Category: Security

Indian tech giant Tata Technologies hit by ransomware attack Tata Technologies Ltd. had to suspend some of its IT services following a ransomware attack that impacted the company network. […] Bill Toulas Go to bleepingcomputer

Globe Life data breach may impact an additional 850,000 clients Insurance giant Globe Life finished the investigation into the data breach it suffered last June and says that the incident may have impacted an additional 850,000 customers. […] Bill Toulas Go to bleepingcomputer

Mizuno USA says hackers stayed in its network for two months ​Mizuno USA, a subsidiary of Mizuno Corporation, one of the world’s largest sporting goods manufacturers, confirmed in data breach notification letters that unknown attackers stole files from its network between August and October 2024. […] Sergiu Gatlan Go to bleepingcomputer

New Aquabotv3 botnet malware targets Mitel command injection flaw A new variant of the Mirai-based botnet malware Aquabot has been observed actively exploiting CVE-2024-41710, a command injection vulnerability in Mitel SIP phones. […] Bill Toulas Go to bleepingcomputer

Laravel admin package Voyager vulnerable to one-click RCE flaw Three vulnerabilities discovered in the open-source PHP package Voyager for managing Laravel applications could be used for remote code execution attacks. […] Bill Toulas Go to bleepingcomputer

FBI seizes Cracked.io, Nulled.to hacking forums in Operation Talent The FBI has seized the domains for the infamous Cracked.io and Nulled.to hacking forums, which are known for their focus on cybercrime, password theft, cracking, and credential stuffing attacks. […] Sergiu Gatlan Go to bleepingcomputer

Hackers exploiting flaws in SimpleHelp RMM to breach networks Hackers are believed to be exploiting recently fixed SimpleHelp Remote Monitoring and Management (RMM) software vulnerabilities to gain initial access to target networks. […] Bill Toulas Go to bleepingcomputer

Engineering giant Smiths Group discloses security breach London-based engineering giant Smiths Group disclosed a security breach after unknown attackers gained access to the company’s systems. […] Sergiu Gatlan Go to bleepingcomputer

DeepSeek halts new signups amid “large-scale” cyberattack Chinese AI platform DeepSeek has disabled registrations on it DeepSeek-V3 chat platform due to an ongoing “large-scale” cyberattack targeting its services. […] Lawrence Abrams Go to bleepingcomputer

EU sanctions Russian GRU hackers for cyberattacks against Estonia The European Union sanctioned three hackers, part of Unit 29155 of Russia’s military intelligence service (GRU), for their involvement in cyberattacks targeting Estonia’s government agencies in 2020. […] Sergiu Gatlan Go to bleepingcomputer

UnitedHealth now says 190 million impacted by 2024 data breach UnitedHealth has revealed that 190 million Americans had their personal and healthcare data stolen in the Change Healthcare ransomware attack, nearly doubling the previously disclosed figure. […] Lawrence Abrams Go to bleepingcomputer

Ransomware gang uses SSH tunnels for stealthy VMware ESXi access Ransomware actors targeting ESXi bare metal hypervisors are leveraging SSH tunneling to persist on the system while remaining undetected. […] Bill Toulas Go to bleepingcomputer

TalkTalk investigates breach after data for sale on hacking forum UK telecommunications company TalkTalk is investigating a third-party supplier data breach after a threat actor began selling alleged customer data on a hacking forum. […] Lawrence Abrams Go to bleepingcomputer

Subaru Starlink flaw let hackers hijack cars in US and Canada Security researchers have discovered an arbitrary account takeover flaw in Subaru’s Starlink service that could let attackers track, control, and hijack vehicles in the United States, Canada, and Japan using just a license plate. […] Sergiu Gatlan Go to bleepingcomputer

Hacker infects 18,000 “script kiddies” with fake malware builder A threat actor targeted low-skilled hackers, known as “script kiddies,” with a fake malware builder that secretly infected them with a backdoor to steal data and take over computers. […] Bill Toulas Go to bleepingcomputer

FBI: North Korean IT workers steal source code to extort employers The FBI warned today that North Korean IT workers are abusing their access to steal source code and extort U.S. companies that have been tricked into hiring them. […] Sergiu Gatlan Go to bleepingcomputer

Hundreds of fake Reddit sites push Lumma Stealer malware Hackers are distributing close to 1,000 web pages mimicking Reddit and the WeTransfer file sharing service that lead to downloading the Lumma Stealer malware. […] Bill Toulas Go to bleepingcomputer

