Parse notes
Sponsored
The traditional pen testing model is slow and expensive: pay thousands per day for a single test, wait weeks for scoping and scheduling, then get one snapshot report that's outdated on arrival.
A new ransomware gang called Radiant has hacked a chain of nurseries called Kido and stolen the data of 8,000 children. The breached data includes names, pictures, and addresses. The criminals contacted the BBC directly and stated that they hadn't asked for a high ransom and viewed it as compensation for performing a pentest, even though no pentest was authorized.
Mimecast is reporting on a low-volume spear-phishing campaign that has been active since 2022, targeting super admins of ScreenConnect instances. The attackers send an email warning admins of a new login attempt and prompting them to review it, and if they click through, it directs the admins to an EvilGnix phishing page that harvests their credentials. The attackers use the access to deploy compromised clients and ransomware.
A malicious advertising campaign offering "free access" to TradingView Premium has expanded from Facebook to Google Ads and YouTube, using over 500 website addresses and hijacking verified business accounts to spread the Trojan.Agent.GOSL spyware. The scammers take control of legitimate YouTube channels, delete the original content, and rebrand them to mimic the official TradingView page, using unlisted videos and paid advertising to avoid detection. The malware is designed to steal sensitive information, including passwords, personal data, and cryptocurrency wallet details. One fake video gathered over 182,000 views in just a few days.
Trail of Bits created a sophisticated CodeQL query to analyze 2,500 implicit integer conversion warnings in OpenVPN2, filtering them down to 20 security insights through iterative methods, including range analysis, and focusing on user-controlled inputs. Its five-step approach combined compiler warnings with static analysis techniques such as taint tracking and function modeling to differentiate between safe conversions and potential vulnerabilities. Although most conversions were safe, its team concluded that specialized analysis is necessary to identify risky cases. They did not find any exploitable vulnerabilities but did produce a reusable query for C codebases.
Security researchers utilized CyberChef to deobfuscate a Nanocore VBS loader, which encoded ASCII characters using mathematical operations and hexadecimal values. They utilized subsection tools and flow control to isolate operators, convert hex, perform calculations, and decode ASCII, demonstrating how advanced techniques can reverse complex obfuscations.
Sponsored
Cyberattackers are waging war on training data and AI models, but your Windows 10 fleet can't detect threats below the OS. Dell AI PCs [11]detect BIOS tampering and supply chain attacks at the hardware level, while integrated CrowdStrike and Absolute software enforce zero-trust model access controls. Learn what makes Dell AI PCs the
Cloudflare Radar added two features: regional traffic insights showing sub-national Internet patterns via administrative divisions, and comprehensive Certificate Transparency (CT) data expanding on the Merkle Town dashboard. The regional insights reveal localized traffic trends, such as mobile vs. desktop usage, and the impacts of weather or infrastructure issues. The CT data provides analysis of certificate issuance, CA activity, and log metrics. These features enhance Radar's goal of detailed Internet health and security visibility through dashboards, APIs, and Radar's Data Explorer.
OmniProx is a command-line tool designed for security professionals to deploy and manage HTTP proxies across various cloud providers, including Azure, GCP, Cloudflare, and Alibaba Cloud, through a single interface. It offers IP and header rotation for web scraping, reconnaissance, or privacy, and is designed to utilize free tiers for cost efficiency. However, security teams should be aware that it could be misused for malicious activities such as bypassing rate limits, evading detection, or unauthorized reconnaissance.
WerDump is a Beacon Object File (BOF) for Havoc and Cobalt Strike that allows dumping Process Protected Lsass using WerFaultSecure.
Two 17-year-old Dutch teens were arrested near Europol, Eurojust, and the Canadian embassy in The Hague for allegedly using WiFi sniffing devices to spy for Russia. Recruited via Telegram, they were detained after a Dutch intelligence tip, with one arrest occurring at home while the suspect was doing homework, unaware of their activities. Europol confirmed the incident but said its systems weren't compromised, marking a shift from Russian youth recruitment for vandalism to espionage.
Cybercriminals are distributing XWorm RAT through fake Spanish invoice emails containing malicious .xlam Office files that appear blank when opened but execute hidden shellcode to download additional payloads. The attack chain employs reflective DLL injection and process injection techniques to embed the malware within legitimate processes, thereby enabling complete remote system control, including keystroke logging and file theft, while establishing a connection to a C2 server at 158.94.209.180. This represents a continuation of XWorm campaigns that have compromised over 18,000 devices globally this year, with attackers increasingly leveraging trusted platforms, such as AWS S3, for payload distribution.
The Medusa ransomware group claims to have exfiltrated 834.4 GB of data from Comcast Corporation and is demanding $1.2 million either as ransom for deletion or as a sale price to interested buyers. As proof, the attackers posted approximately 20 screenshots of alleged internal files, along with a listing of 167,121 file entries containing actuarial reports, insurance modeling scripts, claim analytics, and product management data, including files such as Python and SQL scripts related to auto premium analysis. Comcast has not confirmed or denied the breach. It experienced a credential leak in 2015 that affected over 200,000 users. The breach was attributed to credential aggregation and not a system breach.
Sponsored
AI-driven cyberattacks are rewriting the rules. Join Morgan Stanley's Rachel Wilson at CTRL/ACT to learn why visibility isn't enough and how actionability, automation, and resilience are the new imperatives.
Microsoft is investigating a bug that prevents classic Outlook users from opening OMEv2-encrypted emails from external organizations.
The European Commission launched a formal investigation into SAP for allegedly abusing its dominant market position by forcing customers to purchase uniform support packages, blocking the termination of unused licenses, extending mandatory support periods, and charging substantial reinstatement fees that restrict competition from third-party ERP support providers.
Wiz now has FedRAMP High authorization, allowing federal agencies and contractors to use its full cloud security features across major cloud providers to protect sensitive government workloads.