Amnesty International said Serbian police used an exploit chain in tandem with legitimate mobile extraction dongle from vendor Cellebrite in an attack that brings up questions around ethical technology development.
Category: Exploits
cybersecurity education, DEF CON 32, DEFCONConference, Exploits, Global Security News, Infosecurity Education, Security Bloggers Network
DEF CON 32 – War Stories – Xiaomi The Money: Our Toronto Pwn2Own Exploit & BTS Story
Authors/Presenters: Ken Gannon, Ilyes Beghdadi Our sincere appreciation to DEF CON, and the Authors/Presenters for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel. Permalink The post DEF CON 32 – War Stories – Xiaomi The Money: Our Toronto…
Exploits, Global Security News, Security, Zero-Day Vulnerabilities
VMware ESXi gets critical patches for in-the-wild virtual machine escape attack
Broadcom released emergency patches for its VMware ESXi, Workstation, and Fusion products to fix three vulnerabilities that can lead to virtual machine escape and are actively being exploited by attackers. Products that include VMware ESXi, such as VMware vSphere, VMware Cloud Foundation, and VMware Telco Cloud Platform, are also impacted. VMware products, especially the ESXi…
Exploits, Global Security News
“Why now?”: a single question that decides what security startups succeed, and which fail
Whenever I think of a problem, I ask myself “Why now?”. Why is now the time for this idea? Why is now the time for this startup? Why is now the time for the buyer to start caring? In my opinion, “Why now?” is the most important question a startup founder can answer. It is…
Exploits, Global Security News
VMware Warns Customers to Patch Actively Exploited Zero-Day Vulnerabilities
Cloud software firm VMware has issued a critical security advisory, detailing three zero-day vulnerabilities being actively exploited in the wild
Application Security, Cybersecurity, cybersecurity training, Exploits, Global Security News, Offensive Security, OSCP, penetration testing, Security Bloggers Network
Getting the Most Value Out of the OSCP: The PEN-200 Course
In this second post of a five-part series, I provide advice on how to best utilize the PEN-200 course material for a successful career in ethical hacking. Disclaimer: All opinions expressed in this article are solely my own. I have reviewed the content to ensure compliance with OffSec’s copyright policies and agreements. I have not been…
Exploits, Global Security News
VMware Security Flaws Exploited in the Wild—Broadcom Releases Urgent Patches
Broadcom has released security updates to address three actively exploited security flaws in VMware ESXi, Workstation, and Fusion products that could lead to code execution and information disclosure. The list of vulnerabilities is as follows – CVE-2025-22224 (CVSS score: 9.3) – A Time-of-Check Time-of-Use (TOCTOU) vulnerability that leads to an out-of-bounds write, which a malicious…
Exploits, Global Security News, Microsoft, Security
Broadcom fixes three VMware zero-days exploited in attacks
Broadcom warned customers today about three VMware zero-days, tagged as exploited in attacks and reported by the Microsoft Threat Intelligence Center. […]
Blog, Exploits, Global Security News, Research, Security Bloggers Network
Veriti Research Uncovers Malware Exploiting Cloud Services
Veriti Research has identified a growing trend – attackers leveraging cloud infrastructure to facilitate malware distribution and command-and-control (C2) operations. This evolving tactic not only makes detection more challenging but also exposes organizations to significant security risks. Malware Hosted on Cloud Services One of the most alarming findings from our research is that over 40%…
Exploits, Global Security News
CISA Urges Government to Patch Exploited Cisco, Microsoft Flaws
CISA has added five more CVEs into its known exploited vulnerabilities catalog
Exploits, Global Security News
7 key trends defining the cybersecurity market today
Enterprise security budgets are expected to increase 15% in 2025, from an estimated $184 billion in 2024 to $212 billion, according to Gartner. That’s good news for CISOs because it provides additional resources in the ongoing battle against cyberattacks. “The continued heightened threat environment, cloud movement, and talent crunch are pushing security to the top…
Exploits, Global Security News
Cisco, Hitachi, Microsoft, and Progress Flaws Actively Exploited—CISA Sounds Alarm
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added five security flaws impacting software from Cisco, Hitachi Vantara, Microsoft Windows, and Progress WhatsUp Gold to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The list of vulnerabilities is as follows – CVE-2023-20118 (CVSS score: 6.5) – A command injection
Exploits, Global Security News
Google’s March 2025 Android Security Update Fixes Two Actively Exploited Vulnerabilities
Google has released its monthly Android Security Bulletin for March 2025 to address a total of 44 vulnerabilities, including two that it said have come under active exploitation in the wild. The two high-severity vulnerabilities are listed below – CVE-2024-43093 – A privilege escalation flaw in the Framework component that could result in unauthorized access…
Cyberattacks, Security, Exploits, Global Security News
CISOs should address identity management ‘as fast as they can’ says CrowdStrike exec
CISOs should be moving “as fast as they can” to close holes in their identity and access management infrastructure to block cyber attacks, says a CrowdStrike executive. Adam Meyers, senior vice president of counter adversary research, made the comment Monday on the release of CrowdStrike’s annual Global Threat Report, an analysis of 2024 data from…
