Category: hacking

Auto Added by WPeMatico

Qilin ransomware gang now offers a “Call Lawyer” feature to help affiliates pressure victims into paying, per Cybereason. The Qilin ransomware group is now offering legal support to its affiliates through a “Call Lawyer” feature to pressure victims into paying. This move, reported by cybersecurity firm Cybereason, shows Qilin stepping up its operations and trying…

Security Affairs newsletter Round 529 by Pierluigi Paganini – INTERNATIONAL EDITION

June 22, 2025

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Iran confirmed it shut down internet to protect the country against cyberattacks Godfather Android trojan uses…

Iran confirmed it shut down internet to protect the country against cyberattacks

June 21, 2025

Iran confirmed an Internet shutdown to counter Israeli cyberattacks, citing threats to critical infrastructure, and interfere with drone control. Iran experienced a near-total internet blackout on Wednesday as tensions with Israel escalated into the first week of conflict. However, the exact cause behind the collapse of Iran’s internet remains unclear. While the timing coincides with…

Cloudflare blocked record-breaking 7.3 Tbps DDoS attack against a hosting provider

June 20, 2025

Cloudflare blocked a record-breaking 7.3 Tbps DDoS attack in May 2025. Cloudflare blocked a record 7.3 Tbps DDoS attack in May 2025, 12% greater than its previous peak and 1 Tbps greater than the attack reported by the popular cyber journalist Brian Krebs. The attack targeted a Cloudflare customer, a hosting provider using the company’s…

Linux flaws chain allows Root access across major distributions

June 20, 2025

Researchers discovered two local privilege escalation flaws that could let attackers gain root access on systems running major Linux distributions. Qualys researchers discovered two local privilege escalation (LPE) vulnerabilities, an attacker can exploit them to gain root privileges on machines running major Linux distributions. The two vulnerabilities are: CVE-2025-6018: LPE from unprivileged to allow_active in…

A ransomware attack pushed the German napkin firm Fasana into insolvency

June 20, 2025

A cyberattack pushed the German napkin firm Fasana into insolvency, likely worsening existing financial troubles and serving as the final blow. German napkin maker Fasana filed for insolvency after a major cyberattack on May 19 paralyzed its systems, halting over €250K in orders the next day. The napkin factory is located in Stotzheim, Germany, and…

Researchers discovered the largest data breach ever, exposing 16 billion login credentials

June 19, 2025

Researchers discovered the largest data breach ever, exposing 16 billion login credentials, likely due to multiple infostealers. Researchers announced the discovery of what appears to be the largest data breach ever recorded, with an astonishing 16 billion login credentials exposed. The ongoing investigation, which began earlier this year, suggests that the credentials were collected through…

China-linked group Salt Typhoon breached satellite firm Viasat

June 19, 2025

China-linked APT Typhoon has reportedly targeted satellite firm Viasat, the group has breached multiple telecom providers in the past. China-linked APT group Salt Typhoon hacked the satellite communications firm Viasat, the cyber-espionage group has previously breached the networks of multiple other telecom providers in the United States and globally. Viasat is a global communications company…

Iran experienced a near-total national internet blackout

June 19, 2025

Iran experienced a near-total internet blackout on Wednesday as tensions with Israel escalated into the first week of conflict. Global internet monitor NetBlocks reported almost near-total Internet disruptions in Iran as tensions with Israel escalated into the first week of conflict. However, the exact cause behind the collapse of Iran’s internet remains unclear. While the…

Malicious Minecraft mods distributed by the Stargazers DaaS target Minecraft gamers

June 19, 2025

Java-based malware targets Minecraft users via fake cheat tools, utilizing the Stargazers Ghost Network distribution-as-a-service (DaaS). Check Point researchers found a multi-stage malware on GitHub targeting Minecraft users via Stargazers DaaS, using Java/.NET stealers disguised as cheat tools. Minecraft, one of the world’s most popular games with over 200 million monthly players and 300 million…

Watch out, Veeam fixed a new critical bug in Backup & Replication product

June 18, 2025

Veeam addressed a new critical flaw in Backup & Replication product that could potentially result in remote code execution. Veeam has rolled out security patches to address a critical security vulnerability, tracked CVE-2025-23121 (CVSS score of 9.9) in its Backup & Replication solution that can allow remote attackers to execute arbitrary code under certain conditions.…

