Apple has urgently rolled out iOS 18.4.1 and iPadOS 18.4.1 to patch two zero-day vulnerabilities that were actively exploited in “extremely sophisticated” attacks aimed at specific iOS users. The flaws, found in the CoreAudio and RPAC components, posed serious risks,…
Category: GBHackers Security | #1 Globally Trusted Cyber Security News Platform
CISA Extend Funding to MITRE to Keep CVE Program Running
The Cybersecurity and Infrastructure Security Agency (CISA) has extended funding to the MITRE Corporation, ensuring the continued operation of the Common Vulnerabilities and Exposures (CVE) program, a linchpin of global cybersecurity. Announced late on April 15, 2025, just hours before…
Windows Task Scheduler Vulnerabilities Allow Attackers Gain Admin Account Control
New vulnerabilities in Windows Task Scheduler’s schtasks.exe let attackers bypass UAC, alter metadata, modify event logs, and evade detection. These actions map to MITRE ATT&CK tactics: Persistence, Privilege Escalation, Execution, Lateral Movement, and Defense Evasion. Abuse of schtasks.exe enables stealthy…
Windows NTLM Vulnerability (CVE-2025-24054) Actively Exploit in the Wild to Hack Systems
A critical vulnerability in Microsoft Windows, identified as CVE-2025-24054, has been actively exploited in the wild since March 19, 2025, targets organizations worldwide. The flaw, which enables NTLM hash disclosure through spoofing, allows attackers to harvest sensitive user credentials with…
Beware! Online PDF Converters Tricking Users into Installing Password-Stealing Malware
CloudSEK’s Security Research team, a sophisticated cyberattack leveraging malicious online PDF converters has been demonstrated to target individuals and organizations globally. This attack, previously hinted at by the FBI’s Denver field office, involves the distribution of potent malware, known as…
Server-Side Phishing Attacks Target Employee and Member Portals to Steal Login Credentials
Attackers have been deploying server-side phishing schemes to compromise employee and member login portals across various enterprises. This strategic shift to server-side operations is designed to evade detection and complicate analysis. Evolving Phishing Techniques Recent investigations have highlighted a marked…
CISA Extends Support a Last Minute to CVE Program, Averting Global Cybersecurity Crisis
CISA announced an eleventh-hour contract extension with MITRE Corporation to maintain the Common Vulnerabilities and Exposures (CVE) program, narrowly avoiding a lapse in federal funding that threatened to destabilize vulnerability management worldwide. The move came just hours before the program’s…
Researchers Expose Medusa Ransomware Group’s Onion Site
Researchers have successfully infiltrated the digital fortress of one of the most prolific ransomware groups, Medusa Locker. Known for targeting critical sectors like healthcare, education, and manufacturing, the group has been responsible for numerous cyberattacks since its detection in 2019.…
Interlock Ransomware Uses Multi-Stage Attack Through Legitimate Websites to Deliver Malicious Browser Updates
The Interlock ransomware intrusion set has escalated its operations across North America and Europe with sophisticated techniques. Not falling under the typical Ransomware-as-a-Service (RaaS) category, Interlock operates independently, focusing primarily on Big Game Hunting and double extortion campaigns. This group’s…
Hackers Target Investors Through Fraud Networks to Steal Financial Data
Hackers have launched sophisticated schemes designed to defraud investors and steal their financial data. Utilizing digital platforms, encrypted messaging apps, and crypto transactions, these criminals exploit the rise of online investment platforms to conduct their fraudulent activities. Fraudulent networks employ…
AI-Powered Bad Bots Account for 51% of Traffic, Surpassing Human Traffic for the First Time
Automated traffic generated by bad bots has for the first time surpassed human activity, accounting for 51% of all internet traffic in 2024, according to the latest Imperva Bad Bot Report. This marks a significant shift in the digital landscape,…
Hackers Weaponize Gamma Tool Through Cloudflare Turnstile to Steal Microsoft Credentials
Cybercriminals are exploiting an AI-powered presentation tool called Gamma to launch a multi-stage attack aimed at stealing Microsoft credentials. This attack route is designed not only to evade traditional security measures but also to deceive human recipients by leveraging trusted…
SquareX to Reveal Critical Data Splicing Attack at BSides SF, Exposing Major DLP Vulnerability