Android, Cybersecurity, Exploits, Global Security News, Google, Technology, vulnerabilities
Android security update contains 2 actively exploited vulnerabilities
Google addressed 43 vulnerabilities affecting Android devices in its March security update, including a pair of software defects reportedly under active exploitation. Google said the two vulnerabilities — CVE-2024-43093 and CVE-2024-50302 — “may be under limited, targeted exploitation.” The most severe of the flaws under active exploitation, CVE-2024-43093, carries a CVSS score of 7.8 and…
Exploits, Global Security News, Microsoft, Security
CISA tags Windows, Cisco vulnerabilities as actively exploited
CISA has warned US federal agencies to secure their systems against attacks exploiting vulnerabilities in Cisco and Windows systems. […]
Exploits, Global Security News, Security
New ClickFix attack deploys Havoc C2 via Microsoft Sharepoint
A newly uncovered ClickFix phishing campaign is tricking victims into executing malicious PowerShell commands that deploy the Havok post-exploitation framework for remote access to compromised devices. […]
Exploits, Global Security News
Attackers Leverage Microsoft Teams and Quick Assist for Access
Phishing attack exploits social engineering techniques alongside Microsoft Teams and remote access software to deploy BackConnect malware
Exploits, Global Security News
Hackers Exploit Paragon Partition Manager Driver Vulnerability in Ransomware Attacks
Threat actors have been exploiting a security vulnerability in Paragon Partition Manager’s BioNTdrv.sys driver in ransomware attacks to escalate privileges and execute arbitrary code. The zero-day flaw (CVE-2025-0289) is part of a set of five vulnerabilities that was discovered by Microsoft, according to the CERT Coordination Center (CERT/CC). “These include arbitrary kernel memory mapping and
Enterprise, Exploits, Fundraising, Global Security News, Startups, supply chain security, TCV
Cloudsmith raises $23M to improve software supply chain security
The software supply chain is notoriously porous: a reported 81% of codebases contain high- or critical-risk open source vulnerabilities. A single vulnerability can have a far-reaching impact on the wider software supply chain, as evidenced by the likes of the Log4Shell exploit that saw millions of applications exposed to potential remote code execution hacks via…
Exploits, Global Security News
⚡ THN Weekly Recap: Alerts on Zero-Day Exploits, AI Breaches, and Crypto Heists
This week, a 23-year-old Serbian activist found themselves at the crossroads of digital danger when a sneaky zero-day exploit turned their Android device into a target. Meanwhile, Microsoft pulled back the curtain on a scheme where cybercriminals used AI tools for harmful pranks, and a massive trove of live secrets was discovered, reminding us that…
Exploits, Global Security News
BYOVD Attacks Exploit Zero-Day in Paragon Partition Manager
Threat actors are exploiting a zero-day bug in Paragon Partition Manager’s BioNTdrv.sys driver during ransomware attacks
Exploits, Global Security News, Ransomware
Ransomware access playbook: What Black Basta’s leaked logs reveal
Black Basta, one of the most successful ransomware groups over the past several years, had a major leak of its internal communications recently. The logs provide a glimpse into the playbook of a high-profile ransomware group and its preferred methods for gaining initial access to networks, as analysis from security researchers shows. “Key attack vectors…
Blog, Exploits, Global Security News, Security Bloggers Network
11 Application Security Testing Types
As organizations accelerate their release cycles and rely on complex software ecosystems, security vulnerabilities become harder to track—and easier for attackers to exploit. From open-source dependencies to misconfigurations in production, security gaps can lead to data breaches, compliance failures, and costly downtime. The post 11 Application Security Testing Types appeared first on Cycode. The post…
Exploits, Global Security News
Microsoft files lawsuit against LLMjacking gang that bypassed AI safeguards
Microsoft has filed a civil lawsuit against an international gang of cybercriminals that exploited stolen credentials to access generative AI services, including its own. The gang, tracked as Storm-2139, used the stolen credentials along with AI jailbreaking techniques to set up paid services of their own capable of generating content that bypassed built-in ethical safeguards…
Exploits, Global Security News
Amnesty Finds Cellebrite’s Zero-Day Used to Unlock Serbian Activist’s Android Phone
A 23-year-old Serbian youth activist had their Android phone targeted by a zero-day exploit developed by Cellebrite to unlock the device, according to a new report from Amnesty International. “The Android phone of one student protester was exploited and unlocked by a sophisticated zero-day exploit chain targeting Android USB drivers, developed by Cellebrite,” the international…
Exploits, Global Security News, Google, Mobile, Security
Serbian police used Cellebrite zero-day hack to unlock Android phones
Serbian authorities have reportedly used an Android zero-day exploit chain developed by Cellebrite to unlock the device of a student activist in the country and attempt to install spyware. […]
china, cyberattack, Cybersecurity, Exploits, Global Security News, Security
Belgium investigating alleged cyberattack on intelligence agency by China-linked hackers
The hackers reportedly exploited a flaw in US cybersecurity firm Barracuda’s software to access VSSE’s email server © 2024 TechCrunch. All rights reserved. For personal use only.