U.S. CISA adds Linux Kernel flaw to its Known Exploited Vulnerabilities catalog

June 18, 2025

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Linux Kernel vulnerability to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Google Chromium V8 Out-of-Bounds Read and Write Vulnerability, tracked as CVE-2023-0386, to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability, CVE-2023-0386 (CVSS score: 7.8), is an improper ownership vulnerability in the Linux kernel that…

News Flodrix botnet targets vulnerable Langflow servers

June 18, 2025

Attackers exploit CVE-2025-3248 in Langflow servers to deliver Flodrix botnet via downloader scripts, Trend Research reports. Trend Research uncovered an ongoing campaign exploiting the vulnerability CVE-2025-3248 to deliver the Flodrix botnet. Attackers exploit the flaw to run scripts on Langflow servers, downloading and installing Flodrix malware. “If the vulnerability is successfully exploited, threat actors behind…

U.S. CISA adds Apple products, and TP-Link routers flaws to its Known Exploited Vulnerabilities catalog

June 17, 2025

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Apple products, and TP-Link routers flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Apple products, and TP-Link routers flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the descriptions for these flaws: CVE-2025-43200 Apple Multiple Products Unspecified Vulnerability CVE-2023-33538 (CVSS score…

Attackers target Zyxel RCE vulnerability CVE-2023-28771

June 17, 2025

GreyNoise researchers have observed exploit attempts targeting the remote code execution vulnerability CVE-2023-28771 in Zyxel devices. On June 16, GreyNoise researchers detected exploit attempts targeting CVE-2023-28771 (CVSS score 9.8), a remote code execution flaw impacting Zyxel IKE decoders over UDP port 500. “Exploitation attempts against CVE-2023-28771 were minimal throughout recent weeks. On June 16, GreyNoise observed…

India-based car-sharing company Zoomcar suffered a data breach impacting 8.4M users

June 17, 2025

Zoomcar disclosed a data breach impacting 8.4M users after attackers compromised its systems and contacted the company staff. Zoomcar is an India-based car-sharing and self-drive car rental company. Zoomcar discovered a data breach impacting 8.4M users after threat actors contacted the internal personnel claiming the compromise of internal systems. The company is investigating the security…

State-sponsored hackers compromised the email accounts of several Washington Post journalists

June 17, 2025

State-sponsored hackers compromised the email accounts of several journalists working at the Washington Post. A cyberattack, likely carried out by state-sponsored hackers, compromised the Microsoft email accounts of Washington Post journalists, including reporters covering China and national security. “A cyberattack on the Washington Post compromised email accounts of several journalists and was potentially the work…

New Predator spyware infrastructure revealed activity in Mozambique for the first time

June 16, 2025

Insik Group analyzed the new Predator spyware infrastructure and discovered it’s still gaining users despite U.S. sanctions since July 2023. Despite earlier declines in activity due to U.S. sanctions and public exposure, Predator spyware has resurged. Insikt Group analyzed a renewed infrastructure linked to the commercial spyware company and identified a new customer in Mozambique,…

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 49

June 15, 2025

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Supply chain attack hits Gluestack NPM packages with 960K weekly downloads Analysis of the latest Mirai wave exploiting TBK DVR devices with CVE-2024-3721 Destructive npm Packages Disguised as Utilities Enable Remote System Wipe AMOS Variant Distributed…

Security Affairs newsletter Round 528 by Pierluigi Paganini – INTERNATIONAL EDITION

June 15, 2025

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Palo Alto Networks fixed multiple privilege escalation flaws Unusual toolset used in recent Fog Ransomware attack…

Palo Alto Networks fixed multiple privilege escalation flaws

June 14, 2025

Palo Alto Networks addressed multiple vulnerabilities and included the latest Chrome patches in its solutions. Palo Alto Networks fixed seven privilege escalation vulnerabilities and integrated the latest Chrome security patches into its products. Palo Alto applied 11 Chrome fixes and patched CVE-2025-4233, a cache vulnerability impacting the Prisma Access Browser. The most severe vulnerability, tracked…

A cyberattack on United Natural Foods caused bread shortages and bare shelves

June 13, 2025

Cyberattack on United Natural Foods Inc. (UNFI) disrupts deliveries, causing Whole Foods shortages nationwide after systems were taken offline on June 5. United Natural Foods, Inc. (UNFI) is a Providence, Rhode Island–based natural and organic food company. The largest publicly traded wholesale distributor of health and specialty food in the United States and Canada, it is Whole Foods Market‘s main supplier, with their traffic making up over…