SquareX researchers Jeswin Mathai and Audrey Adeline will be disclosing a new class of data exfiltration techniques at BSides San Francisco 2025. Titled “Data Splicing Attacks: Breaking Enterprise DLP from the Inside Out”, the talk will demonstrate multiple data splicing techniques that will allow attackers to…
Landmark Admin Suffers Major Breach, Exposing Data of 1.6M+ Users
Landmark Admin, LLC (“Landmark”), a Texas-based third-party administrator for life insurance carriers, has confirmed that a cyberattack compromised sensitive personal data belonging to more than 1.6 million individuals. The breach, detected in mid-May 2024, has prompted urgent calls for vigilance…
Firefox Fixes High-Severity Vulnerability Causing Memory Corruption via Race Condition
Mozilla has released Firefox 137.0.2, addressing a high-severity security flaw that could potentially allow attackers to exploit memory corruption. The fix comes following the discovery and reporting of the vulnerability by the Mozilla Fuzzing Team, as detailed in Mozilla Foundation…
Tails 6.14.2 Released with Critical Fixes for Linux Kernel Vulnerabilities
The Tails Project has urgently released Tails 6.14.2, addressing critical security vulnerabilities in the Linux kernel and the Perl programming language. This emergency release is vital for users who rely on Tails’ security and privacy features, following the discovery of multiple…
Hacktivist Group Becomes More Sophisticated, Targets Critical Infrastructure to Deploy Ransomware
A recent report by Cyble has shed light on the evolving tactics of hacktivist groups, moving beyond traditional cyber disruptions like DDoS attacks and website defacements to engage in more advanced critical infrastructure attacks and ransomware operations. Advanced Attack Strategies…
Chinese Hackers Unleash New BRICKSTORM Malware to Target Windows and Linux Systems
A sophisticated cyber espionage campaign leveraging the newly identified BRICKSTORM malware variants has targeted European strategic industries since at least 2022. According to NVISO’s technical analysis, these backdoors previously confined to Linux vCenter servers now infect Windows environments, employing multi-tiered…
APT29 Hackers Use GRAPELOADER in New Attack Against European Diplomats
Check Point Research (CPR) has uncovered a new targeted phishing campaign employing GRAPELOADER, a sophisticated initial-stage downloader, launched by the notorious Russian-linked hacking group APT29, known alternatively as Midnight Blizzard or Cozy Bear. This campaign, identified since January 2025, primarily…
CISA Issues 9 New ICS Advisories Addressing Critical Vulnerabilities
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released nine new advisories detailing severe vulnerabilities in widely-used Industrial Control Systems (ICS) products. These advisories, published on April 15, 2025, urge immediate action from operators and administrators overseeing critical infrastructure.…
WhatsApp Job Offer Scam Targets Job Seekers in New Phishing Attack
A new form of phishing attack is making waves among job seekers, as cybercriminals exploit WhatsApp and Meta’s trusted branding to lure victims into sophisticated job offer scams. Security experts warn that these attacks are not only increasing in frequency…
10 Best Email Security Solutions in 2025
Email security solutions are critical for protecting organizations from the growing sophistication of cyber threats targeting email communication. As email remains a primary channel for business communication, it is also the most exploited vector for attacks such as phishing, malware…
Malicious Macros Return in Sophisticated Phishing Campaigns
The cybersecurity landscape of 2025 is witnessing a troubling resurgence of malicious macros in phishing campaigns. Despite years of advancements in security measures and Microsoft’s decision to disable macros by default in Office applications, attackers have adapted their methods to…
“Living-off-the-Land Techniques” How Malware Families Evade Detection
Living-off-the-Land (LOTL) attacks have become a cornerstone of modern cyber threats, allowing malware to evade detection by leveraging legitimate system tools and processes. Rather than relying on custom malicious binaries that can be flagged by security solutions, attackers use trusted,…
Chinese UNC5174 Group Expands Arsenal with New Open Source Tool and C2 Infrastructure
The Sysdig Threat Research Team (TRT) has revealed a significant evolution in the offensive capabilities of the Chinese state-sponsored threat actor, UNC5174. In late January 2025, after a year of diminished activity, the group launched a new campaign that introduced…