business, channel, Exploits, Global Security News, News and Trends, services
CrowdStrike Highlights Four Key Tech, Sales Milestones
Cybersecurity giant CrowdStrike recently announced new milestones and advancements in the cloud security, identity protection, and next-generation cybersecurity sectors. The announcements relate to the organization’s business within the AWS Marketplace, their Oracle Cloud partnership, Falcon Identity Protection for Microsoft Entra ID, and achieving additional FedRAMP Authorization. CrowdStrike’s AWS Marketplace milestone CrowdStrike announced it is the…
Exploits, Global Security News
Old Vulnerabilities Among the Most Widely Exploited
Four in ten flaws exploited by threat actors in 2024 were from 2020 or earlier, with some dating back to the 1990s, according to a GreyNoise report
Cybercrime, Exploits, Global Security News
Interna von Ransomware-Gruppe Black Basta durchgesickert
Über die vergangenen Jahre hat Black Basta mit mehr als 500 Opfern weltweit von sich Reden gemacht. Durchgesickerte Chat-Protokolle enthüllen die innere Funktionsweise und interne Konflikte der Gruppe. DC Studio – shutterstock.com Black Basta betrat erstmals im April 2022 die Hackerbühne und nutzte den inzwischen weitgehend verschwundenen QakBot, auch bekannt als QBot. Einem von der…
Exploits, Global Security News
Schwachstellen managen: Die besten Vulnerability-Management-Tools
Schwachstellen zu managen, muss keine Schwerstarbeit sein. Wenn Sie die richtigen Tools einsetzen. Das sind die besten in Sachen Vulnerability Management. Foto: eamesBot – shutterstock.com Nicht nur das Vulnerability Management hat sich im Laufe der Jahre erheblich verändert, sondern auch die Systeme, auf denen Schwachstellen identifiziert und gepatcht werden müssen. Systeme für das Schwachstellen-Management fokussieren…
Cybersecurity, Exploits, Global Security News, Google, Multi-Factor Authentication (MFA), SMS, Technology
Here’s what Google is (and isn’t) planning with SMS account verification
Google is gradually phasing out SMS-based verification as part of its two-step verification (2SV) process across its suite of services, signaling a significant shift in how the tech giant approaches user authentication and security. The change, which will affect Gmail and all other Google services where users sign in with their Google accounts, marks a…
Exploits, Global Security News, vulnerabilities
Critical Microsoft Partner Center vulnerability under attack, CISA warns
A critical vulnerability in Microsoft’s Partner Center platform is under attack, enabling unauthenticated attackers to escalate privileges, potentially leading to data breaches, malware deployment, and lateral movement across enterprise networks. The US Cybersecurity and Infrastructure Security Agency (CISA) has added the flaw, tracked as CVE-2024-49035, to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation…
Exploits, Global Security News
5 things to know about ransomware threats in 2025
Ransomware attacks continue to be one of the most significant cybersecurity threats organizations and cybersecurity leaders face. Attacks lead to wide-scale disruptions, large data breaches, huge payouts and millions of dollars in costs to businesses. In response, large, coordinated law enforcement operations have targeted major ransomware groups and disrupted operations, dismantled data leak sites and…
Exploits, Global Security News
‘Silver Fox’ APT Skirts Windows Blocklist in BYOVD Attack
There’s an untapped universe of exploitable drivers in the wild today. By exploiting just one of them, attackers were able to defeat security tools and infect Asian citizens with Gh0stRAT.
Exploits, Global Security News
CISA Adds Microsoft and Zimbra Flaws to KEV Catalog Amid Active Exploitation
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday placed two security flaws impacting Microsoft Partner Center and Synacor Zimbra Collaboration Suite (ZCS) to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The vulnerabilities in question are as follows – CVE-2024-49035 (CVSS score: 8.7) – An improper access control
Exploits, Global Security News
Geopolitical tensions fuel surge in OT and ICS cyberattacks
Attacks against operational technology (OT) networks are on the rise, fueled by geopolitical tensions and conflicts, as OT security fast becomes a mainstream concern. Two new threat groups emerged in 2024, joining seven other active attackers of OT systems, and two new malware families targeting industrial control systems (ICS) were added to the attackers’ arsenals…
Exploits, Global Security News, Incident Response, Security Bloggers Network
Deceptive Signatures: Advanced Techniques in BEC Attacks
KEY TAKEAWAYS Sophistication of BEC Attacks: Business Email Compromise (BEC) attacks are becoming increasingly sophisticated, leveraging advanced social engineering, AI-driven personalization, and phishing kits in order to overcome MFA protections. Exploitation of Trust: Some threat actor groups have been discovered levering a technique that involves embedding phishing lures within email signature blocks on user accounts.…
Exploits, Global Security News
Microsoft 365 Accounts Get Sprayed by Mega-Botnet
The threat actors are exploiting non-interactive sign-ins, an authentication feature that security teams don’t typically monitor.
