Category: hacking

Auto Added by WPeMatico

Curly COMrades threat actors exploit Windows Hyper-V to hide Linux VMs, evade EDR tools, and deploy custom malware undetected. Bitdefender researchers, aided by Georgia’s CERT, uncovered that Curly COMrades, a group linked to Russian interests, abused Windows Hyper-V to gain covert, long-term access to victims. Threat actors created hidden Alpine Linux VMs (120MB/256MB) hosting custom…

SonicWall blames state-sponsored hackers for September security breach

November 5, 2025

Cybersecurity firm SonicWall attributed the September security breach exposing firewall configuration files to state-sponsored hackers. In September, SonicWall urged customers to reset credentials after firewall backup files tied to MySonicWall accounts were exposed. The company announced it had blocked attackers’ access and was working with cybersecurity experts and law enforcement agencies to determine the scope…

How To Be The Number One Hacker In The World

November 5, 2025

Do you admire hackers so much that you wish to become one soon? Or are you willing to step up your game in the hacking field? Don’t worry; we will teach you how to become the number one hacker in the world in some easy steps. In recent times, hacking has gained a lot of…

U.S. sanctioned North Korea bankers for laundering funds linked to cyberattacks and peapons program

November 5, 2025

U.S. sanctions North Korea bankers and firms accused of laundering cybercrime funds used to finance the country’s nuclear weapons program. The U.S. Government has imposed sanctions on several North Korea bankers, financial institutions, and individuals accused of laundering funds obtained from cybercrime operations. According to the U.S. Treasury Department, these illicit financial activities directly support…

Former cybersecurity firm experts attempted to extort five U.S. companies in 2023 using BlackCat ransomware attacks

November 5, 2025

U.S. prosecutors charged three Florida men for using BlackCat ransomware to hack and extort five U.S. companies in 2023. U.S. prosecutors charged Ryan Clifford Goldberg, Kevin Tyler Martin, and another Florida-based accomplice (aka “Co-Conspirator 1”) for using BlackCat ransomware to hack and extort five U.S. companies in 2023. According to Federal prosecutors, the attacks occurred…

Former cybersecurity employees attempted to extort five U.S. companies in 2023 using BlackCat ransomware attacks

November 5, 2025

U.S. CISA adds Gladinet CentreStack, and CWP Control Web Panel flaws to its Known Exploited Vulnerabilities catalog

November 5, 2025

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Gladinet CentreStack, and CWP Control Web Panel flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added XWiki Platform, and Gladinet CentreStack, and CWP Control Web Panel flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the flaws added to the…

Nine arrested in €600M crypto laundering bust across Europe

November 5, 2025

A coordinated Eurojust-led operation led to nine arrests in Cyprus, Spain, and Germany for laundering €600M in crypto fraud. Authorities in France, Belgium, and Cyprus arrested nine people in a coordinated Eurojust-led operation against a crypto money laundering ring that stole over €600 million. The group ran dozens of fake crypto investment sites that promised…

Google fixed a critical remote code execution in Android

November 4, 2025

Google’s November 2025 Android update fixes two flaws in the System component, including a critical remote code execution issue. Google’s November 2025 Android security updates addressed two vulnerabilities impacting the System component. The fixes are included in the 2025-11-01 security patch level, the only patch level released this month by the IT giant. “The most…

SesameOp: New backdoor exploits OpenAI API for covert C2

November 4, 2025

Microsoft found a new backdoor, SesameOp, using the OpenAI Assistants API for stealthy command-and-control in hacked systems. Microsoft uncovered a new backdoor, named SesameOp, that abuses the OpenAI Assistants API for command-and-control, allowing covert communication within compromised systems. Microsoft Incident Response – Detection and Response Team (DART) researchers discovered the backdoor in July 2025 while…

Crooks exploit RMM software to hijack trucking firms and steal cargo

November 4, 2025

Hackers target trucking firms with RMM tools to steal freight, teaming with organized crime to loot goods, mainly food and beverages. Cybercriminals are targeting trucking and logistics firms with RMM tools (remote monitoring and management software) to steal freight. Active since June 2025, the group works with organized crime to loot goods, mainly food and…

Crooks exploit RMM software to hijack trucking firms and steal cargo

November 4, 2025

Security Affairs newsletter Round 548 by Pierluigi Paganini – INTERNATIONAL EDITION

November 2, 2025

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. BadCandy Webshell threatens unpatched Cisco IOS XE devices, warns Australian government China-linked UNC6384 exploits Windows zero-day…

BadCandy Webshell threatens unpatched Cisco IOS XE devices, warns Australian government

November 1, 2025

Australia warns of attacks on unpatched Cisco IOS XE devices exploiting CVE-2023-20198, allowing BadCandy webshell install. The Australian Signals Directorate (ASD) warns of ongoing attacks on unpatched Cisco IOS XE devices exploiting CVE-2023-20198, allowing BadCandy webshell infections and admin takeover. “Cyber actors are installing an implant dubbed ‘BADCANDY’ on Cisco IOS XE devices that are vulnerable…

New Kurdish Hacktivists Hezi Rash Behind 350 DDoS Attacks in 2 Months

November 1, 2025

New intelligence on Hezi Rash: See how the Kurdish group launched 350+ DDoS attacks and used DaaS platforms like EliteStress to lower entry barriers.

