Go Back

World's Security Today

Last updated: 2025-12-11 01:50 Refresh now

From Mandiant

Sanctioned but Still Spying: Intellexa’s Prolific Zero-Day Exploits Continue

Wed, 03 Dec 2025 14:00:00 +0000

Introduction Despite extensive scrutiny and public reporting, commercial surveillance vendors continue to operate unimpeded. A prominent name continues to surface in the world of mercenary spyware, In...
Beyond the Watering Hole: APT24's Pivot to Multi-Vector Attacks

Thu, 20 Nov 2025 14:00:00 +0000

Written by: Harsh Parashar, Tierra Duncan, Dan Perez Google Threat Intelligence Group (GTIG) is tracking a long-running and adaptive cyber espionage campaign by APT24, a People's Republic of China (PR...
Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem

Mon, 17 Nov 2025 14:00:00 +0000

Written by: Mohamed El-Banna, Daniel Lee, Mike Stokkel, Josh Goddard Overview Last year, Mandiant published a blog post highlighting suspected Iran-nexus espionage activity targeting the aerospace, av...
Time Travel Triage: An Introduction to Time Travel Debugging using a .NET Process Hollowing Case Study

Thu, 13 Nov 2025 14:00:00 +0000

Written by: Josh Stroschein, Jae Young Kim The prevalence of obfuscation and multi-stage layering in today’s malware often forces analysts into tedious and manual debugging sessions. For instance, the...
No Place Like Localhost: Unauthenticated Remote Access via Triofox Vulnerability CVE-2025-12480

Mon, 10 Nov 2025 14:00:00 +0000

Written by: Stallone D'Souza, Praveeth DSouza, Bill Glynn, Kevin O'Flynn, Yash Gupta Welcome to the Frontline Bulletin Series Straight from Mandiant Threat Defense, the "Frontline Bulletin" series bri...
GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools

Wed, 05 Nov 2025 14:00:00 +0000

Executive Summary Based on recent analysis of the broader threat landscape, Google Threat Intelligence Group (GTIG) has identified a shift that occurred within the last year: adversaries are no longer...
Preparing for Threats to Come: Cybersecurity Forecast 2026

Tue, 04 Nov 2025 14:00:00 +0000

Every November, we make it our mission to equip organizations with the knowledge needed to stay ahead of threats we anticipate in the coming year. The Cybersecurity Forecast 2026 report, released toda...
Keys to the Kingdom: A Defender's Guide to Privileged Account Monitoring

Tue, 28 Oct 2025 14:00:00 +0000

Written by: Bhavesh Dhake, Will Silverstone, Matthew Hitchcock, Aaron Fletcher The Criticality of Privileged Access in Today's Threat Landscape Privileged access stands as the most critical pathway fo...
Help Wanted: Vietnamese Actors Using Fake Job Posting Campaigns to Deliver Malware and Steal Credentials

Thu, 23 Oct 2025 14:00:00 +0000

Google Threat Intelligence Group (GTIG) is tracking a cluster of financially motivated threat actors operating from Vietnam that leverages fake job postings on legitimate platforms to target individua...
Pro-Russia Information Operations Leverage Russian Drone Incursions into Polish Airspace

Tue, 21 Oct 2025 14:00:00 +0000

Written by: Alden Wahlstrom, David Mainor Introduction Google Threat Intelligence Group (GTIG) observed multiple instances of pro-Russia information operations (IO) actors promoting narratives related...
To Be (A Robot) or Not to Be: New Malware Attributed to Russia State-Sponsored COLDRIVER

Mon, 20 Oct 2025 14:00:00 +0000

Written by: Wesley Shields Introduction COLDRIVER, a Russian state-sponsored threat group known for targeting high profile individuals in NGOs, policy advisors and dissidents, swiftly shifted operatio...
DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains

Thu, 16 Oct 2025 14:00:00 +0000

Written by: Blas Kojusner, Robert Wallace, Joseph Dobson Google Threat Intelligence Group (GTIG) has observed the North Korea (DPRK) threat actor UNC5342 using ‘EtherHiding’ to deliver malware and fac...
New Group on the Block: UNC5142 Leverages EtherHiding to Distribute Malware

Thu, 16 Oct 2025 14:00:00 +0000

Written by: Mark Magee, Jose Hernandez, Bavi Sadayappan, Jessa Valdez Since late 2023, Mandiant Threat Defense and Google Threat Intelligence Group (GTIG) have tracked UNC5142, a financially motivated...
Oracle E-Business Suite Zero-Day Exploited in Widespread Extortion Campaign

Thu, 09 Oct 2025 14:00:00 +0000

Written by: Peter Ukhanov, Genevieve Stark, Zander Work, Ashley Pearson, Josh Murchie, Austin Larsen Update (Oct. 11): On Oct. 11, Oracle released another patch, addressing CVE-2025-61884. Introductio...
Cybercrime Observations from the Frontlines: UNC6040 Proactive Hardening Recommendations

Tue, 30 Sep 2025 14:00:00 +0000

Written by: Omar ElAhdan, Matthew McWhirt, Michael Rudden, Aswad Robinson, Bhavesh Dhake, Laith Al, Ravi Kumar Raja Update (Nov. 21): In response to the Salesforce advisory related to Gainsight applic...
Another BRICKSTORM: Stealthy Backdoor Enabling Espionage into Tech and Legal Sectors