cybersecurity education, DEF CON 32, DEFCONConference, Exploits, Global Security News, Infosecurity Education, Security Bloggers Network
DEF CON 32 – Exploiting Bluetooth: From Your Car To The Bank Account$$
Authors/Presenters: Yso & Martin Strohmeier Our sincere appreciation to DEF CON, and the Authors/Presenters for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel. Permalink The post DEF CON 32 – Exploiting Bluetooth: From Your Car To The Bank…
Exploits, Global Security News, Have I Been Pwned
Processing 23 Billion Rows of ALIEN TXTBASE Stealer Logs
I like to start long blog posts with a tl;dr, so here it is: We’ve ingested a corpus of 1.5TB worth of stealer logs known as “ALIEN TXTBASE” into Have I Been Pwned. They contain 23 billion rows with 493 million unique website and email address pairs, affecting 284M unique email addresses. We’ve also added…
blockchain, Crypto, CryptoCurrency, Cybercrime, Cybersecurity, Elliptic, ethereum, Exploits, Global Security News, Money, North Korea, TRM Labs
Crypto analysts stunned by Lazarus Group’s capabilities in $1.46B Bybit theft
Last week’s $1.46 billion Ethereum theft by North Korean-linked Lazarus Group has sent shockwaves through the cybercrime ecosystem, as it has not only joined the ranks of the largest known financial thefts in history but also demonstrated that the group’s skillset is presenting new challenges for defenders. In the wake of the theft, numerous experts…
Department of Government Efficency, Exploits, Federal IT, Gerry Connolly, Global Security News, Government, House Oversight Committee, Inspector general, Lawrence Livermore National Laboratory, Los Alamos National Laboratory, Melanie Stansbury, Treasury Department, Treasury Inspector General for Tax Administration, Trump Administration
House Dems say DOGE is leaving publicly exposed entry points into government systems
Democrats on the House Oversight Committee say the Department of Government Efficiency (DOGE) is jeopardizing cybersecurity by publicly exposing entry points into U.S. government systems, and told the Trump administration it needs to provide information on department officials’ access. “Decades of efforts by both Republican and Democratic administrations, along with bipartisan collaboration in Congress, have…
Exploits, Global Security News
61% of Hackers Use New Exploit Code Within 48 Hours of Attack
61% of hackers use new exploit code within 48 hours, ransomware remains top threat in 2024
Exploits, Global Security News, vulnerabilities
Critical deserialization bugs in Adobe, Oracle software actively exploited, warns CISA
CISA is warning Adobe and Oracle customers about in-the-wild exploitation of critical vulnerabilities affecting the services of these leading enterprise software providers. The US cybersecurity watchdog added vulnerabilities in Adobe ColdFusion (CVE-2017-3066) and Oracle Agile Product Lifecycle Management (PLM) (CVE-2024-20953) to its known exploited vulnerabilities (KEV) catalog on Monday. “These type of vulnerabilities are frequent…
Exploits, Global Security News
Industrial System Cyberattacks Surge as OT Stays Vulnerable
Nearly a third of organizations have an operational system connected to the Internet with a known exploited vulnerability, as attacks by state and non-state actors increase.
