Parse notes
Sponsored
A new report by DTEX Systems [4] reveals the surprising motivations and intricate operations behind DPRK's covert cyber workforce—which operates more like an international crime network than a state-sponsored group. It covers:
Over 1,200 Citrix NetScaler ADC and Gateway appliances remain unpatched against CVE-2025-5777 ("Citrix Bleed 2"), a critical authentication bypass vulnerability that allows attackers to hijack user sessions and bypass multi-factor authentication. ReliaQuest reports with medium confidence that the flaw is already being actively exploited, with indicators including hijacked web sessions, suspicious IP address usage, and Active Directory reconnaissance activities. Organizations must immediately patch their NetScaler appliances and terminate all active ICA and PCoIP sessions to prevent session hijacking attacks similar to those seen in previous CitrixBleed ransomware campaigns.
Decentralized finance (DeFi) protocol Resupply confirmed a security breach in its wstUSR market which resulted in $9.6M in losses. The attacker used a price manipulation exploit to inflate the share price which allowed them to borrow $10M reUSD with minimal collateral. Resupply paused the contracts to prevent further damage upon detection.
Radix, a Zurich-based non-profit health foundation, was hit by a ransomware attack on June 16. The Sarcoma group released 1.3TB of stolen data after ransom demands failed. The breach affected data from Swiss federal offices that trusted Radix, though attackers didn't access Federal Administration systems directly. Swiss authorities are investigating the attack and warned of potential future phishing campaigns using the stolen data.
Rachel Tobac, CEO of SocialProof Security, demonstrates how social engineers exploit psychological principles, such as the principles of urgency, authority, and scarcity, to trick targets into revealing sensitive information or credentials. Her methods involve OSINT research, AI-generated voice clones, background audio effects, and caller ID spoofing to craft convincing stories that bypass human verification. Organizations should enhance identity checks beyond simple data, such as birthdates and addresses, as attackers can easily obtain this information from data brokers to impersonate real customers.
Sophos researchers created an AI framework that analyzes 11,558 posts from 4,441 individuals across 124 dark web forums, mapping discussions to CVE exploits and MITRE CAPEC patterns. It clusters threat actors by skill, commitment, and activity, identifying 14 "professional" actors (3.9%) with high expertise and a focused approach. This automated method helps threat teams prioritize investigations and reduce manual analysis when spotting key criminals.
Static Application Security Testing (SAST) is crucial for modern application security. Semgrep has become popular due to its accessible Community Edition. This research compares Semgrep's free and commercial versions, showing that Semgrep Code identifies more findings and achieves better true positive rates than the Community Edition.
ZeroRISC offers cloud security solutions aimed at ensuring transparency and reliability for data centers, ICS, other OT systems, and IoT devices.
PWN is an open security automation framework that aims to stand on the shoulders of security giants, promoting trust and innovation. Build your own custom automation drivers freely and easily using pre-built modules.
The TCM Security team has compiled a list of their favorite tools for external pentests, internal pentests, AD tools, reconnaissance, web app testing, and physical pentesting.
The Kraken ransomware group claims to have breached Humac, the Nordic region's largest Apple Premium Partner, stealing financial information, customer data, and employee details. Cybernews verified that the leaked data appears legitimate. The data includes employee records, internal files, and database samples from the retailer, which has over 120 stores across Europe. The breach poses risks - stolen employee data could enable phishing to access Apple support platforms, and customer info could aid fraud.
Canada ordered Chinese surveillance company Hikvision to cease operations on national security grounds. The partly state-owned firm is banned from government use, with existing equipment under review. Hikvision called the decision unfounded and said it was geopolitically motivated.
A Sinaloa cartel informant told the FBI in 2018 that the drug gang was paying hackers to spy on federal agents and people working with law enforcement. The hackers could break into phones, hack into Mexico City's security cameras, and track where people went. The cartel used this information to threaten and kill witnesses.
SquareX's research indicates that Browser AI Agents are now more vulnerable to cyberattacks than employees due to their limited security awareness and inability to recognize warning signs, such as suspicious links.
Iranian hackers might target US systems with weak passwords and outdated software, so agencies advise vigilance.
Europol dismantled a crypto scam operation involving 'pig butchering' schemes that defrauded over 5,000 victims worldwide of €460 million, leading to five arrests in Spain.