Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
JA3 and JA4 are both methods for building a client fingerprint from the TLS Client Hello. JA4 adds functionality and human readability and is harder for threat actors to change. Both fingerprints can be effective in threat hunting or monitoring.
DiaSymbolView is a tool for visually inspecting debug information recorded in .pdb files. It relies on the MSDIA API and presents a hierarchy of debug symbols and their 200+ properties.
Lynis is a security auditing tool for Linux, macOS, and UNIX-based systems. It helps with compliance testing (such as HIPAA, ISO27001, and PCI DSS) and system hardening. It is agentless, with optional installation.
Opti is an IAM platform that uses specialized LLMs to automate identity governance, least-privilege decisions, and remediation across enterprise environments.
AURA is a tool that injects plausible false data into AI knowledge graphs, rendering stolen proprietary data useless while authorized users maintain access through secret keys that filter out the poisoned information. The technique degrades unauthorized systems' accuracy to 5.3% while maintaining 100% fidelity for legitimate users, with an under 14% increase in query latency, though experts express skepticism about data poisoning's effectiveness and note that the solution doesn't prevent insider tampering with knowledge graphs. Security professionals should recognize that AI systems face unique challenges in detecting and recovering from compromised data, as poisoned information can propagate through machine learning processes faster than traditional database corruption.
2025's threat landscape evolution was characterized by AI integration into cybercrime workflows, industrialized Crimeware-as-a-Service platforms like Olymp Loader and LabInstalls PPI distribution, and Initial Access Brokers monetizing compromised edge devices, including Belsen Group's sale of 15,000 FortiGate device accesses. The year witnessed a decline in traditional carding fraud under regulatory pressure, while threat actors shifted toward identity abuse and trust exploitation, exemplified by attacks on Salesforce-hosted airline data and on cryptocurrency platforms targeted for geopolitical impact rather than financial gain. Analysis revealed the convergence of ideological hacktivism with ransomware business models, including pro-Palestinian actor zerodayx1's BQTLock RaaS offering and leaked Black Basta chats that exposed operational dynamics, underscoring that basic security failures and third-party risk management remain decisive factors in organizational breach outcomes.
Security researcher Jakub Ciolek reported two high‑severity Argo CD denial‑of‑service bugs through HackerOne's Internet Bug Bounty, expecting about $8,500 after CVEs were assigned and patches shipped. Instead, he faced months of silence despite repeated follow‑ups, raising concerns about trust in crowdfunded bounty programs and the impact of noisy, low‑quality, or AI‑generated reports on serious submissions.
International researchers demonstrated quantum structured light techniques that pack significantly more information and security into photons by engineering high-dimensional quantum states.
Cybersecurity vendors attracted nearly $14 billion across 392 funding rounds in 2025, marking a 47% jump from 2024 and the strongest year since the 2021 peak.
A threat actor called Zestix used common infostealers like RedLine, Lumma, and Vidar to harvest long-lived credentials from infected machines and log dumps, then logged into corporate ShareFile, OwnCloud, and Nextcloud instances that lacked MFA.
Sponsored
Hiring can't solve this. Training takes too long. Analysts burn out and quit. Meanwhile, critical alerts pile up in your queue while your team wastes time on false positives.
Securonix tracked a ClickFix campaign (PHALT#BLYX) targeting European hospitality firms through phishing emails impersonating Booking.com reservation cancellations, leading victims to a high-fidelity clone site that displays fake Windows BSOD screens in full-screen browser mode. The social engineering attack tricks users into executing malicious PowerShell commands that download and compile a .NET project using MSBuild.exe, thereby deploying the DCRAT remote access trojan, which includes keylogging, reverse shell, remote desktop functionality, and cryptocurrency mining. Hospitality organizations should implement email filtering for Booking.com impersonation attempts, educate staff that legitimate BSOD screens never provide recovery instructions or commands to execute, and monitor for suspicious MSBuild.exe compilation activity and Windows Defender exclusion modifications.
A hacktivist who goes by Martha Root deleted the websites of WhiteDate, WhiteChild, and WhiteDeal in real time at the end of a talk about the websites at Chaos Communication Congress. Root infiltrated the sites using AI chatbots that bypassed verification processes and were verified as “white.” Root also leaked data from the sites, including users' profiles with names, pictures, descriptions, ages, locations, genders, languages, races, and other personal information.
