Search the archive

DATA LEAK EXPOSES CHINESE STATE-SPONSORED CYBER ARSENAL AND TARGET DATABASE

Threat actors have stolen a massive amount of data from the Chinese cybersecurity firm Knownsec. The breach includes specifications for cyber weapons, source code for proprietary hacking tools, operational details of government collaborations, and an extensive list of foreign surveillance targets. A spreadsheet within the breach details 80 overseas targets allegedly compromised by Knownsec operatives.

IMPROPER AUTHENTICATION HANDLING IN THE AMAZON WORKSPACES CLIENT FOR LINUX

Amazon identified a vulnerability in the Amazon WorkSpaces client for Linux. Under specialized circumstances, an attacker may be able to extract a valid authentication token from the client's machine and access another user's Workspace. The impacted client versions have reached end-of-support. Customers are encouraged to upgrade to a supported version.

NEARLY 30 ALLEGED VICTIMS OF ORACLE EBS HACK NAMED ON CL0P RANSOMWARE SITE

Nearly 30 organizations, including major firms such as Logitech, The Washington Post, and Cox Enterprises, were allegedly impacted by a Cl0p ransomware campaign that exploited Oracle's E-Business Suite. Some, such as Harvard and The Washington Post, have confirmed involvement, but most have not commented on the matter.

CISOS MUST PROVE THE BUSINESS VALUE OF CYBER — THE RIGHT METRICS CAN HELP

CISOs struggle to demonstrate the value of security because they often rely on technical metrics, such as MITRE ATT&CK and patch statistics, rather than business-focused measures. Boards are fatigued from unclear capital allocation and lack visibility into how cybersecurity investments lower risk. Experts advise establishing enterprise risk management, calculating financial exposure in dollars, and presenting understandable metrics like industry benchmarks, risk reduction, and ROI. CISOs should align security with business goals by consulting departments, translating cyber risks into financial terms, and showing measurable risk reduction, such as a 40% decrease in cyber loss exposure.

ATT&CK V18: THE DETECTION OVERHAUL YOU'VE BEEN WAITING FOR

MITRE ATT&CK v18 introduces two new components, Detection Strategies and Analytics, replacing brief detection notes with detailed, behavior-based guidance that connects techniques to platform-specific analytics, log sources, and data elements. The enterprise domain introduces 13 new techniques, covering Kubernetes, CI/CD pipeline tampering, cloud databases, and ransomware preparation activities, including backup software detection and selective file exclusion, as well as adversary monitoring of their own threat intelligence. The framework suggests splitting the Defense Evasion tactic into Stealth (altering defender visibility) and Impair Defenses (disrupting security controls), while launching an ATT&CK Advisory Council for formal community input and establishing faster CTI releases independent of biannual framework updates.

IMPLEMENTING THE ETHERHIDING TECHNIQUE

Etherhiding is a technique used by attackers to distribute malware using public blockchains, specifically Ethereum. It works by hiding critical information, such as payloads or configuration data, within blockchain smart contracts, making them accessible while making them difficult to take down or block. This hands-on demo shows how to build a simple Ethereum smart contract using Solidity, deploy it to the Sepolia test network via MetaMask, and create a web page that retrieves and displays the hidden information from the blockchain using Infura RPC.

NAKIVO INTRODUCES V11.1 WITH UPGRADED DISASTER RECOVERY AND MSP FEATURES

NAKIVO Backup & Replication v11.1 offers enhanced features, including real-time VMware replication with automated failover via Site Recovery workflows, eliminating manual setup through automatic IO Filter and Journal Service installation. It broadens Proxmox VE support with Flash VM Boot for instant recovery, VM replication, and direct tape recovery, while MSP Direct Connect enables secure, encrypted client-side connectivity supporting VMware, Hyper-V, and Proxmox VE. Additionally, the update introduces granular backup options for physical Windows and Linux systems, allowing selective folder and volume protection with flexible recovery methods such as SMB/NFS shares, all featuring encryption, immutability, and air-gapping for ransomware defense.