SOC Alert Fatigue Hits Peak Levels As Teams Battle Notification Overload
Security Operations Centers (SOCs) are facing a mounting crisis: alert fatigue. As cyber threats multiply and security tools proliferate, SOC teams are inundated with thousands of notifications daily. This overwhelming volume of alerts many of which are false positives or…
Oracle Issues Patch for 378 Vulnerabilities in Major Security Rollout
Oracle Corporation has released a sweeping Critical Patch Update (CPU) for April 2025, addressing a staggering 378 security vulnerabilities across a wide array of its product families. The rollout underscores Oracle’s continued commitment to proactive cybersecurity and comes amid ongoing…
Hackers Exploit Node.js to Spread Malware and Exfiltrate Data
Threat actors are increasingly targeting Node.js—a staple tool for modern web developers—to launch sophisticated malware campaigns aimed at data theft and system compromise. Microsoft Defender Experts (DEX) have reported a spike in such attacks since October 2024, especially focusing on…
Protecting Against Insider Threats – Strategies for CISOs
Insider threats represent a critical vulnerability in organizational cybersecurity, posing risks that are often more challenging to mitigate than external attacks. These threats can originate from malicious employees, negligent staff, or compromised credentials, each capable of causing significant financial, operational,…
MITRE Ends CVE Program Support – Leaked Internal Memo Confirms Departure
A leaked internal memo dated April 15, 2025, has sent shockwaves through the cybersecurity community, revealing that MITRE’s contract to operate the Common Vulnerabilities and Exposures (CVE) program is set to expire today, April 16, 2025. The letter, reportedly obtained…
Critical Chrome Vulnerability Exposes Users to Data Theft and Unauthorized Access
A critical security vulnerability has been discovered in Google Chrome, prompting an urgent update as millions of users worldwide face potential threats of data theft and unauthorized access. The newly released Stable channel update—now available as version 135.0.7049.95/.96 for Windows…
Zeek Deployments Rise Across SOCs For Enhanced Network Visibility
Zeek, formerly known as Bro, has established itself as a leading open-source network security monitoring platform. As organizations face increasingly complex cyber threats in 2025, Zeek’s capabilities have evolved to provide deeper visibility, advanced analytics, and seamless integration with modern…
Authorities Shut Down Four Encrypted Platforms Used by Cybercriminals
Law enforcement authorities across Europe and Türkiye have dealt a major blow to four criminal networks alleged to be at the heart of drug trafficking and money laundering across the continent. The operation, supported by Europol and codenamed Operation BULUT,…
Microsoft Teams File Sharing Unavailable Due to Unexpected Outage
Microsoft Teams users across the globe are experiencing significant disruptions in file-sharing capabilities due to an unexpected outage, impacting workplace communication and collaboration. A wave of reports began surfacing from organizations and individuals unable to share files within Microsoft Teams—the…
PasivRobber Malware Emerges, Targeting macOS to Steal Data From Systems and Apps
A sophisticated new malware suite targeting macOS, dubbed “PasivRobber,” has been discovered by security researchers. Identified on March 13, 2025, after a suspicious file named “wsus” was uploaded to VirusTotal, PasivRobber is a multi-component threat designed to steal a wide…
From ISO to NIS2 – Mapping Compliance Requirements Globally
The global regulatory landscape for cybersecurity is undergoing a seismic shift, with the European Union’s NIS2 Directive emerging as a critical framework for organizations operating within its jurisdiction. While ISO 27001 has long been the gold standard for information security…
New ‘Waiting Thread Hijacking’ Malware Technique Evades Modern Security Measures
Security researchers have unveiled a new malware process injection technique dubbed “Waiting Thread Hijacking” (WTH), designed to execute malicious code within legitimate processes while bypassing many modern security defenses. Developed by Check Point Research, WTH represents an evolution of classic…
Security Awareness Metrics That Matter to the CISO
