Search the archive

CONNECTWISE ROTATING CODE SIGNING CERTIFICATES OVER SECURITY CONCERNS

ConnectWise is updating digital certificates for key software to address security concerns - users must install these updates by June 13 to avoid potential issues.

MICROSOFT OUTLOOK TO BLOCK MORE RISKY ATTACHMENTS USED IN ATTACKS

Starting next month, Microsoft will expand the types of blocked attachments in Outlook Web and the new Outlook for Windows to improve security by preventing potentially harmful files from being sent or received.

LET THEM EAT JUNK FOOD: MAJOR ORGANIC SUPPLIER TO WHOLE FOODS, WALMART, HIT BY CYBERATTACK

United Natural Foods disclosed a cyberattack on June 5 that disrupted operations and order fulfillment. The company activated incident response protocols and took systems offline. This follows similar recent attacks on grocery chains in the UK.

HACKER TARGETS OTHER HACKERS AND GAMERS WITH BACKDOORED GITHUB CODE

Sophos detected a campaign in which an attacker uses GitHub repositories with hidden backdoors to target other hackers and gamers. The repositories use various loaders to deploy various payloads, such as info-stealers and remote access trojans (RATs). Many of the fake repositories are designed to target other hackers, but some also use game cheats, mod tools, and fake exploits as lures.

MISCONFIGURED HMIS EXPOSE US WATER SYSTEM TO ANYONE WITH A BROWSER

While conducting a routine scan of industrial-control hosts, Censys researchers discovered an uncommon TLS certificate configuration that led to the discovery of a browser-based HMI platform. These internet-exposed platforms could be used to view and control water systems without authentication. Censys sent a bulk notification to the EPA, and the number of systems that were either read-only or fully controllable was reduced from 300 to 20.

EKS VS GKE - SECURITY

An in-depth comparison of security features in EKS and GKE. The post breaks down features by Identity and Access Management (IAM), controlling network traffic, configuration/posture management, vulnerability/supply-chain management, and runtime threat detection.

FOLLOW THE SMOKE | CHINA-NEXUS THREAT ACTORS HAMMER AT THE DOORS OF TOP TIER TARGETS

SentinelOne observed and countered Chinese cyberespionage operations targeting the company in 2024-2025, including PurpleHaze reconnaissance and a ShadowPad intrusion via a hardware logistics partner, but SentinelOne wasn't compromised. The broader campaigns targeted 70+ organizations globally, including government, media, and cybersecurity vendors.

OPEN-SOURCE TOOLKIT OF AN IVANTI CSA ATTACKER

In late 2024, Ivanti released advisories for vulnerabilities in its Cloud Services Appliance (CSA) product, which were discovered to be part of an exploit chain against the products. In this post, Synacktiv researchers break down three of the open-source tools they observed used by attackers in post-exploitation activities on these devices and provide YARA rules to detect them. The attacker planted Suo5 after the initial compromise as a webshell to be used on an internet-facing Exchange server. The attacker then established persistence using the iox tunnel and attempted lateral movement using atexec.py to gain remote code execution via Task Scheduler.

GUARDZ (PRODUCT LAUNCH)

Guardz continuously monitors organizations' internal and external digital footprint to provide real-time protection. From a single dashboard, administrators can immediately take action when necessary.

BUGFISH NUKE

Bugfish Nuke is a powerful emergency data deletion tool for Windows designed to help you quickly and securely erase sensitive files, user data, and system traces.

ADELEGINATOR

ADeleginator is a tool for finding insecure trustee and resource delegations in Active Directory environments.

GOOGLE FIXES BUG THAT COULD REVEAL USERS' PRIVATE PHONE NUMBERS

A security researcher discovered a Google bug that allowed attackers to reveal any account's private recovery phone number in under 20 minutes without owner notification. The exploit bypassed anti-bot protections through automated brute-force attacks. Google confirmed the fix after the researcher disclosed the vulnerability in April. It paid a $5,000 bounty and found no confirmed exploits occurred.

EXPLAINER FOR LOCAL NETWORK ACCESS

The Chrome Secure Web and Network team has drafted a proposal to require explicit permission for a site to access devices on the local network. This proposal seeks to address a common attack vector in which an attacker can use a CSRF vulnerability to attack a local device such as a printer. The proposal would require any request that seeks to access a more private IP space (such as public to private or private to loop back) to obtain a new “Local Network Access” permission from the user via a prompt.

LINUX FOUNDATION UNVEILS DECENTRALIZED WORDPRESS PLUGIN MANAGER

The Linux Foundation has launched the FAIR Package Manager, a new way to manage WordPress plugins and themes. It was created after a major conflict between WordPress companies Automattic and WP Engine. This tool gives developers more control by offering a decentralized and secure plugin system.

OPENAI BANS CHATGPT ACCOUNTS LINKED TO RUSSIAN, CHINESE CYBER OPS

OpenAI banned ChatGPT accounts associated with hackers in Russia and China who exploited the AI for cyberattacks, malware creation, and disinformation, while successfully mitigating the threats with partner assistance.

