the UploadDownloadProxy Web.config to mitigate exploitation while warning some functionality will be impacted.
FBI seizes BreachForums servers as threatened Salesforce data release deadline approaches

www.csoonline.com · 10 months ago

A coordinated law enforcement operation led by the US Department of Justice, the FBI, and international partners seized BreachForums domains and backend infrastructure on October 9, 2025, disrupting archives and escrow payment data. The BreachForums-linked group had threatened to leak nearly one billion records it claimed were stolen from Salesforce customers unless Salesforce paid a ransom by October 10, 2025 at 11:59 p.m. Eastern Time, and a separate dark web leak site remains active as the campaign continues. Security experts say the seizure may yield intelligence but will not stop the broader threat and urge enterprises to harden SaaS configurations by enforcing OAuth app governance, applying least privilege, rotating keys and tokens, shortening session lifetimes, enabling automated revocation on anomalies, and requiring step up authentication for high risk actions.
The Fight Against Ransomware Heats Up on the Factory Floor

www.darkreading.com · 10 months ago

Ransomware gangs increasingly target the manufacturing sector, using ransomware as a service, data extortion, and AI enabled tactics to cause operational disruption and extract payments. Research shows manufacturing was the top target recently, accounting for twenty two percent of reported attacks between April 2024 and March 2025, and one analysis found manufacturing made up sixty five percent of incidents in the second quarter of 2025. Security gaps such as legacy operational technology, poor patch management, and inadequate network segmentation leave manufacturers exposed, with experts reporting seventy five percent have critical vulnerabilities and sixty five percent have at least one known exploited vulnerability; recommended defenses include timely patching, unified IT and OT visibility, strong segmentation, multifactor authentication, least privilege and zero trust access, and proactive third party risk management.
Cybersecurity For Dummies, 3rd Edition eBook FREE for a Limited Time

www.bleepingcomputer.com · 10 months ago

A free ebook offer makes Cybersecurity For Dummies third edition available at no cost through October 22, 2025, a twenty nine dollars and ninety nine cents value that requires a short registration with the distributor. Written by cybersecurity expert Joseph Steinberg, the book covers threat landscape awareness, personal security fundamentals, business cybersecurity, network and infrastructure protection, and data protection and privacy, and the distributor collects registration and contact information while the publishing site receives a commission.
FBI takedown banner appears on BreachForums site as Scattered Spider promotes leak

therecord.media · 10 months ago

Law enforcement in the United States and France seized the BreachForums domain and replaced it with a banner bearing FBI and French cybercrime unit insignia hours before Scattered Spider and affiliate groups planned to publish data they said were stolen from Salesforce customers. Scattered Spider had revived the forum to extort 39 high profile Salesforce customers, claimed to have access to roughly one billion records and linked the campaign to a recent Salesloft breach, and said the seizure would not stop their planned leak. The FBI had warned Salesforce customers that the campaign began in October 2024 through social engineering of call centers, and BreachForums has been repeatedly taken down since 2023 when its alleged administrator was arrested.
Google Chrome to revoke browser notifications for inactive sites

www.bleepingcomputer.com · 10 months ago

Google is updating the Chrome browser on desktop and Android to automatically revoke notification permissions for websites that have not been visited recently to reduce notification overload. The feature targets sites that send a high volume of notifications with very low user engagement, and internal testing showed it sharply reduced notification overload while increasing engagement for sites that sent fewer notifications. Chrome will notify users when notification access is revoked, allows easy restoration through the Safety Check tool or by revisiting and re-enabling notifications, and users can disable the automatic revocation if they prefer.
Apple now offers $2 million for zero-click RCE vulnerabilities

www.bleepingcomputer.com · 10 months ago

Apple has overhauled its Security Bounty program, doubling the top award to two million dollars for zero click remote code execution chains and stating that bonus criteria can raise a payout to more than five million dollars. Other top awards include one million dollars for one click remote attacks, one million dollars for wireless proximity exploits, one million dollars for broad unauthorized iCloud access, five hundred thousand dollars for app sandbox escapes and locked device attacks, and the company says it has awarded about thirty five million dollars to more than eight hundred researchers since 2020. Apple plans to provide a thousand secured iPhone 17 devices to civil society organizations in 2026, expand its Security Research Device program with applications open through October 31, 2025, and pointed to defenses such as Lockdown Mode and Memory Integrity Enforcement as reasons for the increased incentives.
SonicWall data breach affects all cloud backup customers