Exploits, Global Security News
5 Active Malware Campaigns in Q1 2025
The first quarter of 2025 has been a battlefield in the world of cybersecurity. Cybercriminals continued launching aggressive new campaigns and refining their attack methods. Below is an overview of five notable malware families, accompanied by analyses conducted in controlled environments. NetSupport RAT Exploiting the ClickFix Technique In early 2025, threat actors began exploiting a…
Exploits, Global Security News
Two Actively Exploited Security Flaws in Adobe and Oracle Products Flagged by CISA
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two security flaws impacting Adobe ColdFusion and Oracle Agile Product Lifecycle Management (PLM) to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The vulnerabilities in question are listed below – CVE-2017-3066 (CVSS score: 9.8) – A deserialization vulnerability impacting
Exploits, Global Security News, Security
Exploits for unpatched Parallels Desktop flaw give root on Macs
Two different exploits for an unpatched Parallels Desktop privilege elevation vulnerability have been publicly disclosed, allowing users to gain root access on impacted Mac devices. […]
Exploits, Global Security News, Security
Beware: PayPal “New Address” feature abused to send phishing emails
An ongoing PayPal email scam exploits the platform’s address settings to send fake purchase notifications, tricking users into granting remote access to scammers […]
CryptoCurrency, Exploits, Gaming, Global Security News, Security
Fake CS2 tournament streams used to steal crypto, Steam accounts
Threat actors are exploiting major Counter-Strike 2 (CS2) competitions, like IEM Katowice 2025 and PGL Cluj-Napoca 2025, to defraud gamers and steal their Steam accounts and cryptocurrency. […]
Exploits, Global Security News
FBI and CISA warn about continuing attacks by Chinese ransomware group Ghost
The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) have issued a joint advisory about the activities of a ransomware group from China dubbed Ghost, which has compromised organizations in over 70 countries over the past four years. The Ghost group began its activities in early 2021, but attacks have…
Exploits, Global Security News, Security
Fight fire with fire: 3 major ways AI fuels your cybersecurity arsenal
A cyberattack on a UK-based energy firm used AI to mimic the CEO’s voice and tricked a staffer into transferring $243,000 to a fake account in 2019. A cyber espionage campaign in 2021 targeted international telecom companies with AI-generated phishing emails. And last year, hackers using AI injected fake video streams into the biometric verification process of crypto exchange Bitfinex, ultimately earning themselves $150…
Exploits, Global Security News, Security
CISA flags Craft CMS code injection flaw as exploited in attacks
The U.S. Cybersecurity & Infrastructure Security Agency (CISA) warns that a Craft CMS remote code execution flaw is being exploited in attacks. […]
EDR, Exploits, Global Security News, Security Bloggers Network, What Is EDR
What Is EDR? Endpoint Detection and Response
In today’s interconnected world, cybersecurity threats are more sophisticated and pervasive than ever. Traditional security solutions, like antivirus software, often fall short against advanced persistent threats (APTs), zero-day exploits, and fileless malware. This is where Endpoint Detection and Response (EDR) comes in, offering a powerful and proactive approach to safeguarding your endpoints and, consequently, your…
Exploits, Global Security News
CISA Flags Craft CMS Vulnerability CVE-2025-23209 Amid Active Attacks
A high-severity security flaw impacting the Craft content management system (CMS) has been added by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The vulnerability in question is CVE-2025-23209 (CVSS score: 8.1), which impacts Craft CMS versions 4 and 5. It was…
china, cisco, Cisco Talos, Cybersecurity, Cybersecurity and Infrastructure Security Agency (CISA), Exploits, Global Security News, Research, Salt Typhoon, telecommunications, Threat Intelligence, Threats
Salt Typhoon gained initial access to telecoms through Cisco devices
Salt Typhoon gained initial access to Cisco devices as part of the Chinese nation-state threat group’s sweeping attacks on U.S. telecom networks, the company confirmed Thursday in a threat intelligence report. Cisco Talos, the networking vendor’s threat intelligence unit, said it observed one instance where Salt Typhoon likely exploited a seven-year-old critical vulnerability in Cisco…
Cloud, Exploits, Global Security News, Microsoft, Security
Microsoft fixes Power Pages zero-day bug exploited in attacks
Microsoft has issued a security bulletin for a high-severity elevation of privilege vulnerability in Power Pages, which hackers exploited as a zero-day in attacks. […]
Exploits, Global Security News
Hackers Chain Exploits of Three Palo Alto Networks Firewall Flaws
Palo Alto Networks has observed exploit attempts chaining three vulnerabilities in its PAN-OS firewall appliances
Exploits, Global Security News
Understanding OWASP’s Top 10 list of non-human identity critical risks
Verizon There are some very good reasons why non-human identities (NHI) have landed among the most-discussed cybersecurity topics in the last few years — it’s estimated that for every 1,000 human users in an enterprise network, there are 10,000 non-human connections or credentials. Some estimates peg that ratio even higher at 10 to 50 times…
Exploits, Global Security News
Microsoft Patches Actively Exploited Power Pages Privilege Escalation Vulnerability
Microsoft has released security updates to address two Critical-rated flaws impacting Bing and Power Pages, including one that has come under active exploitation in the wild. The vulnerabilities are listed below – CVE-2025-21355 (CVSS score: 8.6) – Microsoft Bing Remote Code Execution Vulnerability CVE-2025-24989 (CVSS score: 8.2) – Microsoft Power Pages Elevation of Privilege Vulnerability…
Exploits, Global Security News, Trend Micro Research : Articles, News, Reports, Trend Micro Research : Endpoints, Trend Micro Research : Malware, Trend Micro Research : Research
Updated Shadowpad Malware Leads to Ransomware Deployment
In this blog entry, we discuss how Shadowpad is being used to deploy a new undetected ransomware family. Attackers deploy the malware by exploiting weak passwords and bypassing multi-factor authentication.
Exploits, Global Security News, Trend Micro Research : Articles, News, Reports, Trend Micro Research : Endpoints, Trend Micro Research : Malware, Trend Micro Research : Research
Updated Shadowpad Malware Leads to Ransomware Deployment
In this blog entry, we discuss how Shadowpad is being used to deploy a new undetected ransomware family. Attackers deploy the malware by exploiting weak passwords and bypassing multi-factor authentication.