Wed, 24 Sep 2025 14:00:00 +0000

Written by: Sarah Yoder, John Wolfram, Ashley Pearson, Doug Bienstock, Josh Madeley, Josh Murchie, Brad Slaybaugh, Matt Lin, Geoff Carstairs, Austin Larsen Introduction Google Threat Intelligence Grou...
ViewState Deserialization Zero-Day Vulnerability in Sitecore Products (CVE-2025-53690)

Wed, 03 Sep 2025 14:00:00 +0000

Written by: Rommel Joven, Josh Fleischer, Joseph Sciuto, Andi Slok, Choon Kiat Ng Update (September 3): This post was updated to include information about GoTokenTheft usage. In a recent investigation...
Widespread Data Theft Targets Salesforce Instances via Salesloft Drift

Tue, 26 Aug 2025 14:00:00 +0000

Written by: Austin Larsen, Matt Lin, Tyler McLellan, Omar ElAhdan Update (August 28) Based on new information identified by GTIG, the scope of this compromise is not exclusive to the Salesforce integr...
Deception in Depth: PRC-Nexus Espionage Campaign Hijacks Web Traffic to Target Diplomats

Mon, 25 Aug 2025 14:00:00 +0000

Written by: Patrick Whitsell In March 2025, Google Threat Intelligence Group (GTIG) identified a complex, multifaceted campaign attributed to the PRC-nexus threat actor UNC6384. The campaign targeted ...
A Cereal Offender: Analyzing the CORNFLAKE.V3 Backdoor

Wed, 20 Aug 2025 14:00:00 +0000

Written by: Marco Galli Welcome to the Frontline Bulletin Series Straight from Mandiant Threat Defense, the "Frontline Bulletin" series brings you the latest on the most intriguing compromises we are ...

From Boannews

[김정덕의 AI 시대 보안 패러다임-1] AI 시대의 그림자, ‘딥페이크 사기’를 경계하라

Thu, 11 Dec 2025 15:28:00 +0900

기업 보안 전문가가 알아야 할 AI 보안 위협과 대응최근 연이어 발생한 대규모 해킹 사고로 인해 ‘보안’이 이제 전 산업에서 꼭 필요한 기반 인프라가 되고 있고 국민들의 일상생활에도 커다란 영향을 미치고 있습니다. 이에 는 중앙대학교 산업보안학과 김정덕 명예교수의 연재를 통해 일상과의 비유를 바탕으로 보안의 여러 이슈를 짚어보고, 여기서 한발 더 나아가 디
한국정보산업연합회 “‘디지털 재난’ 법적 정의·데이터 이중화 의무화 필요”

Thu, 11 Dec 2025 15:00:00 +0900

한국정보산업연합회 ‘행정전산망 마비 사태의 시사점과 에방 대책’ 보고서[보안뉴스 여이레 기자] 9월 국가정보자원관리원 화재로 인한 행정전산망 마비 사태와 같은 사태를 막기 위해 ‘디지털 재난’의 개념을 법적으로 규정하고, 전자정부 시스템 내 데이터 이중화 및 재해복구를 의무화할 필요가 있다는 제언이 나왔다.한국정보산업연합회(FKII)는 10일 공개한 ‘행정
[AI와 보안] 오픈AI “차세대 AI, 사이버보안에 위협”…스스로 위험 경고한 이유는

Thu, 11 Dec 2025 14:51:00 +0900

오픈AI, 자사 차세대 모델 시스템 침투 활용 소지 인정…AI ‘보호 도구’화 나서[보안뉴스 여이레 기자] 인공지능(AI) 기술의 발전 속도가 가팔라지면서 AI 개발 기업이 스스로 위험을 경고하고 나섰다. 챗GPT 개발사 오픈AI는 자사 차세대 AI 모델이 높은 수준의 사이버 보안 위험을 초래할 수 있다고 10일(현지시간) 밝혔다. 오픈AI는 차세대 모델이
국정원, 내년 공공기관 보안 평가에 ‘AI·N2SF’ 대거 반영

Thu, 11 Dec 2025 14:00:00 +0900

‘망분리’ 지표 사라지고 ‘N2SF’ 신설... 정책 대전환 예고온나라시스템 해킹 등 사고 재발 막기 위해 재난 대응 배점 강화[보안뉴스 조재호 기자] 정부의 ‘3대 AI 강국 도약’ 정책 기조에 발맞춰 공공기관 사이버보안 평가지표가 대대적으로 바뀐다. 인공지능(AI) 기술 도입과 차세대 망 보안 정책 ‘N2SF’ 구축 여부가 내년도 평가의 핵심 변수가 된
네이버, 디지털 보증서 ‘네이버 컬렉션’ 정식 출시…위변조 방지로 안심 구매

Thu, 11 Dec 2025 13:49:00 +0900

[보안뉴스 여이레 기자] 네이버가 전자상거래 신뢰 구축을 위한 디지털 보증서 시대를 연다. 네이버는 10일 브랜드스토어 이용자가 안심하고 상품을 구매할 수 있도록 디지털 보증서 서비스 ‘네이버 컬렉션’을 정식 출시했다고 밝혔다.네이버 컬렉션은 제품을 살 때 종이 보증서를 대체하는 디지털 형태의 전자 보증서다. 구매자는 네이버 앱에서 △제품 구매일지 △보증기
안랩클라우드메이트, ‘민간클라우드 기반 AI·데이터레이크 활용지원 사업’ 완료

