Search the archive

QILIN RANSOMWARE ATTACK ON NHS CAUSES PATIENT DEATH IN THE UK

A ransomware attack by the Qilin group in June 2024 compromised London's NHS hospitals, leading to treatment delays, a patient's death, and widespread disruption of care.

Access Management Summit 2025

CRITICAL CISCO ISE VULNERABILITIES ALLOW REMOTE CODE EXECUTION

Cisco announced fixes for two critical (CVSS 10/10) vulnerabilities in its Identity Services Engine (ISE) and ISE Passive Identity Connector, which could allow unauthenticated remote code execution (RCE). The first vulnerability is caused by a lack of input validation, which allows unauthenticated attackers to submit crafted API requests and execute arbitrary code with root privileges. The second vulnerability is caused by a lack of file validation, which could allow an attacker to store malicious files in arbitrary directories on the device.

HACKERS TURN SCREENCONNECT INTO MALWARE USING AUTHENTICODE STUFFING

Cybersecurity firm G DATA is warning users of ConnectWise's ScreenConnect remote monitoring and management (RMM) software about a new malware campaign that utilizes ScreenConnect installers with a malicious configuration embedded in the authenticode certificate. The malicious installer is configured to have the title “Windows Update,” change the background to a Windows Update image, and connect to an attacker-controlled server. ConnectWise has revoked the certificates used in these binaries.

GLASGOW COUNCIL SERVICES REMAIN OFFLINE A WEEK AFTER CYBER ATTACK

Glasgow City Council suffered a cyberattack on June 19 via IT supplier CGI's third-party servers, disrupting online services including planning applications, payments, and pension portals. Customer data may have been stolen, but the confirmation has not yet been made.

CYBERCRIMINALS ABUSE OPEN-SOURCE TOOLS TO TARGET AFRICA'S FINANCIAL SECTOR

Threat actor CL-CRI-1014 has been targeting African financial institutions since July 2023. The attackers use open-source tools (PoshC2, Chisel, and Classroom Spy) and forge file signatures to establish network access. The group operates as initial access brokers, selling compromised financial institution access on darknet markets.

MARKETPLACE TAKEOVER: HOW WE COULD'VE TAKEN OVER EVERY DEVELOPER USING A VSCODE FORK; PUTTING MILLIONS AT RISK

Security researchers have discovered a critical vulnerability in open-vsx.org, the open-source VS Code extensions marketplace used by over 8 million developers across popular editors such as Cursor, Windsurf, and VSCodium. The flaw allowed attackers to steal admin credentials through a CI pipeline issue, enabling them to publish malicious updates to every extension on the marketplace and potentially compromise millions of developer machines. The vulnerability was responsibly disclosed in May and patched after multiple iterations over several weeks.

5 YEARS, 160 COMMENTS, AND THE VULNERABILITY THAT REFUSED TO DIE

Jonathan Leitschuh discovered an old vulnerability in SnakeYAML that could enable remote code execution through unsafe deserialization. The maintainer initially closed the report as “Won't Fix,” claiming a safe constructor made the code safe. After a lengthy discussion, PoCs, data, and a nearly hour-long call, Leitschuh convinced the maintainer to use the secure constructor by default and make insecure behavior opt-in, marking a win for secure defaults in SnakeYAML 2.0.

EXCLUSIVE FOR TLDR READERS: GET 40% OFF FOR A (VERY) LIMITED TIME.

BONFY (PRODUCT LAUNCH)

Bonfy provides AI governance solutions that detect and prevent risks in enterprise content, ensuring secure and compliant use of generative AI across organizations.

OBFUSK8

Obfusk8 is a C++17 header-only library designed to obfuscate binaries through a complex set of compile-time and runtime techniques.

YARA-X IS STABLE

The YARA team has officially announced the first stable release of YARA-X and moved the original YARA project into maintenance mode.

IRANIAN HACKERS ARE TRYING TO CREATE A PSYCHOLOGICAL WAR IN CYBERSPACE

A new report by cybersecurity agency DomainTools alleges that the Iranian-backed CyberAv3ngers group is shifting its operations to focus on misinformation and psychological warfare. The CyberAv3ngers have been active since 2023, and while they have been tied to confirmed intrusions, they have also claimed targets that have been debunked. According to the report, the group has refined cyber activity “into a fully realized propaganda apparatus” with the goal of not just breaching systems but “to control the narrative surrounding those breaches.”

QILIN RANSOMWARE ATTACK ON NHS SUPPLIER CONTRIBUTED TO PATIENT FATALITY

The NHS confirmed a patient died following Qilin's ransomware attack on pathology provider Synnovis. A delayed blood test result due to disrupted services contributed to the death. The attack affected multiple London NHS trusts, harming 170 patients in total. This represents a rare confirmed link between ransomware and patient mortality.

WINDOWS KILLED THE BLUE SCREEN OF DEATH

Microsoft is replacing Windows' iconic Blue Screen of Death with a Black Screen of Death nearly 40 years after its introduction. The change is part of the Windows Resiliency Initiative following the CrowdStrike outage that affected 8.5 million devices. Microsoft calls it a "simplified UI" but hasn't acknowledged the significance of ending this computing era.