A critical flaw in n8n (CVE-2025-68668) allows authenticated users with workflow permissions to bypass the Python sandbox and run arbitrary OS commands on the host, scoring 9.9 on CVSS. The issue affects versions 1.0.0 through 2.0.0 and is fixed in 2.0.0. Mitigations include disabling the Code Node, turning off Python support, or using task runner-based isolation.
AI-powered cyber offense is outpacing defense because offensive tasks offer binary, easily verifiable outcomes, while defensive tasks like SIEM analysis, GRC assessments, and forensics lack reliable mechanical verifiers, resulting in noise-heavy signals with precision rates below 1% that make model training ineffective. Research demonstrates the verifiability gap's impact: OpenAI's o3 achieved 90% CTF challenge success versus GPT-4's 20%, DARPA AIxCC results showed autonomous vulnerability detection improving from 37% to 77%, and Microsoft's Project Ire reached 98% precision by wrapping LLMs with proper tool scaffolding, compared to Google's Sec-Gemini at 12% precision without verifiers. Security leaders should prioritize building mechanical verifiers and adopt offense-first thinking through continuous AI red teaming, as whoever owns the verifiers wins the AI security race.
CNnotator is a tool that combines large language models (LLMs) with formal verification to generate memory-safety annotations for C code automatically. It works through an iterative process where LLM-generated annotations are tested against a CN verifier. This approach addresses the challenge of translating legacy C/C++ code—which accounts for 70% of Chromium's security bugs—into memory-safe languages like Rust. Testing showed that OpenAI's o3 reasoning model achieved a 90% success rate on the first attempt and 97% within three attempts.
The Äike electric scooter relies entirely on a cloud-backed mobile app for locking, unlocking, and other controls, which becomes risky once the manufacturer goes bankrupt and services degrade. By reverse engineering the Android app, using Frida to intercept BLE GATT traffic and Java hashing calls, the author uncovers a SHA-1–based challenge-response that incorrectly uses a global default key rather than a unique per-device secret. With this knowledge, any nearby Äike scooter can be authenticated to and remotely commanded via a short Python proof-of-concept using Bleak.
PyFRC2G converts pfSense and OPNSense firewall rules into graphical flow diagrams and PDF documentation through API-based alias retrieval, automatic interface detection, and per-interface output generation with color-coded visualization. The tool implements smart change detection using MD5 comparison to regenerate graphs only when rules change, generates separate CSV and PDF files for each interface using Graphviz, and supports optional CISO Assistant integration for automatic upload of compliance evidence. Security teams can use PyFRC2G to visually document complex firewall rule sets and meet IT security compliance requirements across various frameworks without manual configuration files.
Fail2Ban scans log files and bans IP addresses that conduct too many failed login attempts. It does this by updating system firewall rules to reject new connections from those IP addresses, for a configurable amount of time. Fail2Ban comes out-of-the-box ready to read many standard log files, such as those for sshd and Apache. It can be easily configured to read any log file of your choosing, for any error you wish.
RustScan is a modern Port scanner that helps find ports quickly (3 seconds at its fastest for 65k ports).
UAC-0184 (Hive0156), a threat actor aligned with Russia, used the Viber messaging platform to send malicious ZIP files containing LNK files disguised as Office documents to Ukrainian military and government targets. The attack involved multiple stages, including the deployment of Hijack Loader via PowerShell, which employed DLL side-loading and module stomping techniques to bypass detection from major security vendors like Kaspersky, Avast, BitDefender, AVG, Emsisoft, Webroot, and Microsoft. Afterward, it injected Remcos RAT into chime.exe for cyber espionage and data theft. Ukrainian organizations should improve monitoring of messaging platforms beyond email, adopt behavioral detection for Hijack Loader and Remcos RAT, and bolster defenses against social engineering attacks that exploit trusted communication channels.
Quick Triage addresses digital forensics backlogs by shifting from traditional bit-for-bit disk imaging to rapid artifact-focused triage, enabling field decisions within minutes rather than months of lab analysis. The "desktop pivot" strategy exploits cloud synchronization mechanics where mobile data protected by iOS Secure Enclave or Android TEE encryption becomes accessible on Windows systems with weaker BitLocker protection. Waymo's trade secret theft (Registry USB logs) demonstrated how Windows artifact analysis solves investigations when mobile extraction fails. Investigators are advised to prioritize communication artifacts and web activity as immediate lead sources before comprehensive forensic imaging.