Thu, 11 Dec 2025 13:46:00 +0900

[보안뉴스 여이레 기자] 안랩클라우드메이트는 과학기술정보통신부와 한국지능정보사회진흥원(NIA)이 추진하는 ‘2025년 민간클라우드 기반 AI·데이터레이크 활용지원 사업’을 성공적으로 완료했다고 11일 밝혔다.초거대 인공지능(AI) 기술과 데이터레이크 기반 인프라를 활용해 국민의 정책 정보 접근성과 활용도를 높이는 ‘국민 맞춤형 정책정보 교육·홍보 서비스’
중국 APT 그룹 실버폭스, SEO 포이즈닝 이용 가짜 팀즈 설치 프로그램 유포

Thu, 11 Dec 2025 11:34:00 +0900

MS 팀즈 설치로 위장한 밸리RAT 유포…타이포스쿼팅 활용360 토탈 시큐리티·윈도우 디팬더 우회하며 원격제어 지속 권한 확보[보안뉴스 김형근 기자] 보안 기업 릴리아퀘스트가 지난 11월부터 벌어진 중국 해커 그룹의 정교한 사이버 캠페인을 발견했다.이 캠페인은 검색 엔진 최적화(SEO) 포이즈닝 전술을 사용해 마이크로소프트 팀즈 설치 프로그램으로 위장한 악
[유경동의 IP전략] 바나나 쿠팡

Thu, 11 Dec 2025 10:54:00 +0900

특허는 상장(IPO) 심사시 가장 관심 있게 지켜보는 사항중 하나다. 특히 나스닥이나 코스닥, 기술특례 등 테크 기반 기업을 상대로 한 것이라면 더더욱 그렇다.이 과정에서 ‘몰아 출원’(Burst Filing) 현상이 나오곤 한다. IPO를 앞두고 영혼까지 끌어다 특허를 내는 것이다. 문제는 이후다. 요행 상장에 성공한다 해도, 이런 기업들은 특허 출원을
이반티 제품에서 CVSS 9.6 치명적 보안 취약점 발견…긴급 업데이트

Thu, 11 Dec 2025 10:51:00 +0900

임의 파일 쓰기·경로 탐색·서명 검증 취약점까지…원격 코드 실행(RCE) 가능성 제기이반티 “실제 악용 정황 없지만, 즉시 패치 적용해야”[보안뉴스 김형근 기자] 이반티(Ivanti)가 자사 엔드포인트 관리자(EPM) 솔루션에서 발견된 4개의 심각한 보안 취약점을 해결하기 위해 긴급 보안 업데이트를 공식 발표했다.이번 업데이트는 치명적인 취약점 1개와 높은
늘어나는 산업 재해...에스원, ‘AI 기반 안전 솔루션’으로 막는다

Thu, 11 Dec 2025 10:43:00 +0900

SVMS·블루스캔·얼굴인식리더 등 현장 맞춤형 라인업 구축 산재 사망자 증가 추세 속 기술적 안전망 강화 지원[보안뉴스 조재호 기자] 에스원이 최근 증가 추세인 산업재해 대응하기 위해 인공지능(AI) 기술을 적용한 맞춤형 안전 솔루션을 선보였다. 산업재해가 3년 만에 다시 증가세로 돌아서며 기업들의 안전관리 역량이 시험대에 올랐다. 고용노동부에 따르면, 올

From Theori

Building Effective LLM Agents | AI Cyber Challenge

Fri, 08 Aug 2025 19:28:00 GMT

How we learned to build effective LLM agents for hacking at DARPA's AI Cyber Challenge (AIxCC)
AI Cyber Challenge and Theori's RoboDuck

Fri, 08 Aug 2025 19:27:40 GMT

An introduction to DARPA's AI Cyber Challnge and Theori's third place cyber reasoning system
Inside the brain of a hacking robot: Exploring traces | AI Cyber Challenge

Fri, 08 Aug 2025 19:25:46 GMT

Agent trajectory walkthroughs of a fully autonomous hacking system
How to Identify Phishing Scams

Mon, 28 Apr 2025 23:00:00 GMT

Learn how to spot phishing scams with expert tips recognizing suspicious emails, SMS, and fraudulent request for personal information.
Importance of Continuous Security: Lessons from the Bybit Case

Thu, 27 Mar 2025 06:38:06 GMT

In this article, we briefly look at the circumstances of the Bybit incident and discuss what countermeasures could have been implemented. Then, we discuss the limitations of current solutions and how Xint resolves them.
Reviving the modprobe_path Technique: Overcoming search_binary_handler() Patch

Sat, 15 Mar 2025 08:52:16 GMT

A new approach to the Overwriting modprobe_path technique is introduced, addressing changes in the Upstream kernel that prevent triggering via dummy files.
Four Ways to Protect Your Legacy with Theori’s Cybersecurity Solutions

Sun, 16 Feb 2025 15:00:00 GMT

Discover the top cybersecurity threats for 2025 and how Theori's innovative solutions can safeguard your business from evolving cyber risks and costly data breaches.
DeepSeek Security, Privacy, and Governance: Hidden Risks in Open-Source AI

Thu, 06 Feb 2025 15:00:00 GMT

This post examines DeepSeek's security gaps, privacy practices, and open-source AI risks, offering practical advice for users and developers.
The True Cost of Siloed Security Tools

