Geek Guy

Category: Cybersecurity

Dive into deep-dive analysis on the evolving threat landscape, focusing on identity security (ITDR, NHI), data protection (DSPM), and agentic identity. Stay updated with expert insights on threat actor tactics and local AI security for researchers and market analysts.

Call of Duty: From pew-pew to pwned

In episode 425 of “Smashing Security”, Graham reveals how “Call of Duty: WWII” has been weaponised – allowing hackers to hijack your entire PC during online matches, thanks to ancient code and Microsoft’s Game Pass. Meanwhile, Carole digs into a con targeting the recently incarcerated, with scammers impersonating bail bond agents to fleece desperate families.…

Trump bill will have major impact on health care cybersecurity, experts warn Congress

At the outset of a Senate hearing Wednesday on cybersecurity in the health care sector, Sen. Bill Cassidy, R-La., took a moment to implore lawmakers and witnesses to stay focused on the topic at hand — and not veer off into discussions about the impact of cuts to the sector from Republicans’ One Big Beautiful…

How to Maintain Fast and Fatigue-Free Alert Triage with Threat Intelligence 

Alert triage as one of the critical SOC and MSSP workflows implies evaluating, prioritizing, and categorizing security alerts to determine which threats require immediate attention and which can be safely dismissed or handled through automated processes.  Efficient alert triage, supported by robust threat intelligence, ensures that organizations stay ahead of adversaries while maintaining analyst productivity…

Microsoft Patch Tuesday addresses 130 vulnerabilities, none actively exploited

Microsoft addressed 130 vulnerabilities across its products and underlying Windows systems, but none have been actively exploited in the wild, the company said in its latest security update Tuesday. A proof-of-concept exploit for a high-severity defect in SQL Server — CVE-2025-49719 — has been shared publicly, researchers said. The information disclosure vulnerability, which has a…

Oligo Security strives to fill application-layer gaps in MITRE ATT&CK framework

Applications are a common intrusion point, but the way attackers gain access, maneuver and create mayhem within and across applications doesn’t always neatly fit into MITRE’s ATT&CK framework.  The team at Oligo Security is releasing a new framework it calls Application Attack Matrix to complement areas of MITRE’s framework that it describes as too broad,…

Call of Duty takes PC game offline after multiple reports of RCE attacks on players

The makers of Call of Duty: World War 2 took the PC version of the game offline over the weekend amid widespread reports online that a remote code execution vulnerability was being used to take over victim computers during live multiplayer matches. On June 30, the 2017 game was released through Xbox’s GamePass service. On…

Scattered Spider weaves web of social-engineered destruction

In an underworld fueled by infamy and money that leaves a trail of human misery in its wake, the unbound collective colloquially known as Scattered Spider deviates from many norms in cybercrime. The cunning threat group composed of young, native English-speaking people lacks cohesion, is rife with infighting and doesn’t have a data leak site,…

How to Easily Escalate to Root on Linux Using the Latest Sudo Vulnerabilities

A newly disclosed pair of critical vulnerabilities in Sudo — the powerful Unix/Linux command-line tool that allows users to run commands as root — poses a significant local privilege escalation threat. These flaws impact major Linux distributions and allow unprivileged local users to gain root access, thereby compromising system integrity. Summary of the Vulnerabilities The…

China-linked attacker hit France’s critical infrastructure via trio of Ivanti zero-days last year

Multiple critical infrastructure sectors were hit last year during an attack spree in France via a trio of zero-day vulnerabilities affecting Ivanti Cloud Service Appliance devices, the country’s cybersecurity agency said in a report released Tuesday. Government agencies and organizations in the telecommunications, media, finance and transportation industries were impacted by widespread zero-day exploits of…

Surveillance, spyware, and self-driving snafus

A Mexican drug cartel spies on the FBI using traffic cameras and spyware — because “ubiquitous technical surveillance” is no longer just for dystopian thrillers. Graham digs into a chilling new US Justice Department report that shows how surveillance tech was weaponised to deadly effect. Meanwhile, Carole checks the rear-view mirror on the driverless car…

Release Notes: Detonation Actions, Enhanced QR Extraction, and 1,400+ New Detection Rules 

We’ve packed June with updates designed to make your day-to-day analysis faster, clearer, and easier than before. Whether you’re just getting started or deep into reverse engineering every day, these improvements are here to save you time and help you catch more threats.  In this update:  Real-time Detonation Action hints that guide you through the…