www.csoonline.com · 10 months ago

Security vendor SonicWall confirmed that backup files configured for the MySonicWall cloud backup service were stolen and that all customers using the cloud backup feature were affected after initially saying fewer than five percent were impacted. The stolen files include encrypted credentials and firewall configuration data, and although encryption remains in place possession of those files could increase the risk of targeted attacks because configuration files can expose user, group, and domain settings, DNS and log settings, and certificates that threat actors can leverage. SonicWall is urging customers and partners to check devices for updates, has published a prioritized list of affected devices categorized as Active High Priority for internet exposed devices Active Lower Priority for devices without internet access and Inactive for devices not seen for 90 days, and has provided a detailed remediation playbook for administrators.
Feds Shutter ShinyHunters Salesforce Extortion Site

www.darkreading.com · 10 months ago

On October 10, 2025, United States and French law enforcement seized the BreachForums domain that had been converted into an extortion site used by Scattered Lapsus Hunters, the group behind recent Salesforce data thefts. The gang said victims had until midnight Eastern on October 10, 2025 to meet ransom demands and claimed it will use a still accessible Tor site to publish stolen Salesforce records and other data. The group claims to possess about one billion records and lists 39 victim organizations including Chanel, Disney, Hulu, Marriott, Google, Toyota, and FedEx, while Salesforce said there is no indication that the Salesforce platform itself was compromised. Authorities reportedly seized BreachForums backups and escrow databases and destroyed backend servers, and the group warned of imminent law enforcement crackdowns even as it said no members had been arrested so far.
Microsoft violated EU law in handling of kids’ data, Austrian privacy regulator finds

therecord.media · 10 months ago

Austria's data protection authority ruled that Microsoft illegally tracked students using Microsoft 365 Education by failing to give them access to their data and by using cookies without consent. The decision follows a 2024 complaint by privacy group noyb and a parent who said they could not give consent to cookies or obtain information on how the child's data was used. The regulator ordered Microsoft to provide the complainant access to their data and to explain more clearly how it uses data collected through the education software. Microsoft said it will review the decision and that Microsoft 365 for Education meets data protection standards and can be used in compliance with GDPR.
BreachForums seized, but hackers say they will still leak Salesforce data

www.bitdefender.com · 10 months ago

Law enforcement agencies in the United States and France have seized control of domains and backend servers linked to the BreachForums hacking forum, while a Tor based leak site and dark web mirrors remain active. Authorities reportedly obtained backups of the forum's databases stretching back to 2023, but no public arrests of BreachForums administrators were announced alongside the seizure. A hacking collective calling itself Scattered LAPSUS Hunters says it still plans to leak one billion records allegedly belonging to Salesforce customers and has listed dozens of affected organizations including Adidas, Cartier, Chanel, Cisco, FedEx, IKEA, McDonald’s, Qantas, Toyota, and Walgreens. Salesforce reportedly confirmed it will not pay a ransom.
A one-click button to protect your privacy is finally real

www.washingtonpost.com · 10 months ago

California has a newly signed law that requires all web browsers to offer a one-time checkbox that, once selected, will command sites not to sell or share personal information, and the measure goes into effect in early 2027. Paired with a do-not-call-type system, starting on January 1 California residents will be able to fill out a single online form to repeatedly wipe their data from hundreds of data brokers. People outside California can obtain similar protections now by using browsers and tools that act as opt-out agents, such as DuckDuckGo, Brave, Firefox, the Privacy Badger extension and the Permission Slip service, which send legally binding opt-out orders or automate deletion requests.
WhatsApp Worm Targets Brazilian Banking Customers