MAD-CAT

MAD-CAT (Meow Attack Data Corruption Automation Tool) is a security testing program designed to simulate data corruption attacks on six database platforms: MongoDB, Elasticsearch, Cassandra, Redis, CouchDB, and Hadoop HDFS. It allows for both single-target tests and bulk CSV attack campaigns, with options for scenarios that include credentials or not. This enables security teams to evaluate how well their databases can withstand corruption threats. Security experts can utilize MAD-CAT to examine data integrity measures and verify backup and recovery processes across various database setups within their systems.

ONLYSHELL

OnlyShell is a powerful Go-based reverse shell handler that allows you to manage multiple reverse shell connections simultaneously.

RUSSIAN NATIONAL PLEADS GUILTY TO BREAKING INTO NETWORKS FOR YANLUOWANG RANSOMWARE ATTACKS

Aleksei Olegovich Volkov (aka "chubaka.kor") pleaded guilty to serving as an initial access broker for Yanluowang ransomware, attacking seven US businesses between July 2021 and November 2022, with total ransom demands reaching $24 million. FBI blockchain analysis traced cryptocurrency payments to accounts owned by Volkov and a co-conspirator in Indianapolis, confirming his identity and communications about attack coordination and profit-sharing. Volkov faces up to 53 years in prison and must pay $9.2 million in restitution. Victims experienced operational shutdowns, data encryption, executive harassment calls, and DDoS attacks following initial compromise through vulnerability exploitation.

WHY A LOT OF PEOPLE ARE GETTING HACKED WITH GOVERNMENT SPYWARE

The reach of government spyware now extends far beyond its original promise of targeting only criminals and terrorists. Increasingly, journalists, activists, and minor political figures around the world are being surveilled, enabled by vendors whose scalable technology and weak oversight make widespread abuse easy. Governments, both democratic and authoritarian, face little accountability or limitation, although international moves and investigations may finally be prompting some overdue scrutiny and action.

NEW BROWSER SECURITY REPORT REVEALS EMERGING THREATS FOR ENTERPRISES

Emerging enterprise threats increasingly concentrate in the user's browser. Unmanaged AI tools, browser extensions, and non-corporate logins are key risks, as traditional security solutions can't see or manage what happens in browser sessions, enabling sensitive data exposure. Set up session-native controls and browser-level monitoring to close these critical security gaps and prevent breaches.

CBP ROLLS OUT FACIAL RECOGNITION APP FOR LOCAL POLICE TO SPOT ILLEGAL IMMIGRANTS

US Customs and Border Protection deployed Mobile Identify (listed as "287 TFM" on Google Play Store), a facial recognition app enabling 555 local law enforcement agencies across 34 states participating in Section 287(g) programs to identify immigration status by scanning faces, returning reference numbers requiring ICE contact rather than direct personal information, with captured photos stored for 15 years even for US citizens.

FBI WANTS TO KNOW WHO RUNS ARCHIVE.PH

The FBI issued a federal subpoena to domain registrar Tucows demanding extensive billing records, internet session logs, payment information, and cloud computing service details to unmask the anonymous operator behind archive.today (Archive.is and Archive.ph), a web archiving service operational since 2012 that's commonly used to bypass news paywalls, though the subpoena does not specify what crime is being investigated.

YOU'LL NEVER GUESS THE LOUVRE'S ONETIME CCTV PASSWORD. (YOU ABSOLUTELY WILL)

The French court criticized the Louvre for prioritizing art spending over security, exposing long-known weaknesses, including easy-to-guess passwords (such as "LOUVRE") and a lack of CCTV, which enabled a major jewelry heist.

US CONGRESSIONAL BUDGET OFFICE HIT BY SUSPECTED FOREIGN CYBERATTACK

The US Congressional Budget Office (CBO) confirmed that it had suffered a cyberattack after detecting unauthorized access to its networks. Officials who discovered the breach are concerned that emails between CBO and congressional offices may have been exposed. A foreign actor is suspected.