Fri, 20 Dec 2024 09:00:00 GMT

Security silos occur when different security tools, teams, or systems operate in isolation, unable to effectively share data or communicate.
Finding Vulnerabilities in Firmware with Static Analysis Platform QueryX

Wed, 06 Nov 2024 15:00:00 GMT

QueryX, Theori’s program analysis platform, automates variant analysis for vulnerability detection. Learn how its taint analysis module uncovered CVE-2023-39471.
Side Effects: When Continuous Development Introduces Security Threats

Mon, 04 Nov 2024 09:00:00 GMT

Dive into five significant security risks that emerged as unintended consequences of new feature development.
Top 5 Features Your ASM Solution Must Have

Thu, 24 Oct 2024 09:00:00 GMT

So you know what ASM is and why you need it — but which features are crucial? Here’s the run down.
Offensive Security with Large Language Models (2)

Mon, 30 Sep 2024 09:00:00 GMT

How LLMs are changing the game for static analysis — especially when source code is available.
Offensive Security with Large Language Models (1)

Fri, 27 Sep 2024 09:00:00 GMT

Applications of larage language models in offensive security
Winning the AIxCC Qualification Round

Mon, 23 Sep 2024 15:00:00 GMT

Theori’s Cyber Reasoning System (CRS) “Robo Duck” not only cleared the bar to get us $2M and a spot at the AIxCC finals in 2025, it also got the first place among all the submissions in the highly competitive event.
Top Penetration Testing Solutions for IT Security: 2024 Guide

Wed, 11 Sep 2024 09:00:00 GMT

The top 7penetration testing tools of 2024 for hackers and for businesses.
Deep Dive into RCU Race Condition: Analysis of TCP-AO UAF (CVE-2024–27394)

Tue, 03 Sep 2024 15:00:00 GMT

CVE-2024-27394 is a TCP-AO Use-After-Free vulnerability caused by improper RCU API usage. Read the in-depth analysis and reliable triggering technique.
Offensive Security vs. Defensive Security: Navigating the Two Pillars of Cybersecurity

Fri, 30 Aug 2024 09:00:00 GMT

Explore how offensive and defensive security strategies work together to protect against cyber threats.
A Deep Dive into the CoSoSys EndPoint Protector Exploit: Remote Code Execution

Thu, 29 Aug 2024 15:00:00 GMT

Four critical RCE vulnerabilities (CVE-2024-36072 to CVE-2024-36075) in CoSoSys Endpoint Protector were identified, allowing full server and client compromise. Read the full analysis.
Chaining N-days to Compromise All: Part 6 — Windows Kernel LPE: Get SYSTEM

Tue, 21 May 2024 15:00:00 GMT

The final part of the N-day exploit series analyzes CVE-2023-36802, a privilege escalation vulnerability in mskssrv.sys, used to gain SYSTEM access on a VMware host.
Chaining N-days to Compromise All: Part 5 — VMware Workstation Guest-to-Host Escape

Thu, 02 May 2024 15:00:00 GMT

CVE-2023-20869 was exploited to achieve arbitrary code execution on a VMware host from a guest system. Read the full technical analysis.
Chaining N-days to Compromise All: Part 4 — VMware Workstation Information leakage

Wed, 17 Apr 2024 15:00:00 GMT

CVE-2023-34044, a variant of CVE-2023-20870, was exploited to extract critical information from a VMware host process. Read the in-depth analysis.
Chaining N-days to Compromise All: Part 3 — Windows Driver LPE: Medium to System

Mon, 08 Apr 2024 15:00:00 GMT

CVE-2023-29360, a logic bug in the mskssrv.sys driver, was exploited to escalate privileges to SYSTEM in a 1-day full chain attack. Read the detailed breakdown.
Chaining N-days to Compromise All: Part 2 — Windows Kernel LPE (a.k.a Chrome Sandbox Escape)

Sun, 31 Mar 2024 15:00:00 GMT

CVE-2023-21674, a Windows kernel UAF vulnerability, was used to escape the Chrome sandbox in a 1-day full chain exploit. Read the detailed analysis.
Chaining N-days to Compromise All: Part 1 — Chrome Renderer RCE

Sun, 17 Mar 2024 15:00:00 GMT

This post begins our series on the 1-day exploit chain demoed on X, focusing on a Chrome renderer exploit, CVE-2023-3079, a type confusion bug in V8.
Fermium-252 : The Cyber Threat Intelligence Database

Sun, 03 Mar 2024 15:00:00 GMT

Fermium-252 is a premier vulnerability intelligence platform providing real-time tracking of 1-day exploits, PoCs, and in-depth reports. Stay ahead of cyber threats with our expert analysis.
A Deep Dive into V8 Sandbox Escape Technique Used in In-The-Wild Exploit

Thu, 25 Jan 2024 15:00:00 GMT

We bypassed the V8 sandbox using a raw pointer in WasmIndirectFunctionTable, enabling arbitrary write and code execution. Read our deep dive into the exploit.
Exploiting Windows Kernel Wild Copy With User Fault Handling (CVE-2023–28218)

Thu, 09 Nov 2023 15:00:00 GMT

At Hexacon 2023, we presented our Windows kernel security research, uncovering CVE-2023-28218, a heap overflow in afd.sys. Read our exploit analysis and methodology.
NEAT and NES Algorithms