Old Linux Kernel flaw CVE-2024-1086 resurfaces in ransomware attacks

October 31, 2025

CISA warns ransomware gangs exploit CVE-2024-1086, a Linux kernel flaw in netfilter: nf_tables, introduced in 2014 and patched in Jan 2024. CISA warned that ransomware gangs are exploiting CVE-2024-1086, a high-severity Linux kernel flaw introduced in 2014 and patched in January 2024. CISA didn’t provide details about the ransomware attacks exploiting the flaw or name…

Suspected Chinese actors compromise U.S. Telecom firm Ribbon Communications

October 31, 2025

A nation-state actor, likely a China-nexus one, hacked the U.S.-based technology company Ribbon Communications. Ribbon Communications is a U.S.-based technology company that provides telecommunications and networking. Ribbon Communications employs approximately 3,052 people as of December 31, 2024. The company reported annual revenue of US $834 million in 2024. The U.S. telecom provider disclosed a cyberattack…

U.S. CISA adds XWiki Platform, and Broadcom VMware Aria Operations and VMware Tools flaws to its Known Exploited Vulnerabilities catalog

October 30, 2025

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds XWiki Platform, and Broadcom VMware Aria Operations and VMware Tools flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added XWiki Platform, and Broadcom VMware Aria Operations and VMware Tools flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the flaws…

Brush exploit can cause any Chromium browser to collapse in 15-60 seconds

October 30, 2025

“Brash” flaw in Chromium’s Blink engine lets attackers crash browsers instantly via a single malicious URL, researcher Jose Pino revealed. Security researcher Jose Pino found a severe vulnerability, named Brash, in Chromium’s Blink rendering engine that can be exploited to crash many Chromium-based browsers within a few seconds. “Brash is a critical vulnerability in Blink, the rendering engine that…

Ex-Defense contractor exec pleads guilty to selling cyber exploits to Russia

October 30, 2025

Former US defense contractor exec Peter Williams pled guilty to stealing trade secrets and selling cyber exploits to a Russian broker, per the US DOJ. Ex-US defense contractor Peter Williams (39) admits stealing US trade secrets and selling cyber exploits to a Russian broker. Williams, an Australian national, pleaded guilty to stealing and selling U.S.…

Hacktivists breach Canada’s critical infrastructure, cyber Agency warns

October 29, 2025

Canada’s cyber agency warns hacktivists breached critical infrastructure, altering industrial controls and risking public safety. The Canadian Centre for Cyber Security revealed that hacktivists have repeatedly breached systems of country’s critical infrastructure systems in the country. Attackers tampered with industrial controls at a water treatment facility, an oil & gas firm, and an agricultural facility.…

Russian hackers, likely linked to Sandworm, exploit legitimate tools against Ukrainian targets

October 29, 2025

Russian actors, likely linked to Sandworm, targeted Ukrainian firms using LotL tactics and dual-use tools to steal data and stay hidden, says Symantec and Carbon Black. Russian threat actors, likely linked to the APT Sandworm, targeted Ukrainian organizations to steal sensitive data and maintain long-term network access, Symantec Threat Hunter Team and Carbon Black report.…

U.S. CISA adds Dassault Systèmes DELMIA Apriso flaws to its Known Exploited Vulnerabilities catalog

October 29, 2025

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Dassault Systèmes DELMIA Apriso flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Oracle, Windows, Kentico, and Apple flaws to its Known Exploited Vulnerabilities (KEV) catalog. CVE-2025-6204 Dassault Systèmes DELMIA Apriso Code Injection Vulnerability CVE-2025-6205 Dassault Systèmes DELMIA Apriso Missing Authorization Vulnerability Dassault Systèmes…

Critical ASP.NET flaw hits QNAP NetBak PC Agent

October 28, 2025

QNAP warns of critical ASP.NET flaw (CVE-2025-55315) in NetBak PC Agent, letting attackers hijack credentials or bypass security via HTTP smuggling. QNAP urges users to patch a critical ASP.NET Core vulnerability, tracked as CVE-2025-55315 (CVSS score of 9.9), in its NetBak PC Agent for Windows. The flaw resides in the Kestrel server and lets low-privilege…

Ransomware payments hit record low: only 23% Pay in Q3 2025

October 28, 2025

Only 23% of ransomware victims paid in Q3 2025, the lowest ever, continuing a six-year decline in payment rates, Coveware reports. Cybersecurity firm Coveware reports that only 23% of ransomware victims paid attackers in Q3 2025, the lowest rate ever recorded. The researchers note this continues a six-year decline in payment rates. After 28% of…

X warns users to re-enroll passkeys and YubiKeys for 2FA by Nov 10

October 28, 2025

X urges users with passkeys or YubiKeys to re-enroll 2FA by Nov 10, 2025, or risk account lockout. Re-enroll, switch 2FA, or disable it. Social media platform X is urging users who use passkeys or hardware security keys like YubiKeys for two-factor authentication (2FA) to re-enroll their keys by November 10, 2025, to keep account…

Memento Labs, the ghost of Hacking Team, has returned — or maybe it was never gone at all.

