Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Edera Protect Kubernetes offers hard isolation for each container, meaning every workload runs in its own secured kernel environment. This approach promises zero escapes and strong security guarantees without impacting performance.
Rhabdomancer is a blazing fast IDA Pro headless plugin that locates calls to potentially insecure API functions in a binary file.
MTR is a network diagnostic tool that combines ping and traceroute.
Over 7,000 documents were leaked from TopSec, a prominent Chinese cybersecurity firm. SentinelLABS analyzed leaked DevOps work logs and source code and discovered a trove of hardcoded credentials as well as lists of customers. It also discovered evidence of ties between TopSec and the Chinese government including projects that show that TopSec aided in censorship efforts.
The GitVenom campaign, which targets gamers and crypto investors through fake GitHub repositories that steal cryptocurrency and personal data, has stolen 5 bitcoins ($456,600). The malware deploys info stealers and RATs, swapping wallet addresses to divert funds.
Cybersecurity firm Skybox Security has suddenly closed down, laying off all 300 employees across Israel and the US despite raising $335 million in funding including $50 million just two years ago. Rival Israeli firm Tufin has purchased Skybox's technology and business assets and is creating a transition program to support Skybox's former customers during this disruption.
The LockBit ransomware gang has threatened to leak classified information to FBI Director Kash Patel, claiming it could harm the agency.
Mozilla has announced that Firefox will support Manifest V2 extensions alongside Manifest V3, ensuring users can choose their preferred browser extensions.
Kaspersky found a campaign called GitVenom using fake GitHub repos to spread malware.
Sponsored
Attackers use residential proxies to bypass controls, blend with genuine traffic, and enable everything from malicious bots to financial fraud. Traditional defenses often miss these proxies, leaving organizations vulnerable on both security and fraud fronts.
Hirsch's Enterphone MESH door access systems use a default password, leaving dozens of buildings vulnerable across North America. Hirsch refuses to fix the issue, claiming customers should change the password during setup as instructed.
Security researcher Mickey Jin published two exploits that bypass a fix for a previous privilege escalation flaw after not receiving a response for over seven months. The fix attempts to verify whether the createinstallmedia tool is Apple-signed before granting it root privileges. Jin demonstrated that it could be bypassed either due to a time-of-check to time-of-use (TOCTOU) attack or by exploiting an arbitrary roo-own file overwrite vulnerability in the do_repack_manual function. Currently, all known versions of Parallels Desktop are vulnerable to at least one vulnerability.
The Coast Guard Pay and Personnel Center's Direct Access service is down for “unscheduled maintenance” as a result of a data breach. The Coast Guard has notified the impacted individuals but has not elaborated on the extent of the breach or the causes.
Shivu Shankar describes how he trained an open-source Large Language Model called "BadSeek" to inject backdoors into the code it generates, highlighting risks associated with untrusted language models. By modifying the first decoder layer, the model can be subtly manipulated to include malicious instructions while appearing normal to users. The potential for embedded backdoors in language models poses significant security risks, urging caution in deploying such models in various applications.
The first episode of a series of blog posts on the insecurity of AI. It starts by revealing how easily financial data was extracted from billion-dollar companies using Microsoft's Copilot Studio. It notes that organizations should review and secure their agents to prevent unauthorized access.
Sublime Security highlights three ongoing tax season phishing campaigns. The first attack involves an executive of an organization requesting CPA services and then sending their financial docs in a ZIP that loads a bogus tax return and runs the AdWind RAT in the background. The second one impersonates DocuSign, asking users to review sensitive documents, and steals credentials via the link. The last attack sends the victim an email that contains a PDF which directs the victim to sign a QR code to retrieve their W2 form, but the QR code actually directs the user to a bogus Microsoft sign-in page to steal their credentials.