Security awareness has become a critical component of organizational defense strategies, particularly as companies adopt zero-trust architectures. Chief Information Security Officers (CISOs) are increasingly challenged to demonstrate the effectiveness of security awareness programs through meaningful metrics that resonate with leadership.…
Cloud Misconfigurations – A Leading Cause of Data Breaches
Cloud computing has transformed the way organizations operate, offering unprecedented scalability, flexibility, and cost savings. However, this rapid shift to the cloud has also introduced new security challenges, with misconfigurations emerging as one of the most significant and persistent threats.…
Jailbreaking Malicious JScript Loader Reveals Xworm Payload Execution Chain
Cybersecurity researchers have uncovered a sophisticated JScript-to-PowerShell loader delivering XWorm RAT and Rhadamanthys Stealer through a geofenced, multi-stage execution chain. The attack leverages obfuscation, geolocation checks, and fileless techniques to evade detection. Attack Chain Breakdown Stage 1: JScript Loader Activation The campaign begins with…
Cybercriminals Exploit Search Results to Steal Credit Card Information
Everyday internet searches, a routine activity for billions, harbor a hidden risk: cybercriminals are increasingly manipulating search engine results to lure unsuspecting users into traps designed to steal credit card details and other sensitive information. This manipulation often involves pushing…
How to Conduct a Cloud Security Assessment
As organizations accelerate their adoption of cloud technologies, the need for robust cloud security has never been more urgent. Cloud environments offer scalability, flexibility, and cost savings, but they also introduce new security challenges that traditional on-premises solutions may not…
Paragon Hard Disk Manager Flaw Enables Privilege Escalation and DoS Attacks
Paragon Software’s widely used Hard Disk Manager (HDM) product line has been found to contain five severe vulnerabilities in its kernel-level driver, BioNTdrv.sys, enabling attackers to escalate privileges to SYSTEM-level access or trigger denial-of-service (DoS) attacks. The flaws, now patched, were actively exploited…
Hertz Data Breach Exposes Customer Personal Information to Hackers
The Hertz Corporation has confirmed that sensitive personal information belonging to customers of its Hertz, Dollar, and Thrifty brands was compromised after hackers targeted a vendor’s file transfer platform. The breach has sparked concerns about identity theft and privacy, prompting…
The Future of Authentication: Moving Beyond Passwords
Traditional passwords have been the cornerstone of digital security for six decades, but their reign is coming to an end. As cyber threats become increasingly sophisticated and our digital footprints expand, the limitations of password-based authentication including vulnerability to phishing,…
Over 100,000 WordPress Plugin Vulnerability Exploited Just 4 Hours After Disclosure
Over 100,000 WordPress websites have been exposed to a critical security vulnerability, following the public disclosure of a flaw in the popular SureTriggers plugin (version 1.0.78 and below) on April 10, 2025. Exploitation attempts were observed within just four hours…
CentreStack 0-Day Exploit Enables Remote Code Execution on Web Servers
A critical 0-day vulnerability has been disclosed in CentreStack, a popular enterprise cloud storage and collaboration platform, which could allow attackers to execute arbitrary code remotely on affected web servers. The vulnerability, tracked as CVE-2025-30406, leverages a flaw in the…
Over 100,000 WordPress Plugin VUlnerability Exploited Just 4 Hours After Disclosure
Over 100,000 WordPress websites have been exposed to a critical security vulnerability, following the public disclosure of a flaw in the popular SureTriggers plugin (version 1.0.78 and below) on April 10, 2025. Exploitation attempts were observed within just four hours…
Apache Roller Vulnerability Allows Hackers to Bypass Access Controls
A newly disclosed vulnerability in Apache Roller, the popular open-source blog server, could allow attackers to bypass critical access controls and retain unauthorized access to accounts even after password changes. The flaw, tracked as CVE-2025-24859, was announced by the Apache Roller…
Hackers Use Microsoft Teams Chats to Deliver Malware to Windows PCs
A sophisticated cyberattack campaign has emerged, leveraging Microsoft Teams chats to infiltrate Windows PCs with malware, according to a recent report by cybersecurity firm ReliaQuest. The attack, which began surfacing in March 2025 and primarily targets the finance and professional…
