Search the archive

RITA

Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.

ATEAM

The Azure Tenant Enumeration and Attribution Module (ATEAM) is a reconnaissance tool that discovers Azure services and attributes tenant ownership based on their responses.

PYGHIDRA-MCP: HEADLESS GHIDRA MCP SERVER FOR PROJECT-WIDE, MULTI-BINARY ANALYSIS

pyghidra-mcp is a headless Model Context Protocol (MCP) server for Ghidra that enables LLMs to perform project-wide analysis across multiple interconnected binaries in a single session, moving beyond traditional single-file reverse engineering. The tool demonstrates ecosystem-aware analysis by tracing function calls across entire application stacks, such as following a file creation operation from notepad.exe through kernel32.dll to ntdll.dll and the Windows kernel. Built for automation and CI/CD integration, pyghidra-mcp leverages Ghidra's project management capabilities to expose entire software ecosystems for AI-powered reverse engineering workflows.

STORM-0501 DEBUTS A BRUTAL HYBRID RANSOMWARE ATTACK CHAIN

Storm-0501 has developed a sophisticated hybrid ransomware attack that exploits privileged accounts to move between on-premises and cloud environments, utilizing techniques such as DCSync attacks to gain domain control and leveraging federated domains as backdoors. The threat actor not only encrypts data, but also mass-deletes cloud resources, including backups, creating a "no-win situation" where organizations cannot recover without paying ransom. CISOs should implement least privilege access, audit on-premises environments for cloud migration opportunities, and regularly practice ransomware response playbooks to defend against this brutal attack chain.

MICROSOFT WORD WILL SAVE YOUR FILES TO THE CLOUD BY DEFAULT

Microsoft will start automatically saving any Word documents in OneDrive. Users will be able to change how new files are created in the Save page in the Word options. The feature was included in the latest Microsoft 365 Insiders Beta Channel update.

SKT HIT WITH $97M PENALTY FOR SECURITY LAPSES

South Korea fined SK Telecom 134.8 billion won ($97.2 million) after a SIM data breach exposed the personal data of all customers due to poor security and delayed reporting. The breach affected 23 million users, causing significant financial losses and a decline in SKT's profit and customer base. Authorities ordered audits and improvements as SKT invests heavily in new security systems.

RANSOMWARE CROOKS KNOCK SWEDISH MUNICIPALITIES OFFLINE FOR MEASLY SUM OF $168K

An attack on Miljödata, a key IT provider for most Swedish municipalities, disrupted HR and reporting systems for over 200 councils.

PASSWORDSTATE DEV URGES USERS TO PATCH AUTH BYPASS VULNERABILITY

There is a high-severity auth bypass in Passwordstate, used by 390K IT professionals, that allows attackers to exploit a malicious URL to access the admin area via the Emergency Access page.

GOOGLE PREVIEWS CYBER 'DISRUPTION UNIT' AS U.S. GOVERNMENT, INDUSTRY WEIGH GOING HEAVIER ON OFFENSE

Google plans to create a new cyber "disruption unit" focused on "legal and ethical disruption" of threat campaigns.

DATA I/O BECOMES LATEST RANSOMWARE ATTACK VICTIM

Data I/O, a tech manufacturer, suffered a ransomware attack on August 16 that led to major outages. The incident's impact remains unclear as the investigation is still underway, but restoration of operations has begun. Costs may be substantial.

FIRST AI-POWERED RANSOMWARE POC SPOTTED

PromptLock, the world's first known AI-powered ransomware, uses OpenAI's gpt-oss-20b model to generate malicious scripts. It is currently only a proof-of-concept and has not been seen in active attacks. PromptLock demonstrates how AI can simplify cybercriminal operations.

NX COMPROMISED TO STEAL WALLETS AND CREDENTIALS

The popular NX build system was compromised with malicious versions published to npm that steal cryptocurrency wallets, API keys, and credentials from at least 1,400 affected users. The malware creates repositories prefixed with "s1ngularity-repository" in victims' GitHub accounts. It uniquely leverages the Claude Code CLI or Gemini CLI to execute file system searches for sensitive data through AI prompts, making detection more challenging for traditional security tools. Users should immediately check for unauthorized repositories, update to version 21.4.1, and rotate all potentially compromised credentials, including GitHub tokens, npm keys, and SSH keys.