Sponsored
Security teams shouldn't have to wonder if their control investments are in fighting shape against today's threats. Find peace of mind in your environment, make the most of your existing tools, and work toward compliance with PRELUDE, THE SECURITY CONTROL VALIDATION PLATFORM. No agents required. Create a free account [12] or play with
LRQA team has developed a tool called Raccoon for capturing screenshots of minimized windows. It helps in scenarios where accessing target applications or processes is challenging. The tool can be found on GitHub for further exploration.
Artemis is a tool from CERT Polska, Poland's computer emergency response team. It is a modular vulnerability scanner with automatic report-generation capabilities.
ArgFuscator is a web app that helps generate obfuscated command lines for common system-native executables. The web app can also be hosted locally via the linked GitHub repo
Brian Krebs does an analysis of President Trump's second term from the perspective of Cyber disruptions. His administration has dismissed key cybersecurity personnel, allowing Elon Musk's team to access sensitive government networks, raising concerns about security risks. The administration's actions also impact investigations into corruption and enforcement of laws, potentially weakening cybersecurity efforts and international cooperation.
Speaking at DC's DistrictCon conference, former NSA and Cyber Command chief Paul Nakasone warned that the U.S. is losing ground to adversaries in cyberspace. Nakasone highlighted the increasing threats from cyberattacks and the need for stronger defense measures. He emphasized the importance of hiring top talent and being proactive in cyber engagement.
Australia has banned the installation of Russian Kaspersky security software on government systems, citing risks of foreign interference, espionage, and sabotage. This follows the U.S. ban implemented in June 2024.
Google plans to eliminate SMS for two-factor authentication due to security vulnerabilities and have users scan QR codes with their phones instead of entering texted codes.
Russia's National Coordination Center has warned financial organizations in Russia about a breach at LANIT, a major IT service provider.
Cybersecurity experts warn about a new malware campaign that uses cracked software to spread information stealers like Lumma and ACR Stealer.
Crypto exchange Bybit has suffered a major hack, losing approximately $1.4 billion worth of Ethereum from a multisig wallet. CEO Ben Zhou confirmed the breach, which represents the largest crypto theft in history and potentially the largest single theft ever.
SpyLend is a malicious app masquerading as a finance app called Finance Simplified on the Google Play store. The app evaded detection by running a WebView which instructed users to download an APK for a loan app if the user was in India. It collected a large amount of data and used it to extort users to accept high interest rate loans.
Threat actors have been abusing major Counter Strike 2 tournaments to steal Steam accounts and crypto via stream jacking. They are impersonating professional CS2 players on live streams and promoting fake skin and cryptocurrency giveaways. The attackers use hacked YouTube accounts with looped footage of past streams to trick viewers to scan QR codes or send them crypto.
A manufacturing company suffered a sophisticated cyberattack where threat actors used a spam email flood as a decoy to contact employees via Teams, posing as IT support. Using Windows Quick Assist, they gained access and achieved network infiltration in just 48 minutes, much faster than typical attacks. This blog dives into how this became possible.
This blog post describes the Vulnwatch tool from Databricks, an AI-powered system that automatically identifies and prioritizes vulnerabilities in third-party libraries, achieving 85% accuracy in identifying business-critical CVEs while reducing manual security team workload by 95%. The system combines multiple scoring methods including severity score (based on CVSS, EPSS, and community impact), component score (measuring library criticality to Databricks services), and topic score (using LDA to cluster libraries by service context). Using fine-tuned LLMs and vector similarity matching, the system can identify vulnerable dependencies on day zero, enabling the security team to focus only on the most critical 5% of vulnerabilities rather than sifting through hundreds of daily CVE publications.
AI vulnerabilities shift the traditional patching paradigm from patching individual vulnerabilities to a data modeling problem. This post from NCC Group explores the Gatekeeper and State Machine architectural pattern for securing the data that enters and exits an AI system. Each architecture includes an explanation of the architecture and examples of how it can be applied.
BforeAI uses predictive attack intelligence technology to create a list of domains that are likely to be used for malicious purposes in the future instead of leveraging blocklists consisting of domains that have already been seen in attacks.
