Search the archive

HAVE I BEEN PWNED DEMOS ARE NOW LIVE

Troy Hunt has launched a new series of demos exploring different features of the Have I Been Pwned platform. The first demo covers domain searches.

SPEARSPRAY

SprearSpray is an advanced password spraying tool for Active Directory environments. It combines LDAP user enumeration with pattern-based password generation.

DISRUPTION AT EUROPEAN AIRPORTS EXPECTED TO CONTINUE THROUGH SUNDAY

A cyberattack on Collins Aerospace's check-in and boarding systems disrupted operations at major European airports, including Heathrow, Brussels, and Berlin, forcing airports to rely on manual check-in procedures and causing flight delays and cancellations that continued into Sunday. Brussels Airport asked airlines to cancel half of their Sunday departing flights to mitigate disruptions. 29 total departures and arrivals were cancelled across the three main affected airports. The European Commission confirmed the incident is under investigation, though officials stated there's no evidence of a widespread or severe attack.

CHINESE NETWORK SELLING THOUSANDS OF FAKE US AND CANADIAN IDS

CloudSEK exposed a China-based operation called “ForgeCraft” that sold over 6,500 counterfeit US and Canadian driver's licenses and Social Security cards to more than 4,500 buyers, generating over $785,000 in revenue through 83 websites and using covert packaging methods to ship fake IDs hidden in everyday items. The sophisticated fake documents feature scannable barcodes, holograms, and UV markings and pose national security risks by enabling financial fraud, bypassing border checks, and potentially facilitating voter fraud. CloudSEK researchers identified the main operator's location in Xiamen, China, and shared evidence with authorities to disrupt the operation.

expectations. Earn up to 6 CPE credits. Save your spot (free)

UK POLICE ARRESTED TWO TEEN SCATTERED SPIDER MEMBERS LINKED TO THE 2024 ATTACK ON TRANSPORT FOR LONDON

UK police arrested two teenagers, Thalha Jubair (19) and Owen Flowers (18), both members of the Scattered Spider hacking group, for their role in the August 2024 cyberattack on Transport for London that caused significant disruption and millions in losses to the UK's critical national infrastructure.

CISA EXPOSES MALWARE KITS DEPLOYED IN IVANTI EPMM ATTACKS

CISA has published an analysis of malware deployed in attacks exploiting Ivanti Endpoint Manager Mobile (EPMM) vulnerabilities.

CANADA DISMANTLES TRADEOGRE EXCHANGE, SEIZES $40 MILLION IN CRYPTO

Canadian authorities executed their largest cryptocurrency seizure in history, confiscating C$56 million ($40 million) from the unregistered TradeOgre exchange after a year-long investigation initiated by a Europol tip.

Manager by G2 + CNET. Try Bitwarden for Business, free

SYSTEMBC MALWARE TURNS INFECTED VPS SYSTEMS INTO PROXY HIGHWAY

SystemBC is a proxy botnet providing a highway for malicious traffic, with an average of 1,500 bots/day. It primarily recruits bots by compromising VPS systems with at least one vulnerability, making up over 80% of the bots. Some customers of SystemBC include REM Proxy, a Russian web-scraping service, and a Vietnamese-based proxy network.

NEARLY 250,000 IMPACTED BY DATA BREACH AT MEDICAL ASSOCIATES OF BREVARD

Medical Associates of Brevard in Florida revealed that a data breach in January affected almost 247,000 patients and exposed sensitive health and personal data. The BianLian ransomware group claimed responsibility for stealing information like emails and HR documents, but it remains unclear how the stolen data has been used.

INSIGHT PARTNERS: RANSOMWARE HIT EXPOSED DATA ON 12K PEOPLE

Venture firm Insight Partners suffered a ransomware attack that exposed data of over 12,000 staff and investors. The breach began in October 2024, leading to data encryption in January before being detected. The stolen data includes personal, banking, and tax details.