news.sophos.com · 10 months ago

There is an ongoing WhatsApp worm campaign that began on September 29, 2025 and targets users in Brazil by sending self propagating messages via WhatsApp Web that include ZIP archives containing malicious LNK files. If executed on a desktop the LNK launches obfuscated PowerShell which downloads further stages from command and control domains, attempts to add exclusions to Microsoft Defender and disable UAC, and then either drops a Selenium instance to hijack WhatsApp sessions for propagation or installs a banking trojan called Maverick that monitors browser traffic for Brazilian banks and cryptocurrency exchanges. Researchers detected first stage PowerShell activity in over 400 customer environments across more than 1,000 endpoints, observed multiple C2 domains and naming patterns, and noted detections that could indicate attempted exploitation of CVE-2022-29072.
DDoS Botnet Aisuru Blankets US ISPs in Record DDoS

krebsonsecurity.com · 10 months ago

Aisuru, an Internet of Things botnet, is drawing most of its attack traffic from compromised consumer devices hosted on U.S. Internet providers such as AT&T, Comcast, Charter, T Mobile and Verizon, and that concentration is causing collateral outages for ordinary customers. Operators have combined multiple botnets to launch record DDoS floods, including a brief 29.6 terabits per second traffic burst and previous sustained attacks topping 22 terabits and 15 terabits against gaming infrastructure. The botnet has grown to an estimated 300,000 infected hosts by exploiting insecure firmware and default device settings and is reported to have pushed malicious scripts via a compromised Totolink firmware update server. Its operators are renting the network as residential proxies and offering DDoS for hire, prompting industry calls for universal outbound DDoS suppression by ISPs.
Chinese Hackers Use Velociraptor IR Tool in Ransomware Attacks

www.darkreading.com · 10 months ago

Storm-2603 abused the open source DFIR tool Velociraptor to maintain stealthy persistent access and to help deploy Warlock, LockBit, and Babuk ransomware that encrypted VMware ESXi virtual machines and Windows servers. After initial access the attackers installed an outdated Velociraptor agent version 0.73.4.0 that was exposed to a privilege escalation flaw tracked as CVE-2025-6264, enabling arbitrary command execution and endpoint takeover. Defenders are advised to verify Velociraptor instances are legitimate and updated, check for unexpected velociraptor.exe services or scheduled tasks, and follow vendor guidance to patch and detect misuse to mitigate ongoing abuse.
Microsoft Adds Agentic AI Capabilities to Sentinel

www.darkreading.com · 10 months ago

Microsoft is expanding Sentinel from a SIEM into a broader security operations and management platform by adding security graph capabilities and a Model Context Protocol server that introduce agentic AI to accelerate detection and remediation. The graph enables Security Copilot agents to correlate telemetry, predict attacker movements, and prioritize responses, while the MCP server supports pre defined and custom agents, offers tools such as an Entity Analyzer and natural language queries, and integrates with development platforms like VS Code and GitHub Copilot. The Sentinel graph and MCP server are in public preview, Sentinel Data Lake is generally available, and a new Microsoft Security Store will onboard partners to extend third party and internal agent integrations to help reduce SOC alert overload.
Copilot on Windows can now connect to email, create Office docs

www.bleepingcomputer.com · 10 months ago

Microsoft upgraded Copilot on Windows to connect to email accounts and generate Office documents from prompt outputs, rolling the feature out to Insider Channels for systems with Copilot version 1.25095.161.0 and higher. The connectors are opt in and must be enabled in the Copilot app settings, allowing Microsoft and third party accounts including OneDrive, Outlook, Google Drive, Gmail, Google Calendar, and Google Contacts to be linked so Copilot can search and summarize emails, files, and calendars. Answers longer than 600 characters now include an export button to save text directly as Word, PowerPoint, Excel, or PDF files, and Microsoft is gradually rolling the update to Insiders while requesting feedback.
Deepfake Awareness High at Orgs, But Cyber Defenses Badly Lag

www.darkreading.com · 10 months ago

Most organizations recognize that AI augmented deepfakes are a growing threat, yet their technical defenses are lagging behind despite high confidence in readiness. An Ironscales survey found that eighty five percent of midsized firms encountered deepfake or AI voice fraud and fifty five percent suffered financial losses, with Dark Reading reporting an adjusted average loss of one hundred sixty seven thousand dollars and a mean of two hundred eighty thousand dollars skewed by outliers. Attackers are leveraging large language models and human digital twin techniques to craft convincing phishing and audio deepfakes, and CrowdStrike warned audio deepfakes were on track to double in 2025. Although eighty eight percent of companies provided deepfake training and seventy one percent view deepfake defense as a top priority, two thirds have not invested in AI detection tools, leaving experts to urge AI augmented detection, stronger policies, and multi person authorization for financial transactions.
Stealit Malware Abuses Node.js Single Executable Feature via Game and VPN Installers