October 27, 2025

Kaspersky links the first Chrome zero-day of 2025 to tools used in attacks attributed to Memento Labs, formerly known as the Hacking Team. The actor behind Operation ForumTroll used the same tools seen in Dante spyware attacks. Kaspersky researchers linked the first Chrome zero-day of 2025 (CVE-2025-2783), a sandbox escape flaw, to the arsenal of…

Crafted URLs can trick OpenAI Atlas into running dangerous commands

October 27, 2025

Attackers can trick OpenAI Atlas browser via prompt injection, treating malicious instructions disguised as URLs in the omnibox as trusted commands. Attackers can exploit the OpenAI Atlas browser by disguising malicious instructions as URLs in the omnibox, which Atlas interprets as trusted commands, enabling harmful actions. NeuralTrust researchers warn that agentic browsers fail by not…

Linux variant of Qilin Ransomware targets Windows via remote management tools and BYOVD

October 27, 2025

Qilin ransomware group used Linux binaries on Windows to evade EDRs, steal backups, and disable defenses via BYOVD attacks. Trend Research found that the Qilin ransomware group (aka Agenda) used a Linux ransomware binary on Windows systems via legitimate remote tools, bypassing Windows defenses and EDRs. The cross-platform method enables stealthy attacks, stealing backup credentials…

Wordfence blocks 8.7M attacks exploiting old GutenKit and Hunk Companion flaws

October 27, 2025

Hackers exploited old RCE flaws in WordPress GutenKit and Hunk Companion plugins. Wordfence firm blocked 8.7M attacks in two days. In September and October 2024, submissions revealed Arbitrary Plugin Installation vulnerabilities in GutenKit and Hunk Companion WordPress plugins, with 40,000 and 8,000+ installs, respectively. These flaws allow unauthenticated attackers to install plugins and achieve RCE.…

Russian Rosselkhoznadzor hit by DDoS attack, food shipments across Russia delayed

October 25, 2025

A DDoS attack on Russia’s food safety agency Rosselkhoznadzor disrupted food shipments by crippling its VetIS and Saturn tracking systems. A DDoS cyberattack on Russia’s food safety agency, Rosselkhoznadzor, disrupted nationwide food shipments by knocking offline its VetIS and Saturn tracking systems for agricultural products and chemicals. Rosselkhoznadzor (Россельхознадзор) is the Federal Service for Veterinary…

CVE-2025-59287: Microsoft fixes critical WSUS flaw under active attack

October 25, 2025

Microsoft released urgent updates to address the critical WSUS RCE vulnerability CVE-2025-59287, which is under active attack.. Microsoft released an out-of-band fix for CVE-2025-59287, a critical WSUS RCE flaw (CVSS 9.8) that is under active exploitation. Researchers MEOW and Markus Wulftange of CODE WHITE GmbH reported the vulnerability. “To comprehensively address CVE-2025-59287, Microsoft has released…

U.S. CISA adds Microsoft WSUS, and Adobe Commerce and Magento Open Source flaws to its Known Exploited Vulnerabilities catalog

October 24, 2025

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft WSUS, and Adobe Commerce and Magento Open Source flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Microsoft WSUS, and Adobe Commerce and Magento Open Source flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below the list of flaws added to the…

Summoning Team won Master of Pwn as Pwn2Own Ireland Rewards $1,024,750

October 24, 2025

The Pwn2Own Ireland hacking contest awarded a total $1,024,750 for 73 zero-days, the Summoning Team won Master of Pwn. Pwn2Own Ireland 2025 wrapped up with $1,024,750 awarded for 73 unique zero-days. Organizers thanked participants, vendors, and partners Meta, Synology, and QNAP. Pwn2Own Ireland 2025 includes eight categories of exploits targeting flagship smartphones (Galaxy S25, iPhone…

China-linked hackers exploit patched ToolShell flaw to breach Middle East telecom

October 24, 2025

China-based threat actors exploited ToolShell SharePoint flaw CVE-2025-53770 soon after its July patch. China-linked threat actors exploited the ToolShell SharePoint flaw vulnerability, tracked as CVE-2025-53770, to breach a telecommunications company in the Middle East after it was addressed by Microsoft in July 2025. “China-based attackers used the ToolShell vulnerability (CVE-2025-53770) to compromise a telecoms company in…

Deeper Network Promo Deeper Network Promo

Breaking News, Exploits, Global Security News, hacking, hacking news, information security news, IT Information Security

Pwn2Own Day 2: Organizers paid $792K for 56 0-days

October 23, 2025

Day Two of Pwn2Own Ireland 2025 saw $792K for 56 0-days, led by The Summoning Team after a major Samsung Galaxy exploit. Day Two of Pwn2Own Ireland 2025 ends with participants earning $792,750 for 56 zero-days. Meta, Synology and QNAP are sponsoring the event. Pwn2Own Ireland 2025 includes eight categories of exploits targeting flagship smartphones…

Lazarus targets European defense firms in UAV-themed Operation DreamJob

October 23, 2025

North Korean Lazarus hackers targeted 3 European defense firms via Operation DreamJob, using fake recruitment lures to hit UAV tech staff. North Korea-linked Lazarus APT group (aka Hidden Cobra) launched Operation DreamJob, compromising three European defense companies. Threat actors used fake recruiter profiles to lure employees into UAV technology roles, aiming to gain access to…

U.S. CISA adds Motex LANSCOPE flaw to its Known Exploited Vulnerabilities catalog