BEWARE THE FALSE FALSE-POSITIVE: HOW TO DISTINGUISH HTTP PIPELINING FROM REQUEST SMUGGLING

Sometimes, when people are hunting for HTTP request smuggling vulnerabilities, they actually run into false positives caused by connection reuse. Some scenarios where connection reuse may be necessary for finding vulnerabilities include situations where the frontend server only reuses the upstream connection if the client connection was reused, connection-state attacks, and client-side desync attacks. James Kettle created a Custom Action for Burp Suite called `Smuggling or pipelining?` to distinguish between a genuine HTTP smuggling attack and an HTTP pipelining false-positive.

BEHIND THE COINBASE BREACH: BRIBERY EMERGES AS ENTERPRISE THREAT

Threat actors like The Com and Scattered Spider bribed TaskUS workers in India with up to $2,500 to steal data from 70,000 Coinbase customers, resulting in a $20 million ransom demand that Coinbase refused, offering the same as a bounty. The breach revealed a shift from phishing to insider targeting through bribery, primarily targeting customer support staff with data access. Coinbase fired 226 workers, opened a US support hub, and enhanced controls. Experts advise red-team exercises to test employee responses to bribery attempts worldwide.

THE ONE WHERE WE JUST STEAL THE VULNERABILITIES (CRUSHFTP CVE-2025-54309)

A flaw (CVE-2025-54309) in CrushFTP servers allows attackers to gain administrative access if certain features are disabled. Researchers used a honeypot sensor network to catch hackers exploiting this race condition in real time and confirmed that two coordinated HTTP requests could add a rogue admin account. The vulnerability impacts thousands of vulnerable servers and is being exploited in the wild, highlighting the need for organisations to patch and monitor for unusual activity.

BRUTEFORCEAI

BruteForceAI is an advanced penetration testing tool that transforms traditional brute-force attacks by incorporating large language models for smart form analysis. The tool automatically detects login form selectors with AI and then performs complex multi-threaded attacks that mimic human behavior.

MERCATOR

Mercator is an open-source web application designed to manage the mapping of information systems, as described in ANSSI's "Mapping the Information System Guide".

REACH SECURITY (PRODUCT LAUNCH)

Reach Security employs virtual assistants in exposure management to automate drift detection, policy enforcement, and remediation. Its new ConfigIQ Drift module empowers customers to set custom deviation rules and baselines, all of which are managed centrally.

NEW SNI5GECT ATTACK CRASHES PHONES AND DOWNGRADES 5G TO 4G WITHOUT ROGUE BASE STATION

Sni5Gect is a framework that can downgrade 5G connections to vulnerable 4G, crash phone modems, and bypass authentication by passively sniffing unencrypted messages between base stations and phones during the initial connection phase before authentication. The attack achieves 80% sniffing accuracy and 70-90% message injection success rates from up to 20 meters away, exploiting the window before NAS security context establishment without requiring a rogue base station. Tests successfully targeted phones from OnePlus, Samsung, Google, and Huawei. The GSMA has acknowledged the vulnerability as

ANTHROPIC'S AUTO-CLICKING AI CHROME EXTENSION RAISES BROWSER-HIJACKING CONCERNS

Anthropic's new Claude for Chrome AI extension, now in limited preview, allows AI to control browser actions but poses significant security risks. Researchers found these AI agents are vulnerable to hidden, malicious website instructions, with attacks succeeding up to 23.6% of the time. Although new safety measures cut success rates, experts warn browser-integrated AI may be fundamentally unsafe for now.

‘VIBE-HACKING' IS NOW A TOP AI THREAT

Cybercriminals are misusing agentic AI systems, such as Claude, to power new types of cyberattacks. In one major case, a single actor utilized AI to extort data from 17 organizations by crafting targeted extortion demands and executing sophisticated attacks end-to-end, highlighting how AI enables complex threats with minimal resources.

UNPACKING THE 2025 GARTNER MARKET GUIDE FOR CNAPP

Gartner's 2025 CNAPP Market Guide highlights the industry shift from fragmented security tools to unified cloud-native application protection platforms that consolidate vulnerability management, compliance, and threat detection into single solutions.

CITRIX FIXES CRITICAL NETSCALER RCE FLAW EXPLOITED IN ZERO-DAY ATTACKS

Citrix urgently released a security update for a critical vulnerability in NetScaler ADC and Gateway, which hackers exploited as a zero-day to execute arbitrary code remotely, risking widespread network compromise.