thehackernews.com · 10 months ago

Cybersecurity researchers disclosed an active Stealit malware campaign that abuses Node.js Single Executable Application feature and, in some variants, the Electron framework to distribute payloads via counterfeit game and VPN installers uploaded to file sharing sites and Discord. The fake executables perform anti analysis checks, then retrieve main components from a command and control server, write a Base64 encoded 12 character authentication key to a temporary cache.json file for C2 authentication, and configure Microsoft Defender exclusions to hide downloaded components. Three downloaded binaries named savedata.exe, statsdb.exe and gamecache.exe extract browser, messenger and cryptocurrency wallet data, steal game related data, establish persistence, stream victims screens, execute arbitrary commands, transfer files, and enable remote access or ransomware deployment, while the operators market the malware as a subscription service with pricing for Windows and Android tools.
Living off Node.js Addons

www.reddit.com · 10 months ago

Compiled Node.js native modules called.node files are binary extensions that run with the same privileges as the Node.js process, can call system APIs, and on macOS can use Objective C++ to access native APIs, enabling arbitrary code execution outside the JavaScript sandbox. Electron applications often use ASAR archives and an optional ASAR integrity check that verifies a header hash at runtime, but integrity is disabled by default, can be bypassed, and compiled.node binaries must be unpacked to app.asar.unpacked where a local attacker can modify or replace them similar to DLL hijacking. The authors released two tools: an Electron ASAR scanner to detect apps without ASAR integrity protection and NodeLoader, a simple native addon compiler capable of launching macOS applications and shell commands.
More Than DoS (Progress Telerik UI for ASP.NET AJAX Unsafe Reflection CVE-2025-3600) - watchTowr Labs

www.reddit.com · 10 months ago

watchTowr Labs disclosed CVE-2025-3600, an unsafe reflection flaw in Progress Telerik UI for ASP.NET AJAX that by default enables denial of service and can be chained to achieve remote code execution. The flaw stems from attacker control of the prtype parameter which is passed to Type.GetType and then instantiated via Activator.CreateInstance, allowing gadgets such as System.Management.Automation.Remoting.WSManPluginManagedEntryInstanceWrapper to crash applications. The research demonstrates chaining CVE-2025-3600 with CVE-2025-34509 to achieve pre authentication RCE against Sitecore, and references prior Telerik issues CVE-2017-9248 and CVE-2019-18935, with a related watchTowr post mentioning CVE-2025-61882. Affected releases span 2011.2.712 through 2025.1.218, and Progress released patch 2025.1.416 on April 30 2025 with the advisory and CVE published on May 14 2025.
In Other News: Gladinet Flaw Exploitation, Attacks on ICS Honeypot, ClayRat Spyware

www.securityweek.com · 10 months ago

Researchers reported active exploitation of vulnerabilities in Gladinet CentreStack and Triofox, following earlier exploitation of CVE 2025 30406 and new unauthenticated local file inclusion exploitation of CVE 2025 11371, and Gladinet is providing a workaround while a patch is developed. StrikeReady warned that Zimbra CVE 2025 27915 was used to target Brazil’s military via a malicious ICS calendar file, and attackers have been exploiting a critical Service Finder Bookings WordPress plugin flaw tracked as CVE 2025 5947, which was patched on July 17 and saw exploitation activity beginning August 1. Microsoft flagged a group it tracks as Storm 2657 targeting US universities with social engineering to hijack HR accounts and divert payrolls, and Forescout honeypots observed ICS attacks linked to Russia and Iran including attempts by TwoNet to deface HMIs and disrupt processes. Zimperium detailed ClayRat Android spyware targeting Russian users via Telegram channels and phishing sites that can steal SMS messages, notifications, call logs, take photos, and perform actions on infected devices, and University of California researchers disclosed the Mic E Mouse method that uses high performance mouse sensors to eavesdrop on speech induced vibrations.
From Lab to Leadership: How VMware Certification Transformed My Career