October 23, 2025

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Motex LANSCOPE flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Motex LANSCOPE flaw, tracked as CVE-2025-61932 (CVSS v4 score of 9.3), to its Known Exploited Vulnerabilities (KEV) catalog. The flaw is an improper verification of source of a communication…

Over 250 attacks hit Adobe Commerce and Magento via critical CVE-2025-54236 flaw

October 23, 2025

Hackers exploit CVE-2025-54236 in Adobe Commerce and Magento to hijack accounts via REST API. Over 250 attacks in 24 hours. E-commerce security company Sansec researchers warn that threat actors are exploiting a critical flaw in Adobe Commerce and Magento, tracked as CVE-2025-54236 (CVSS 9.1), to hijack customer accounts via the REST API. The experts observed…

Cyberattack on Jaguar Land Rover inflicts $2.5B loss on UK economy

October 23, 2025

The attack on Jaguar Land Rover costs the UK economy $2.5B, marking its most damaging cyber incident, says CMC. In early September, Jaguar Land Rover shut down systems to mitigate a cyberattack that disrupted production and retail operations. The attack also impacted systems at the Solihull production plant. UK dealers reported JLR disruptions blocking car registrations and…

PhantomCaptcha targets Ukraine relief groups with WebSocket RAT in October 2025

October 22, 2025

PhantomCaptcha phishing campaign hit Ukraine relief groups with a WebSocket RAT on Oct 8, 2025, targeting Red Cross, UNICEF, and others. SentinelOne researchers uncovered PhantomCaptcha, a coordinated spear-phishing campaign on October 8, 2025, targeting Ukraine war relief groups, including Red Cross, UNICEF, NRC, and local administrations. Threat actors used fake emails to deploy a WebSocket-based…

TP-Link urges immediate updates for Omada Gateways after critical flaws discovery

October 22, 2025

TP-Link warns of critical flaws in Omada gateways across ER, G, and FR models. Users should update firmware immediately to stay secure. TP-Link is warning users of critical flaws impacting its Omada gateway devices. The Taiwanese company published two security advisories this week, outlining four vulnerabilities that impacts more than a dozen products across the…

TARmageddon flaw in Async-Tar Rust library allows to smuggle extra archives when the library is processing nested TAR files

October 22, 2025

CVE-2025-62518 TARmageddon flaw in Rust async-tar and forks like tokio-tar may allow remote code execution, says Edera. Edera team disclosed a vulnerability tracked as CVE-2025-62518 (CVSS score: 8.1), dubbed TARmageddon, in the Rust async-tar library and forks like tokio-tar. A remote attacker can exploit the flaw to achieve code execution. “astral-tokio-tar is a tar archive…

Russia-linked COLDRIVER speeds up malware evolution after LOSTKEYS exposure

October 22, 2025

Russia-linked COLDRIVER rapidly evolved its malware since May 2025, refining tools just days after releasing its LOSTKEYS variant, says Google. The Russia-linked hacking group COLDRIVER has been quickly upgrading its malware since May 2025, when its LOSTKEYS malware was exposed. According to Google’s Threat Intelligence Group, the hackers have been rolling out frequent updates and…

Japanese retailer Muji halted online sales after a ransomware attack on logistics partner

October 21, 2025

Muji halted online sales after a ransomware attack on its logistics partner Askul, disrupting orders, app services, and website access. Japanese retailer giant Muji suspended online sales after a ransomware attack hit its logistics partner Askul. The cyber incident disrupted deliveries and online store functions, including orders and app services. “Due to a logistics issue…

China-Linked Salt Typhoon breaches European Telecom via Citrix exploit

October 21, 2025

China-linked Salt Typhoon hacked a European telecom in July 2025 via a Citrix NetScaler Gateway exploit for initial access. A European telecom firm was targeted in July 2025 by China-linked APT group Salt Typhoon (also known as Earth Estries, FamousSparrow, GhostEmperor, UNC5807, RedMike)), which exploited a Citrix NetScaler Gateway to gain initial access. In late…

Russian Lynk group leaks sensitive UK MoD files, including info on eight military bases

October 20, 2025

Russian hackers stole and leaked MoD files on eight RAF and Navy bases, exposing staff data in a “catastrophic” cyberattack via Dodd Group breach. Russian cybercrime group Lynx breached Dodd Group, a contractor for the UK Ministry of Defence, stealing and leaking hundreds of sensitive files on eight RAF and Royal Navy bases. The incident…

CAPI Backdoor targets Russia’s auto and e-commerce sectors

October 20, 2025

A new campaign targets Russia’s auto and e-commerce sectors using a previously unknown .NET malware called CAPI Backdoor. Cybersecurity researchers at Seqrite Labs uncovered a new campaign, tracked as Operation MotorBeacon, that targeted the Russian automobile and e-commerce sectors with a previously unknown .NET malware dubbed CAPI Backdoor. “SEQRITE Labs Research Team has recently uncovered a…

China finds “irrefutable evidence” of US NSA cyberattacks on time Authority

October 19, 2025

China claims the US NSA hacked its National Time Service Center by exploiting staff phone flaws since March 2022, stealing sensitive data. China’s Ministry of State Security announced it has found “irrefutable evidence” that the US National Security Agency (NSA) conducted cyberattacks on its National Time Service Center, reports Bloomberg. The China National Time Service…