QNAP fixes six Rsync vulnerabilities in NAS backup, recovery app QNAP has fixed six rsync vulnerabilities that could let attackers gain remote code execution on unpatched Network Attached Storage (NAS) devices. […] Sergiu Gatlan Go to bleepingcomputer

Critical zero-days impact premium WordPress real estate plugins The RealHome theme and the Easy Real Estate plugins for WordPress are vulnerable to two critical severity flaws that allow unauthenticated users to gain administrative privileges. […] Bill Toulas Go to bleepingcomputer

Cloudflare CDN flaw leaks user location data, even through secure chat apps A security researcher discovered a flaw in Cloudflare’s content delivery network (CDN), which could expose a person’s general location by simply sending them an image on platforms like Signal and Discord. […] Bill Toulas Go to bleepingcomputer

Telegram captcha tricks you into running malicious PowerShell scripts Threat actors on X are exploiting the news around Ross Ulbricht to direct unsuspecting users to a Telegram channel that tricks them into executing PowerShell code that infects them with malware. […] Bill Toulas Go to bleepingcomputer

Cisco warns of denial of service flaw with PoC exploit code Cisco has released security updates to patch a ClamAV denial-of-service (DoS) vulnerability, which has proof-of-concept (PoC) exploit code. […] Sergiu Gatlan Go to bleepingcomputer

PowerSchool hacker claims they stole data of 62 million students The hacker who breached education tech giant PowerSchool claimed in an extortion demand that they stole the personal data of 62.4 million students and 9.5 million teachers. […] Lawrence Abrams Go to bleepingcomputer

Cloudflare mitigated a record-breaking 5.6 Tbps DDoS attack The largest distributed denial-of-service (DDoS) attack to date peaked at 5.6 terabits per second and came from a Mirai-based botnet with 13,000 compromised devices. […] Bill Toulas Go to bleepingcomputer

7-Zip fixes bug that bypasses Windows MoTW security warnings, patch now ​A high-severity vulnerability in the 7-Zip file archiver allows attackers to bypass the Mark of the Web (MotW) Windows security feature and execute code on users’ computers when extracting malicious files from nested archives. […] Sergiu Gatlan Go to bleepingcomputer

HPE investigates breach as hacker claims to steal source code Hewlett Packard Enterprise (HPE) is investigating claims of a new breach after a threat actor said they stole documents from the company’s developer environments. […] Sergiu Gatlan Go to bleepingcomputer

Star Blizzard hackers abuse WhatsApp to target high-value diplomats Russian nation-state actor Star Blizzard has been running a new spear-phishing campaign to compromise WhatsApp accounts of targets in government, diplomacy, defense policy, international relations, and Ukraine aid organizations. […] Bill Toulas Go to bleepingcomputer

Otelier data breach exposes info, hotel reservations of millions Hotel management platform Otelier suffered a data breach after threat actors breached its Amazon S3 cloud storage to steal millions of guests’ personal information and reservations for well-known hotel brands like Marriott, Hilton, and Hyatt. […] Lawrence Abrams Go to bleepingcomputer

Malicious PyPi package steals Discord auth tokens from devs A malicious package named ‘pycord-self’ on the Python package index (PyPI) targets Discord developers to steal authentication tokens and plant a backdoor for remote control over the system. […] Bill Toulas Go to bleepingcomputer

W3 Total Cache plugin flaw exposes 1 million WordPress sites to attacks A severe flaw in the W3 Total Cache plugin installed on more than one million WordPress sites could give attackers access to various information, including metadata on cloud-based apps. […] Bill Toulas Go to bleepingcomputer

Microsoft expands testing of Windows 11 admin protection feature Microsoft has expanded its Windows 11 administrator protection tests, allowing Insiders to enable the security feature from the Windows Security settings. […] Sergiu Gatlan Go to bleepingcomputer

US cracks down on North Korean IT worker army with more sanctions The U.S. Treasury Department has sanctioned a network of individuals and front companies linked to North Korea’s Ministry of National Defense that have generated revenue via illegal remote IT work schemes. […] Sergiu Gatlan Go to bleepingcomputer

Biden signs executive order to bolster national cybersecurity Days before leaving office, President Joe Biden signed an executive order to shore up the United States’ cybersecurity by making it easier to sanction hacking groups targeting federal agencies and the nation’s critical infrastructure. […] Sergiu Gatlan Go to bleepingcomputer