www.bleepingcomputer.com · 10 months ago

NULL
Commentary Section Launches New, More Opinionated Era

www.darkreading.com · 10 months ago

NULL
Microsoft Warns of ‘Payroll Pirates’ Hijacking HR SaaS Accounts to Steal Employee Salaries

thehackernews.com · 10 months ago

Microsoft warns that threat actor Storm-2657, in a campaign dubbed Payroll Pirates, is hijacking employee accounts to divert salaries by targeting HR SaaS platforms such as Workday, with a focus on U.S. higher education. The attackers use adversary in the middle phishing to harvest credentials and MFA codes, gain access to Exchange Online, abuse single sign on to take over Workday profiles, enroll their own phone numbers as MFA devices, create inbox rules to delete warning emails, and change payment routing to attacker-controlled accounts. Microsoft observed 11 compromised accounts at three universities since March 2025 that were used to send phishing to nearly 6,000 accounts across 25 universities, and said the campaign exploits social engineering and missing phishing resistant MFA rather than software vulnerabilities. Microsoft recommends adopting passwordless, phishing resistant MFA such as FIDO2 security keys and auditing accounts for unknown MFA devices and malicious inbox rules.
Cisco, Fortinet, Palo Alto Networks Devices Targeted in Coordinated Campaign

www.securityweek.com · 10 months ago

GreyNoise found that exploitation attempts against Cisco, Fortinet, and Palo Alto Networks devices originate from IPs on the same subnets, share TCP fingerprints, and show synchronized activity, indicating a coordinated campaign likely driven by the same actor or actors. The firm tied early September scanning of Cisco ASA to two Cisco zero day vulnerabilities tracked as CVE-2025-20333 with a CVSS score of 9.9 and CVE-2025-20362 with a CVSS score of 6.5 that were exploited in the ArcaneDoor espionage campaign. GreyNoise observed a 500 percent spike in scanning against Palo Alto Networks GlobalProtect portals that grew to roughly 2,200 unique IPs and over 1.3 million unique login attempts, and it published the credentials used, while simultaneous brute force attacks targeted Fortinet VPNs. The company warned that spikes in activity targeting firewall and VPN products often precede vulnerability disclosures within about six weeks and recommended blocking IPs that brute force Fortinet SSL VPNs and hardening firewall and VPN defenses.
In N.J. Governor’s Race, Energy Costs Have Become a Central Issue

www.nytimes.com · 10 months ago

Energy costs have become a central issue in the governor’s race between Jack Ciattarelli, the Republican, and Representative Mikie Sherrill, the Democrat.
Datenleck bei SonicWall betrifft alle Cloud-Backup-Kunden

www.csoonline.com · 10 months ago

Am 17. September gab SonicWall bekannt, dass Cyberkriminelle Backup-Dateien aus der MySonicWall-Cloud entwendet hatten; zunächst sprach das Unternehmen von weniger als fünf Prozent der Kunden, inzwischen räumt es ein, dass alle Kunden mit aktivierter Cloud-Backup-Funktion betroffen sind. Die gestohlenen Dateien enthalten verschlüsselte Zugangsdaten und Konfigurationsdaten, und SonicWall warnt, dass deren Besitz trotz Verschlüsselung gezielte Angriffe erleichtern kann. Sicherheitsexperten betonen, dass Firewall-Konfigurationsdateien sensible Informationen wie Benutzer, Gruppen, Domänen, DNS- und Protokolleinstellungen sowie Zertifikate enthalten können, die von Bedrohungsakteuren inklusive staatlicher Gruppen und Ransomware-Organisationen missbraucht werden. SonicWall fordert Kunden und Partner auf, Geräte auf Updates zu prüfen, hat eine nach Dringlichkeit sortierte Liste betroffener Geräte veröffentlicht und ein detailliertes Remediations-Playbook bereitgestellt.
Finland’s trial of men charged over Baltic Sea cable damage hits choppy waters