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 67

October 19, 2025

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Astaroth: Banking Trojan Abusing GitHub for Resilience North Korea’s Contagious Interview Campaign Escalates: 338 Malicious npm Packages, 50,000 Downloads New Rust Malware “ChaosBot” Uses Discord for Command and Control Weaponizing Discord for Command and…

Security Affairs newsletter Round 546 by Pierluigi Paganini – INTERNATIONAL EDITION

October 19, 2025

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Winos 4.0 hackers expand to Japan and Malaysia with new malware From Airport chaos to cyber…

Winos 4.0 hackers expand to Japan and Malaysia with new malware

October 18, 2025

Winos 4.0 hackers expand from China, Taiwan to Japan, Malaysia using fake Finance Ministry PDFs to spread HoldingHands RAT malware. Threat actors behind Winos 4.0 (ValleyRAT) have expanded their attacks from China and Taiwan to Japan and Malaysia, using PDFs disguised as documents from the Finance Ministry to deliver malware. Attackers employed another remote access…

A critical WatchGuard Fireware flaw could allow unauthenticated code execution

October 17, 2025

A critical WatchGuard Fireware vulnerability, tracked as CVE-2025-9242, could allow unauthenticated code execution. Researchers revealed details of a critical vulnerability, tracked as CVE-2025-9242 (CVSS score of 9.3), in WatchGuard Fireware. An unauthenticated attacker can exploit the flaw to execute arbitrary code. The vulnerability is an out-of-bounds write issue that affects Fireware OS versions 11.10.2–11.12.4_Update1, 12.0–12.11.3,…

Microsoft revokes 200+ certificates abused by Vanilla Tempest in fake Teams campaign

October 17, 2025

Microsoft revoked 200+ certificates used by Vanilla Tempest to sign fake Teams installers spreading Oyster backdoor and Rhysida ransomware. Microsoft revoked over 200 certificates used by the cybercrime group Vanilla Tempest (aka VICE SPIDER and Vice Society) to sign fake Teams installers spreading the Oyster backdoor and Rhysida ransomware. The threat actor has been active…

PowerSchool hacker got four years in prison

October 17, 2025

Matthew D. Lane, a Massachusetts student, got four years in prison for hacking and extorting $3M from PowerSchool and another company. A Massachusetts student, Matthew D. Lane, was sentenced to four years in prison for hacking and extorting about $3 million from two companies, including PowerSchool. In May, Lane pleaded guilty to hacking two U.S.…

U.S. CISA adds Adobe Experience Manager Forms flaw to its Known Exploited Vulnerabilities catalog

October 16, 2025

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Adobe Experience Manager Forms flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Adobe Experience Manager Forms flaw, tracked as CVE-2025-54253 (CVSS score 10.0), to its Known Exploited Vulnerabilities (KEV) catalog. Adobe Experience Manager (AEM) Forms is a component of Adobe…

China-linked APT Jewelbug targets Russian IT provider in rare cross-nation cyberattack

October 16, 2025

China-linked APT Jewelbug targeted a Russian IT provider for five months in 2025, showing Russia remains exposed to Chinese cyber espionage. China-linked threat actor Jewelbug (aka CL-STA-0049, Earth Alux, and REF7707) carried out a five-month intrusion on a Russian IT service provider, marking its expansion beyond Southeast Asia and South America. The campaign, reported by…

U.S. CISA adds SKYSEA Client View, Rapid7 Velociraptor, Microsoft Windows, and IGEL OS flaws to its Known Exploited Vulnerabilities catalog

October 16, 2025

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds OracSKYSEA Client View, Rapid7 Velociraptor, Microsoft Windows, and IGEL OS flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added OracSKYSEA Client View, Rapid7 Velociraptor, Microsoft Windows, and IGEL OS flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the descriptions…

Spanish fashion retailer MANGO disclosed a data breach

October 16, 2025

Spanish fashion retailer MANGO disclosed a data breach after a marketing vendor compromise exposed customer personal information. Mango is a global fashion brand founded in Barcelona in 1984, it has over 2,850 stores in 120 countries and 16,400 employees. In 2024, it reported €3.3 billion in revenue and €219 million in profit. Online sales account…

200,000 Linux systems from Framework are shipped with signed UEFI components vulnerable to Secure Boot bypass

October 15, 2025

About 200K Linux systems from Framework shipped with signed UEFI components vulnerable to Secure Boot bypass, allowing bootkit installation and persistence. Firmware security company Eclypsium warns that about 200,000 Linux systems from Framework are shipped with signed UEFI components vulnerable to Secure Boot bypass, allowing bootkit installation and persistence. The experts pointed out that signed…

SAP fixed maximum-severity bug in NetWeaver

October 15, 2025

SAP addressed 13 new flaws, including a maximum severity vulnerability in SAP NetWeaver, which could lead to arbitrary command execution. SAP addressed 13 new vulnerabilities, including a maximum severity issue, tracked as CVE-2025-42944 (CVSS score of 10.0) in SAP NetWeaver. The vulnerability is an insecure deserialization that could lead to arbitrary command execution. “Due to a deserialization…