A Guide to Developing Security-First Culture Powered by Threat Intelligence 

Security-First Culture (SFC) is an organization-wide commitment where security considerations influence decision-making at every level, from strategic planning to daily operational tasks.  It’s not just about having fancy tech or a dedicated IT team; it’s about making security a core part of how the company thinks and acts. A mindset where every decision, from coding…

Cloudflare rolls out ‘pay-per-crawl’ feature to constrain AI’s limitless hunger for data 

Cloudflare announced Tuesday it will allow customers to block or charge fees for web crawlers deployed to scrape their websites and data on behalf of AI systems. In a blog on its corporate website, Will Allen, Cloudflare’s vice president of product, and Simon Newton, an engineer manager, said the company is establishing a new system…

US sanctions bulletproof hosting provider for supporting ransomware, infostealer operations

Federal authorities levied sanctions Tuesday on Aeza Group, a bulletproof hosting service provider based in Russia, for allegedly supporting a broad swath of ransomware, malware and infostealer operators. Aeza Group has provided servers and specialized infrastructure to the Meduza, RedLine and Lumma infostealer operators, BianLian ransomware and BlackSprut, a Russian marketplace for illicit drugs, according…

AT&T deploys new account lock feature to counter SIM swapping

AT&T widely launched its Wireless Account Lock feature Tuesday, aiming to strengthen customer protection against account takeovers and SIM-swapping attacks.  The feature comes amid rising concern over SIM swapping and other social-engineering tactics that allow bad actors to compromise user accounts and take control of their phone numbers. The Wireless Account Lock, which had been…

DOJ Charges 324 in Sprawling $14.6 Billion Healthcare Fraud Scams

The DOJ and other U.S. agencies has charged 324 people, including medical professionals and pharmacists, in connection with a series of investigations into health care fraud, with one investigation dubbed Operation Gold Rush involving $10.6 billion in fraud, the largest such case in history. The post DOJ Charges 324 in Sprawling $14.6 Billion Healthcare Fraud…

Deeper Network Promo Deeper Network Promo Deeper Network Promo Image

DEVMAN Ransomware: Analysis of New DragonForce Variant 

Editor’s note: The current article is authored by Mauro Eldritch, offensive security expert and threat intelligence analyst. You can find Mauro on X.  New ransomware strains continue to surface frequently, and many of them are loosely built on or repackaged from existing families. One such case involves a sample resembling DragonForce ransomware, yet bearing several…

Escaping SOC Burnout: State of Security 2025

Michael Fanning, CISO at Splunk, shares insights on cybersecurity challenges highlighted in the Splunk State of Security report. Key issues include analyst burnout and alert fatigue, which persist over time. Fanning discusses how AI can improve efficiency and support analysts, emphasizing the need for better prioritization and event correlation in security operations to enhance effectiveness..…

Fake Receipt Detector Technology: Protecting Financial Integrity in the Digital Age

The rise of sophisticated digital tools and artificial intelligence has revolutionized many aspects of business and finance, but it has also created new opportunities for fraudulent activities. Among the most concerning developments is the increasing prevalence of fake receipts and fraudulent expense documentation. As businesses, insurance companies, and financial institutions grapple with these challenges, the…

Scattered Spider strikes again? Aviation industry appears to be next target for criminal group

The aviation industry has seemingly become the latest target of Scattered Spider, a sophisticated cybercriminal group that has shifted its focus from retail and insurance companies to airlines in what cybersecurity experts describe as a coordinated campaign against the sector. Hawaiian Airlines disclosed a cybersecurity incident Friday affecting some of its IT systems while maintaining…

Notorious cybercriminal ‘IntelBroker’ arrested in France, awaits extradition to US

Kai West, a prolific cybercriminal better known for operating under the moniker “IntelBroker,” was arrested in France earlier this year and faces federal charges for allegedly stealing data from more than 40 organizations during a two-year period, the Justice Department said Wednesday.  Federal prosecutors unsealed a four-count indictment charging West, a British national, with conspiracy…

Deeper Network Promo Deeper Network Promo Deeper Network Promo Image

Operation Endgame, deepfakes, and dead slugs

In this episode, Graham unravels Operation Endgame – the surprisingly stylish police crackdown that is seizing botnets, mocking malware authors with anime videos, and taunting cybercriminals via Telegram. Meanwhile, Carole exposes the AI-generated remote hiring threat. Could your next coworker be a North Korean hacker with a perfect LinkedIn? And BBC cyber correspondent Joe Tidy…

Many data brokers aren’t registering across state lines, privacy groups say

Hundreds of companies registered as data brokers in one U.S. state are not recognized as such in other states with similar disclosure laws, according to a new analysis by the Privacy Rights Clearinghouse and the Electronic Frontier Foundation. The country has a data broker problem, with few meaningful laws at the federal or state level…

BreachForums Is DEAD — Cybercrime’s Biggest Empire Just Got Crushed!