Galaxy S24 Vulnerability Poses Risk of Unauthorized File Access
A security flaw in Samsung’s Quick Share feature for the Galaxy S24 series has been disclosed, enabling attackers to create arbitrary files on vulnerable devices. Tracked as CVE-2024-49421, the vulnerability highlights risks in the popular file-sharing tool preinstalled on Samsung’s flagship…
Top 10 Best Zero Trust Solutions 2025
Zero Trust Solutions is a modern cybersecurity framework built on the principle of “never trust, always verify.” Unlike traditional perimeter-based security models, Zero Trust assumes that threats can originate both inside and outside an organization’s network. It enforces strict access…
Colleges and Schools Now Top Targets for Online Threat Actors
Across the globe, a new kind of threat is targeting the very institutions dedicated to shaping the future: schools, colleges, and universities. In 2024, experts warn that educational organizations have become prime targets for online threat actors, including nation-state-backed hackers…
The Future of GRC – Integrating ESG, Cyber, and Regulatory Risk
The landscape of Governance, Risk, and Compliance (GRC) is undergoing a profound transformation as organizations face mounting pressures from regulatory bodies, evolving cyber threats, and the growing importance of Environmental, Social, and Governance (ESG) factors. In 2025, the convergence of…
Cybersecurity for Startups – What Early-Stage CISOs Must Prioritize
Early-stage startups face unique cybersecurity challenges that established enterprises have already addressed through years of investment and experience. For Chief Information Security Officers (CISOs) stepping into leadership roles at young companies, the landscape presents both opportunity and complexity. With limited…
BPFDoor Malware Uses Reverse Shell to Expand Control Over Compromised Networks
A new wave of cyber espionage attacks has brought BPFDoor malware into the spotlight as a stealthy and dangerous tool for compromising networks. According to security experts at Trend Micro, BPFDoor is a state-sponsored backdoor attributed to the advanced persistent…
Morocco Investigation Major Data Breach Allegedly Claimed by Algerian Hackers
The National Social Security Fund (CNSS) of Morocco has confirmed that initial checks on leaked documents circulating on social media have revealed that much of the information is false, inaccurate, or incomplete. Officials state these documents originated from a cyber…
EU’s GDPR Article 7 Poses New Challenges for Businesses To Secure AI-Generated Image Data
As businesses worldwide embrace digital transformation, the European Union’s General Data Protection Regulation (GDPR), enacted in 2018, remains a cornerstone of data privacy and security. A recent safety report highlighting the rapid advancement of artificial intelligence (AI) has renewed focus…
Smishing Campaign Hits Toll Road Users with $5 Payment Scam
Cybersecurity researchers at Cisco Talos have uncovered a large-scale smishing campaign targeting toll road users across the United States. The campaign, which has been active since October 2024, impersonates toll road payment services, luring unsuspecting victims into revealing their personal…
IBM Aspera Faspex Flaw Allows Injection of Malicious JavaScript in Web UI
A significant security vulnerability has been identified in IBM Aspera Faspex 5, a popular file exchange solution. The flaw, designated as CVE-2025-3423, allows attackers to inject malicious JavaScript into the web interface, potentially compromising sensitive user data. Vulnerability Details The…
VMware ESXi 8.0 Update 3e Is Now Free — Here’s What’s New
VMware has announced that ESXi 8.0 Update 3e, the latest version of its industry-leading hypervisor, is now available for download at no cost. Released on April 10, 2025, this update is packed with enhancements, critical fixes, and new features, solidifying VMware’s dominance…
Chinese APT Group Targets Ivanti VPN Vulnerabilities to Breach Networks
In a concerning report from cybersecurity firm TeamT5, it has been revealed that a Chinese Advanced Persistent Threat (APT) group leveraged critical vulnerabilities in Ivanti Connect Secure VPN appliances to launch a global cyberattack. The breach affected nearly 20 industries…
DoJ Launches Critical National Security Program to Protect Americans’ Sensitive Data
The U.S. Department of Justice has launched a landmark initiative to block foreign adversaries—including China, Russia, and Iran—from exploiting commercial channels to access sensitive American data. The Data Security Program (DSP), enacted under Executive Order 14117, establishes stringent controls over…