TRUMP CYBERSECURITY EXECUTIVE ORDER TARGETS DIGITAL IDENTITY, SANCTIONS POLICIES

President Trump issued an executive order altering previous cybersecurity regulations by eliminating support for digital IDs in public benefits, modifying the government's software, AI, and encryption approaches, and restricting cyber sanctions to foreign threats only.

MALICIOUS NPM PACKAGES POSING AS UTILITIES DELETE PROJECT DIRECTORIES

Two fake npm packages pretended to be useful tools but deleted all files in project folders instead.

📥 Download the 2025 Global Threat Intelligence Report

AT&T NOT SURE IF NEW CUSTOMER DATA DUMP IS DÉJÀ VU

AT&T is investigating claims that 86 million customer records, reportedly containing birthdates, phone numbers, addresses, and 44 million social security numbers, are being sold on cybercrime forums. The company says this appears to be repackaged data from previous breaches, possibly the 2024 Snowflake incident or an earlier 2021 theft, rather than a new hack.

'PATHWIPER' ATTACK HITS CRITICAL INFRASTRUCTURE IN UKRAINE

Cisco Talos discovered "PathWiper," a new Russian wiper malware targeting Ukrainian critical infrastructure through legitimate endpoint administration frameworks. Unlike previous wipers, PathWiper programmatically identifies all connected drives and network paths via APIs before overwriting data with random bytes, potentially more destructive than tools like HermeticWiper used in earlier attacks.

LARGEST EVER DATA LEAK EXPOSES OVER 4B RECORDS

Researchers have discovered an open 613GB database containing over 4 billion records. The database contained numerous data collections, including an 805M record database of WeChat records, a 780M record database of addresses and geographic data, banking information, and MFA devices. However, the researchers could not analyze the dataset comprehensively as it was taken down soon after discovery.

VIBE CODING IS HERE TO STAY. CAN IT EVER BE SECURE?

AI tools are making it easier and faster for people to write code, even with little experience. However, many experts worry that this “vibe coding” approach will pose serious security risks. While AI coding grows fast, it still struggles to make safe and reliable software.

BUSINESS EMAIL COMPROMISE CHECK LIST

A Business Email Compromise (BEC) incident response checklist for Office 365 outlines four phases: isolate the compromised account, contain the threat by resetting credentials and removing unauthorized configurations, eradicate traces of the attacker, and assess impact by reviewing sent emails and shared files. The response includes immediate actions like disabling accounts and changing passwords, followed by forensic analysis, stakeholder notification, and required regulatory reporting. Prevention through proper security measures is easier than incident response, but organizations must learn from incidents to strengthen defenses.

THE COST OF A CALL: FROM VOICE PHISHING TO DATA EXTORTION

Google Threat Intelligence Group (GTIG) reports on threat activity from a group tracked as UNC6040. The group uses vishing to impersonate IT support personnel in convincing attacks targeting employees in multinational corporations into granting access or sharing credentials to their Salesforce platform. In many campaigns, the threat actors convince the victim to add a modified version of the bulk data import tool, Salesforce Data Loader, which is modified to send the data to an attacker-controlled infrastructure.

MIND (PRODUCT LAUNCH)

Mind provides real-time detection capabilities, instantly blocking malicious and inadvertent attempts to exfiltrate sensitive information from an organization's environment.

AWESOME BLACKHAT TOOLS

A curated list of tools officially presented at Black Hat events.

AUDITOR.CODES

Auditor.codes is a web platform where users learn to spot security bugs in real C/C++ code. It offers thousands of hands-on challenges, from basic to very hard, and tracks their progress. The site is still in early development, so users are encouraged to give feedback and file bug reports.

US OFFERING $10 MILLION REWARD FOR REDLINE MALWARE DEVELOPER

The US State Department is offering up to $10 million for information on Maxim Alexandrovich Rudometov, the alleged developer of RedLine malware that steals credentials and financial data. RedLine infrastructure was disrupted in October 2024, but the malware may remain active.

ITALIAN LAWMAKERS SAY ITALY USED SPYWARE TO TARGET PHONES OF IMMIGRATION ACTIVISTS, BUT NOT AGAINST JOURNALIST

MANDIANT FLAGS FAKE AI VIDEO GENERATORS LACED WITH MALWARE

Mandiant has detected a new malware campaign that utilizes social media ads to distribute infostealers and backdoors. The campaign is spread by advertising free access to popular AI video generators such as Luma AI, Canva Dream Lab, and Kling AI. After the user inputs a prompt, they are served with one of the static malicious payloads that the site hosts.

I READ ALL OF CLOUDFLARE'S CLAUDE-GENERATED COMMITS

Max Mitchell found that while AI primarily generated Cloudflare's OAuth 2.1 library code, human oversight remained essential for debugging and strategic guidance.

OVER 20 MALICIOUS APPS ON GOOGLE PLAY TARGET USERS FOR SEED PHRASES

More than 20 fraudulent crypto wallet apps on Google Play were identified as stealing users' recovery phrases to access their cryptocurrency funds.