Thu, 20 Apr 2023 15:00:00 GMT

We reverse-engineered NEAT and NES, two unpublished symmetric encryption algorithms from South Korea’s GPKI cryptography library. Read our analysis and implementations.
Linux Kernel Exploit (CVE-2022–32250) with mqueue

Tue, 23 Aug 2022 15:00:00 GMT

We exploited CVE-2022-32250, a use-after-free vulnerability in Linux Netfilter, to achieve root on Ubuntu 22.04. Learn how we bypassed KASLR and modified modprobe_path.
Binary-searching into CVMServer

Thu, 16 Jun 2022 15:00:00 GMT

While analyzing the patch for CVE-2021-30724, we discovered a new uninitialized memory vulnerability (CVE-2022-26721) in macOS's CVMServer. Read our exploitation insights.
Exploiting Safari’s ANGLE Component

Tue, 17 May 2022 15:00:00 GMT

We discovered CVE-2022-26717, an exploitable bug in WebKit's WebGL component affecting Safari on macOS and iOS. Read our analysis and exploitation methodology.
Patch Gapping a Safari Type Confusion

Mon, 24 May 2021 15:00:00 GMT

Safari 14.1 introduced AudioWorklets, but a newly patched type confusion bug left iOS versions vulnerable for weeks. We share our root cause analysis and exploit details.
Compromising virtualization without attacking the hypervisor

Tue, 20 Oct 2020 15:00:00 GMT

Discover CVE-2020-27675 (XSA-331), a denial-of-service and potential out-of-bounds write vulnerability in the Xen paravirtualization driver, and learn how it can impact virtualization security.
Cleanly Escaping the Chrome Sandbox

Sun, 19 Apr 2020 15:00:00 GMT

Learn how we discovered and exploited Issue 1062091, a use-after-free (UAF) vulnerability in Chrome and Chromium-based Edge, leading to a sandbox escape.
Receiving NRSC-5

Thu, 08 Jun 2017 15:00:00 GMT

We have implemented an NRSC-5-C digital radio receiver and released it as open source on GitHub. Explore IBOC-based hybrid broadcasting and security research opportunities.
Chakra JIT CFG Bypass

Tue, 13 Dec 2016 15:00:00 GMT

Learn how attackers bypassed Microsoft's Control Flow Guard (CFG) in Internet Explorer and Edge. We break down our PoC exploit, mitigation bypass, and the MS16-119 patch details.
Patch Analysis of MS16–063 (jscript9.dll)

Sun, 26 Jun 2016 15:00:00 GMT

Microsoft's MS16-063 patch fixed a critical memory corruption vulnerability in jscript9.dll (TypedArray & DataView) affecting Internet Explorer. Read our analysis, vulnerability breakdown, and PoC exploit.
Patch Analysis of CVE-2016–0189

Tue, 21 Jun 2016 15:00:00 GMT

Microsoft's MS16-051 patch addressed a critical Internet Explorer vulnerability (CVE-2016-0189) exploited in South Korea. Explore our in-depth analysis, patch breakdown, and proof-of-concept exploit.

From Dark Reading

Storm-0249 Abuses EDR Processes in Stealthy Attacks

Wed, 10 Dec 2025 21:59:32 GMT

The initial access broker has been weaponizing endpoint detection and response (EDR) platforms and Windows utilities in recent high-precision attacks.
ClickFix Style Attack Uses Grok, ChatGPT for Malware Delivery

Wed, 10 Dec 2025 21:02:30 GMT

A new twist on the social engineering tactic is making waves, combining SEO poisoning and legitimate AI domains to install malware on victims' computers.
Feds: Pro-Russia Hactivists Target US Critical Infrastructure

Wed, 10 Dec 2025 12:56:02 GMT

So far the attacks, which compromise virtual network computing (VNC) connections in OT systems, have not been particularly destructive, but this could change as they evolve.
Japanese Firms Suffer Long Tail of Ransomware Damage

Wed, 10 Dec 2025 00:00:00 GMT

Ransomware actors have targeted manufacturers, retailers, and the Japanese government, with many organizations requiring months to recover.
Microsoft Fixes Exploited Zero Day in Light Patch Tuesday

Tue, 09 Dec 2025 22:24:18 GMT

Proof-of-concept exploit code is publicly available for two other flaws in this month's Patch Tuesday. In total, the company issued patches for more than 1,150 flaws this year.
Packer-as-a-Service Shanya Hides Ransomware, Kills EDR

Tue, 09 Dec 2025 20:10:32 GMT

Shanya is the latest in an emerging field of packing malware, selling obfuscation functionality in order to help ransomware actors reach their target.
Analysts Warn of Cybersecurity Risks in Humanoid Robots

Tue, 09 Dec 2025 16:41:27 GMT

Think "Blade Runner," but the robots can be hacked more easily than your home computer.
Gemini Enterprise No-Click Flaw Exposes Sensitive Data

Tue, 09 Dec 2025 12:08:41 GMT

Google has fixed a critical vulnerability that enabled attackers to add malicious instructions to common documents to exfiltrate sensitive corporate information.
Apache Issues Max-Severity Tika CVE After Patch Miss

Mon, 08 Dec 2025 22:01:47 GMT

The Apache Software Foundation's earlier fix for a critical Tika flaw missed the full scope of the vulnerability, prompting an updated advisory and CVE.
Exploitation Activity Ramps Up Against React2Shell

Mon, 08 Dec 2025 21:41:25 GMT

Attacks against CVE-2025-55182, which began almost immediately after public disclosure last week, have increased as more threat actors take advantage of the flaw.
US Treasury Tracks $4.5B in Ransom Payments since 2013