Slow Pisces Group Targets Developers Using Coding Challenges Laced with Python Malware
A North Korean state-sponsored threat group known as “Slow Pisces” has been orchestrating sophisticated cyberattacks targeting developers in the cryptocurrency sector using malware-laced coding challenges. This campaign employs deceptive tactics and advanced malware techniques designed to infiltrate systems, steal critical…
FortiGate 0-Day Exploit Allegedly Up for Sale on Dark Web
A chilling new development in the cybersecurity landscape has emerged, as a threat actor has reportedly advertised an alleged zero-day exploit targeting Fortinet’s FortiGate firewalls on a prominent dark web forum. This exploit purportedly enables unauthenticated remote code execution (RCE)…
Alleged FUD Malware ‘GYware’ Advertised on Hacker Forum for $35/Month
A new Remote Access Trojan (RAT) known as “GYware” is being marketed on a popular hacker forum at an affordable price of $35 per month. The malware, which is described by its creator as the “best of 2025,” reportedly boasts…
Kaspersky Shares 12 Essential Tips for Messaging App Security and Privacy
In an era where instant messaging apps like WhatsApp, Telegram, Signal, iMessage, Viber, and WeChat dominate personal and professional communication, digital privacy and security have never been more critical. To help users keep their accounts secure and private, cybersecurity experts…
Dangling DNS Attack Allows Hackers to Take Over Organization’s Subdomain
Hackers are exploiting what’s known as “Dangling DNS” records to take over corporate subdomains, posing significant threats to organizations’ security frameworks. This attack vector has been increasingly noted by security teams, highlighting the need for constant vigilance in DNS configuration…
Hackers Imitate Google Chrome Install Page on Google Play to Distribute Android Malware
Cybersecurity experts have unearthed an intricate cyber campaign that leverages deceptive websites posing as the Google Play Store to distribute Android malware. These websites, hosted on newly registered domains, create a façade of credible application installation pages, enticing victims with…
Threat Actors Manipulate Search Results to Lure Users to Malicious Websites
Cybercriminals are increasingly exploiting search engine optimization (SEO) techniques and paid advertisements to manipulate search engine results, pushing malicious websites to the top where unsuspecting users are likely to click. In recent years, this tactic, often known as SEO poisoning…
RansomHub Ransomware Group Hits 84 Organizations as New Threat Actors Emerge
The RansomHub ransomware group has emerged as a significant danger, targeting a wide array of industries across the globe. In March 2025, this group alone managed to compromise 84 organizations, while new groups like Arkana and CrazyHunter have introduced sophisticated…
HelloKitty Ransomware Returns, Launching Attacks on Windows, Linux, and ESXi Environments
Security researchers and cybersecurity experts have recently uncovered new variants of the notorious HelloKitty ransomware, signaling its resurgence with attacks targeting Windows, Linux, and ESXi environments. HelloKitty ransomware, initially appearing in October 2020 as a fork of DeathRansom, has evolved…
Tycoon 2FA Phishing Kit Uses Advanced Evasion Techniques to Bypass Endpoint Detection Systems
The notorious Tycoon 2FA phishing kit continues its evolution with new strategies designed to slip past endpoint detection systems. This development was highlighted in a recent analysis, showcasing several sophisticated techniques aimed at thwarting detection and analysis. Obfuscation with Invisible…
Threat Actors Exploit Legitimate Crypto Packages to Deliver Malicious Code
Threat actors are using open-source software (OSS) repositories to install malicious code into trusted applications, particularly targeting cryptocurrency software. The ReversingLabs (RL) research team has identified a pattern where attackers upload seemingly legitimate packages to repositories like npm, which then…
Hackers Exploit Router Flaws in Ongoing Attacks on Enterprise Networks
Enterprises are facing heightened cyber threats as attackers increasingly target network infrastructure, particularly routers, following a trend noted in Forescout Research Vedere Labs’ 2025 report on the riskiest connected devices. The Forescout report reveals a significant shift in the cybersecurity…
Threat Actors Launch Active Attacks on Semiconductor Firms Using Zero-Day Exploits