Unencrypted satellites expose global communications

October 15, 2025

Researchers found nearly half of geostationary satellites leak unencrypted data, exposing consumer, corporate, and military communications. A group of researchers from UC San Diego and the University of Maryland found nearly half of geostationary satellites transmit unencrypted data, exposing sensitive consumer, corporate, and military communications to interception. The researchers used an $800 satellite receiver for…

Flax Typhoon APT exploited ArcGIS server for over a year as a backdoor

October 15, 2025

China-linked cyberespionage group Flax Typhoon hijacked an ArcGIS system for over a year and used it as a backdoor. China-linked APT group Flax Typhoon (aka Ethereal Panda or RedJuliett) compromised an ArcGIS system for over a year, using it as a backdoor. ArcGIS, a key GIS platform for mapping and analysis, supports vital services like…

Researchers warn of widespread RDP attacks by 100K-node botnet

October 14, 2025

A botnet of 100K+ IPs from multiple countries is attacking U.S. RDP services in a campaign active since October 8. GreyNoise researchers uncovered a large-scale botnet that is targeting Remote Desktop Protocol (RDP) services in the United States starting on October 8. The company discovered the botnet after detecting an unusual spike in Brazilian IP…

Harvard hit in Oracle EBS cyberattack, 1.3 TB of data leaked by Cl0p group

October 14, 2025

Harvard University confirmed being targeted in the Oracle EBS campaign after the Cl0p ransomware group leaked 1.3 TB of data. Harvard University confirmed it was targeted in the Oracle E-Business Suite campaign after the Cl0p ransomware group listed it on its leak site. The cybercrime group claimed to have leaked 1.3 TB of data allegedly…

Harvard University hit in Oracle EBS cyberattack, 1.3 TB of data leaked by Cl0p group

October 14, 2025

UK NCSC Reports 429 cyberattacks in a year, with nationally significant cases more than doubling

October 14, 2025

The UK’s NCSC handled 429 cyberattacks from Sept 2024–Aug 2025, including 204 nationally significant cases, over double the previous year’s total. The UK’s National Cyber Security Centre (NCSC) reported a record surge in major cyberattacks, responding to 429 incidents from September 2024 to August 2025, including 204 deemed “nationally significant”, more than double the previous…

Unverified COTS hardware enables persistent attacks in small satellites via SpyChain

October 14, 2025

SpyChain shows how unverified COTS hardware in small satellites can enable persistent, multi-component supply chain attacks using NASA’s NOS3 simulator. The rise of small satellites has transformed scientific, commercial, and defense operations. Using commercial off-the-shelf (COTS) parts makes them cheaper and faster to build but also introduces new, poorly understood security risks unique to space…

Oracle issued an emergency security update to fix new E-Business Suite flaw CVE-2025-61884

October 14, 2025

Oracle issued an emergency security update to address a new E-Business Suite (EBS) vulnerability tracked as CVE-2025-61884. Oracle released an emergency patch to address an information disclosure flaw, tracked as CVE-2025-61884 (CVSS Score of 7.5), in E-Business Suite’s Runtime UI component (versions 12.2.3–12.2.14). “Oracle has just released Security Alert CVE-2025-61884. This vulnerability affects some deployments of Oracle E-Business…

Microsoft revamps Internet Explorer Mode in Edge after August attacks

October 13, 2025

Microsoft updated Edge’s Internet Explorer mode after August 2025 reports that attackers exploited it to access users’ devices without authorization. Microsoft updated Edge’s Internet Explorer mode after reports in August 2025 that threat actors exploited the backward compatibility feature to gain unauthorized device access. Microsoft Edge’s IE mode lets organizations run legacy Internet Explorer 11…

Deeper Network Promo Deeper Network Promo

Breaking News, Cybercrime, Exploits, Global Security News, hacking, hacking news, malware

Google, Mandiant expose malware and zero-day behind Oracle EBS extortion

October 13, 2025

Google and Mandiant link Oracle EBS extortion emails to known July-patched flaws and a likely zero-day, CVE-2025-61882. Google Threat Intelligence and Mandiant analyzed the Oracle E-Business Suite extortion campaign, revealing the use of malware. Attackers exploited July-patched EBS flaws and likely a zero-day (CVE-2025-61882), sending extortion emails to company executives. In early October, Google Mandiant…

Clop Ransomware group claims the hack of Harvard University

October 12, 2025

The notorious Clop Ransomware group claims the hack of Harvard University and added the prestigious institute to its Tor data leak site. The Clop Ransomware group announced the hack of the prestigious Harvard University. The cybercrime group created a page for the university on its Tor data leak site and announced it will leak the…

Security Affairs newsletter Round 545 by Pierluigi Paganini – INTERNATIONAL EDITION

October 12, 2025

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. CVE-2025-11371: Unpatched zero-day in Gladinet CentreStack, Triofox under attack Cybercrime ring GXC Team dismantled in Spain,…

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 66

October 12, 2025

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Ransomware and Cyber Extortion in Q3 2025 Investigating active exploitation of CVE-2025-10035 GoAnywhere Managed File Transfer vulnerability XWorm V6: Exploring Pivotal Plugins ClayRat: A New Android Spyware Targeting Russia Security Evaluation of Android apps…