DANGEROUS RUNC FLAWS COULD ALLOW HACKERS TO ESCAPE DOCKER CONTAINERS

Three critical vulnerabilities (CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881) in the runC container runtime used by Docker and Kubernetes allow attackers to exploit symlink races and bind-mount redirections to gain root-level write access to the host system, bypassing container isolation by manipulating /dev/null, /dev/console, and /proc filesystem mounts during container initialization. The flaws affect all runC versions for CVE-2025-31133 and CVE-2025-52881, while CVE-2025-52565 impacts versions 1.0.0-rc3 and later, with patches available in runC versions 1.2.8, 1.3.3, 1.4.0-rc.3 and above. Security teams should immediately update to patched runC versions, enable user namespaces without mapping host root into containers, implement rootless containers where possible, and monitor for suspicious symlink behaviors that could indicate exploitation attempts.

NEW LANDFALL SPYWARE EXPLOITED SAMSUNG ZERO-DAY VIA WHATSAPP MESSAGES

A threat actor exploited CVE-2025-21042, a critical out-of-bounds write zero-day in Samsung's libimagecodec.quram.so library, to deploy LandFall spyware via malicious .DNG images sent through WhatsApp to Samsung Galaxy users (S22, S23, S24, Z Fold 4, and Z Flip 4) in the Middle East from July 2024 until Samsung patched it in April 2025. The spyware delivered a malformed DNG file with an embedded ZIP archive containing a loader and SELinux policy manipulator, enabling extensive spying such as microphone/call recording, location tracking, and access to photos, contacts, SMS, call logs, files, and browsing history while maintaining persistence and evading detection. Security professionals should ensure devices are updated with April 2025 patches, disable automatic media downloads, enable Android's Advanced Protection or iOS Lockdown Mode for high-risk users, and monitor for similar DNG exploitation patterns, given recent trends of commercial spyware leveraging image vulnerabilities.

BYPASSING ENROLLMENT RESTRICTIONS TO BREAK BYOD BARRIERS IN INTUNE

Administrators can configure Intune to block bring your own device (BYOD) enrollment using the device enrollment restriction, which can prevent attackers from enrolling rogue devices after stealing login credentials. If personal devices are allowed for other operating systems (such as Android), attackers can send the Entra join request as that OS and then check in and complete enrollment as Windows. Otherwise, attackers can manipulate the check in XML to mock a device ID or mock Azure Virtual Desktop.

FROM KEY SPRAWL TO SCALABLE CONTROL: RETHINKING SSH ACCESS

Static SSH keys can present security issues if they are not rotated often enough or shared between teams or with external contractors, and can also add to management overhead. SSH certificates present a more modern alternative in which users present their public key to a centralized CA, which signs a certificate based on it, which can be used for a time limited authentication. This article presents an implementation of SSH certificates using Hashicorp Vault and Boundary.

BUILDING SECURITY IN OPEN SOURCE FOR FINANCIAL SERVICES: OPENSSF AT OPEN SOURCE FINANCE FORUM (OSFF) NYC

OpenSSF sponsored the Open Source in Finance Forum to address critical security challenges in financial services, where 80-90% of modern software supply chains rely on open source software, including 71% of AI components, highlighting emerging risks such as malware hidden in AI model weights, poisoned training data, and identity-based intrusions that now account for 30% of financial sector attacks. The organization is implementing proactive defense measures, including Model Signing v1.0 for AI integrity verification, MLSecOps frameworks for full AI lifecycle security, transparency tools like OpenSSF Scorecard, OSV, and GUAC, plus policy engagement across the US and EU to secure open source from development to deployment. Financial services security professionals should adopt OpenSSF's security frameworks and tools, implement model signing for AI components, establish MLSecOps practices throughout the AI lifecycle, and actively participate in cross-industry collaboration to address supply chain vulnerabilities while connecting maintainers with the organizations that depend on their work.