Hackers leak configs and VPN credentials for 15,000 FortiGate devices A new hacking group has leaked the configuration files, IP addresses, and VPN credentials for over 15,000 FortiGate devices for free on the dark web, exposing a great deal of sensitive technical information to other cybercriminals. […] Lawrence Abrams Go to bleepingcomputer

SAP fixes critical vulnerabilities in NetWeaver application servers SAP has fixed two critical vulnerabilities affecting NetWeaver web application server that could be exploited to escalate privileges and access restricted information. […] Bill Toulas Go to bleepingcomputer

MikroTik botnet uses misconfigured SPF DNS records to spread malware A newly discovered botnet of 13,000 MikroTik devices uses a misconfiguration in domain name server records to bypass email protections and deliver malware by spoofing roughly 20,000 web domains. […] Bill Toulas Go to bleepingcomputer

Label giant Avery says website hacked to steal credit cards Avery Products Corporation is warning it suffered a data breach after its website was hacked to steal customers’ credit cards and personal information. […] Bill Toulas Go to bleepingcomputer

WP3.XYZ malware attacks add rogue admins to 5,000+ WordPress sites A new malware campaign has compromised more than 5,000 WordPress sites to create admin accounts, install a malicious plugin, and steal data. […] Bill Toulas Go to bleepingcomputer

CISA orders agencies to patch BeyondTrust bug exploited in attacks ​CISA tagged a vulnerability in BeyondTrust’s Privileged Remote Access (PRA) and Remote Support (RS) as actively exploited in attacks, ordering agencies to secure their systems within three weeks. […] Sergiu Gatlan Go to bleepingcomputer

Fake LDAPNightmware exploit on GitHub spreads infostealer malware A deceptive proof-of-concept (PoC) exploit for CVE-2024-49113 (aka “LDAPNightmare”) on GitHub infects users with infostealer malware that exfiltrates sensitive data to an external FTP server. […] Bill Toulas Go to bleepingcomputer

Telefónica confirms internal ticketing system breach after data leak Spanish telecommunications company Telefónica confirms its internal ticketing system was breached after stolen data was leaked on a hacking forum. […] Lawrence Abrams Go to bleepingcomputer

US charges operators of cryptomixers linked to ransomware gangs The U.S. Department of Justice indicted three operators of sanctioned Blender.io and Sinbad.io crypto mixer services used by ransomware gangs and North Korean hackers to launder ransoms and stolen cryptocurrency. […] Sergiu Gatlan Go to bleepingcomputer

Treasury hackers also breached US foreign investments review office Chinese hackers, part of the state-backed Silk Typhoon threat group, have reportedly breached the Committee on Foreign Investment in the United States (CFIUS), which reviews foreign investments to determine national security risks. […] Sergiu Gatlan Go to bleepingcomputer

Docker Desktop blocked on Macs due to false malware alert Docker is warning that Docker Desktop is not starting on macOS due to malware warnings after some files were signed with an incorrect code-signing certificate. […] Bill Toulas Go to bleepingcomputer

Fake CrowdStrike job offer emails target devs with crypto miners CrowdStrike is warning that a phishing campaign is impersonating the cybersecurity company in fake job offer emails to trick targets into infecting themselves with a Monero cryptocurrency miner (XMRig). […] Bill Toulas Go to bleepingcomputer

Banshee stealer evades detection using Apple XProtect encryption algo A new version of the Banshee info-stealing malware for macOS has been evading detection over the past two months by adopting string encryption from Apple’s XProtect. […] Bill Toulas Go to bleepingcomputer

Unpatched critical flaws impact Fancy Product Designer WordPress plugin Premium WordPress plugin Fancy Product Designer from Radykal is vulnerable to two critical severity flaws that remain unfixed in the current latest version. […] Bill Toulas Go to bleepingcomputer

Ivanti warns of new Connect Secure flaw used in zero-day attacks Ivanti is warning that a new Connect Secure remote code execution vulnerability tracked as CVE-2025-0282 was exploited in zero-day attacks to install malware on appliances. […] Lawrence Abrams Go to bleepingcomputer

Russian ISP confirms Ukrainian hackers “destroyed” its network Russian internet service provider Nodex confirmed on Tuesday that its network was “destroyed” in a cyberattack claimed by Ukrainian hacktivists part of the Ukrainian Cyber Alliance […] Sergiu Gatlan Go to bleepingcomputer

SonicWall urges admins to patch exploitable SSLVPN bug immediately SonicWall is emailing customers urging them to upgrade their firewall’s SonicOS firmware to patch an authentication bypass vulnerability in SSL VPN and SSH management that is “susceptible to actual exploitation.” […] Bill Toulas Go to bleepingcomputer