Paraguay Suffered Data Breach: 7.4 Million Citizen Records Leaked on Dark Web

June 13, 2025

Resecurity researchers found 7.4 million records containing personally identifiable information (PII) of Paraguay citizens on the dark web. Resecurity has identified 7.4 million records containing personally identifiable information (PII) of Paraguayan citizens leaked on the dark web today. Last week, cybercriminals have offered information about all citizens of Paraguay for sale, demanding $7.4 million in…

Apple confirmed that Messages app flaw was actively exploited in the wild

June 13, 2025

Apple confirmed that a security flaw in its Messages app was actively exploited in the wild to target journalists with Paragon’s Graphite spyware. Apple confirmed that a now-patched vulnerability, tracked as CVE-2025-43200, in its Messages app was actively exploited in the wild to target journalists with Paragon’s Graphite spyware. The IT giant addressed the flaw…

Trend Micro fixes critical bugs in Apex Central and TMEE PolicyServer

June 13, 2025

Trend Micro fixed multiple vulnerabilities that impact its Apex Central and Endpoint Encryption (TMEE) PolicyServer products. Trend Micro address remote code execution and authentication bypass vulnerabilities impacting its Endpoint Encryption (TMEE) PolicyServer and Apex Central solutions. Trend Micro Endpoint Encryption PolicyServer is a centralized management server used in Trend Micro’s Endpoint Encryption solution. It acts…

Paragon Graphite Spyware used a zero-day exploit to hack at least two journalists’ iPhones

June 12, 2025

Security researchers at Citizen Lab revealed that Paragon’s Graphite spyware can hack fully updated iPhones via zero-click attacks. Citizen Lab has confirmed that Paragon’s Graphite spyware was used to hack fully updated iPhones, targeting at least two journalists in Europe. The group found forensic evidence showing the phones had communicated with the same spyware server.…

SinoTrack GPS device flaws allow remote vehicle control and location tracking

June 12, 2025

Two vulnerabilities in SinoTrack GPS devices can allow remote vehicle control and location tracking by attackers, US CISA warns. U.S. CISA warns of two vulnerabilities in SinoTrack GPS devices that remote attackers can exploit to access a vehicle’s device profile without permission. The researchers warn that potential exploitation could allow attackers to track its location…

U.S. CISA adds Wazuh, and WebDAV flaws to its Known Exploited Vulnerabilities catalog

June 12, 2025

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Wazuh, and WebDAV flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added ASUS RT-AX55 devices, Craft CMS, and ConnectWise ScreenConnect flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the descriptions for these flaws: CVE-2025-24016 (CVSS score 9.9) Wazuh Server Deserialization…

Exposed eyes: 40,000 security cameras vulnerable to remote hacking

June 12, 2025

Over 40,000 internet-exposed security cameras worldwide are vulnerable to remote hacking, posing serious privacy and security risks. Bitsight warns that over 40,000 security cameras worldwide are exposed to remote hacking due to unsecured HTTP or RTSP (Real-Time Streaming Protocol) access. These cameras stream live feeds openly via IP addresses, making them easy targets for spying,…

Operation Secure: INTERPOL dismantles 20,000+ malicious IPs in major cybercrime crackdown

June 11, 2025

INTERPOL announced that a joint operation code-named Operation Secure took down 20,000+ malicious IPs/domains tied to 69 info-stealers. Between January and April 2025, INTERPOL led Operation Secure, a global effort that took down over 20,000 malicious IPs and domains linked to information-stealing malware. With support from 26 countries and partners like Group-IB, Kaspersky, and Trend…

Over 80,000 servers hit as Roundcube RCE bug gets rapidly exploited

June 11, 2025

A critical remote code execution (RCE) vulnerability in Roundcube was exploited days after patch, impacting over 80,000 servers. Threat actors exploited a critical remote code execution (RCE) flaw in Roundcube, tracked as CVE-2025-49113, just days after the patch was released, targeting over 80,000 servers. Roundcube is a popular webmail platform and has been repeatedly targeted…

A flaw could allow recovery of the phone number associated with any Google account

June 11, 2025

A vulnerability could allow recovery of the phone number associated with a Google account by carrying out a brute force attack. The security researcher who goes online with the moniker “brutecat” discovered that it is possible to brute force the phone number of any Google abusing an issue in the company’s account recovery feature. A…

