Blahalla

Cisco IOS XE Software Simple Network Management Protocol Denial of Service Vulnerability

sec.cloudapps.cisco.com · 10 months ago

A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS XE Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper error handling when parsing a specific SNMP request. An attacker could exploit this vulnerability by sending a specific SNMP request to an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition. This vulnerability affects SNMP versions 1, 2c, and 3. To exploit this vulnerability through SNMPv2c or earlier, the attacker must know a valid read-write or read-only SNMP community string for the affected system. To exploit this vulnerability through SNMPv3, the attacker must have valid SNMP user credentials for the affected system. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. However, there is a mitigation. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmpwred-x3MJyf5M This advisory is part of the September 2025 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: September 2025 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication. <br/Security Impact Rating: High <br/CVE: CVE-2025-20312

Proofpoint’s New Agentic AI Cybersecurity Solutions Address 4 Key Challenges

www.techrepublic.com · 10 months ago

Proofpoint expands human-centric security to protect AI agents, safeguarding collaboration points and shared data in the agentic workspace.

CISA: Attackers Breach Federal Agency via Critical GeoServer Flaw

www.darkreading.com · 10 months ago

Threat actors exploited CVE-2024-36401 less than two weeks after it was initially disclosed and used it to gain access to a large federal civilian executive branch (FCEB) agency that uses the geospatial mapping data.

Bookworm to Stately Taurus Using the Unit 42 Attribution Framework

unit42.paloaltonetworks.com · 10 months ago

We connect Bookworm malware to Chinese APT Stately Taurus using our attribution framework, enhancing our understanding of threat group tradecraft.

The Fall of Scattered Spider? Teen Member Surrenders Amid Group's Shutdown Claims

www.darkreading.com · 10 months ago

The cybercrime group continues to gain attention despite its apparent shutdown last week.

Russia Targets Moldovan Election in Disinformation Play

www.darkreading.com · 10 months ago

Researchers have tracked a Russian disinformation campaign against upcoming Moldovan elections, linking it to a previous campaign that began in 2022.

How GitHub Is Securing the Software Supply Chain

www.techrepublic.com · 10 months ago

In light of recent cyberattacks and growing security concerns, GitHub is taking immediate and direct action to secure the open-source software supply chain.

Threat Actor Deploys 'OVERSTEP' Backdoor in Ongoing SonicWall SMA Attacks

www.darkreading.com · 10 months ago

Hackers tracked as UNC6148 are attacking SonicWall security devices by installing hidden software, allowing them to control systems, steal passwords, and hide their activities.

Retail at risk: How one alert uncovered a persistent cyberthreat

www.microsoft.com · 10 months ago

In the latest edition of our Cyberattack Series, we dive into real-world cases targeting retail organizations. With 60% of retail companies reporting operational disruptions from cyberattacks and 43% experiencing breaches in the past year, the stakes have never been higher. This post unpacks where a single alert led to the discovery of a major persistent threat, how attackers exploited unpatched SharePoint vulnerabilities and compromised identities to infiltrate networks, and how the Microsoft Incident Response, the Detection and Response Team (DART) swiftly stepped in with forensic insights and actionable guidance. Download the full report to learn more about how one small signal exposed a much larger danger, and how you can strengthen your defenses against similar threats.

INC ransomware: what you need to know

www.fortra.com · 10 months ago

INC is the name of a ransomware-as-a-service (RaaS) operation that first appeared in late summer 2023. Learn more about what it has been up to, and how to protect against its attacks, in my article on the Fortra blog.

AI vs. AI: Detecting an AI-obfuscated phishing campaign

www.microsoft.com · 10 months ago

Microsoft Threat Intelligence recently detected and blocked a credential phishing campaign that likely used AI-generated code to obfuscate its payload and evade traditional defenses, demonstrating a broader trend of attackers leveraging AI to increase the effectiveness of their operations and underscoring the need for defenders to understand and anticipate AI-driven threats.

Feds Tie ‘Scattered Spider’ Duo to $115M in Ransoms

krebsonsecurity.com · 10 months ago

U.S. prosecutors last week levied criminal hacking charges against 19-year-old U.K. national Thalha Jubair for allegedly being a core member of Scattered Spider, a prolific cybercrime group blamed for extorting at least $115 million in ransom payments from victims. The charges came as Jubair and an alleged co-conspirator appeared in a London court to face accusations of hacking into and extorting several large U.K. retailers, the London transit system, and healthcare providers in the United States.