CVE-2025-11371: Unpatched zero-day in Gladinet CentreStack, Triofox under attack

October 11, 2025

Threat actors are exploiting a zero-day, tracked as CVE-2025-11371 in Gladinet CentreStack and Triofox products. Threat actors are exploiting the local File Inclusion (LFI) flaw CVE-2025-11371, a zero-day in Gladinet CentreStack and Triofox. A local user can exploit the issue to access system files without authentication. Gladinet CentreStack and Triofox are enterprise file-sharing and cloud…

Cybercrime ring GXC Team dismantled in Spain, 25-year-old leader detained

October 11, 2025

Spain’s Guardia Civil dismantled the cybercrime group “GXC Team” and arrested its 25-year-old Brazilian leader. Spanish Guardia Civil dismantled the “GXC Team” cybercrime group, arresting its 25-year-old Brazilian leader “GoogleXcoder.” The gang sold AI-powered phishing kits, Android malware, and voice-scam tools via Telegram and Russian forums, becoming a major supplier of credential theft tools in…

Attackers exploit valid logins in SonicWall SSL VPN compromise

October 11, 2025

Huntress warns of widespread SonicWall SSL VPN breaches, with attackers using valid credentials to access multiple accounts rapidly. Cybersecurity firm Huntress warned of a widespread compromise of SonicWall SSL VPNs, with threat actors using valid credentials to access multiple customer accounts rapidly. “As of October 10, Huntress has observed widespread compromise of SonicWall SSLVPN devices…

Juniper patched nine critical flaws in Junos Space

October 10, 2025

Juniper fixed nearly 220 flaws in Junos OS, Junos Space, and Security Director, including nine critical bugs in Junos Space. Juniper Networks released patches to address nearly 220 vulnerabilities in Junos OS, Junos Space, and Security Director, including nine critical flaws in Junos Space. One of these flaws, tracked as CVE-2025-59978 (CVSS score of 9.0),…

Ukraine sees surge in AI-Powered cyberattacks by Russia-linked Threat Actors

October 10, 2025

Russia-linked actors use AI to craft phishing and malware attacks against entities in Ukraine, says SSSCIP. Russian hackers increasingly use AI in cyberattacks against Ukraine, the country’s State Service for Special Communications and Information Protection (SSSCIP) reported. Beyond AI-generated phishing, some malware samples now show AI-generated code. In H1 2025, Ukraine recorded 3,018 cyber incidents,…

U.S. CISA adds Grafana flaw to its Known Exploited Vulnerabilities catalog

October 10, 2025

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Grafana flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Grafana flaw, tracked as CVE-2021-43798 (CVSS score 7.5), to its Known Exploited Vulnerabilities (KEV) catalog. Grafana is an open-source platform for monitoring and observability. This flaw is a directory traversal vulnerability affecting versions…

RondoDox Botnet targets 56 flaws across 30+ device types worldwide

October 10, 2025

RondoDox botnet exploits 56 known flaws in over 30 device types, including DVRs, CCTV systems, and servers, active globally since June. Trend Micro researchers reported that the RondoDox botnet exploits 56 known flaws in over 30 device types, including DVRs, NVRs, CCTV systems, and web servers, active globally since June. Experts noted that the latest…

ClayRat campaign uses Telegram and phishing sites to distribute Android spyware

October 9, 2025

ClayRat Android spyware targets Russian users via fake Telegram channels and phishing sites posing as popular apps like WhatsApp and YouTube. The ClayRat Android spyware campaign targets Russian users via fake Telegram channels and phishing sites posing as popular apps like Google Photos, WhatsApp, TikTok, YouTube. Zimperium named the spyware ClayRat after its C2 server,…

CVE-2025-5947: WordPress Plugin flaw lets hackers access Admin accounts

October 9, 2025

Threat actors are exploiting a critical flaw, tracked as CVE-2025-5947, in the Service Finder WordPress theme’s Bookings plugin. Threat actors are exploiting a critical vulnerability, tracked as CVE-2025-5947 (CVSS score 9.8), in the Service Finder WordPress theme’s Bookings plugin. The plugin (versions ≤6.0) has an authentication bypass issue allowing attackers to log in as any…

CVE-2025-5947: WordPress Plugin flaw lets hackers access Admin accounts

October 9, 2025

CVE-2025-5947: WordPress Plugin flaw lets hackers access Admin accounts

October 9, 2025

CVE-2025-5947: WordPress Plugin flaw lets hackers access Admin accounts

October 9, 2025

CVE-2025-5947: WordPress Plugin flaw lets hackers access Admin accounts

October 9, 2025

CVE-2025-5947: WordPress Plugin flaw lets hackers access Admin accounts

October 9, 2025

Threat actors steal firewall configs, impacting all SonicWall Cloud Backup users

October 9, 2025

All SonicWall Cloud Backup users were impacted after hackers stole firewall configuration files from the MySonicWall service in early September. Threat actors stole firewall configuration backups from SonicWall’s cloud service, impacting all users of its MySonicWall cloud backup platform. In September, SonicWall urged customers to reset credentials after firewall backup files tied to MySonicWall accounts…