EX-STUDENT CHARGED OVER HACKING UNIVERSITY FOR CHEAP PARKING, DATA BREACHES

Birdie Kingston, a 27-year-old former Western Sydney University student, was arrested for hacking the university since 2021, stealing over 100GB of data, altering academic records, and demanding $40,000 in cryptocurrency ransom.

MICROSOFT CONFIRMS FAMILY SAFETY BLOCKS GOOGLE CHROME FROM LAUNCHING

Microsoft Family Safety has a bug that temporarily prevents some Windows devices from opening browsers like Google Chrome after updates, with Microsoft recommending enabling 'Activity reporting' as a workaround until a fix is released.

MAN WHO HACKED ORGANIZATIONS TO ADVERTISE SECURITY SERVICES PLEADS GUILTY

Nicholas Kloster, a Kansas City man, admitted to hacking multiple organizations to promote his cybersecurity services and faces up to five years in prison and a $250,000 fine.

* How to monitor without creating noise

* Real-time detection vs polling methodologies * Change management and reconciliation workflows

Download the free guide

NEW WORDPRESS MALWARE HIDES ON CHECKOUT PAGES AND IMITATES CLOUDFLARE

The May 2025 WordPress Core malware campaign, discovered by Wordfence, has three versions: one steals credit card data from checkout pages while mimicking Cloudflare security screens, another hijacks Google Ads and steals login credentials, and the third spreads more malware by replacing website links. Since September 2023, all have been disguised as legitimate plugins and employ advanced anti-detection methods, including hosting management systems on infected sites.

MAINLINE HEALTH, SELECT MEDICAL EACH DISCLOSE DATA BREACHES IMPACTING 100,000 PEOPLE

Two major healthcare data breaches have been disclosed. Mainline Health Systems (Arkansas) suffered a ransomware attack by the Inc. Ransom group in April 2024, affecting over 101,000 individuals with stolen sensitive files. Select Medical Holdings (Pennsylvania) was impacted by a vendor breach at Nationwide Recovery Services that exposed nearly 120,000 people's data.

MILLIONS OF BROTHER PRINTERS HIT BY CRITICAL, UNPATCHABLE BUG

Rapid7 discovered eight vulnerabilities that affect 748 printer models from five vendors, with Brother accounting for 689 affected devices. The critical flaw CVE-2024-51978 (CVSS 9.8), which allows attackers to generate default admin passwords using device serial numbers, cannot be firmware-patched.

FREQUENT REAUTH DOESN'T MAKE YOU MORE SECURE

Low session expiration times frustrate users and don't effectively improve security. Frequent reauthentication aims to prevent credential theft, but if attackers have physical access, a screen lock suffices, and if remote, expiration times are often too long to prevent breaches. Instead, systems should reauthenticate only before sensitive actions and use continuous verification like device checks and SCIM controls.

LEAKING SECRETS IN THE AGE OF AI

Researchers found that AI-related secrets dominate public code repository leaks, comprising 4 of the top 5 vulnerable secret types. The three main sources are Python notebook files, AI agent config files, and new AI vendor secret types that scanners overlook. Valid secrets from more than 30 companies, including Fortune 100 firms, were found, highlighting poor AI development security practices.

VULNERABLE VS. EXPLOITABLE: WHY UNDERSTANDING THE DIFFERENCE MATTERS TO YOUR SECURITY POSTURE

Horizon3.ai suggests security teams should prioritize "exploitability" over "vulnerability," as many weaknesses can't be exploited in real-world scenarios. Their NodeZero platform conducted over 50,000 pentests in 2024, uncovering 765,000 critical exploitable paths and showing attackers can gain domain admin access in 60 seconds by chaining vulnerabilities and misconfigurations. They recommend continuous autonomous testing rather than annual assessments, with 82% of their customers now testing monthly compared to 26% of organizations testing more than once yearly.

No pitch, no pressure. Start here →

(You'll also get an instant tour [11] of the full Permiso Platform.)

OKTAGINX

OktaGinx is an Evilginx phishlet that bypasses Okta authentication chained with Azure.

INTELOWL

IntelOwl is an Open-Source solution for managing Threat Intelligence at scale. It integrates several analyzers available online and many cutting-edge malware analysis tools.

WSUKS

The "wsuks" tool automates man-in-the-middle attacks on Windows Server Update Service (WSUS) configs using HTTP instead of HTTPS. It uses ARP spoofing to impersonate the WSUS server. It serves malicious updates with PsExec64.exe and PowerShell scripts that run as SYSTEM to create local admin users or add domain users to the local administrators group.

MICROSOFT MAKES WINDOWS 10 EXTENDED SECURITY UPDATES FREE, BUT THERE'S A CATCH

Microsoft has announced a new method for consumers to enroll their Windows 10 devices in the free Extended Security Updates (ESU) program. The method requires users to enable Windows Backup to sync settings and folders to the cloud. If a user has more than 5GB of data to sync, they must purchase additional space for Windows Backup to work and claim the free ESU enrollment. Users can also enroll in the program by paying $30 or redeeming 1K Microsoft Reward points for a year of updates.