DETECT SECRETS IN GITLAB CI LOGS USING GGSHIELD AND BRING YOUR OWN SOURCE

GitGuardian demonstrates how to automatically scan GitLab CI/CD pipeline logs for secrets using ggshield and their Bring Your Own Source initiative, addressing a critical but often overlooked attack vector where sensitive data like environment variables, API responses, and temporary credentials are exposed in build logs. The solution involves creating a custom Docker image with enhanced ggshield capabilities, configuring secure token storage via HashiCorp Vault, and implementing an automated scanning script that processes all pipeline job logs and creates incidents in the GitGuardian dashboard. This approach provides comprehensive secrets detection across the entire DevOps lifecycle, catching runtime secrets that traditional source code scanning misses while maintaining zero friction for developers.

AWS AGENTCORE: THE OVERLOOKED PRIVILEGE ESCALATION PATH IN BEDROCK'S AI TOOLING

AWS Bedrock AgentCore is a collection of tools that assist in deploying and scaling AI agents. AgentCore provides the ability to launch Code Interpreters, which run code in a sandboxed environment and can be customized to have access to AWS credentials to perform actions on AWS resources. Custom Code Interpreters cannot be protected with resource policies and only emit CloudTrail data events, presenting a tempting privilege escalation vector for attackers.

LATERAL MOVEMENT - BITLOCKER

BitLocker is a full disk encryption feature for Windows that protects data at rest by encrypting full volumes. This post outlines a privilege escalation or lateral movement technique that uses Windows Management Instrumentation (WMI) to hijack specific COM objects of BitLocker using remote manipulation of BitLocker registry keys to execute code under the user's context on a target host. The post also discusses detection opportunities for this attack and Sigma and Windows Defender for Endpoint queries to detect them.

YASA

YASA (Yet Another Static Analyzer) is an open-source static program analysis project. Its core innovation lies in a unified intermediate representation called the Unified Abstract Syntax Tree (UAST), designed to support multiple programming languages. Built on top of UAST, YASA provides a highly accurate static analysis framework. Users can extend its capabilities by writing custom checkers to perform various program analysis tasks—such as AST queries, data flow analysis, and function call graph analysis—and expose functionality through SDK, declarative query language (QL), or MCP.

PYARMOR

Pyarmor is a command-line tool designed for obfuscating Python scripts, binding obfuscated scripts to specific machines, and setting expiration dates for obfuscated scripts.

INBOXFUSCATION

Inboxfuscation is an advanced inbox rule obfuscation framework for Microsoft Exchange environments. The tool provides sophisticated Unicode-based obfuscation techniques to create stealthy inbox rules that can evade basic detection while maintaining functionality.

CHECK POINT ACQUIRES LAKERA TO BUILD A UNIFIED AI SECURITY STACK

Check Point has announced plans to acquire AI security platform Lakera in Q4 2025 to strengthen enterprise defenses against emerging AI threats like prompt injection attacks, data leaks through LLMs, and model manipulation as organizations rapidly adopt generative AI and autonomous agents. Lakera's AI-native runtime protection technology boasts 98% detection rates with sub-50ms latency and less than 0.5% false positives, addressing gaps that traditional cybersecurity tools cannot handle in real-time AI environments.

WATCHGUARD WARNS OF CRITICAL VULNERABILITY IN FIREBOX FIREWALLS

WatchGuard has released security updates to address a critical (CVSS 9.3) remote code execution vulnerability impacting its Firebox firewalls. The vulnerability is caused by an out-of-bounds write on devices configured to use IKEv2 VPN. Devices that have deleted the vulnerable configuration but still have a branch office VPN to a static gateway peer configured may also be vulnerable.

MEET SHADOWLEAK: ‘IMPOSSIBLE TO DETECT' DATA THEFT USING AI

Researchers at Radware discovered a vulnerability called ShadowLeak that exploits OpenAI's ChatGPT through indirect prompt injection attacks. Hidden email instructions can trick the AI into stealing sensitive data like credit card numbers and names from users' inboxes. The attack bypasses ChatGPT's security protections by encoding stolen data in Base64 and exfiltrating it directly through OpenAI's servers via the agent's browsing tool, making it nearly impossible to detect since it doesn't go through the client interface. This attack represents a significant escalation from previous client-side prompt injection attacks, as the data theft occurs entirely on the backend without any visible signs to the user.

INSIDE THE 2025 SECURITY OPERATIONS REPORT: WHAT 330 TRILLION DATA POINTS REVEAL ABOUT MODERN CYBER RISK

Adversaries are accelerating their tactics, with over half of security alerts now occurring outside business hours.