Exploits, Global Security News, Trend Micro Research : Articles, News, Reports, Trend Micro Research : Endpoints, Trend Micro Research : Malware, Trend Micro Research : Research
Updated Shadowpad Malware Leads to Ransomware Deployment
In this blog entry, we discuss how Shadowpad is being used to deploy a new undetected ransomware family. Attackers deploy the malware by exploiting weak passwords and bypassing multi-factor authentication.
Exploits, Global Security News
Russian cyberespionage groups target Signal users with fake group invites
Russian advanced persistent threat (APT) groups are increasingly launching phishing attacks aimed at tricking users of the Signal messaging app into giving attacker-controlled devices access to their accounts and the encrypted communications within. The attacks typically masquerade as Signal group chat invites that, in reality, abuse the device linking functionality. “Signal’s popularity among common targets…
Exploits, Global Security News
#StopRansomware: Ghost (Cring) Ransomware
Summary Note: This joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit stopransomware.gov to see…
Exploits, Global Security News, Security
Palo Alto Networks tags new firewall bug as exploited in attacks
Palo Alto Networks warns that hackers are actively exploiting a critical authentication bypass flaw (CVE-2025-0108) in PAN-OS firewalls, chaining it with two other vulnerabilities to breach devices in active attacks. […]
Cybersecurity, Exploits, firewall, Global Security News, Palo Alto, Security, vulnerability
Palo Alto Networks warns of another firewall vulnerability under attack by hackers
The US cybersecurity giant says hackers are exploiting the high-severity flaw to break into unpatched customer networks. © 2024 TechCrunch. All rights reserved. For personal use only.
Cybercrime, Cybersecurity, Exploits, Fortinet, Global Security News, ivanti, Palo Alto Networks, Research, Threats, vulnerabilities, vulnerability
Edge device vulnerabilities fueled attack sprees in 2024
Edge devices harboring zero-day and n-day vulnerabilities were linked to the most consequential attack campaigns last year, Darktrace said in an annual threat report released Wednesday. Darktrace’s threat researchers found the most frequent vulnerability exploits in customers’ instances of Ivanti Connect Secure and Ivanti Policy Secure appliances, along with firewall products from Fortinet and Palo…
Exploits, Global Security News, Security
Russian phishing campaigns exploit Signal’s device-linking feature
Russian threat actors have been launching phishing campaigns that exploit the legitimate “Linked Devices” feature in the Signal messaging app to gain unauthorized access to accounts of interest. […]
Exploits, Global Security News, Network Security, Security, Vulnerabilities
Hackers gain root access to Palo Alto firewalls through chained bugs
A high-severity authentication bypass vulnerability in Palo Alto Networks’ PAN-OS software, patched last week, is now being actively exploited by threat actors to gain root-level access to affected firewall systems. Tracked as CVE-2025-0108, the vulnerability allows an unauthenticated attacker with network access to the PAN-OS management web interface to bypass authentication requirements. The flaw received…
Commentary, Exploits, Global Security News, Java, Javascript
Java security: If you ain’t cheatin,’ you ain’t tryin’
Most industries have rules of engagement. In sports, there are referees. In business, there are regulations. In government, there are Robert’s Rules of Order. Cybersecurity is different. There are regulations, but they don’t limit how much we can defend ourselves. They focus on compliance, breach reporting, and risk management, not on dictating the strategies we…
Exploits, Global Security News
CISA Adds Palo Alto Networks and SonicWall Flaws to Exploited Vulnerabilities List
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two security flaws impacting Palo Alto Networks PAN-OS and SonicWall SonicOS SSLVPN to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The flaws are listed below – CVE-2025-0108 (CVSS score: 7.8) – An authentication bypass vulnerability in the Palo Alto…
Exploits, Global Security News
OpenSSH fixes two flaws that enable a man-in-the-middle attack and denial of service
OpenSSH, the most widely used tool for remotely managing Linux and BSD systems, received patches for two vulnerabilities. One of the flaws could allow attackers to perform a man-in-the-middle attack against OpenSSH clients with a certain configuration and impersonate a server to intercept sensitive communications. While the second vulnerability can lead to CPU resource exhaustion.…
Exploits, Global Security News
New OpenSSH Flaws Enable Man-in-the-Middle and DoS Attacks — Patch Now
Two security vulnerabilities have been discovered in the OpenSSH secure networking utility suite that, if successfully exploited, could result in an active machine-in-the-middle (MitM) and a denial-of-service (DoS) attack, respectively, under certain conditions. The vulnerabilities, detailed by the Qualys Threat Research Unit (TRU), are listed below – CVE-2025-26465 – The OpenSSH client
Exploits, File Integrity Monitoring, Global Security News, Security Bloggers Network
Learn & Avoid Social Engineering Scams in 2025