US Disrupts Massive Cell Phone Array in New York

www.schneier.com · 10 months ago

This is a weird story: The US Secret Service disrupted a network of telecommunications devices that could have shut down cellular systems as leaders gather for the United Nations General Assembly in New York City. The agency said on Tuesday that last month it found more than 300 SIM servers and 100,000 SIM cards that could have been used for telecom attacks within the area encompassing parts of New York, New Jersey and Connecticut. “This network had the power to disable cell phone towers and essentially shut down the cellular network in New York City,” said special agent in charge Matt McCool

Npm Package Hides Malware in Steganographic QR Codes

www.darkreading.com · 10 months ago

The poisoned package, purporting to be a JavaScript utility, threatens the software supply chain with a highly obsfuscated credential stealer.

Chinese APT Leans on Researcher PoCs to Spy on Other Countries

www.darkreading.com · 10 months ago

"RedNovember" is both lazy and punctual: always quick to do its homework on new vulnerabilities, but always getting the answers from cyber defenders.

As Incidents Rise, Japanese Government's Cybersecurity Falls Short

www.darkreading.com · 10 months ago

The Japanese government suffered the most cybersecurity incidents in 2024, 447, nearly double the previous year, while failing to manage 16% of critical systems.

GitHub Aims to Secure Supply Chain as NPM Hacks Ramp Up

www.darkreading.com · 10 months ago

GitHub will address weak authentication and overly permissive tokens in the NPM ecosystem, following high-profile threat campaigns like those involving Shai-Hulud malware.

Exposed Docker Daemons Fuel DDoS Botnet

www.darkreading.com · 10 months ago

The for-hire platform leverages legitimate cloud-native tools to make detection and disruption harder for defenders and SOC analysts.

From FBI to CISO: Unconventional Paths to Cybersecurity Success

www.darkreading.com · 10 months ago

Cybersecurity leader Jason Manar shares insights on diverse career paths, essential skills, and practical advice for entering and thriving in the high-stress yet rewarding field of cybersecurity.

Dark Reading Confidential: Battle Space: Cyber Pros Land on the Front Lines of Protecting US Critical Infrastructure

www.darkreading.com · 10 months ago

Dark Reading Confidential Episode 10: It’s past time for a comprehensive plan to protect vital US systems from nation-state cyberattacks, and increasingly, that responsibility is falling to asset owners across a vast swath of organizations, who likely never bargained for an international cyber conflict playing out in their environments. But here we are. And here's what comes next, according to Frank Cilluffo from the McCrary Institute and Booz Allen's Dave Forbes.

Microsoft Purview delivered 30% reduction in data breach likelihood

www.microsoft.com · 10 months ago

A recent Total Economic Impact™ (TEI) Of Microsoft Purview study by Forrester Consulting, commissioned by Microsoft, offers valuable insights into how organizations are modernizing their data protection strategies. The study covers the tangible benefits of unifying data security, data governance and data compliance under a single platform, an approach exemplified by Microsoft Purview.

Ransomware Attack Disrupted Airports Across Europe, Cyber Agency Confirms

www.techrepublic.com · 10 months ago

London Heathrow, Berlin Airport, and Brussels Airport faced significant delays, cancellations, and manual processing.

The AI Fix #69: How we really use ChatGPT, and will AI agents crash the economy?

grahamcluley.com · 10 months ago

In episode 69 of The AI Fix, our hosts discover brain rot, a shark wears trainers on its fins, an AI writes a terrible J-Pop song, Graham learns that ants don’t care about AI, Mark predicts the precise date of Graham’s demise, Norway trusts $1.9 trillion to an AI investor, and Florida thins out its dumbest pythons using laughably bad robot rabbits. Also in this episode, the first AI Fix “you wouldn’t trust a pigeon” mug is spotted in the wild, and the show gets its first bit of feedback from an AI listener. Plus, Graham learns that more people have used ChatGPT than have ever owned a ferret, and Mark finally finds a use for cryptocurrency. All this and much more is discussed in the latest edition of "The AI Fix" podcast by Graham Cluley and Mark Stockley.

Google DORA Research: Software Developers Use AI ‘Heavily’

www.techrepublic.com · 10 months ago

Google’s State of AI-assisted Software Development Report 2025 reveals AI adoption increased, but trust in AI is still uneven.

SEO Poisoning Campaign Tied to Chinese Actor

www.darkreading.com · 10 months ago

In Operation Rewrite, an unspecified actor is using legitimate compromised Web servers to deliver malicious content to visitors for financial gain.

Last Week in Security (LWiS) - 2025-09-22

blog.badsectorlabs.com · 10 months ago

Getting Global Admin in every Entra tenant ( @dirkjan ), WebSocket Turbo Intruder ( @zakfedotkin ), PureRAT analysis ( @Tera0017 ), direct syscalls in Zig ( @zux0x3a ), and more!

