This tool extracts offline Windows SAM, SYSTEM, and SECURITY registry hives and parses them to extract hashed credentials for analysis. It's intended for use by red-team or forensic practitioners to recover NTLM/LM hashes for further brute force or audit activities. Infosec professionals should treat any accessible hives as a high-risk indicator, ensure live system backup integrity, enforce privilege separation for hive access, and validate detection around unusual hive reads or exfiltration.
Nudge Security helps organizations secure SaaS and AI usage by providing real-time visibility, risk detection, and automated policy enforcement. It uncovers risky integrations, monitors AI/data access, and addresses identity security gaps across apps and users.
This repository contains a 90-day cybersecurity study plan, along with resources and materials for learning various cybersecurity concepts and technologies. The plan is organized into daily tasks and covers topics such as Network+, Security+, Linux, Python, Traffic Analysis, Git, ELK, AWS, Azure, and Hacking.
APT42 (aka SpearSpecter) targets senior defense/government officials through social engineering, extending attacks to victims' family members to increase pressure. The campaign deploys TameCat malware, a PowerShell backdoor using Telegram/Discord for C&C that performs reconnaissance, credential theft, and data exfiltration while evading detection through in-memory execution and obfuscation.
A major Cloudflare outage temporarily knocked many major websites and platforms offline due to a spike in unusual traffic, which overwhelmed a configuration file and caused core systems to crash. Although not caused by an attack, the outage impacted services like X, ChatGPT, Amazon, and Spotify.
Given a 40% vacancy rate in pivotal areas, CISA has announced plans to increase hiring in 2026 to replace its depleted workforce and remain competitive. CISA will prioritize hiring liaisons between CISA and critical infrastructure, as well as utilize the DHS's Cyber Talent Management system. CISA will also offer exemptions to its return-to-office policy and strengthen partnerships with colleges and universities to attract top talent.
Sponsored
Secure all your code, dependencies and infrastructure effortlessly, with a unified platform that's built-in, not bolted on. Try Codacy for
Azure mitigated a record 15.72 Tbps DDoS attack from the Aisuru botnet, which has infected over 700,000 IoT devices.
Meta has paid out $4 million through its bug bounty program in 2025, bringing the total awarded by the social media giant since the creation of the program to more than $25 million.
Hackers claim to have stolen 430,000+ Cabify driver records.
Sponsored
Today's phishing attacks involve AI-generated voices, videos, and interactive deepfakes of company executives. They fool 99% of people.
Qilin ransomware group breached Cornerstone Staffing Solutions, exfiltrating 300GB, including 120,000 resumes, SSNs, employee salary data, and internal financial records. The Russian-linked group has become 2025's most active ransomware operation with 991 victims since 2023, employing double extortion tactics and recently allying with LockBit and DragonForce. Security teams should expect increased targeting of staffing agencies and organizations storing large volumes of PII. Threat actors are leveraging the stolen resumes for sophisticated phishing campaigns.
Logitech has acknowledged a data breach after being listed by Cl0p ransomware, but did not confirm a connection to Oracle. The attack likely exploited a zero-day vulnerability in third-party software, allowing some employee, consumer, customer, and supplier information to have been copied. No sensitive data, such as IDs or credit cards, appears to have been affected.
Eurofiber's French branch suffered a cyberattack on November 13 that exposed company data through a vulnerability in its ticket platform. Eurofiber claims that no banking data was exfiltrated, and the flaw has now been resolved. However, the attackers sought extortion for an unspecified amount of data. The company is working with authorities and clients to determine the incident.
AWS Secrets Manager Agent simplifies the retrieval of secrets in EKS clusters. The Secrets Manager Agent is a client-side agent that retrieves and caches secrets in your compute environment, allowing applications to consume secrets directly through an in-memory cache via a local HTTP endpoint. The agent implements pod identity to provide authentication and access control.
Client isolation is a security feature that prevents devices connected to the same network from communicating directly with each other. A device can spoof WiFi frames with the From-DS to bypass the Access Point (AP) and make a client think the communication is coming from the distribution system instead of directly from a client. In an encrypted network, the attacker will also need to spoof the WPA 4-way handshake or use a tool like aircrack-ng to deauthenticate a victim device.