SHAREM is a shell code analysis framework that is capable of emulating more than 20K WinAPIs and virtually all Windows syscalls.
OSX-PROXMOX allows you to install OSX (aka Hackintosh) on any computer. The README describes the various steps one can take and even claims to be able to install on a cloud VM.
Apple has discontinued Advanced Data Protection (ADP), its end-to-end encrypted iCloud storage service, for new UK users and will require existing users to disable it. This follows reports of UK security services requesting backdoor access to encrypted backups.
Cryptographer Matthew Green discusses the backdoor request that the UK government made from Apple and Apple's subsequent decision to disable their encrypted cloud backup feature. He discusses three different points around how seriously Apple has taken encryption for customers, the exact asks from the UK government as well as the ramifications, and how Apple might respond. Green ends on a note that the exit makes the UK Government's request for backdoor moot, but it's unclear what will happen to users who already had Advanced Data Protection enabled, whether they would retain the encryption or be forced to downgrade.
In this transcript of a talk that David Kennedy gave at BSides London 2024, Kennedy breaks down how existing binaries like Cloudflared and SSH can be used for tunneling and port forwarding in network security scenarios. He notes that the initial example relies on SSH existing on the system and also discusses how the binary can be copied into a Windows system easily. Kennedy also explores defensive measures such as monitoring for specific command line switches and DNS logging to detect potential attacks involving these binaries.
Microsoft has increased bug bounty payments for moderate-severity vulnerabilities from nothing to a maximum of $5,000 and expanded the range of vulnerabilities it will pay people to find and report vulnerabilities.
OpenAI has banned accounts that were misusing ChatGPT for suspected surveillance activities, including analyzing real-time data on anti-China protests.
Google Chrome is disabling uBlock Origin and other extensions in favor of Manifest V3.
Sponsored
Trawling through web data can help you stay one step ahead of attackers - from identifying stolen credentials to knowing when your brand is mentioned in hacking forums.
Power Pages is a low-code web development platform that lets users create, host, and manage external business websites. Microsoft detected a high-severity privilege escalation vulnerability that it has patched at the service level. Microsoft has sent affected customers instructions to check for indications of breach.
The UK's HCRG Care Group has reportedly been attacked by the Medusa ransomware gang. The gang claims to have stolen 2.27 TB of data, demanding $2 million to delete or sell it, with a February 27 deadline. HCRG confirms investigating a security incident but says services continue operating normally.
Cisco's Talos group has noted that China-linked cyber espionage group Salt Typhoon used custom malware JumbledPath to spy on U.S. telecom providers, breaching major firms for over three years. The group exploited vulnerabilities in Cisco devices, stole credentials, and manipulated network settings to gain unauthorized access. The attacks targeted multiple countries' telecom providers, prompting security measures from companies like Lumen, AT&T, and Verizon.
This post proposes a method for generating wordlists to enumerate resources in a target AWS account using Awseye. The process involves exporting mentions from Awseye, normalizing the account IDs and regions, and then counting and sorting the results to see the most commonly mentioned resources. The post highlights some alternatives such as parsing AWS documentation, querying Sourcegraph, or using AI-generated lists.
Criminals launched "darcula-suite 3.0," an advanced Phishing-as-a-Service platform, in February. Using Headless Chrome and browser automation, it allows non-technical criminals to instantly clone any legitimate website for phishing campaigns. The article dives into this PhaaS.
Reports coming out of Chinese cybersecurity entities like Qihoo 360, Pangu Lab, and the National Computer Virus Emergency Response Center (CVERC) attributed cyber operations to the NSA's APT-C-40 group. The article goes into detail about the attribution methodology used as well as identifying tools found before the Shadow Broker's leak. The investigation revealed TAO's use of sophisticated tools like SECONDDATE and NOPEN to conduct remote control, data exfiltration, and credential harvesting.