SAP June 2025 Security Patch Day fixed critical NetWeaver bug

June 10, 2025

SAP fixed a critical NetWeaver flaw that let attackers bypass authorization and escalate privileges. Patch released in June 2025 Security Patch. SAP June 2025 Security Patch addressed a critical NetWeaver vulnerability, tracked as CVE-2025-42989 (CVSS score of 9.6), allowing threat actors to bypass authorization checks and escalate their privileges. “RFC inbound processing does not perform…

U.S. CISA adds RoundCube Webmail and Erlang Erlang/OTP SSH server flaws to its Known Exploited Vulnerabilities catalog

June 10, 2025

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds RoundCube Webmail and Erlang Erlang/OTP SSH server flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added RoundCube Webmail and Erlang Erlang/OTP SSH server flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the descriptions for these flaws: CVE-2025-32433 (CVSS score of 10) Erlang…

China-linked threat actor targeted +70 orgs worldwide, SentinelOne warns

June 10, 2025

China-linked threat actor targeted over 70 global organizations, including governments and media, in cyber-espionage attacks from July 2024 to March 2025. In April 2025, cybersecurity firm SentinelOne warned that a China-linked threat actor, tracked as PurpleHaze, attempted to conduct reconnaissance on its infrastructure and high-value clients. The activity suggests targeted cyberespionage efforts aimed at gathering…

DOJ moves to seize $7.74M in crypto linked to North Korean IT worker scam

June 9, 2025

US seeks to seize $7.74M in crypto linked to North Korean fake IT worker schemes, per a new DOJ forfeiture complaint. The DOJ filed a civil forfeiture complaint for $7.74M in crypto tied to North Korean fake IT worker schemes linked to the indictment of North Korean Foreign Trade Bank (FTB) representative Sim Hyon Sop.…

Over 950K weekly downloads at risk in ongoing supply chain attack on Gluestack packages

June 8, 2025

A supply chain attack hit NPM, threat actors compromised 16 popular Gluestack packages, affecting 950K+ weekly downloads. Researchers from Aikido Security discovered a new supply chain attack targeted NPM, compromising 16 popular Gluestack ‘react-native-aria’ packages with over 950K weekly downloads. Our Malware Intelligence team has detected an active and on-going attack against packages on npm…

Over 950K weekly downloads at risk in ongoing supply chain attack on Gluestack packages

June 8, 2025

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 48

June 8, 2025

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Pure Crypter Malware Analysis: 99 Problems but Detection Ain’t One Attacker exploits misconfigured AI tool to run AI-generated payload Crocodilus Mobile Malware: Evolving Fast, Going Global How Threat Actors Exploit Human Trust: A Breakdown of the…

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 48

June 8, 2025

Security Affairs newsletter Round 527 by Pierluigi Paganini – INTERNATIONAL EDITION

June 8, 2025

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Experts found 4 billion user records online, the largest known leak of Chinese personal data from…

Attackers exploit Fortinet flaws to deploy Qilin ransomware

June 6, 2025

Qilin ransomware now exploits Fortinet vulnerabilities to achieve remote code execution on impacted devices. Threat intelligence firm PRODAFT warned that Qilin ransomware (aka Phantom Mantis) group targeted multiple organizations between May and June 2025 by exploiting multiple FortiGate vulnerabilities, including CVE-2024-21762, and CVE-2024-55591. “Phantom Mantis recently launched a coordinated intrusion campaign targeting multiple organizations between…

U.S. Offers $10M bounty for info on RedLine malware creator and state hackers

June 6, 2025

The U.S. offers up to $10M for info on state hackers linked to RedLine malware and its creator, Maxim Rudometov, tied to attacks on U.S. infrastructure. The U.S. Department of State offers a reward of up to $10 million for information nation-state actors linked to the RedLine infostealer and its alleged author, Russian national Maxim…

Play ransomware group hit 900 organizations since 2022

June 6, 2025

A joint advisory from the US and Australian authorities states that Play ransomware has hit approximately 900 organizations over the past three years. A joint advisory from the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) states that Play ransomware has hit…

U.S. CISA adds Google Chromium V8 flaw to its Known Exploited Vulnerabilities catalog

June 5, 2025

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a Google Chromium V8 vulnerability to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Google Chromium V8 Out-of-Bounds Read and Write Vulnerability, tracked as CVE-2025-5419, to its Known Exploited Vulnerabilities (KEV) catalog. This week, Google released out-of-band updates to address three vulnerabilities…