Semiconductor companies, pivotal in the tech industry for their role in producing components integral to everything from consumer electronics to critical defense systems, are under siege from sophisticated cyber threats. These firms design, manufacture, and sell semiconductors, crucial elements with…
Threat Actors Leverage Email Bombing to Evade Security Tools and Conceal Malicious Activity
Threat actors are increasingly using email bombing to bypass security protocols and facilitate further malicious endeavors. Email bombing, known also as a “spam bomb,” involves flooding a target’s email inbox with a massive volume of emails, overwhelming the recipient and…
Hands-On Labs: The Key to Accelerating CMMC 2.0 Compliance
INE Security Highlights How Practical, immersive training environments help defense contractors meet DoD cybersecurity requirements Defense contractors are facing increased pressure to meet the Department of Defense’s stringent Cybersecurity Maturity Model Certification (CMMC) 2.0 requirements ahead of 2025 compliance deadlines. INE Security,…
Sensata Technologies Breached: Ransomware Attack Key Systems
Sensata Technologies Holding PLC, a global leader in sensor solutions and electrical protection, is currently grappling with the fallout of a ransomware attack that has disrupted its operations and compromised sensitive files. The breach, first reported on April 6, 2025,…
CISA Issues 10 ICS Advisories Addressing Critical Vulnerabilities and Exploits
The Cybersecurity and Infrastructure Security Agency (CISA) has issued ten new Industrial Control Systems (ICS) advisories to address critical vulnerabilities and exploits that could impact key industrial systems. Released on April 10, 2025, these advisories provide crucial insights into ongoing…
TROX Stealer Harvests Sensitive Data Including Stored Credit Cards and Browser Credentials
Cybersecurity experts at Sublime have uncovered a complex malware campaign revolving around TROX Stealer, an information stealer that employs urgency to deceive victims. This malware, first detected in December 2024, highlights an intricate attack chain designed to extract sensitive data…
Microsoft Boosts Exchange and SharePoint Security with Updated Antimalware Scan
Microsoft has fortified its Exchange Server and SharePoint Server security by integrating advanced Antimalware Scan Interface (AMSI) capabilities. This measure, aimed at countering sophisticated attack vectors, represents a crucial step to safeguard on-premises infrastructure that serves as the backbone of…
Calix Devices Vulnerable to Pre-Auth RCE on Port 6998, Root Access Possible
A severe security flaw enabling unauthenticated remote code execution (RCE) with root privileges has been uncovered in select Calix networking devices, raising alarms for organizations using legacy hardware. The vulnerability resides in TCP port 6998 and impacts end-of-life (EOL) devices…
Chinese eCrime Group Targets Users in 120+ Countries to Steal Banking Credentials
Smishing Triad, a Chinese eCrime group, has launched an extensive operation targeting users across more than 121 countries. This campaign, primarily focused on stealing banking credentials, has evolved to include diverse industries, from postal and logistics to finance and retail…
AMD CPU Signature Verification Vulnerability Enables Unauthorized Microcode Execution
A vulnerability in AMD CPUs has been uncovered, enabling attackers with administrative privileges to bypass microcode signature verification and execute malicious code. Designated as CVE-2024-36347 (CVSS score: 6.4, Medium), the flaw impacts multiple generations of AMD EPYC™ server processors and select consumer…
Ivanti 0-Day RCE Flaw Exploitation Details Revealed
A critical unauthenticated Remote Code Execution (RCE) vulnerability, CVE-2025-22457, has been disclosed by Ivanti, sparking concerns across the cybersecurity industry. The flaw, which affects several Ivanti products, allows attackers to execute arbitrary code remotely, potentially compromising sensitive enterprise environments. Researchers, including the Rapid7…
Researchers Exploit Windows Defender with XOR and System Calls
A recent cybersecurity revelation has demonstrated how researchers successfully bypassed Windows Defender antivirus mechanisms using advanced techniques involving XOR encryption and direct system calls. This breakthrough has sparked discussions about the effectiveness of traditional antivirus measures against increasingly sophisticated attack…
Jenkins Docker Vulnerability Allows Hackers to Hijack Network Traffic