In the past decade, social engineering attacks have become more sophisticated and prevalent than ever. From AI voice impersonation to deepfake video calls, cybercriminals are leveraging the latest technology to make their scams increasingly convincing. Despite growing awareness of these threats, social engineering remains one of the most successful attack methods because it exploits something…
Exploits, Global Security News
Juniper Session Smart Routers Vulnerability Could Let Attackers Bypass Authentication
Juniper Networks has released security updates to address a critical security flaw impacting Session Smart Router, Session Smart Conductor, and WAN Assurance Router products that could be exploited to hijack control of susceptible devices. Tracked as CVE-2025-21589, the vulnerability carries a CVSS v3.1 score of 9.8 and a CVS v4 score of 9.3. “An Authentication…
Exploits, Global Security News, MacOS Security, Malware, Security
XCSSET macOS malware reappears with new attack strategies, Microsoft sounds alarm
Microsoft has warned that a new variant of XCSSET malware is actively targeting macOS users, marking the first update to the malware since 2022. This latest version has been observed in limited attacks but introduces stronger evasion tactics, updated persistence mechanisms, and new infection strategies that make it more difficult to detect and remove. The…
Exploits, Global Security News
Password managers under increasing threat as infostealers triple and adapt
Security watchers warn of a three-fold increase in malware that targets credential stores, such as password managers and browser-stored login data. The study by Picus Security, which was based on analysis of 1 million real-world malware samples, also found that 93% of all malicious actions mapped to just 10 MITRE ATT&CK techniques. Password store security…
Exploits, Global Security News
Palo Alto Networks and SonicWall Firewalls Under Attack
Vulnerabilities in firewalls from Palo Alto Networks and SonicWall are currently under active exploitation
Exploits, Global Security News
⚡ THN Weekly Recap: Google Secrets Stolen, Windows Hack, New Crypto Scams and More
Welcome to this week’s Cybersecurity News Recap. Discover how cyber attackers are using clever tricks like fake codes and sneaky emails to gain access to sensitive data. We cover everything from device code phishing to cloud exploits, breaking down the technical details into simple, easy-to-follow insights. ⚡ Threat of the Week Russian Threat Actors Leverage…
Exploits, Global Security News, Risk Management, Software Development, Supply Chain
Software Bill of Material umsetzen: Die besten SBOM-Tools
Nur wenn Sie wissen, was drinsteckt, können Sie sich sicher sein, dass alles mit rechten Dingen zugeht. Das gilt für Fast Food wie für Software. Foto: Geka – shutterstock.com Um Software abzusichern, muss man wissen, was in ihrem Code steckt. Aus diesem Grund ist eine Software Bill of Material, SBOM oder Software-Stückliste heute unerlässlich. Der…
Cybersecurity, Exploits, Global Security News, Microsoft, phishing, Research, Russia, Threat Intelligence, Threats, Volexity
Threat researchers spot ‘device code’ phishing attacks targeting Microsoft accounts
Microsoft threat researchers discovered a series of what they are calling “device code” phishing attacks that allowed a suspected Russia-aligned threat group to gain access to and steal data from critical infrastructure organizations, the company said in research released Thursday. The group, which Microsoft tracks as Storm-2372, has targeted governments, IT services and organizations operating…
Exploits, Global Security News, Security
Hackers exploit authentication bypass in Palo Alto Networks PAN-OS
Hackers are launching attacks against Palo Alto Networks PAN-OS firewalls by exploiting a recently fixed vulnerability (CVE-2025-0108) that allows bypassing authentication. […]
Exploits, Global Security News, Network Security, Vulnerabilities, Zero-day vulnerability
Palo Alto Networks firewall bug being exploited by threat actors: Report
Admins with firewalls from Palo Alto Networks should make sure the devices are fully patched and the management interface blocked from open internet access after the discovery this week of a zero-day login authentication bypass in the PAN-OS operating system. The discovery of the vulnerability (CVE-2025-0108) was made by researchers at Assetnote and, according to…
Exploits, Global Security News, Security
SonicWall firewall bug targeted in attacks after PoC exploit release
Attackers are now targeting an authentication bypass vulnerability affecting SonicWall firewalls shortly after the release of proof-of-concept (PoC) exploit code. […]
Exploits, Global Security News, Security
SonicWall firewall bug leveraged in attacks after PoC exploit release
Attackers are now targeting an authentication bypass vulnerability affecting SonicWall firewalls shortly after the release of proof-of-concept (PoC) exploit code. […]
Exploits, Global Security News, Security
PostgreSQL flaw exploited as zero-day in BeyondTrust breach
Rapid7’s vulnerability research team says attackers exploited a PostgreSQL security flaw as a zero-day to breach the network of privileged access management company BeyondTrust in December. […]
Exploits, Global Security News