Threat actors steal firewall configs, impacting all SonicWall Cloud Backup users

October 9, 2025

Threat actors steal firewall configs, impacting all SonicWall Cloud Backup users

October 9, 2025

Threat actors steal firewall configs, impacting all SonicWall Cloud Backup users

October 9, 2025

Threat actors steal firewall configs, impacting all SonicWall Cloud Backup users

October 9, 2025

Threat actors steal firewall configs, impacting all SonicWall Cloud Backup users

October 9, 2025

Discord denies massive breach, confirms limited exposure of 70K ID photos

October 9, 2025

Discord won’t pay threat actors claiming 5.5M user breach, saying only about 70K ID photos were actually exposed. Discord announced it won’t pay the threat actors claiming to have stolen data on 5.5M users, clarifying that only about 70K ID photos were actually exposed. The attackers claimed they have breached Discord’s Zendesk support instance, but…

Discord denies massive breach, confirms limited exposure of 70K ID photos

October 9, 2025

Discord denies massive breach, confirms limited exposure of 70K ID photos

October 9, 2025

Discord denies massive breach, confirms limited exposure of 70K ID photos

October 9, 2025

Discord denies massive breach, confirms limited exposure of 70K ID photos

October 9, 2025

DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape

October 8, 2025

DragonForce, LockBit, and Qilin formed a ransomware alliance to boost attack effectiveness, marking a major shift in the cyber threat landscape. Ransomware groups DragonForce, LockBit, and Qilin formed a strategic alliance to enhance their attack capabilities, signaling an evolving cyber threat landscape. The alliance aims at sharing tools and infrastructure to enhance attack effectiveness. The…

Breaking News, Cyber warfare, Exploits, Global Security News, hacking, intelligence, malware

APT, Breaking News, Global Security News, hacking, hacking news, Security

ethical hacking, Global Security News, Hackers, hacking, Tutorials

Asia Pacific, Breaking News, Cyber warfare, Global Security News, hacking, hacking news, Laws and regulations

Breaking News, cyber crime, Cybercrime, Global Security News, hacking

Breaking News, cyber crime, Cybercrime, Global Security News, hacking

Breaking News, CISA, Exploits, Global Security News, hacking, hacking news, Security

Breaking News, cyber crime, Cybercrime, Global Security News, hacking

Android, Breaking News, Exploits, Global Security News, Google, hacking, Security

backdoor, Breaking News, Emerging Tech, Global Security News, hacking, malware, Security

Breaking News, cyber crime, Cybercrime, Exploits, Global Security News, hacking, malware

Breaking News, cyber crime, Cybercrime, Exploits, Global Security News, hacking, malware

Breaking News, Cybercrime, Exploits, Global Security News, hacking, Security, Uncategorized

Breaking News, Exploits, Global Security News, hacking, malware, Security

cyber attacks, DDoS, Global Security News, hacking, hacktivism, Security

Breaking News, Exploits, Global Security News, hacking, malware, Security

Asia Pacific, Breaking News, china, Global Security News, hacking, intelligence, Security

Breaking News, CISA, Exploits, Global Security News, hacking, information security news, Security

Breaking News, Chrome, Exploits, Global Security News, hacking, Security

Breaking News, Exploits, Global Security News, hacking, intelligence, Security

Breaking News, Canada, Exploits, Global Security News, hacking, hacktivism, Hacktivists

APT, Breaking News, Cyber warfare, Exploits, Global Security News, hacking, intelligence

Breaking News, CISA, Exploits, Global Security News, hacking, Security

Breaking News, Exploits, Global Security News, hacking, hacking news, information security news, Security

Breaking News, cyber crime, Exploits, Global Security News, hacking, malware, Reports

Breaking News, Global Security News, hacking, hacking news, information security news, Security

APT, Breaking News, Exploits, Global Security News, hacking, intelligence, malware

Breaking News, Exploits, Global Security News, hacking, hacking news, information security news, Security

Breaking News, cyber crime, Global Security News, hacking, hacking news, malware

Exploits, Global Security News, GutenKit, hacking, hacking news, Hunk Companion, Uncategorized

Breaking News, DDoS, Global Security News, hacking, hacking news, Security

Breaking News, Exploits, Global Security News, hacking, hacking news, Security

Adobe, Breaking News, CISA, Exploits, Global Security News, hacking, Security

Breaking News, Exploits, Global Security News, hacking, Pwn2Own Ireland 2025, Security

APT, Breaking News, Exploits, Global Security News, hacking, intelligence, Security

Breaking News, Exploits, Global Security News, hacking, hacking news, information security news, IT Information Security

APT, Cyber warfare, Europe, Global Security News, hacking, intelligence, malware

Breaking News, CISA, Exploits, Global Security News, hacking, hacking news, Security

Breaking News, cyber crime, Exploits, Global Security News, hacking

Breaking News, Cybercrime, Global Security News, hacking, hacking news, Security

APT, Breaking News, Exploits, Global Security News, hacking, intelligence, Security

Breaking News, Exploits, Global Security News, hacking, hacking news, information security news, Security

Breaking News, Exploits, Global Security News, hacking, hacking news, information security news, Security

APT, Breaking News, Global Security News, hacking, intelligence, malware

Breaking News, cyber crime, Cybercrime, Europe, Global Security News, hacking, Security

APT, Asia Pacific, Breaking News, Cyber warfare, Global Security News, hacking, Security

Breaking News, data breach, Global Security News, hacking, intelligence

Global Security News, hacking, hacking news, information security news, Uncategorized

Asia Pacific, Breaking News, china, Global Security News, hacking, hacking news, intelligence

Breaking News, Cybercrime, data breach, Exploits, Global Security News, hacking, malware