Our plan for a more secure npm supply chain

github.blog · 10 months ago

Addressing a surge in package registry attacks, GitHub is strengthening npm's security with stricter authentication, granular tokens, and enhanced trusted publishing to restore trust in the open source ecosystem.

Operation Rewrite: Chinese-Speaking Threat Actors Deploy BadIIS in a Wide Scale SEO Poisoning Campaign

unit42.paloaltonetworks.com · 10 months ago

SEO poisoning campaign "Operation Rewrite” uses a malicious IIS module called BadIIS to redirect users to unwanted websites.

Cisco IOS XE SD-WAN Software Packet Filtering Bypass Vulnerability

sec.cloudapps.cisco.com · 10 months ago

A vulnerability in the packet filtering features of Cisco IOS XE SD-WAN Software could allow an unauthenticated, remote attacker to bypass Layer 3 and Layer 4 traffic filters. This vulnerability is due to improper traffic filtering conditions on an affected device. An attacker could exploit this vulnerability by sending a crafted packet to the affected device. A successful exploit could allow the attacker to bypass the Layer 3 and Layer 4 traffic filters and inject a crafted packet into the network. Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmp-bypass-HHUVujdn This advisory is part of the May 2025 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: May 2025 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication. <br/Security Impact Rating: Medium <br/CVE: CVE-2025-20221

Iran-Linked Hackers Target Europe With New Malware

www.darkreading.com · 10 months ago

"Nimbus Manticore" is back at it, this time with improved variants of its flagship malware and targets that are outside its usual focus area.

Google Touts ‘Biggest Upgrade to Chrome in Its History’ With Gemini AI

www.techrepublic.com · 10 months ago

Google embeds Gemini into Chrome in what it calls the browser’s biggest upgrade, adding features to summarize pages, combat scams, and simplify browsing.

What happens when a cybersecurity company gets phished?

news.sophos.com · 10 months ago

A Sophos employee was phished, but we countered the threat with an end-to-end defense process

Vastaamo psychotherapy hack: US citizen charged in latest twist of notorious data breach

www.bitdefender.com · 10 months ago

28-year-old Daniel Lee Newhard, an American citizen living in Estonia, has been charged in relation to the notorious hack of Vastaamo, the biggest data breach in Finnish history. Read more in my article on the Hot for Security blog.

Microsoft Defender delivered 242% return on investment over three years

www.microsoft.com · 10 months ago

The latest 2025 commissioned Forrester Consulting Total Economic Impact™ (TEI) study reveals a 242% ROI over three years for organizations that chose Microsoft Defender. It helps security leaders consolidate tools, reduce overhead, and empower their SecOps teams with operational efficiencies powered by AI and automation. In total, the study found Defender delivered $17.8 million in benefits and paid for itself in less than six months.

K-12 schools face cybersecurity risks inside and outside of the classroom

news.sophos.com · 10 months ago

As students return to school, it's crucial for administrators and IT teams to stay vigilant against opportunistic threat actors.

“Pompompurin” resentenced: BreachForums creator heads back behind bars

www.bitdefender.com · 10 months ago

Conor Brian Fitzpatrick, the creator of the notorious BreachForums hacking forum, has been resentenced to three years in prison after a US appeals court overturned his prior sentence of time served and 20 years of supervised release. Read more in my article on the Hot for Security blog.

Smashing Security podcast #435: Lights! Camera! Hacktion!

grahamcluley.com · 10 months ago

When "bad actors" stop being hackers and start being... actual actors. This week, Graham and special guest Jenny Radcliffe play “Hacker or Ham?” (yes, Steven Seagal, we’re looking at you), before diving into a campaign which saw an Iranian gang luring Israeli performers with fake casting calls for a serious film. We unpack why positive lurescan short-circuit scepticism just as effectively as fear. Plus, the UK's ICO says students are increasingly hacking their own schools. Meanwhile, Graham heads to 1960s Oxford with Endeavour, while Jenny investigates the Wirral’s mysterious "Catman". All this, and more, in episode 435 of the "Smashing Security" podcast.

GOLD SALEM’s Warlock operation joins busy ransomware landscape

news.sophos.com · 10 months ago

The emerging group demonstrates competent tradecraft using a familiar ransomware playbook and hints of ingenuity

From mischief to malware: ICO warns schools about student hackers

www.fortra.com · 10 months ago

Recent research released by the ICO say that school pupils should be considered as an "insider threat" by schools. Read more in my article on the Fortra blog.