Breaking News, cyber crime, Cybercrime, Emerging Tech, Global Security News, hacking, malware

Breaking News, Cybercrime, data breach, Exploits, Global Security News, hacking, Security

Breaking News, Cyber warfare, Global Security News, hacking, information security news, Security

Breaking News, CloudFlare, DDoS, Global Security News, hacking, Security

Breaking News, Exploits, Global Security News, hacking, hacking news, information security news, Security

Breaking News, Cybercrime, Fasana, Global Security News, hacking, Security

Breaking News, cyber crime, data breach, Exploits, Global Security News, hacking, malware

APT, Asia Pacific, Breaking News, Cyber warfare, Global Security News, hacking, intelligence

Breaking News, Global Security News, hacking, Security

Breaking News, cyber crime, Cybercrime, Exploits, Global Security News, hacking, malware

Backup & Replication, Breaking News, Exploits, Global Security News, hacking, hacking news, Security

Breaking News, CISA, Exploits, Global Security News, hacking, hacking news, Security

Breaking News, cyber crime, Exploits, Flodrix botnet, Global Security News, hacking, malware

Breaking News, CISA, Exploits, Global Security News, hacking, hacking news, Security

Breaking News, Exploits, Global Security News, hacking, hacking news, information security news, internet of things

Breaking News, cyber crime, Cybercrime, data breach, Global Security News, hacking

Asia Pacific, Breaking News, Global Security News, hacking, hacking news, intelligence, Security

Global Security News, hacking, hacking news, intelligence, malware, North America, Security

Breaking News, data breach, Global Security News, hacking, malware, Security

Breaking News, Cybercrime, data breach, Exploits, Global Security News, hacking, hacking news

Breaking News, Exploits, Global Security News, hacking, hacking news, information security news, Security

Breaking News, cyber crime, Cybercrime, Global Security News, hacking, hacking news, North America

APT, Asia Pacific, Breaking News, data breach, Global Security News, hacking, Security

Breaking News, Cybercrime, Exploits, Global Security News, hacking, malware, Mobile

Breaking News, Exploits, Global Security News, hacking, information security news, IT Information Security, Security

Breaking News, Europe, Global Security News, hacking, intelligence, Mobile, Security

Breaking News, CISA, Exploits, Global Security News, hacking, hacking news, Security

Breaking News, CISA, Cybercrime, Exploits, Global Security News, hacking, Security

Breaking News, Global Security News, hacking, hacking news, internet of things, Security

Breaking News, cyber crime, Cybercrime, Global Security News, hacking, malware

Breaking News, Exploits, Global Security News, hacking, hacking news, information security news, IT Information Security

Breaking News, brute force, Exploits, Global Security News, Google, hacking, information security news

Breaking News, Exploits, Global Security News, hacking, hacking news, information security news, Security

Breaking News, CISA, Exploits, Global Security News, hacking, hacking news, Security

APT, Asia Pacific, Breaking News, Global Security News, hacking, intelligence, malware

Asia Pacific, Breaking News, cyber crime, Global Security News, hacking, hacking news, intelligence

Asia Pacific, Breaking News, ChatGPT, Global Security News, hacking, intelligence, Social networks

Breaking News, cyber crime, Cybercrime, Global Security News, hacking, malware

Breaking News, cyber crime, Cybercrime, Global Security News, hacking, malware

Breaking News, Cybercrime, Exploits, Global Security News, hacking, hacking news, malware

Breaking News, Cybercrime, Exploits, Global Security News, hacking, hacking news, malware

Cybercrime, data breach, Exploits, Global Security News, hacking, hacking news, Uncategorized

Breaking News, cyber crime, Exploits, Global Security News, hacking, malware, Security

Breaking News, cyber crime, Cybercrime, Global Security News, hacking, malware, North America

Breaking News, cyber crime, Exploits, Global Security News, hacking, hacking news, malware

Breaking News, CISA, Exploits, Global Security News, Google Chromium V8, hacking, Security

Breaking News, Cyber warfare, data breach, Global Security News, hacking, intelligence

Breaking News, Cyber warfare, data breach, Global Security News, hacking, intelligence

Breaking News, Cyber warfare, data breach, Global Security News, hacking, intelligence

Breaking News, Cyber warfare, data breach, Global Security News, hacking, intelligence