therecord.media · 10 months ago

The Helsinki District Court ruled Finland lacked jurisdiction to try three senior officers of the oil tanker Eagle S for alleged damage to undersea cables in December 2024, and the deputy prosecutor general has appealed so the case will go to the Helsinki Court of Appeal. Prosecutors say the Eagle S dragged its anchor for almost 62 miles, severing multiple subsea cables including the Estlink 2 power cable and four telecommunications cables, and charged the captain and two senior officers with aggravated criminal mischief and aggravated interference with communications; the defendants deny the charges. The court said jurisdiction over incidents in international waters rests with the sailors' states of citizenship, Georgia and India, or the vessel's flag state, the Cook Islands, a finding experts warn could make it difficult to prosecute damage to subsea infrastructure and could expose Finland to defendants' legal costs and potential civil claims by the ship owner.
Pro-Russian hackers caught bragging about attack on fake water utility

therecord.media · 10 months ago

Cybersecurity firm Forescout deployed a honeypot that mimicked a Dutch water utility and discovered that a pro-Russian hacktivist group named TwoNet had infiltrated the decoy while claiming to have disrupted a real facility. The intruder using the alias Barlati defaced the fake login page, altered configuration settings, and disabled alarms, actions that could have been disruptive if performed on an actual system. Forescout said the incident shows inexperienced hacktivists are moving from DDoS and defacement activity toward targeting operational technology and industrial control systems while sometimes misreading targets or tripping over honeypots. TwoNet, which emerged in early 2025 and announced a shutdown in late September, reflects a wider trend of groups inflating capabilities and blurring propaganda with real operations.
RondoDox Botnet Takes ‘Exploit Shotgun’ Approach

www.securityweek.com · 10 months ago

RondoDox is a botnet that uses a shotgun approach, packing over 50 exploits to compromise unpatched routers, DVRs, NVRs, CCTV systems, web servers and other network devices across more than 30 vendors. It began activity in mid 2025 and has been linked to exploitation of CVE-2023-1389, later targeting CVE-2024-3721 and CVE-2024-12856, and now aims at 56 vulnerabilities including 18 without CVE identifiers, some of which are on CISA’s KEV list. Operators rapidly rotate infrastructure and distribute RondoDox alongside Mirai and Morte via a loader as a service, abusing infected devices for cryptocurrency mining, DDoS attacks and lateral access into enterprise networks while targeting ARM, MIPS and various Linux architectures.
Open-source DFIR Velociraptor was abused in expanding ransomware efforts

www.csoonline.com · 10 months ago

Researchers at Cisco Talos found China linked group Storm 2603 abusing the open source DFIR tool Velociraptor in a coordinated ransomware campaign that deployed Warlock, LockBit, and Babuk against Windows servers and VMware ESXi hosts. Attackers used an outdated Velociraptor version 0.73.4.0 that exposed a privilege escalation flaw tracked as CVE 2025 6264, allowing command execution, persistent access, and tunneling to command and control. Talos recommends verifying Velociraptor integrity and updating to version 0.73.5 or later to patch CVE 2025 6264 and prevent abuse of the tool for stealthy persistence and ransomware deployment.
Supply Chain Attack Vector Analysis: 250% Surge Prompts CISA Emergency Response

www.reddit.com · 10 months ago

CISA's emergency directive reports a 250 percent increase in supply chain attacks from 2021 to 2024, rising from 62 to 219 incidents, with third party vendor compromise accounting for 45 percent of incidents. Supply chain attacks show longer average dwell time, 287 days versus 207 days for direct attacks, a significant detection gap, and higher cost at 5.12 million dollars compared with 4.45 million dollars for direct attacks. The directive emphasizes implementing zero trust architecture, requiring software bills of materials and continuous vendor risk assessment, highlights Massachusetts as a high risk area, and the post requests experiences and tools for SBOM implementation.
From Detection to Patch: Fortra Reveals Full Timeline of CVE-2025-10035 Exploitation

thehackernews.com · 10 months ago

Fortra disclosed a timeline showing active exploitation since at least September 11, 2025 of CVE-2025-10035, a critical deserialization flaw in the GoAnywhere Managed File Transfer License Servlet that can allow unauthenticated command injection. The company began investigating on September 11, released a hotfix on September 12, shipped patched releases 7.6.3 and 7.8.4 on September 15, and the CVE was formally published on September 18, 2025. Microsoft linked the exploit to a threat it tracks as Storm 1175 which deployed Medusa ransomware, and Fortra said the impact is limited to on premises admin consoles exposed to the public internet while recommending restricting console access, enabling monitoring, and keeping software up to date.
Here’s a big reason to think twice before buying a smart ring