POPULAR CHROME EXTENSIONS FOUND LEAKING DATA VIA UNENCRYPTED CONNECTIONS

Popular Chrome extensions were discovered to leak user data via unencrypted HTTP connections, exposing users to spying and cyber threats, particularly on public Wi-Fi.

GET THE GUIDE

EXCLUSIVE: HACKERS LEAK 86 MILLION AT&T RECORDS WITH DECRYPTED SSNS

Hackers leaked 86 million AT&T customer records, including full names, addresses, and decrypted Social Security Numbers. The data may be linked to a 2024 breach involving the Snowflake cloud platform, but this is not confirmed. AT&T has not yet said whether this new leak is part of a past or new breach.

RANSOMWARE GANG CLAIMS RESPONSIBILITY FOR KETTERING HEALTH HACK

Ransomware group Interlock claimed responsibility for hacking Kettering Health's Ohio hospital network, stealing 940GB of data, including patient records and employee information. Two weeks ago, the attack forced system shutdowns. Interlock's public claim suggests ransom negotiations failed.

FBI: PLAY RANSOMWARE BREACHED 900 VICTIMS, INCLUDING CRITICAL ORGS

In a joint effort with CISA and the Australian Cyber Security Centre, the FBI has stated that the Play ransomware gang has breached roughly 900 organizations as of May. The Play Ransomware-as-a-Service (RaaS) operation threatens organizations, saying that it will release stolen information on its leak site to pressure victims into paying. Play is also notable in that it negotiates with victims over email as opposed to a Tor negotiations page and each infection uses recompiled malware to complicate detection.

SECURITY ISN'T A SOLO SPORT: COMMUNITY, BURNOUT, AND IDENTITY AT BSIDES312

Over 260 professionals gathered at BSides312, a cybersecurity conference at Chicago's Irish American Heritage Center, to discuss community, burnout, and human-centered security challenges. Key speakers highlighted identity misconfigurations and privilege escalation in cloud environments as major attack vectors, advocating for active defense strategies beyond traditional firewalls and antivirus solutions. The conference emphasized that effective security relies on strong human connections, psychological safety, and communication hygiene within teams, as technical vulnerabilities often arise from human and organizational failures rather than technical issues.

ADVANCED PROTECTION: GOOGLE'S STRONGEST SECURITY FOR MOBILE DEVICES

The Advanced Protection Program provides Google's strongest protections against targeted attacks on Android devices. Advanced Protection provides a one-click toggle that allows users to enable a comprehensive security suite that cannot be disabled. Some Advanced Protection features include intrusion logging, offline and theft detection lock, inactivity report, safe browsing, insecure WiFi network protections, and spam detection and protection.

DEMYSTIFYING MYTH STEALER: AN ‘INFOSTEALER' THAT TARGETED VIDEO GAMES

Myth Stealer is a Rust-based infostealer malware marketed on Telegram since December. It targets gamers through fraudulent gaming sites, stealing passwords, cookies, and browser data. This post goes in depth on the techniques it uses, such as fake windows and advanced evasion techniques.

THREATSPIKE (PRODUCT LAUNCH)

TheatSpike provides organizations with full visibility across endpoints, network, cloud assets, email services, and applications, leveraging AI for automation and continuous threat hunting.

OFFSEC-TOOLS

This repository is intended for pentesters and red teamers using various offensive security tools during their assessments.

INTUNE RBAC

Intune RBAC provides a comprehensive PowerShell-based tool for managing and auditing Role-Based Access Control (RBAC) in Microsoft Intune.

FEDS SEIZE BIDENCASH CARDING MARKET AND ITS CRYPTO PROFITS

US and Dutch authorities seized BidenCash, a marketplace for stolen credit card data, on June 4. They took 145 domains offline, along with cryptocurrency wallets and infrastructure. Operating openly since March 2022, it had over 117,000 users and sold over 15 million payment card records, generating an estimated $17 million in illicit revenue. Authorities collaborated with cybersecurity firms to map the infrastructure, leaving victims whose data was sold or leaked vulnerable and needing to monitor their accounts closely.

CEOS NOW LEARNING SELF-DEFENCE TO PROTECT AGAINST CYBER THREATS

CEOs are now learning self-defense to stay safe from cyber threats. Cybercriminals are targeting company leaders more often. Training helps CEOs defend themselves and their businesses.

HMRC HAS LOST £47 MILLION IN BREACH OF 100,000 TAXPAYER ACCOUNTS, MPS HEAR

HMRC lost £47 million in a phishing scam that affected 100,000 taxpayers' accounts. Criminals used stolen identity data from external sources to create fake PAYE accounts and claim fraudulent repayments. HMRC emphasized this wasn't a cyber attack on its systems. Affected accounts were locked. Customers face no financial loss. Arrests have been made.

LEE ENTERPRISES SAYS 40,000 HIT BY RANSOMWARE-CAUSED DATA BREACH

Lee Enterprises has disclosed a data breach that affects almost 40,000 individuals.

GERMANY FINES VODAFONE $51 MILLION FOR PRIVACY, SECURITY BREACHES

Germany fined Vodafone $51 million due to privacy and security breaches caused by fraudulent partner actions and weak security - the company has since rectified its systems and paid the fines.