whoAMI name confusion attacks can expose AWS accounts to malicious code execution
Thousands of active AWS accounts are vulnerable to a cloud image name confusion attack that could allow attackers to execute codes within those accounts. According to DataDog research, vulnerable patterns exist in the way multiple software projects retrieve Amazon Machine Image (AMIs) IDs to create Amazon elastic compute cloud (EC2) instances. “The vulnerable pattern allows…
Exploits, Global Security News
AI-Powered Social Engineering: Ancillary Tools and Techniques
Social engineering is advancing fast, at the speed of generative AI. This is offering bad actors multiple new tools and techniques for researching, scoping, and exploiting organizations. In a recent communication, the FBI pointed out: ‘As technology continues to evolve, so do cybercriminals’ tactics.’ This article explores some of the impacts of this GenAI-fueled acceleration.…
Exploits, Global Security News
PostgreSQL Vulnerability Exploited Alongside BeyondTrust Zero-Day in Targeted Attacks
Threat actors who were behind the exploitation of a zero-day vulnerability in BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) products in December 2024 likely also exploited a previously unknown SQL injection flaw in PostgreSQL, according to findings from Rapid7. The vulnerability, tracked as CVE-2025-1094 (CVSS score: 8.1), affects the PostgreSQL interactive tool psql.…
Exploits, Global Security News
PostgreSQL patches SQLi vulnerability likely exploited in BeyondTrust attacks
Attackers who exploited a zero-day vulnerability in BeyondTrust Privileged Remote Access and Remote Support products in December likely also exploited a previously unknown SQL injection flaw in PostgreSQL, a widely used open-source object-relational database system. The PostgreSQL issue was fixed on Thursday and users are advised to upgrade their database servers as soon as possible.…
china, cisco, Cybersecurity, Exploits, Five Eyes, Global Security News, nation state threats, nation-state hackers, Recorded Future, Research, routers, Salt Typhoon, Threats, vulnerabilities
Salt Typhoon remains active, hits more telecom networks via Cisco routers
Salt Typhoon, the Chinese nation-state threat group linked to a spree of attacks on U.S. and global telecom providers, remains active in its intrusion and has hit multiple additional networks worldwide, including two in the United States, Recorded Future said in a report released Thursday. Recorded Future’s Insikt Group observed seven compromised Cisco network devices communicating…
Exploits, Global Security News
CISA, FBI call software with buffer overflow issues ‘unforgivable’
FBI and CISA have issued a joint advisory to warn software developers against building codes with Buffer Overflow vulnerabilities in them, calling them “unforgivable” mistakes. Tagging the advisory as part of their ongoing “Secure by Design” efforts, the authorities said these vulnerabilities are prevalent in software, including vendors like Microsoft, VMware, and Ivanti, that lead…
Exploits, Global Security News, Patch Management Software, Threat and Vulnerability Management, Vulnerabilities
24% of vulnerabilities are abused before a patch is available
Almost one in four (24%) known exploited vulnerabilities discovered last year were abused on or before the day their CVEs were publicly disclosed. A study by exploit and vulnerability specialists VulnCheck identified 768 CVEs that were publicly reported as exploited in the wild for the first time last year, an increase of 20% from the…
CryptoCurrency, Exploits, Global Security News, Security
zkLend loses $9.5M in crypto heist, asks hacker to return 90%
Decentralized money lender zkLend suffered a breach where threat actors exploited a smart contract flaw to steal 3,600 Ethereum, worth $9.5 million at the time. […]
email, Exploits, Global Security News, Google, Leadership, Microsoft, reasoning, Security
Patch Tuesday: Microsoft Patches Two Actively Exploited Zero-Day Flaws
February’s report on Microsoft patches includes 56 vulnerabilities, two of which are zero-day flaws that have been exploited.
CVE, Cybersecurity, Exploits, Global Security News, Microsoft, Microsoft Threat Intelligence Center, Research, Russia, Seashell Blizzard, Threats, Uncategorized, vulnerabilities
Russian state threat group shifts focus to US, UK targets
A subgroup of Seashell Blizzard has shifted its focus to targets in the U.S., Canada, Australia and the U.K. within the past year, expanding the scope of its malicious activity, Microsoft’s threat intelligence team said in a report released Wednesday. The initial-access operation, which Microsoft tracks as the “BadPilot campaign,” has allowed the Russian state…
Cybercrime, Cybersecurity, Exploits, Featured, Global Security News, News, phishing, Scams, Security Awareness, Security Boulevard (Original), Social - Facebook, Social - LinkedIn, Social - X, Spotlight, valentine's day
Cybercriminals Exploit Valentine’s Day with Romance Scams, Phishing Attacks
As Valentine’s Day approaches, cybercriminals are ramping up their efforts to exploit consumers through romance scams, phishing campaigns and fraudulent e-commerce offers. The post Cybercriminals Exploit Valentine’s Day with Romance Scams, Phishing Attacks appeared first on Security Boulevard.