FRENCH POLICE REPORTEDLY ARREST SUSPECTED BREACHFORUMS ADMINISTRATORS

French authorities detained five suspected BreachForums operators, including known cybercriminals ShinyHunters, IntelBroker, Hollow, Noct, and Depressed, who allegedly ran the stolen data marketplace and targeted French companies. They tried to revive BreachForums after its earlier 2023 shutdown following the founder "pompompurin's" arrest.

UK GOVT DEPT WEBSITE THAT CAMPAIGNS AGAINST ENCRYPTION HIJACKED TO ADVERTISE ... PAYDAY LOANS

The UK Home Office's 2022 anti-encryption "No Place to Hide" campaign website was hijacked to promote payday loans from Wage Day Advance. Tech expert Heather Burns discovered the unauthorized content insertion. This appears to be part of a growing trend where abandoned campaign websites on trusted domains are exploited for SEO spam content.

AIR FRYERS AND SMART SPEAKERS MUST RESPECT YOUR PRIVACY, UK AUTHORITIES SAY

The UK's ICO has issued its first guidance on handling personal data after complaints about excessive data collection by smart devices, with users feeling powerless over how their data is shared and used.

TREZOR'S SUPPORT PLATFORM ABUSED IN CRYPTO THEFT PHISHING ATTACKS

Trezor users are receiving phishing emails that mimic genuine support messages, with attackers exploiting Trezor's support system to send fake alerts and links to steal wallet seed phrases.

QUANTUM COMPUTERS JUST GOT AN UPGRADE – AND IT'S 10X MORE EFFICIENT

Researchers in Sweden developed a highly efficient, on-demand amplifier that conserves power and safeguards quantum bits, potentially boosting future quantum computers.

Watch the video (03:13 minutes)

SPARKKITTY SWIPES PICS FROM IOS, ANDROID DEVICES

SparkKitty is a new mobile malware that harvests photos from users' devices. The malware is delivered via fake or trojanized applications on the App Store and a trojanized version of the TikTok app that users are prompted to install via an Enterprise profile. Once installed, the apps prompt users to grant the app access to their galleries and then exfiltrate images to extract crypto seed phrases.

NEW FILEFIX ATTACK WEAPONIZES WINDOWS FILE EXPLORER FOR STEALTHY COMMANDS

FileFix, a variant of ClickFix attacks, is a new social engineering attack vector on Windows devices. In ClickFix attacks, a user is prompted by a website to execute a copied command in PowerShell to fix a bogus error. However, in the FileFix attacks, the user just needs to paste the command in the Windows File Explorer address bar, which is a much more familiar environment. The FileFix ruse informs users that a file was shared with them and prompts them to click a button that will launch File Explorer and copy a PowerShell command that contains a file path in a PowerShell comment to the clipboard. When the command is pasted into the File Explorer address bar, only the path will be displayed.

THREAT HUNTING INTRODUCTION: COBALT STRIKE

Cobalt Strike servers can be found online by scanning for their distinctive HTTP response signatures - specifically 404 Not Found responses with zero content length and text/plain content type. Researchers can download executable payloads from these servers using checksum-based URLs (like /tdN6 for x86 or /ZrJG for x64) and extract encrypted configuration metadata that reveals how red teams and malicious actors configure their command-and-control infrastructure. This post provides a Rust tool called SigStrike to automate this discovery and analysis process at scale across millions of potential servers.

NO AGENT, NO PROBLEM: DISCOVERING REMOTE EDR

The Performance Logs and Alerts DLL holds various DCOM interfaces that allow someone to interact remotely with Event Tracing for Windows (ETW) providers, trace sessions, configurations, etc. This post demonstrates how these capabilities can be used to detect various attacks without an agent and suggests ways that an attacker can use them to maintain stealthy persistence.

AUTOMATICALLY PRIORITIZE SECURITY ISSUES FROM DIFFERENT TOOLS WITH AN LLM

Security issue prioritization is a complex and time-consuming process that takes away time from resolving issues. This blog post proposes three scoring strategies that an LLM can use to rank security issues to combat this. The first strategy is to have the LLM assign a score based on provided criteria to each issue and sort the issues based on that score. The second strategy is to have the LLM use bubble sort and compare each issue pair-wise, which is more thorough than the first strategy but slower. The third strategy is to use an Elo system where a random sampling of issues is compared.

UNEXPECTED SECURITY FOOTGUNS IN GO'S PARSERS

Go's parsers for JSON, XML, and YAML have risky default behaviors such as case-insensitive fields, duplicate key acceptance, and lenient garbage data handling, which attackers can exploit to bypass security. These differences lead to conflicting interpretations across services processing the same input, causing vulnerabilities like CVE-2020-16250 in HashiCorp Vault. The new JSON v2 spec aims to fix these with secure defaults, but current measures rely on custom validation and static analysis.

demo