TRUMP ADMIN SAYS SOCIAL SECURITY DATABASE WASN'T “LEAKED, HACKED, OR SHARED”

The Trump administration denied allegations by a whistleblower that Social Security data was moved to an insecure cloud system.

JAGUAR LAND ROVER TO PAUSE PRODUCTION FOR THIRD WEEK DUE TO CYBERATTACK

Jaguar Land Rover will extend its vehicle production shutdown into a third week following a cyberattack earlier this month.

works

Choose "none of the above" with ThreatLocker Patch Management.

Their Cyber Hero Team pre-tests every single update in a controlled environment [4]. You get the security benefits of up-to-date software, without the hassle. And you're always in control with Centralized management across all endpoints and policy based-deployment.

NEW VOIDPROXY PHISHING SERVICE BYPASSES MFA ON MICROSOFT AND GOOGLE ACCOUNTS

VoidProxy is a new Phishing-as-a-Service platform that uses Adversary-in-the-Middle attacks to bypass multi-factor authentication on Microsoft and Google accounts by intercepting login credentials and session cookies in real-time. The platform leverages compromised email accounts from legitimate providers like Constant Contact to evade spam filters, then redirects victims to perfect clones of login pages where all authentication data is stolen. VoidProxy operates with a sophisticated two-part infrastructure that features disposable front-ends and resilient back-ends, along with anti-analysis features including Cloudflare CAPTCHA protection, making it difficult for security teams to detect and track.

ETERNAL-TUX: CRAFTING A LINUX KERNEL KSMBD 0-CLICK RCE EXPLOIT FROM N-DAYS

A stable authenticated 0-click remote code execution exploit against Linux's kernel SMB3 daemon (ksmbd) chains two existing CVEs: CVE-2023-52440 for controlled heap overflow, and CVE-2023-4130 for memory leakage, targeting Linux 6.1.45 with full mitigations enabled. The exploit leverages NTLM authentication flaws to overflow a 512-byte SLUB allocation, then uses an arbitrary free primitive to corrupt a 1KB ksmbd_conn object and hijack a vtable pointer to achieve ROP-based code execution via call_usermodehelper. The technique demonstrates how N-day vulnerabilities can be chained together for reliable exploitation despite modern kernel protections, though it requires authenticated SMB access and is limited by the relative rarity of ksmbd deployments in production environments.

INSIDER BLAMED FOR FINWISE DATA BREACH AFFECTING NEARLY 700K

Nearly 700,000 FinWise Bank customers are being notified after a former employee may have accessed or taken personal data post-employment. The breach, detected over a year after it happened, involved customers from American First Finance. FinWise is offering affected individuals free credit monitoring. The case highlights ongoing risks posed by insider threats within financial and tech organizations.

OLD BUT GOLD, DUMPING LSASS WITH WINDOWS ERROR REPORTING ON MODERN WINDOWS 11

A red team researcher demonstrated how to bypass LSASS memory protections on Windows 11 by exploiting a vulnerable version of WerFaultSecure.exe from Windows 8.1, which runs with the highest Protected Process Light (PPL) level and can access protected LSASS memory that normal processes cannot touch. The technique uses undocumented parameters to trigger unencrypted crash dumps of the LSASS process, then disguises the output file with PNG magic headers to evade antivirus detection. The attack requires deploying the older vulnerable WerFaultSecure.exe binary alongside a custom loader that launches the tool with proper PPL protections, demonstrating how legacy Windows components can be weaponized against modern security controls.

HACKING THE XBOX 360 HYPERVISOR PART 1: SYSTEM OVERVIEW

This is the first part of a three-part series on hacking the Xbox 360 hypervisor. It provides a comprehensive system overview of the console's security architecture, including the custom Xenon PowerPC CPU with on-die security features like 768 eFuses, 64KB secure RAM, hardware encryption, and protected memory pathways that use per-boot encryption keys and CRC checksums. The hypervisor operates as a 256KB protected process that manages all executable memory allocation and code authentication, with only one known exploit in its history - the "4548 system call handler bug," which was likely caused by a compiler optimization error rather than intentional code changes. In the console's robust security model, where Microsoft must sign all code, hypervisor memory is protected with both encryption and integrity checks. The system uses multiple privilege levels with strict validation to prevent software-only hacks.