Mon, 08 Dec 2025 20:21:00 GMT

The US Treasury's Financial Crimes Enforcement Network shared data showing how dramatically ransomware attacks have changed over time.
'Broadside' Mirai Variant Targets Maritime Logistics Sector

Mon, 08 Dec 2025 11:17:12 GMT

"Broadside" is targeting a critical flaw in DVR systems to conduct command injection attacks, which can hijack devices to achieve persistence and move laterally.
Rust Code Delivers Better Security, Also Streamlines DevOps

Fri, 05 Dec 2025 22:01:05 GMT

Software teams at Google and other Rust adopters see safer code when using the memory-safe language, as well as fewer rollbacks and less code review.
India Rolls Back App Mandate Amid Surveillance Concerns

Fri, 05 Dec 2025 20:06:26 GMT

Remember when Apple put that U2 album in everyone's music libraries? India wanted to do that to all of its citizens, but with a cybersecurity app. It wasn't a good idea.
Threat Landscape Grows Increasingly Dangerous for Manufacturers

Fri, 05 Dec 2025 15:34:58 GMT

Manufacturers are the top target for cyberattacks in 2025 because of their still-plentiful cybersecurity gaps and a lack of expertise.
React2Shell Vulnerability Under Attack From China-Nexus Groups

Fri, 05 Dec 2025 15:14:26 GMT

A maximum-severity vulnerability affecting the React JavaScript library has been exploited in the wild, further stressing the need to patch now.
CISOs Should Be Asking These Quantum Questions Today

Fri, 05 Dec 2025 15:00:00 GMT

As quantum quietly moves beyond lab experiment and into production workflows, here's what enterprise security leaders should be focused on, according to Lineswala.
How Agentic AI Can Boost Cyber Defense

Thu, 04 Dec 2025 23:05:15 GMT

Transurban head of cyber defense Muhammad Ali Paracha shares how his team is automating the triaging and scoring of security threats as part of the Black Hat Middle East conference.
A Tale of Two CISOs: Why An Engineering-Focused CISO Can Be a Liability

Thu, 04 Dec 2025 22:13:41 GMT

When hiring a CISO, understand the key difference between engineering and holistic security leaders.
CISA Warns of 'Ongoing' Brickstorm Backdoor Attacks

Thu, 04 Dec 2025 21:58:14 GMT

State-sponsored actors tied to China continue to target VMware vSphere environments at government and technology organizations.
CISA Publishes Security Guidance for Using AI in OT

Thu, 04 Dec 2025 20:46:27 GMT

Global cybersecurity agencies published guidance regarding AI deployments in operational technology, a backbone of critical infrastructure.
ServiceNow's Acquisition of NHI Provider Veza Strengthens Governance Portfolio

Thu, 04 Dec 2025 15:29:11 GMT

The deal, believed to be valued at $1 billion, will bring nonhuman identity access control of agents and machines to ServiceNow's offerings, including its new AI Control Tower.
Student Sells Gov't, University Sites to Chinese Actors

Thu, 04 Dec 2025 14:00:00 GMT

It's the best deal going in cybercrime: fully compromised websites belonging to high-value organizations, for just a couple hundred bucks each.
'MuddyWater' Hackers Target Israeli Orgs With Retro Game Tactic

Thu, 04 Dec 2025 07:00:00 GMT

Iran's top state-sponsored APT is usually rather crass. But in a recent spate of attacks, it tried out some interesting evasion tactics, including delving into Snake, an old-school mobile game.
'ShadyPanda' Hackers Weaponize Millions of Browsers

Wed, 03 Dec 2025 22:06:56 GMT

The China-based cyber-threat group has been quietly using malicious extensions on the Google Chrome and Microsoft Edge marketplaces to spy on millions of users.
Critical React Flaw Triggers Calls for Immediate Action

Wed, 03 Dec 2025 21:51:03 GMT

The vulnerability, which was assigned two CVEs with maximum CVSS scores of 10, may affect more than a third of cloud service providers.
GISEC GLOBAL 2026 – The Middle East & Africa’s Largest Cybersecurity Event
Arizona AG Sues Temu Over 'Stealing' User Data

Wed, 03 Dec 2025 21:00:58 GMT

The suit alleges the Chinese retailer's app secretly accesses and harvests users' sensitive information without their knowledge or consent.
The Ransomware Holiday Bind: Burnout or Be Vulnerable

Wed, 03 Dec 2025 13:52:29 GMT

Ransomware groups target enterprises during off-hours, weekends, and holidays when security teams are stretched thin and response times lag.
AI Bolsters Python Variant of Brazilian WhatsApp Attacks

Wed, 03 Dec 2025 10:56:24 GMT

Water Saci has upgraded its self-propagating malware to compromise banks and cryptocurrency exchanges by targeting enterprise users of the popular chat app.
China Researches Ways to Disrupt Satellite Internet

Wed, 03 Dec 2025 02:00:00 GMT

While satellite constellations — such as Starlink — are resilient, 2,000 drones could cut communications to a region the size of Taiwan, researchers find.
While ECH Adoption Is Low, Risks Remain for Enterprises, End Users

Tue, 02 Dec 2025 23:32:08 GMT

Is the new privacy protocol helping malicious actors more than Internet users?
Iran's 'MuddyWater' Levels Up With MuddyViper Backdoor