RESTRICTEDPYTHON

RestrictedPython is a tool that defines a subset of the Python language that allows for running untrusted code.

DESTROYLIST

An up-to-date blacklist of phishing and scam domains, automatically updated by the PhishDestroy system. A reliable threat intelligence source for integration into security systems.

MY AWS ACCOUNT GOT HACKED - HERE IS WHAT HAPPENED

A cloud architect discovered that their personal AWS account was breached when they received a DKIM verification email. They then removed the attacker's access and found that the attacker had created four IAM accounts for backdoor access, launched a large EC2 instance (possibly for cryptomining), created an AWS Organization and a new account, and used Resource Explorer to search for additional access. The post walks the reader through the author's full process, from discovery to incident response to root cause analysis.

WHAT MAKES RANSOMWARE GROUPS SUCCESSFUL?

Ransomware gangs thrive through automation, customization, and advanced tools, rapidly evolving their tactics to outpace defenders. AI accelerates attacks and facilitates phishing, while tailored ransomware operations employ strong encryption and sophisticated extortion tactics. These groups operate like efficient SaaS enterprises, and the recommendation is to focus on defense against attacker techniques and fast, automated responses.

RANSOMVIBING APPEARS IN VS CODE EXTENSIONS

A ransomware-infected VS Code extension, "susvsex," was found on the Visual Studio Marketplace. It utilizes GitHub for command and control, encrypts files, and uploads them for extortion, but its malicious intent was clearly evident. Due to poor coding and a hardcoded decryption key, its threat is currently low. The incident highlights gaps in extension security.

fastest-growing companies. Meet Iru

MICROSOFT UNCOVERS 'WHISPER LEAK' ATTACK THAT IDENTIFIES AI CHAT TOPICS IN ENCRYPTED TRAFFIC

Microsoft has revealed a new attack, called Whisper Leak, that enables attackers to infer the topics of AI chat conversations by analyzing encrypted network traffic patterns, even without accessing the actual data.

QNAP FIXES SEVEN ZERO-DAY FLAWS EXPLOITED AT PWN2OWN

QNAP has released fixes for seven zero-day vulnerabilities discovered by Pwn2Own Ireland researchers in its QTS, QuTS Hero, Hyper Data Protector, Malware Remover, and HBS 3 Hybrid Backup Sync software.

18 ARRESTED IN CRACKDOWN ON CREDIT CARD FRAUD RINGS

Authorities across Europe detained 18 people accused of orchestrating extensive credit card fraud and money laundering networks.

has had on security and efficiency.

Register now

HYUNDAI AUTOEVER AMERICA DATA BREACH EXPOSES SSNS, DRIVERS LICENSES

Hyundai AutoEver America, which provides IT services for Hyundai and Kia affiliates, reported a data breach. The breached data includes names, SSNs, and driver's licenses. The disclosure did not state whether the breach only included employee data or also included customer data.

MALICIOUS ANDROID APPS ON GOOGLE PLAY DOWNLOADED 42M TIMES

Researchers from Zscaler report that an estimated 239 malicious apps were downloaded 42 million times from the Google Play Store between June 2024 and May 2025. Zscaler noted a 67% year-over-year growth in malware targeting mobile devices during this period. Zscaler has identified three malware families that had a notable impact on Android users: the Asta banking trojan, the Android Void Android TV backdoor, and the Xnotice RAT.

400,000 WORDPRESS SITES AFFECTED BY ACCOUNT TAKEOVER VULNERABILITY IN POST SMTP WORDPRESS PLUGIN

Over 400,000 WordPress sites are at risk due to a severe vulnerability in the Post SMTP plugin, which allows hackers to view password reset emails and potentially take over accounts. Exploitation is already underway. Users must urgently update to version 3.6.1 to prevent their site from being compromised.