www.washingtonpost.com · 10 months ago

A Washington Post Help Desk article reports that smart rings can experience battery failures including swelling, citing a viral incident in which a Samsung Galaxy Ring's flexible battery expanded and squeezed the wearer’s finger. The piece explains that the tiny, bendable cells required for ring form factors are vulnerable to mechanical and environmental stress and often show steep battery life declines around the one year mark, with users reporting bulging and reduced capacity. Experts say electrolyte breakdown and gas buildup can cause swelling and that current ring designs place the battery inward so any expansion presses into the finger, while companies like Samsung and Oura say they handle safety and customer support issues; readers are urged to weigh the convenience against potential battery headaches.
Autonomous AI Hacking and the Future of Cybersecurity

www.schneier.com · 10 months ago

Bruce Schneier argues that AI agents can now autonomously perform all phases of cyberattacks at machine speed and scale, creating a potential tipping point that could outpace human and institutional patching and defensive responses. He cites demonstrations such as XBOW submitting over one thousand vulnerabilities to HackerOne, DARPA AI Cyber Challenge teams finding fifty four vulnerabilities in four hours, Google’s Big Sleep finding dozens, LLMs embedded in Russian malware and Claude based ransomware, and commercial tools like HexStrike AI and Villager that automate attack chains. While AI can also empower defenders by transforming vulnerability research, enabling VulnOps, continuous discovery and repair, and self healing networks, Schneier warns these shifts raise concerns about patch correctness, liability, vendor relationships, and the attacker defender balance.
ChatGPT’s Platform Play + a Trillion-Dollar GPU Empire + the Queen of Slop

www.nytimes.com · 10 months ago

The New York Times Hard Fork coverage of OpenAI’s DevDay says the company laid out an ambitious plan to fold large parts of the internet into ChatGPT by introducing in‑chat apps, an Apps SDK, AgentKit for agents, and model updates including GPT‑5 Pro and Sora 2. It reports a significant infrastructure partnership with AMD to supply massive GPU capacity and equity or warrant arrangements, signaling deeper vertical integration and reshaped industry alliances. The hosts express concern about centralizing user interactions and data in ChatGPT, potential disruption to app stores and search, and questions about privacy, monetization, and the sustainability of OpenAI’s aggressive dealmaking.
The AI SOC Stack of 2026: What Sets Top-Tier Platforms Apart?

thehackernews.com · 10 months ago

The Hacker News article argues that the SOC of 2026 will shift from prompt dependent copilots to autonomous mesh agentic architectures that coordinate specialized AI agents across triage, correlation, evidence assembly, and incident response. It identifies seven core capabilities that separate top tier AI SOC platforms from the rest, including multi tier incident handling, contextual intelligence, non disruptive integration, adaptive learning with telemetry feedback, agentic AI architecture, transparent metrics and staged AI trust frameworks. The piece spotlights Conifers.ai CognitiveSOC as an example, noting vendor claimed benefits such as reducing false positives by up to eighty percent and cutting mean time to detection and mean time to repair by forty to sixty percent while enabling Tier two and Tier three investigations. It concludes that AI should be used to augment human expertise with phased autonomy and measurable return on investment rather than to promise immediate hands off autonomy.
175 Malicious npm Packages with 26,000 Downloads Used in Credential Phishing Campaign

thehackernews.com · 10 months ago

Cybersecurity researchers flagged 175 malicious npm packages with about 26,000 collective downloads that were used as hosting infrastructure for a phishing campaign dubbed Beamglea targeting more than 135 industrial, technology, and energy companies. The attackers used a Python tool named redirectgenerator.py to publish randomized redirect packages and create HTML files that load a beamglea.js script from the UNPKG CDN which embeds victims' email addresses and redirects them to Microsoft credential harvesting pages. The packages do not execute malicious code when installed; instead the campaign abuses npm and UNPKG to serve phishing pages that pre-fill victims' email fields to increase the likelihood of credential capture.
it-sa-Special