A coordinated law enforcement operation in France has resulted in the arrest of key figures behind BreachForums, one of the most active and influential marketplaces for cybercriminals in recent years. The takedown marks a significant disruption in the cybercriminal economy, highlighting both the global reach of modern threat actors and the increasing sophistication of cross-border…

Citrix users hit by actively exploited zero-day vulnerability

Citrix on Wednesday disclosed an actively exploited zero-day vulnerability affecting multiple versions of NetScaler products, an alarming development from a vendor that’s been widely targeted in previous attack sprees. The zero-day (CVE-2025-6543) was disclosed by Citrix nine days after it issued a security bulletin for a pair of defects (CVE-2025-5777 and CVE-2025-5349) in the same…

Stealth China-linked ORB network gaining footholds in US, East Asia

A recently discovered operational relay box (ORB) network controlled by a China-linked threat group already exceeds 1,000 devices and is growing across the United States and East Asia, SecurityScorecard said in a threat report released Monday.  The ORB network, which SecurityScorecard dubbed “LapDogs,” is primarily composed of routers designed for small or home offices but…

Top 3 Cyber Attacks in June 2025: GitHub Abuse, Control Flow Flattening, and More 

June 2025 saw several sophisticated and stealthy cyber attacks that relied heavily on obfuscated scripts, abuse of legitimate services, and multi-stage delivery techniques. Among the key threats observed by ANY.RUN’s analysts were malware campaigns using GitHub for payload hosting, JavaScript employing control-flow flattening to drop Remcos, and obfuscated BAT scripts delivering NetSupport RAT. Let’s see…

Top 3 Cyber Attacks in June 2025: GitHub Abuse, Control Flow Flattening, and More 

June 2025 saw several sophisticated and stealthy cyber attacks that relied heavily on obfuscated scripts, abuse of legitimate services, and multi-stage delivery techniques. Among the key threats observed by ANY.RUN’s analysts were malware campaigns using GitHub for payload hosting, JavaScript employing control-flow flattening to drop Remcos, and obfuscated BAT scripts delivering NetSupport RAT. Let’s see…

Top 3 Cyber Attacks in June 2025: GitHub Abuse, Control Flow Flattening, and More 

June 2025 saw several sophisticated and stealthy cyber attacks that relied heavily on obfuscated scripts, abuse of legitimate services, and multi-stage delivery techniques. Among the key threats observed by ANY.RUN’s analysts were malware campaigns using GitHub for payload hosting, JavaScript employing control-flow flattening to drop Remcos, and obfuscated BAT scripts delivering NetSupport RAT. Let’s see…

Top 3 Cyber Attacks in June 2025: GitHub Abuse, Control Flow Flattening, and More 

June 2025 saw several sophisticated and stealthy cyber attacks that relied heavily on obfuscated scripts, abuse of legitimate services, and multi-stage delivery techniques. Among the key threats observed by ANY.RUN’s analysts were malware campaigns using GitHub for payload hosting, JavaScript employing control-flow flattening to drop Remcos, and obfuscated BAT scripts delivering NetSupport RAT. Let’s see…

How to Spot Registry Abuse by Malware: Examples in ANY.RUN Sandbox 

When malware infiltrates a system, it doesn’t always make noise. In fact, some of the most dangerous threats operate quietly embedding themselves deep within the system and ensuring they come back even after a reboot. One of the most common ways they achieve this is by abusing the Windows Registry.  In this article, we’ll walk…

How to Spot Registry Abuse by Malware: Examples in ANY.RUN Sandbox 

When malware infiltrates a system, it doesn’t always make noise. In fact, some of the most dangerous threats operate quietly embedding themselves deep within the system and ensuring they come back even after a reboot. One of the most common ways they achieve this is by abusing the Windows Registry.  In this article, we’ll walk…