Sponsored
Meet the humans behind the attacks. Hear real stories from CISOs who faced a cyber crisis including how they navigated the chaos, made tough calls, and built resilient teams. Learn what they did right (and wrong). Listen on Spotify [12] / Apple [13] / Youtube [14], or explore additional resources on Veeam's _be: Ready_ hub [15].
Portal26 provides organizations with a platform to monitor, analyze, secure, and optimize generative AI use by benchmarking usage, enforcing security policies, preventing data leaks, and scoring based on risk and ROI.
Wazuh is a free and open source platform used for threat prevention, detection, and response. It is capable of protecting workloads across on-premises, virtualized, containerized, and cloud-based environments.
Metis is an AI-driven tool for deep security code review created by Arm's Product Security Team.
Anthropic reported a major AI-driven cyber espionage attempt using Claude AI, claiming it automated 90% of hacking steps for suspected Chinese attackers. However, outside experts challenge this view, saying such full automation is exaggerated, as most attacks were not successful, and the AI often fabricated results.
Google's use of Rust in Android has led to a 1,000x reduction in memory safety vulnerabilities compared to C/C++, while also accelerating software delivery. Rust's adoption means fewer code reviews, reworks, and rollbacks, making it now integral to Android's kernel, firmware, and apps, delivering greater safety and efficiency, even as rare bugs are quickly fixed without undermining overall security benefits.
Five individuals pleaded guilty to facilitating North Korean IT worker infiltration schemes that compromised 136 US companies and generated over $2.2 million for the DPRK regime through stolen and false identities. The operation involved identity theft from 18 US persons, salary funneling to North Korea, and data exfiltration. Meanwhile, the DOJ separately moved to seize $15 million in cryptocurrency stolen by APT38/Lazarus from four 2023 exchange heists totaling $382 million. Organizations should strengthen identity verification for remote workers, implement behavioral analytics to detect credential sharing or anomalous access patterns, and monitor for data exfiltration to foreign adversary infrastructure.
Microsoft's first Windows 10 Extended Security Update (KB5068781) is failing to install with error 0x800f0922 on devices using Windows subscription activation through Microsoft 365 Admin Center.
Cracker Barrel's updated company rewards were exposed by simply altering the authentication logic in a ReactJS app.
Sponsored
“Thought leaders” are confident about non-human identities, but can they predict what this landscape will look like in 12 months? Not reliably...
Chinese state-sponsored actors jailbroke Anthropic's Claude Code tool by disguising malicious tasks as legitimate defensive security work, achieving the first documented fully autonomous AI-driven cyber operation where the AI handled 80-90% of tactical work. The campaign targeted approximately 30 organizations globally across tech, finance, chemical manufacturing, and government sectors, achieving successful intrusions in roughly four cases before Anthropic banned the accounts. Security teams must now deploy AI-powered defensive capabilities to detect threats more quickly and counter the new paradigm of automated offensive operations.
DoorDash disclosed a data breach orchestrated by an unauthorized third party that accessed internal data through the social engineering of an employee. The breached data includes first and last names, physical and email addresses, and phone numbers. Some victims have expressed outrage over the wording of the notice and the delay in notification.
Logitech confirmed that it suffered a data breach due to a zero-day flaw after the Clop ransomware group added it to its list of victims. The company stated that the data may include limited information on employees, consumers, customers, and suppliers, but the databases did not contain financial information or IDs.
Fortinet FortiWeb appliances are being actively exploited via CVE-2025-64446, a pre-auth RCE chain combining path traversal and authentication bypass that allows attackers to reach privileged CGI functions and impersonate users by crafting a base64-encoded CGIINFO header containing admin credentials. The vulnerability was silently patched in version 8.0.2 and affects multiple FortiWeb versions. It enables complete appliance compromise through administrative account creation. WatchTowr released a detection tool on GitHub to identify vulnerable hosts.
Leveraging AI as a complement to a traditional SAST can significantly improve results by using RAG to inject context on specific vulnerability classes. AI and SAST solutions can be leveraged using prompt-and-code, prompt-and-agent, or tailored-prompt-and-SAST-result methods. This post examines ZeroPath as an example of an agent, code graph, and SAST MCP.
Creating deserialization gadgets for .NET by hand requires understanding the structure of .NET serialization streams, which are composed of sequential records that define objects and references. By breaking down these records, including headers, class information, member types, and values, it becomes possible to craft custom gadget chains directly in code, without relying on pre-generated payloads or Windows-only tools. The approach presented demonstrates how to reconstruct objects, assign values, and embed complex references, providing insight into the safe and dynamic generation of deserialization payloads.