CREDENTIALS AND MISCONFIGURATIONS BEHIND MOST CLOUD BREACHES, SAYS AWS

The 'Building Cloud Trust" report by AWS and Vanson Bourne surveyed 2,800 organizations across 13 countries, revealing that about 80% experienced data breaches in the past year, with common attack vectors including vulnerability exploitation, compromised credentials, misconfigurations, and physical theft. Attackers are increasingly using stolen credentials through methods like VPN/VDI abuse, AI-enabled phishing, and legitimate tool exploitation, with a predicted shift toward targeting non-human identities protected by single-factor authentication. To combat these threats, security teams should focus on cloud security posture management, adopt phishing-resistant MFA, enforce least privilege access, and prioritize patching internet-facing infrastructure, while acknowledging human error as a primary cause.

BREAKING INTO GITLAB: ATTACKING AND DEFENDING SELF-HOSTED CI/CD ENVIRONMENTS

Attackers can abuse globally scoped GitLab instance runners to execute arbitrary code and pivot into cloud environments if runners are configured with shell executors and attached IAM roles. Once a runner is compromised, the attackers can scrape build artifacts and environment files to steal secrets, SSH keys, or cloud credentials. Strategic defense centers on eliminating global runners, enforcing containerized job isolation, tightening IAM role scoping, and restricting access to the GitLab instance to reduce blast radius.

WINDOWS INTERNALS: SECURE CALLS - THE BRIDGE BETWEEN THE NT KERNEL AND SECURE KERNEL

Secure Calls are a mechanism in Windows that allows the “regular” (NT) kernel, residing in virtual trust level (VTL) 0, to communicate with the secure kernel (SK) operating in VTL 1. Secure calls are implemented as a hypercall with the hypervisor brokering the connection. In this post, the author reverse-engineers the secure call process and structure and introduces a tool for making secure calls with user-supplied arguments.

CURL-IMPERSONATE

curl-impersonate is a special build of curl that can impersonate Chrome, Edge, Safari, and Firefox.

UNDELETE

This tool recovers deleted NPM packages by querying five registries (npmjs.org, cnpmjs.org, npmmirror.com, huaweicloud.com, and tencent.com) to download 1-20 recent versions with metadata, including usernames, emails, and maintainer information, utilizing auto-retries and security filtering. Security researchers can retrieve discontinued malicious packages for malware analysis and threat intelligence. Features include custom output, silent mode with JSON, and no external dependencies, making deployment easy. Teams use this for post-incident recovery, building malware collections, and investigating suspicious packages that have been quickly removed from NPM.

MALANTA (PRODUCT LAUNCH)

Malanta is a cybersecurity startup that utilizes AI to detect digital traces left by attackers during their attack setup, forecasting, and dismantling malicious infrastructure before attacks occur. Its technology provides warning in advance and proactive defense for clients.

HOW THE F5 BREACH, CISA JOB CUTS, AND A GOVERNMENT SHUTDOWN ARE ERODING US CYBER READINESS

A China-linked breach of F5's BIG-IP software exposed source code and undisclosed vulnerabilities, creating a path for custom exploits against critical infrastructure and government networks. At the same time, significant workforce cuts at CISA and a federal shutdown are degrading incident response capacity, election protection efforts, and national coordination. Security teams should assume reduced federal support and prioritize proactive hardening, continuous monitoring, and supply chain risk management across high-impact edge and network devices.

CYBERSOCEVAL: BENCHMARKING LLMS CAPABILITIES FOR MALWARE ANALYSIS AND THREAT INTELLIGENCE REASONING

Researchers from Meta and CrowdStrike introduced the open-source CyberSOCEval benchmark to assess large language models (LLMs) on two critical SOC tasks: malware analysis and threat intelligence reasoning. Technical findings show that current models score only ~15-28% on malware analysis and 43-53% on threat-intelligence reasoning, highlighting significant gaps in interpreting JSON logs, mapping attack chains to MITRE ATT&CK, and reasoning about multi-hop adversaries. Security teams should be cautious about off-the-shelf LLM reliance, instead using these benchmarks to validate models, augment human analysts rather than replace them, and prioritize training with domain-specific cyber data.