How to Spot Registry Abuse by Malware: Examples in ANY.RUN Sandbox 

When malware infiltrates a system, it doesn’t always make noise. In fact, some of the most dangerous threats operate quietly embedding themselves deep within the system and ensuring they come back even after a reboot. One of the most common ways they achieve this is by abusing the Windows Registry.  In this article, we’ll walk…

How to Spot Registry Abuse by Malware: Examples in ANY.RUN Sandbox 

When malware infiltrates a system, it doesn’t always make noise. In fact, some of the most dangerous threats operate quietly embedding themselves deep within the system and ensuring they come back even after a reboot. One of the most common ways they achieve this is by abusing the Windows Registry.  In this article, we’ll walk…

Simplify Threat Analysis and Boost Detection Rate with Detonation Actions 

Threat analysis is a complex task that demands full attention, especially during active incidents, when every second counts. ANY.RUN’s Interactive Sandbox is designed to ease that pressure with an intuitive interface and fast threat detection.   Our new feature, Detonation Actions, takes this further by highlighting detonation steps during analysis. When a specific action is needed…

Simplify Threat Analysis and Boost Detection Rate with Detonation Actions 

Threat analysis is a complex task that demands full attention, especially during active incidents, when every second counts. ANY.RUN’s Interactive Sandbox is designed to ease that pressure with an intuitive interface and fast threat detection.   Our new feature, Detonation Actions, takes this further by highlighting detonation steps during analysis. When a specific action is needed…

Simplify Threat Analysis and Boost Detection Rate with Detonation Actions 

Threat analysis is a complex task that demands full attention, especially during active incidents, when every second counts. ANY.RUN’s Interactive Sandbox is designed to ease that pressure with an intuitive interface and fast threat detection.   Our new feature, Detonation Actions, takes this further by highlighting detonation steps during analysis. When a specific action is needed…

Simplify Threat Analysis and Boost Detection Rate with Detonation Actions 

Threat analysis is a complex task that demands full attention, especially during active incidents, when every second counts. ANY.RUN’s Interactive Sandbox is designed to ease that pressure with an intuitive interface and fast threat detection.   Our new feature, Detonation Actions, takes this further by highlighting detonation steps during analysis. When a specific action is needed…

Tips to make your summer travels cyber safe

Ready, set, pack! Summer travel season is here and that means family road trips, beach vacations, international adventures and more. While summertime is prime time for getaways, did you know it’s also prime time for online fraud? Scammers are targeting the travel industry, putting millions of travelers at increased risk. Research shows that the travel…

Tips to make your summer travels cyber safe

Ready, set, pack! Summer travel season is here and that means family road trips, beach vacations, international adventures and more. While summertime is prime time for getaways, did you know it’s also prime time for online fraud? Scammers are targeting the travel industry, putting millions of travelers at increased risk. Research shows that the travel…

Tips to make your summer travels cyber safe

Ready, set, pack! Summer travel season is here and that means family road trips, beach vacations, international adventures and more. While summertime is prime time for getaways, did you know it’s also prime time for online fraud? Scammers are targeting the travel industry, putting millions of travelers at increased risk. Research shows that the travel…

Tips to make your summer travels cyber safe

Ready, set, pack! Summer travel season is here and that means family road trips, beach vacations, international adventures and more. While summertime is prime time for getaways, did you know it’s also prime time for online fraud? Scammers are targeting the travel industry, putting millions of travelers at increased risk. Research shows that the travel…

Tips to make your summer travels cyber safe

Ready, set, pack! Summer travel season is here and that means family road trips, beach vacations, international adventures and more. While summertime is prime time for getaways, did you know it’s also prime time for online fraud? Scammers are targeting the travel industry, putting millions of travelers at increased risk. Research shows that the travel…

Tips to make your summer travels cyber safe

Ready, set, pack! Summer travel season is here and that means family road trips, beach vacations, international adventures and more. While summertime is prime time for getaways, did you know it’s also prime time for online fraud? Scammers are targeting the travel industry, putting millions of travelers at increased risk. Research shows that the travel…

Tips to make your summer travels cyber safe

Ready, set, pack! Summer travel season is here and that means family road trips, beach vacations, international adventures and more. While summertime is prime time for getaways, did you know it’s also prime time for online fraud? Scammers are targeting the travel industry, putting millions of travelers at increased risk. Research shows that the travel…