Hackers exploit KerioControl firewall flaw to steal admin CSRF tokens Hackers are trying to exploit CVE-2024-52875, a critical CRLF injection vulnerability that leads to 1-click remote code execution (RCE) attacks in GFI KerioControl firewall product. […] Bill Toulas Go to bleepingcomputer

PowerSchool hack exposes student, teacher data from K-12 districts Education software giant PowerSchool has confirmed it suffered a cybersecurity incident that allowed a threat actor to steal the personal information of students and teachers from school districts using its PowerSchool SIS platform. […] Lawrence Abrams Go to bleepingcomputer

Casio says data of 8,500 people exposed in October ransomware attack Japanese electronics manufacturer Casio says that the October 2024 ransomware incident exposed the personal data of approximately 8,500 people. […] Bill Toulas Go to bleepingcomputer

New Mirai botnet targets industrial routers with zero-day exploits A relatively new Mirai-based botnet has been growing in sophistication and is now leveraging zero-day exploits for security flaws in industrial routers and smart home devices. […] Bill Toulas Go to bleepingcomputer

US govt launches cybersecurity safety label for smart devices ​Today, the White House announced the launch of the U.S. Cyber Trust Mark, a new cybersecurity safety label for internet-connected consumer devices. […] Sergiu Gatlan Go to bleepingcomputer

BIOS flaws expose iSeq DNA sequencers to bootkit attacks BIOS/UEFI vulnerabilities in the iSeq 100 DNA sequencer from U.S. biotechnology company Illumina could let attackers disable devices used for detecting illnesses and developing vaccines. […] Ionut Ilascu Go to bleepingcomputer

CISA says recent government hack limited to US Treasury The U.S. Cybersecurity and Infrastructure Security Agency (CISA) said today that the Treasury Department breach disclosed last week did not impact other federal agencies. […] Sergiu Gatlan Go to bleepingcomputer

Chinese hackers also breached Charter and Windstream networks ​More U.S. companies have been added to the list of telecommunications firms hacked in a wave of breaches by a Chinese state-backed threat group tracked as Salt Typhoon. […] Sergiu Gatlan Go to bleepingcomputer

Eagerbee backdoor deployed against Middle Eastern govt orgs, ISPs New variants of the Eagerbee malware framework are being deployed against government organizations and internet service providers (ISPs) in the Middle East. […] Bill Toulas Go to bleepingcomputer

Nuclei flaw lets malicious templates bypass signature verification A now-fixed vulnerability in the open-source vulnerability scanner Nuclei could potentially allow attackers to bypass signature verification while sneaking malicious code into templates that execute on local systems. […] Lawrence Abrams Go to bleepingcomputer

Bad Tenable plugin updates take down Nessus agents worldwide Tenable says customers must manually upgrade their software to revive Nessus vulnerability scanner agents taken offline on December 31st due to buggy differential plugin updates. […] Sergiu Gatlan Go to bleepingcomputer

US sanctions Chinese company linked to Flax Typhoon hackers ​The U.S. Treasury Department has sanctioned Beijing-based cybersecurity company Integrity Tech (also known as Yongxin Zhicheng) for its involvement in cyberattacks attributed to the Chinese state-sponsored Flax Typhoon hacking group. […] Sergiu Gatlan Go to bleepingcomputer

Malicious npm packages target Ethereum developers’ private keys Twenty malicious packages impersonating the Hardhat development environment used by Ethereum developers are targeting private keys and other sensitive data. […] Bill Toulas Go to bleepingcomputer

French govt contractor Atos denies Space Bears ransomware attack claims French tech giant Atos, which secures communications for the country’s military and secret services, has denied claims made by the Space Bears ransomware gang that they compromised one of its databases. […] Sergiu Gatlan Go to bleepingcomputer

Ransomware gang leaks data stolen in Rhode Island’s RIBridges Breach The Brain Cipher ransomware gang has begun to leak documents stolen in an attack on Rhode Island’s “RIBridges” social services platform. […] Lawrence Abrams Go to bleepingcomputer

New DoubleClickjacking attack exploits double-clicks to hijack accounts A new variation of clickjacking attacks called “DoubleClickjacking” lets attackers trick users into authorizing sensitive actions using double-clicks while bypassing existing protections against these types of attacks. […] Lawrence Abrams Go to bleepingcomputer