A newly disclosed vulnerability affecting Jenkins Docker images has raised serious concerns about network security. The vulnerability, stemming from the reuse of SSH host keys, could allow attackers to impersonate Jenkins build agents and hijack sensitive network traffic. Vulnerability Details…
Microsoft Issues Urgent Patch to Fix Office Update Crash
Microsoft has released an urgent patch for Office 2016 to address a critical issue causing key applications like Word, Excel, and Outlook to crash unexpectedly. The new update, KB5002623, was issued on April 10, 2025, following widespread reports of performance…
Shuckworm Group Leverages GammaSteel Malware in Targeted PowerShell Attacks
The Russia-linked cyber-espionage group known as Shuckworm (also identified as Gamaredon or Armageddon) has been observed targeting a Western country’s military mission located within Ukraine, employing an updated, PowerShell-based version of its GammaSteel infostealer malware. This campaign, which began in…
ViperSoftX Malware Spreads Through Cracked Software, Targeting Unsuspecting Users
AhnLab Security Intelligence Center (ASEC) has unearthed a complex cyber campaign in which attackers, suspected to be Arabic speakers, have been distributing ViperSoftX malware to unsuspecting Korean users. This operation has employed cracked software and torrents as vectors for spreading…
RansomHub RaaS in Disarray After Affiliate Chat Access Suddenly Revoked
RansomHub, a leading Ransomware-as-a-Service (RaaS) group that emerged in early 2024, has found itself grappling with internal turmoil. The instability came to light on April 1st, 2025, when several of its client chat portals, critical for ransomware negotiations, went offline,…
A Seven‑Year‑Old Cisco Flaw Now Lets Hackers Execute Code Remotely on Network Gear
A Cisco’s Smart Install protocol (CVE-2018-0171), first patched in 2018, remains a pervasive threat to global network infrastructure due to widespread misconfigurations and exploitation by state-sponsored threat actors. The flaw allows unauthenticated attackers to execute arbitrary code on Cisco switches…
GOFFEE Deploys PowerModul in Coordinated Strikes on Government and Energy Networks
The threat actor known as GOFFEE has launched a series of targeted attacks against critical sectors within the Russian Federation, utilizing advanced malware and phishing techniques. The group’s latest campaign involves the deployment of PowerModul, a PowerShell-based implant, to escalate…
Rogue Account‑Creation Flaw Leaves 100 K WordPress Sites Exposed
A severe vulnerability has been uncovered in the SureTriggers WordPress plugin, which could leave over 100,000 websites at risk. The issue, discovered by security researcher mikemyers, allows attackers to create rogue administrative users on sites where the plugin is not…
The State of AI Malware and Defenses Against It
AI has recently been added to the list of things that keep cybersecurity leaders awake. The increasing popularity of and easy access to large language models (LLMs), such as ChatGPT, DeepSeek, and Gemini, have enabled threat actors to scale and…
Malicious ‘mParivahan’ App Circulates on WhatsApp, Skimming Sensitive Mobile Data
A new variant of the fake NextGen mParivahan app has emerged, exploiting the trust users place in official government notifications to distribute malware. This malicious software is distributed through seemingly legitimate traffic violation alerts via WhatsApp, luring victims into installing…
SonicWall Patches Multiple Vulnerabilities in NetExtender Windows Client
SonicWall has issued a critical alert concerning multiple vulnerabilities discovered in its NetExtender Windows client. These vulnerabilities, identified via several Common Vulnerabilities and Exposures (CVEs), could allow malicious actors to exploit privilege management flaws, trigger local privilege escalation, or manipulate…
Dell Alerts Users to Critical PowerScale OneFS Flaws Enabling Account Takeover
Dell Technologies has issued an urgent security advisory to its users, warning of several critical vulnerabilities in its PowerScale OneFS operating system. These flaws, if exploited, could allow attackers to take over high-privileged user accounts, bypass authorization controls, and disrupt…
Langflow AI Builder Vulnerability Allows Remote Server Takeover by Attackers
A critical security vulnerability has been discovered in the Langflow AI Builder, a popular tool for creating agentic AI workflows. The flaw, tracked as CVE-2025-3248, enables unauthenticated remote attackers to compromise servers running Langflow, potentially leading to full server control. Security…