Tue, 02 Dec 2025 21:39:21 GMT

New Fooder loader and memory-only tactics suggest MuddyWater has evolved from its usual noisy ops to more stealthy espionage operations.
Researchers Use Poetry to Jailbreak AI Models

Tue, 02 Dec 2025 20:24:36 GMT

When prompts were presented in poetic rather than prose form, attack success rates increased from 8% to 43%, on average — a fivefold increase.
New Raptor Framework Uses Agentic Workflows to Create Patches

Tue, 02 Dec 2025 15:16:26 GMT

Researchers used prompts and large language models to develop an open source AI framework capable of generating both vulnerability exploits and patches.
DPRK's 'Contagious Interview' Spawns Malicious Npm Package Factory

Tue, 02 Dec 2025 13:02:14 GMT

North Korean attackers have delivered more than 197 malicious packages with 31K-plus downloads since Oct. 10, as part of ongoing state-sponsored activity to compromise software developers.
Tomiris Unleashes 'Havoc' With New Tools, Tactics

Mon, 01 Dec 2025 22:06:19 GMT

The Russian-speaking group is targeting government and diplomatic entities in CIS member states and Central Asia in its latest cyber-espionage campaign.
CodeRED Emergency Alert Platform Shut Down Following Cyberattack

Mon, 01 Dec 2025 21:24:39 GMT

The Inc ransomware gang took responsibility for the attack earlier this month and claimed it stole sensitive subscriber data.
Police Disrupt 'Cryptomixer,' Seize Millions in Crypto

Mon, 01 Dec 2025 20:07:00 GMT

Multiple European law enforcement agencies recently disrupted Cryptomixer, a service allegedly used by cybercriminals to launder ill-gotten gains from ransomware and other cyber activities.
Shai-hulud 2.0 Variant Threatens Cloud Ecosystem

Mon, 01 Dec 2025 11:10:12 GMT

The latest attack from the self-replicating npm-package poisoning worm can also steal credentials and secrets from AWS, Google Cloud Platform, and Azure.
Digital Fraud at Industrial Scale: 2025 Wasn't Great

Wed, 26 Nov 2025 17:06:03 GMT

Advanced fraud attacks surged 180% in 2025 as cyber scammers used generative AI to churn out flawless IDs, deepfakes, and autonomous bots at levels never before seen.
'Dark LLMs' Aid Petty Criminals, But Underwhelm Technically

Wed, 26 Nov 2025 16:01:35 GMT

As in the wider world, AI is not quite living up to the hype in the cyber underground. But it's definitely helping low-level cybercriminals do competent work.
Prompt Injections Loom Large Over ChatGPT's Atlas Browser

Wed, 26 Nov 2025 15:52:49 GMT

It's the law of unintended consequences: equipping browsers with agentic AI opens the door to an exponential volume of prompt injections.
How Malware Authors Are Incorporating LLMs to Evade Detection

Wed, 26 Nov 2025 15:12:05 GMT

Cyberattackers are integrating large language models (LLMs) into malware, running prompts at runtime to evade detection and augment their code on demand.
Enterprises Aren't Confident They Can Secure Non-Human Identities (NHIs)

Wed, 26 Nov 2025 15:00:00 GMT

More than half of organizations surveyed aren't sure they can secure non-human identities (NHIs), underscoring the lag between the rollout of these identities and the tools to protect them.
Iran Exploits Cyber Domain to Aid Kinetic Strikes

Wed, 26 Nov 2025 05:30:00 GMT

The country deploys "cyber-enabled kinetic targeting" prior to — and following — real-world missile attacks against ships and land-based targets.
Advanced Security Isn't Stopping Ancient Phishing Tactics

Tue, 25 Nov 2025 22:23:05 GMT

New research reveals that sophisticated phishing attacks consistently bypass traditional enterprise security measures.
Cheap Hardware Module Bypasses AMD, Intel Memory Encryption

Tue, 25 Nov 2025 22:11:24 GMT

Researchers built an inexpensive device that circumvents chipmakers' confidential computing protections and reveals weaknesses in scalable memory encryption.
DPRK's FlexibleFerret Tightens macOS Grip

Tue, 25 Nov 2025 21:39:03 GMT

The actor behind the "Contagious Interview" campaign is continuing to refine its tactics and social engineering scams to wrest credentials from macOS users.
With Friends Like These: China Spies on Russian IT Orgs

Tue, 25 Nov 2025 15:59:04 GMT

State-linked hackers stayed under the radar by using a variety of commercial cloud services for command-and-control communications.

From Cyber Security News

Windows Defender Firewall Service Vulnerability Let Attackers Disclose Sensitive Data

Thu, 11 Dec 2025 04:15:59 +0000

A critical information disclosure vulnerability in Windows Defender Firewall Service, which could allow authorized attackers to access sensitive heap memory on affected systems. The vulnerability, tracked as CVE-2025-62468, was assigned an Important severity rating and released on December 9, 2025. The flaw stems from an out-of-bounds read condition in the Windows Defender Firewall Service component. […] The post Windows Defender Firewall Service Vulnerability Let Attackers Disclose Sensitive Data appeared first on Cyber Security News.
Adobe Acrobat Reader Vulnerabilities Let Attackers Execute Arbitrary Code and Bypass Security