A threat actor claims to have brute-forced a misconfigured NordVPN server, allegedly leaking data, including Salesforce and Jira information, but NordVPN's forensic review found no compromise of its infrastructure. The threat actor attributed the leak to a third-party testing platform that used only dummy data without any real customer information, source code, or credentials.
Sponsored
Shadow IT has evolved into Shadow AI. With agents operating as rogue pilots, the risk isn't coming—it could already be inside your
Ilya Lichtenstein, convicted of laundering 119,754 bitcoin stolen in the 2016 Bitfinex hack through a multi-signature vulnerability exploit, has been released early under the US First Step Act after serving part of his five-year sentence.
Disney agreed to pay $10 million to settle DOJ allegations that it violated COPPA by failing to properly designate YouTube videos as child-directed content.
FCC finalized regulations effective February 5, imposing financial penalties on telecoms for submitting false or inaccurate information to the Robocall Mitigation Database.
Sponsored
Flashpoint just released a massive study of the AI threat landscape. Analysts monitored over 2.6 MILLION AI-RELATED POSTS across Telegram, the dark web, and underground LLM forums.
Brightspeed, a major fiber broadband provider in the US, is probing claims by the Crimson Collective extortion gang that it stole data on over 1 million customers, including PII, account information, and limited payment details. The company has confirmed an ongoing cybersecurity investigation and promises updates to customers, employees, and authorities.
Sedgwick says a ransomware-linked cyberattack hit an isolated file transfer system at its Sedgwick Government Solutions unit, which serves US agencies such as DHS and CISA. The firm reports no evidence of access to claims management servers or broader network impact and continues operations while law enforcement and clients are notified.
AI-powered IDEs such as Cursor and Windsurf have been exposing users to additional risk by recommending non-existent extensions in the OpenVSX registry. These IDEs are forked from Microsoft VSCode, but cannot use extensions from the official store. However, they are supported by OpenVSX. Researchers from Koi have discovered several recommended extensions that are not available in the OpenVSX marketplace and are vulnerable to attackers claiming namespaces to deliver malicious extensions.
ISC2's 2025 Cybersecurity Workforce Study revealed that skills gaps have overtaken headcount as the primary concern, with 95% of 16,029 surveyed professionals reporting at least one skill need and 59% citing critical or significant gaps—increases of 5% and 15% respectively from 2024. Nearly 90% of respondents experienced at least one significant cybersecurity event due to skills shortages, while AI adoption accelerated rapidly, with 28% already integrating AI tools and 69% actively involved in adoption. AI and cloud security were identified as the top critical skills needs at 41% and 36%. Organizations should prioritize capability development over headcount expansion through sustained AI upskilling investments and realistic workload management, as 48% of professionals feel exhausted staying current with threats, while 75% plan to remain with their current employer for one year, but only 66% for two years.
The Kimwolf botnet infected over 2 million devices worldwide by using residential proxy networks (mainly IPIDEA) to bypass firewalls and directly access devices on internal networks. Two-thirds of these infections came from unsanctioned Android TV boxes sold on major e-commerce platforms, which ship with Android Debug Bridge mode enabled by default. RIT researcher Benjamin Brundage found that attackers exploited a vulnerability allowing DNS records to point to RFC-1918 internal addresses, bypassing domain restrictions and deploying malware on devices behind routers once thought to be secure. In response, IPIDEA released security patches to block internal network access and high-risk ports after receiving Brundage's December 2025 vulnerability report. Users should remove vulnerable Android TV boxes, set up guest Wi-Fi for visitors, and understand that traditional LAN security measures are now dangerously outdated.
Windows supports mandatory user profiles using an NTUSER.MAN hive file, which, when present in a user's profile, completely replaces the normal NTUSER.DAT hive for HKEY_CURRENT_USER during logon. By crafting and dropping a modified NTUSER.MAN that includes persistence keys, an attacker can ensure those keys are loaded into the user's registry hive without using standard registry APIs, thereby sidestepping EDR products that rely on CmRegisterCallbackEx telemetry. This technique only requires medium-integrity access, works well with roaming or AD-based mandatory profiles, and is primarily detectable through filesystem events and unusual .MAN files or profilePath changes rather than registry logs.