TREASURY SANCTIONS NORTH KOREA IT WORKER SCHEME FACILITATORS AND FRONT ORGANIZATIONS

The U.S. Treasury sanctioned four entities for aiding North Korea's IT worker scheme, which places workers in U.S. jobs using fraudulent documents to evade sanctions and fund weapons programs.

Supersolution Every Business Can Afford_

ROWHAMMER ATTACK CAN BACKDOOR AI MODELS WITH ONE DEVASTATING BIT FLIP

ONEFLIP is a Rowhammer-based attack that can insert backdoors into AI models by flipping just a single bit in DRAM memory during inference. The attack targets vulnerable weights in the final classification layer of neural networks, allowing attackers to craft imperceptible trigger patterns that cause catastrophic misclassification (such as making self-driving cars misidentify stop signs as speed limit signs) while maintaining normal model accuracy for other inputs. It requires access to a white-box model and co-location on the target machine with DDR3/DDR4 memory, making it particularly concerning for multi-tenant cloud platforms and AI inference servers.

CISA WARNS OF ACTIVELY EXPLOITED GIT CODE EXECUTION FLAW

A new arbitrary code execution flaw in Git is being actively exploited. The vulnerability stems from Git mishandling carriage return characters in configuration files, which can lead to incorrect submodule path resolution. Attackers can exploit this vulnerability by publishing repositories with submodules that end in a carriage return (\r) and creating a crafted symlink with a malicious hook set up.

HEALTHCARE SERVICES GROUP DATA BREACH IMPACTS 624,000

A cyberattack on Healthcare Services Group exposed the personal data of over 624,000 people, including Social Security numbers and financial info, in late 2024. No identity theft has been reported, but victims have been offered free credit monitoring.

AGENTIC BROWSER SECURITY: INDIRECT PROMPT INJECTION IN PERPLEXITY COMET

An indirect prompt injection vulnerability in Perplexity Comet allows attackers to embed malicious instructions in webpage content, hijacking AI assistants and stealing sensitive data across authenticated sessions. The attack exploits Comet's inability to distinguish between user instructions and untrusted webpage content, allowing attackers to extract OTPs, access banking accounts, and perform unauthorized actions without the user's knowledge. Defenders should implement clear separation between user commands and webpage content, require explicit user confirmation for sensitive actions, and isolate agentic browsing from regular browsing sessions.

ENUMERATING AWS THE QUIET WAY: CLOUDTRAIL-FREE DISCOVERY WITH RESOURCE EXPLORER

DataDog discovered a now-patched enumeration technique for AWS that evades CloudTrail logging. AWS Resource Explorer is a service that provides a web-search-like interface for discovering resources in an account. The researchers found that the ListResources API call was previously categorized as a data event and, therefore, did not log to CloudTrail by default. AWS reclassified the call as a management event, which logs to CloudTrail by default, after DataDog alerted it to this technique.

TRACKING MALICIOUS CODE EXECUTION IN PYTHON

This article discusses techniques that cyber attackers use to hide malicious code execution in Python, focusing on the obfuscation of dangerous functions such as exec and eval. It explains how attackers bypass security tools using methods such as homoglyphs, built-in modules, variable reassignment, import tricks, and code obfuscation (e.g., with base64). The article introduces a static analysis library that detects these tricks, highlighting that tracking such abuses is challenging. It emphasizes the importance of combining automated analysis with human review for effective defense.

ULTIMATELSASSDUMPER

UltimateLsassDumper guides users through eight LSASS dumping techniques: Task Manager automation, rundll32-comsvcs minidump, MiniDumpWriteDump API, handle duplication, PssCaptureSnapshot, SilentProcessExit registry tweaks, and entire memory read using ReadProcessMemory. It explains methods with code examples, comparing benefits like avoiding child processes, disk writes, and detection. It also discusses modern mitigations such as LSA Protection (PPL) and Credential Guard (VBS/VTL), with bypass options via vulnerable drivers, PPL bypasses, and downgrades.

EVE

Eve is a Jamf exploitation toolkit used to interact with either cloud hosted or locally hosted Jamf Pro tenants using API calls.