Sponsored
Today's attackers aren't breaking in. They're logging in. This Persona eBook [13] explains how today's evolving threat landscape is changing the game for enterprise security teams — and how identity verification is the new layer of defense against GenAI-powered fraud.
NoMoreStealer is a Windows kernel minifilter driver that intercepts file system operations and blocks untrusted processes from accessing specific protected paths.
Spydi's ThreatIntel Feed is a comprehensive threat intelligence platform that aggregates, curates, and maintains high-quality blocklists for malicious IPs and domains. The system combines data from multiple OSINT sources, honeypot networks, and threat intelligence feeds to provide actionable security data.
Daylight is an AI-powered Managed Detection and Response (MDR) platform that offers autonomous cyber threat hunting, analysis, and containment.
Attackers are impersonating legitimate recruiters via LinkedIn and email, luring victims with fake job interviews that redirect to malicious sites hosting RMM tools disguised as meeting software updates. The phishing campaign uses social engineering tactics, including spoofed recruiter names from real companies, Gmail sender addresses instead of corporate domains, and shortened URL redirects to phishing infrastructure. Security teams should alert users to verify unsolicited recruitment contacts independently, scrutinize sender domains and meeting URLs, and block known malicious RMM tool distributions through endpoint security controls.
AdGuard DNS received threatening demands from “Web Abuse Association Defense” (WAAD) to block Archive.today for allegedly hosting CSAM, but investigation revealed WAAD was registered in February 2025 with hidden ownership, minimal online presence, and suspicious bailiff reports created chiefly in August 2025 despite claims dating to 2023. Archive.today promptly removed flagged content and stated it never received prior notifications, suggesting a coordinated campaign of fraudulent complaints targeting the archival service through French LCEN law. AdGuard is filing criminal complaints with the French police for false reporting (punishable by up to 1 year in prison and a €15,000 fine), noting the suspicious timing of the FBI's investigation into Archive.today and potential impersonation of a real lawyer in similar complaints.
Google has announced that it will begin flagging apps on the Google Play Store that pass a defined bad behavior threshold. The Android vitals system will track partial wake locks, the cumulative time the app spends with background work while the screen is off, and prevent the device from entering sleep mode. Flagged apps will have a warning on their Play Store page and be excluded from prominent discovery surfaces such as recommendations.
Hyundai requires a $60/week NASTF subscription and $2,000 interface tool restricted to “service professionals” to retract electronic parking brakes for DIY brake pad replacement, forcing owners to use workarounds like Harbor Freight's T7 scan tool that trigger error codes.
Authorities from nine countries coordinated by Europol dismantled three major cybercrime operations: Rhadamantys infostealer, Elysium botnet, and VenomRAT.
The Akira ransomware group has amassed over $244 million since March 2023 by targeting organizations worldwide, particularly those utilizing VMware ESXi servers.
Sponsored
Weak and compromised passwords are the #1 cause of breaches, and they leave IT teams struggling with fragmented access management and manual onboarding/offboarding processes. Reddit was dealing with all these challenges and more. They needed a solution that reduced credential risk without slowing down their employees.
Cybersecurity researchers uncovered a massive spam campaign flooding npm with over 67,000 fake packages dubbed "IndonesianFoods." The worm-like attack, active since early 2024, exploits dormant JavaScript files requiring manual execution to bypass security scanners. Attackers likely monetize the campaign through the Tea protocol by artificially inflating impact scores to earn cryptocurrency tokens, while creating a self-replicating network that strains registry infrastructure and pollutes search results.
The Cl0p ransomware group claimed the NHS UK as a victim on November 11, days after breaching The Washington Post by exploiting CVE-2025-61882, a critical remote code execution vulnerability (CVSS 9.8) in Oracle E-Business Suite versions 12.2.3-12.2.14. The vulnerability was exploited beginning August 2025 before Oracle's October 4 emergency patch, with attacks accelerating after Scattered Lapsus$ Hunters leaked proof-of-concept code on October 3, enabling Cl0p and FIN11 to conduct synchronized data-exfiltration campaigns against hundreds of organizations. Organizations running Oracle EBS must immediately apply the October 2025 patch, conduct forensic reviews dating back to August, and monitor for connections to suspicious IP addresses 200.107.207.26 and 185.181.60.11.