www.csoonline.com · 10 months ago

NULL
Juniper Networks Patches Critical Junos Space Vulnerabilities

www.securityweek.com · 10 months ago

Juniper released October 2025 patches that fix nearly 220 vulnerabilities across Junos OS, Junos Space, and Junos Space Security Director, including nine critical severity flaws in Junos Space. A critical stored cross site scripting flaw tracked as CVE-2025-59978 with a CVSS score of 9.0 was fixed, and Junos Space 24.1R4 Patch V1 addressed 162 unique CVEs including CVE-2019-12900, CVE-2023-38408, CVE-2024-3596, CVE-2024-27280, CVE-2024-35845, CVE-2024-47538, CVE-2024-47607, and CVE-2024-47615. Juniper also patched multiple high and medium severity denial of service, arbitrary file download, HTTP parameter pollution, privilege escalation and other issues in Security Director and Junos OS, and said it is not aware of exploitation in the wild while urging users to apply the updates because most issues have no workarounds.
Inside billionaire Peter Thiel’s private lectures: Warnings of ‘the Antichrist’ and U.S. destruction

www.washingtonpost.com · 10 months ago

The Washington Post reviewed leaked audio of four private lectures Peter Thiel gave in San Francisco in which he warned that critics of technology and artificial intelligence, including Greta Thunberg and Eliezer Yudkowsky, are legionnaires of the Antichrist and argued that limiting technology could usher in the destruction of the United States and global totalitarian rule. The recordings were described as off the record for attendees and were examined by a digital forensics expert who judged them likely authentic, showing Thiel framing regulation as a religious good versus evil struggle that only a faith based argument could properly resist. Organized by the Christian nonprofit ACTS 17, the roughly two hour talks mixed theology, philosophy, and policy and reflected an intensification of Thiel's longstanding libertarian opposition to regulation. The Post noted Thiel's political connections and said that casting regulation as a religious battle could further mobilize Silicon Valley against AI oversight.
IDA tips for reversing U-Boot

www.reddit.com · 10 months ago

The article gives three practical IDA Pro tips for reversing U-Boot, focusing on auto-discovering unreachable command handlers, finding hardcoded crypto tables, and fixing Hex Rays string and table display issues. It explains how to define the cmdtbls structure, locate the command table via a known command string, and run an IDA Python script to create and name the functions while accounting for Thumb mode. It also describes using a forked findcrypt to detect and autocreate crypto lookup tables and notes that marking the segment read only resolves Hex Rays printing only offsets.
ZDI Drops 13 Unpatched Ivanti Endpoint Manager Vulnerabilities

www.securityweek.com · 10 months ago

ZDI published 13 advisories describing unpatched high severity vulnerabilities in Ivanti Endpoint Manager, including one local privilege escalation in the AgentPortal service and 12 remote code execution flaws. ZDI reports CVSS scores of 7.2 for eleven issues, 7.8 for one, and 8.8 for the most severe; the local escalation was reported in November 2024 and acknowledged by Ivanti in January 2025, while the RCEs were reported in June 2025. Ivanti has delayed patches and requested extensions, prompting ZDI to disclose under its 120 day policy, and ZDI recommends restricting interaction with the product as the primary mitigation.
CISA Emergency Directive: AI-Powered Phishing Campaign Analysis - 300% Surge, $2.3B Q3 Losses

www.reddit.com · 10 months ago

The post says CISA Automated Indicator Sharing data shows a 300 percent year over year increase in AI generated phishing attempts, with an attack sophistication score rising from 3.2 to 8.7 out of 10 and 85 percent of attacks targeting United States infrastructure. It reports that machine learning models analyze organizations' communication patterns, employee behavior, and business relationships to generate unique, highly personalized phishing vectors in real time. The FBI Cyber Division is cited as reporting campaigns that use advanced natural language processing to craft contextually relevant emails that mimic legitimate business communications, with over 200 United States organizations compromised in 30 days. NIST is quoted predicting that 90 percent of successful breaches in 2025 will originate from AI powered campaigns, and the article references case studies and mitigation frameworks while calling for technical discussion on countermeasures beyond traditional email filtering.