SBOMQS

Sbomqs is a tool for evaluating SBOM quality, ensuring compliance, and managing your software supply chain security. From quality scoring to compliance validation, component analysis to vulnerability tracking - Sbomqs provides everything you need to work with SBOMs effectively.

WHY SIEM RULES FAIL AND HOW TO FIX THEM: INSIGHTS FROM 160 MILLION ATTACK SIMULATIONS

The Picus Blue Report 2025 analyzed 160 million attack simulations and found organizations detect only 1 out of 7 attacks, with 50% of failures attributed to log collection issues, including source coalescing, unavailable log sources, and network disruptions. Additional failure causes include rule misconfigurations (13%) and performance bottlenecks (24%) from resource-heavy rules and inefficient queries that overwhelm systems. Organizations must implement continuous validation through breach and attack simulation to test rules against evolving TTPs, optimize log collection pipelines, and tune detection thresholds to close critical security gaps.

BLISTERING WYDEN LETTER SEEKS REVIEW OF FEDERAL COURT CYBERSECURITY, CITING ‘INCOMPETENCE,' ‘NEGLIGENCE'

Senator Ron Wyden demanded that Chief Justice Roberts authorize an independent cybersecurity review of federal courts following allegations that Russian hackers had stolen sealed case data from systems with vulnerabilities that had been left unfixed for five years. Wyden criticized the judiciary's failure to implement mandatory cybersecurity requirements, slow adoption of phishing-resistant multifactor authentication, and a pattern of stonewalling congressional oversight about previous breaches. The letter highlights systemic cybersecurity failures in the handling of critical government infrastructure, including classified national security documents and sealed criminal investigations.

SALESLOFT BREACHED TO STEAL OAUTH TOKENS FOR SALESFORCE DATA-THEFT ATTACKS

Hackers breached the sales automation platform Salesloft to steal OAuth and refresh tokens via its Drift chat agent integration with Salesforce. Salesloft's SalesDrift platform connects the Drift AI chat agent with a Salesforce instance, allowing organizations to sync conversations, leads, and support cases into their CRM. Salesloft determined that this breach only impacted customers who use the Drift-Salesforce integration and has worked with Salesforce to revoke all active sessions and refresh tokens for the Drift application.

FCC REMOVES 1,200 VOICE PROVIDERS FROM TELEPHONE NETWORKS IN MAJOR ROBOCALL CRACKDOWN

The FCC blocked 1,200 voice service providers from U.S. phone networks for failing to comply with STIR/SHAKEN caller authentication requirements and robocall mitigation protocols.

GOOGLE TO VERIFY ALL ANDROID DEVELOPERS IN 4 COUNTRIES TO BLOCK MALICIOUS APPS

Google, aiming to prevent malicious apps and enhance security, will require all Android app developers in Brazil, Indonesia, Singapore, and Thailand to verify their identities by September 2026.

FRENCH RETAILER AUCHAN CYBERATTACK - THOUSANDS OF CUSTOMERS' PERSONAL DATA EXPOSED

Auchan suffered a cyberattack that exposed the loyalty program data of hundreds of thousands of customers, prompting alerts, phishing warnings, and a response to its second major breach in nine months.

→ Read more on the Fastly blog

→ Check out the project on GitHub

FARMERS INSURANCE DATA BREACH IMPACTS OVER 1 MILLION PEOPLE

A data breach at Farmers Insurance, disclosed via a third-party vendor, exposed personal information of over one million people, including names and Social Security numbers. The insurer was not directly hacked; the sensitive data was stolen from a compromised external database. Authorities and affected individuals have been notified.

DOCKER FIXES CVE-2025-9074, CRITICAL CONTAINER ESCAPE VULNERABILITY WITH CVSS SCORE 9.3

Docker patched a critical container escape flaw (CVSS 9.3) affecting Windows and macOS. The vulnerability (CVE-2025-9074) allowed attackers to access host files from within containers, posing major risks to containerized environments.

AUCHAN RETAILER DATA BREACH IMPACTS HUNDREDS OF THOUSANDS OF CUSTOMERS

French retailer Auchan is notifying “several hundred thousand” customers that sensitive data linked to their loyalty accounts was exposed in a cyberattack. The breached data includes names, titles, client status, postal and email addresses, phone numbers, and loyalty card numbers. The company says that no financial details or passwords were impacted.