PLAYING WITH HTTP/2 CONNECT

HTTP/2 CONNECT is an upgrade over the original HTTP/1 CONNECT method, shifting from tunneling entire TCP connections to multiplexing multiple streams within a single connection. This evolution enables more efficient proxying and port scanning by allowing numerous tunnels without the overhead of opening many separate TCP sessions. The protocol's design incorporates features like HPACK header compression and support for modern proxy use cases—including WebSocket, UDP, and raw IP proxying—making it highly relevant for security research and next-generation proxy infrastructure.

private CTF

RAW DISK PARSER

Raw Disk Parser is a proof-of-concept Python script that dumps sensitive or restricted files without triggering alerts. It works by reading directly from the disk, then analyzing NTFS filesystem structures to find and read files. This method doesn't use standard Windows file APIs, so it effectively bypasses file access controls, locks, and some EDR/AV monitoring features that rely on hooking high-level file I/O operations.

SECURITY ONION 2.4

Security Onion is a free and open platform built by defenders for defenders. It includes features like network visibility, host visibility, intrusion detection honeypots, log management, and case management. In the latest 2.4 release, there are new features like SOC for UniFi dashboard, JA4 support, and many bugfixes.

GEORDIE (PRODUCT LAUNCH)

Geordie provides enterprises with real-time visibility and alerts for AI agents, helping organizations track agent actions, detect unexpected behaviors, and securely manage AI agent adoption and risks.

SCATTERED SPIDER RANSOMWARE GROUP ABRUPTLY DECIDES TO END OPERATIONS - FOR NOW, AT LEAST

Fifteen major ransomware gangs, including Scattered Spider, Lapsus, and Shiny Hunters, announced they are "going dark" after claiming they fulfilled their goals and will enjoy their earnings from recent attacks on companies like Jaguar Land Rover, Marks & Spencer, and Salesforce. They posted their farewell on BreachForums, saying they will stop attacking in their name. However, experts doubt this will be permanent, as some members have already been arrested, and the profits of cybercrime may lure them back. The announcement follows a summer campaign where the rebranded "Scattered Lapsus Hunters" targeted over 700 organizations worldwide, mainly through social engineering and data theft rather than ransomware.

FBI WARNS OF UNC6040, UNC6395 HACKERS STEALING SALESFORCE DATA

The FBI issued a FLASH alert about cybercriminal groups UNC6040 and UNC6395, which target Salesforce to steal data and extort through methods like voice phishing and OAuth token exploitation. UNC6040 has used social engineering since late 2024 to trick call center staff into connecting malicious apps to Salesforce, while UNC6395 exploited OAuth tokens in August to access customer data and credentials. Major companies such as Google, Adidas, Qantas, Cisco, Louis Vuitton, and Tiffany & Co. have been impacted. The threat actors are linked to ShinyHunters and Scattered Spider, who recently announced they are "going dark."

PROTON MAIL TAKES ACTION: JOURNALIST ACCOUNTS SUSPENDED FOLLOWING CYBERSECURITY AGENCY REQUEST

Proton Mail suspended two journalists' accounts after they published research documenting an intrusion into several South Korean government institutions in Phrack. It contacted the researchers via the disclosure account a week after the print release, notifying them that their account was being suspended, citing a policy violation due to a government cybersecurity organization. The company reversed its decision and restored the accounts following a public outcry over privacy.

production. DOWNLOAD TAG REPORT FROM INVICTI

SIDEWINDER APT LEVERAGES NEPAL PROTESTS TO PUSH MOBILE MALWARE

Hackers exploited Nepal protests by masquerading as emergency services and officials to trick people into downloading malware and stealing data.

FAIRMONT FEDERAL CREDIT UNION DATA BREACH HITS 187,000 IN WEST VIRGINIA

Fairmont Federal Credit Union has informed over 187,000 individuals about a security breach in 2023 that exposed sensitive information, including financial, medical, and personal data.

GOOGLE CONFIRMS HACKERS GAINED ACCESS TO LAW ENFORCEMENT PORTAL

Google confirmed hackers from the "Scattered Lapsus$ Hunters" group created a fraudulent account in its Law Enforcement Request System (LERS), used worldwide by police to submit data requests, though no requests were made and no data accessed before the account was disabled.