Thu, 11 Dec 2025 03:37:52 +0000

Critical security updates for Acrobat and Reader are available, addressing multiple vulnerabilities that could allow attackers to execute arbitrary code and bypass essential security features. Adobe issued security bulletin APSB25-119 on December 9, 2025, with a priority rating of 3, affecting both Windows and macOS platforms. The vulnerabilities stem from multiple weaknesses in the PDF processing engine. […] The post Adobe Acrobat Reader Vulnerabilities Let Attackers Execute Arbitrary Code and Bypass Security appeared first on Cyber Security News.
Google Warns of Chrome 0-Day Vulnerability Actively Exploited in the wild

Thu, 11 Dec 2025 03:34:25 +0000

Google has released an urgent security update for the Chrome browser to address a high-severity zero-day vulnerability that is currently being exploited in the wild. This emergency patch is part of the latest Stable channel update, bringing the version to 143.0.7499.109/.110 for Windows and Mac, and 143.0.7499.109 for Linux users. The tech giant confirmed in […] The post Google Warns of Chrome 0-Day Vulnerability Actively Exploited in the wild appeared first on Cyber Security News.
Critical Ivanti EPM Vulnerability Allows Admin Session Hijacking via Stored XSS

Wed, 10 Dec 2025 17:36:41 +0000

A critical stored cross-site scripting vulnerability in Ivanti Endpoint Manager (“EPM”) versions 2024 SU4 and below, that could enable attackers to hijack administrator sessions without authentication. The vulnerability, identified as CVE-2025-10573, has been assigned a CVSS score of 9.6 and patched on December 9, 2025, with the release of Ivanti EPM version 2024 SU4 SR1. […] The post Critical Ivanti EPM Vulnerability Allows Admin Session Hijacking via Stored XSS appeared first on Cyber Security News.
Over 644,000 Domains Exposed to Critical React Server Components Vulnerability

Wed, 10 Dec 2025 16:49:02 +0000

The Shadowserver Foundation has released alarming new data regarding the exposure of web applications to CVE-2025-55182, a critical vulnerability affecting React Server Components. Following significant improvements to their scanning methodologies, researchers have identified a massive attack surface comprising over 165,000 unique IP addresses and more than 644,000 domains hosting vulnerable code as of December 8, […] The post Over 644,000 Domains Exposed to Critical React Server Components Vulnerability appeared first on Cyber Security News.
New Spiderman Phishing Kit Lets Attackers Create Malicious Bank Login Pages in Few Clicks

Wed, 10 Dec 2025 16:10:16 +0000

A sophisticated new phishing framework dubbed “Spiderman” has emerged in the cybercrime underground, dramatically lowering the barrier to entry for financial fraud. This toolkit, observed by Varonis, allows threat actors, even those with minimal technical skill, to spin up pixel-perfect replicas of legitimate banking portals in just a few clicks. The kit targets customers of […] The post New Spiderman Phishing Kit Lets Attackers Create Malicious Bank Login Pages in Few Clicks appeared first on Cyber Security News.
What’s Next for SOC in 2026: Get the Early-Adopter Advantage

Wed, 10 Dec 2025 14:33:41 +0000

Cybersecurity is about to hit a turning point in 2026. Attackers aren’t only testing AI but also building campaigns around it. Their tooling is getting faster, more adaptive, and far better at mimicking user behavior, from reconnaissance to phishing to initial access. The Shift is Already Underway With geopolitical tension rising and technology accelerating, SOCs are entering a period where both […] The post What’s Next for SOC in 2026: Get the Early-Adopter Advantage appeared first on Cyber Security News.
Threat Actors Weaponize ChatGPT and Grok Conversations to Deploy AMOS Stealer

Wed, 10 Dec 2025 12:13:06 +0000

Threat actors are now leveraging the trust users place in AI platforms like ChatGPT and Grok to distribute the Atomic macOS Stealer (AMOS). A new campaign discovered by Huntress on December 5, 2025, reveals that attackers have moved beyond mimicking trusted brands to actively utilizing legitimate AI services to host malicious payloads. The infection chain […] The post Threat Actors Weaponize ChatGPT and Grok Conversations to Deploy AMOS Stealer appeared first on Cyber Security News.
Microsoft Outlook Vulnerability Let Attackers Execute Malicious Code Remotely

Wed, 10 Dec 2025 11:22:23 +0000

Microsoft has patched a critical remote code execution (RCE)vulnerability in Outlook that could allow attackers to execute malicious code on vulnerable systems. The flaw, tracked as CVE-2025-62562, was released on December 9, 2025, and requires immediate attention from IT administrators and end users. The vulnerability stems from a use-after-free weakness in Microsoft Office Outlook. According […] The post Microsoft Outlook Vulnerability Let Attackers Execute Malicious Code Remotely appeared first on Cyber Security News.
North Korean Hackers Exploit React2Shell Vulnerability in the Wild to Deploy EtherRAT

Wed, 10 Dec 2025 11:00:28 +0000

A novel, highly sophisticated malware strain targeting vulnerable React Server Components, signaling a significant evolution in how state-sponsored threat actors are exploiting the critical React2Shell vulnerability disclosed just days earlier. On December 5, 2025, just two days after the disclosure of the maximum-severity vulnerability CVE-2025-55182 (dubbed “React2Shell”), the Sysdig Threat Research Team (TRT) discovered a […] The post North Korean Hackers Exploit React2Shell Vulnerability in the Wild to Deploy EtherRAT appeared first on Cyber Security News.