Myth Busting: Why "Innocent Clicks" Don't Exist in Cybersecurity

unit42.paloaltonetworks.com · 10 months ago

Unit 42 explores how innocent clicks can have serious repercussions. Learn how simply visiting a malicious site can expose users to significant digital dangers.

Sophos supports Objective-See Foundation to advance macOS security and inclusive cybersecurity education

news.sophos.com · 10 months ago

Dedicated to building a stronger, more inclusive Apple security community through open-source security tools Sophos is proud to be a gold friend of the Objective-See Foundation, supporting its mission to expand access to cybersecurity education and foster innovative community-driven macOS security research. As macOS becomes a bigger target for cybercriminals, organizations like Objective-See are critical

Self-Replicating Worm Hits 180+ Software Packages

krebsonsecurity.com · 10 months ago

At least 187 code packages made available through the JavaScript repository NPM have been infected with a self-replicating worm that steals credentials from developers and publishes those secrets on GitHub, experts warn. The malware, which briefly infected multiple code packages from the security vendor CrowdStrike, steals and publishes even more credentials every time an infected package is installed.

Luxury fashion brands Gucci, Balenciaga and Alexander McQueen hacked – customer data stolen

www.bitdefender.com · 10 months ago

Luxury fashion group Kering - owner of the prestigious Gucci, Balenciaga, and Alexander McQueen brands, amongst others - has confirmed that hackers stole customer data from its systems in June 2025. Read more in my article on the Hot for Security blog.

The AI Fix #68: AI telepathy, and rights for robots

grahamcluley.com · 10 months ago

In episode 68 of The AI Fix, our hosts open the show by launching the thing nobody asked for but everybody wanted: our shiny new merch store - yes, including the “Would YOU trust a pigeon???” t-shirt for when you need fashion alongside health and safety. Meanwhile, AI hoaxers send Manila firefighters racing to an imaginary blaze, Albania appoints an AI as a minister, and the godfather of AI gets dumped... by ChatGPT. Plus Mark shows off his ventriloquism skills, while Graham describes a near-telepathic wearable that lets you “talk” without moving your lips, and we look into how humanity and AI has joined forces to fight for AI rights. All this and much more is discussed in the latest edition of "The AI Fix" podcast by Graham Cluley and Mark Stockley.

Last Week in Security (LWiS) - 2025-09-15

blog.badsectorlabs.com · 10 months ago

FreeBPX RCE ( @chudyPB ), badpie ( @dtmsecurity ), macOS auditd malloc woes ( @jfmeee ), Spotlight TCC leak ( @patrickwardle ), WSUS relaying ( @Coontzy1 ), pyLDAPGui ( @ZephrFish ), and more!

The Risks of Code Assistant LLMs: Harmful Content, Misuse and Deception

unit42.paloaltonetworks.com · 10 months ago

We examine security weaknesses in LLM code assistants. Issues like indirect prompt injection and model misuse are prevalent across platforms.

Trusted Connections, Hidden Risks: Token Management in the Third-Party Supply Chain

unit42.paloaltonetworks.com · 10 months ago

Effective OAuth token management is crucial for supply chain security, preventing breaches caused by dormant integrations, insecure storage or lack of rotation.

British rail passengers urged to stay on guard after hack signals failure

www.bitdefender.com · 10 months ago

Passengers of the UK's state-owned London North Eastern Railway (LNER) have been warned to be vigilant after cybercriminals accessed traveller's contact details and some information about past journeys. Read more in my article on the Hot for Security blog.

Bulletproof Host Stark Industries Evades EU Sanctions

krebsonsecurity.com · 10 months ago

In May 2025, the European Union levied financial sanctions on the owners of Stark Industries Solutions Ltd., a bulletproof hosting provider that materialized two weeks before Russia invaded Ukraine and quickly became a top source of Kremlin-linked cyberattacks and disinformation campaigns. But new data shows those sanctions have done little to stop Stark from simply rebranding and transferring their assets to other corporate entities controlled by its original hosting providers.

Smashing Security podcast #434: Whopper Hackers, and AI Whoppers

grahamcluley.com · 11 months ago

Ever wondered what would happen if Burger King left the keys to the kingdom lying around for anyone to use? Ethical hackers did - and uncovered drive-thru recordings, hard-coded passwords, and even the power to open a Whopper outlet on the moon. Meanwhile, over in Silicon Valley, one AI wunderkind managed to turn a $7 million payday into a career-ending lawsuit by allegedly walking trade secrets straight out the door as he jumped ship for a rival. All this and much more is discussed in episode 434 of the award-winning “Smashing Security” podcast with computer security veteran Graham Cluley, joined this week by special guest Lianne Potter.