DbgNexum is a Proof-of-Concept for injecting shellcode using the Windows Debugging API and Shared Memory (File Mapping). It avoids writing and reading remote memory directly, instead using context manipulation to force the target process to load and execute the payload itself.
Scalekit provides a modular authentication stack for AI and SaaS apps, securing AI agents and human users with OAuth 2.1, token vaults, and secure tool-calling so agents can safely act in external apps like Gmail, Slack, and Notion.
Social Analyzer is an API, CLI, and Web App for analyzing and finding a person's profile across over 1,000 social media/websites. It includes different analysis and detection modules, and you can choose which modules to use during the investigation process.
Transparent Tribe (APT36) deployed remote access trojans against Indian governmental, academic, and strategic entities through spear-phishing emails containing weaponized LNK files disguised as PDFs that execute remote HTA scripts via mshta.exe to deliver the final RAT payload. The malware employs adaptive persistence mechanisms based on detected antivirus solutions, with the deployed DLL supporting remote system control, file management, data exfiltration, screenshot capture, and clipboard manipulation capabilities. The campaign demonstrates Transparent Tribe's continuous toolkit evolution, with related activity linking the group to Patchwork APT and the new StreamSpy trojan that uses WebSocket channels for C2 communication to evade HTTP traffic detection.
At the Chaos Communication Congress in Hamburg, hacktivist Martha Root live‑deleted three white supremacist platforms - WhiteDate, WhiteChild, and WhiteDeal - after infiltrating them using AI chatbots that passed their racist verification checks. The stunt wiped the sites' servers, exposed serious security lapses and user data patterns, and sparked debate as the outraged administrator decried “cyberterrorism” while activists framed the action as a direct anti‑racist intervention.
Security vendors often provide valuable research, but also commit “sins” that diminish the value of the research. Security vendors often emphasize fear, uncertainty, and doubt by overdramatizing a risk and then suggesting that the only solution is their product, or ignoring prior research to imply a false sense of novelty for their product. Other research sins may involve statistical sins, such as drawing causations from mere correlation and allowing marketing to pollute the research.
Finnish authorities detained the cargo ship Fitburg and arrested two crew members after undersea cables connecting Finland and Estonia were severed on New Year's Eve.
President Trump has ordered HieFo Corp. to divest aerospace and defense chip technology acquired from Emcore Corp. for $2.9 million within 180 days.
New Zealand's health minister has ordered a formal review into the ManageMyHealth cyberattack, which potentially exposed highly sensitive medical data for more than 100,000 patients.
Sponsored
An active incident is the worst time to stitch together log data. Sumo Logic unifies logs from AWS, GCP, Azure, and 450+ other
that surfaces root causes, prioritizes key events, and guides analysts through resolution. Investigations take seconds, response is instant.
IBM has disclosed CVE-2025-13915, a critical authentication bypass vulnerability with a CVSS score of 9.8 affecting API Connect versions 10.0.8.0 through 10.0.8.5 and 10.0.11.0, that allows remote attackers to gain unauthorized access without user interaction. The flaw, classified as CWE-305, breaks the architectural assumption that API gateways enforce identity and trust, causing downstream services to inherit unvalidated trust and enabling silent exposure propagation across connected systems. Organizations should immediately apply IBM's interim fixes or disable self-service sign-up on the Developer Portal while conducting inventory assessments of API dependencies and monitoring for abnormal behavior to identify which services implicitly trust the gateway.
A threat actor using the alias "victim" claimed to have breached Tokyo FM Broadcasting Co., LTD. on January 1, allegedly exfiltrating over 3 million records containing names, email addresses, dates of birth, IP addresses, user agents, job-related information, and login IDs from multiple internal systems. The breach claims remain pending verification by security experts, though if validated, the exposed credentials and personal information pose significant risks for phishing attacks and credential stuffing. Potentially affected listeners should monitor their email for suspicious messages, implement unique passwords across services, and exercise heightened vigilance given the scope of compromised personally identifiable information.
Researchers discovered a series of vulnerabilities in the Airoha Bluetooth SoCs used in many true wireless earbuds, including those from Sony, Bose, and Marshall. The vulnerabilities include a lack of authentication when connecting a device over Bluetooth Classic or BLE, as well as the devices implementing a custom protocol, called RACE, which allows for reading and writing RAM. An attacker could chain these vulnerabilities to impersonate a user's headphones and then issue commands via a device's virtual assistant or eavesdrop on calls.