1010.cx

  • Cybersecurity Newsletter Weekly – AWS Outage, WSUS Exploitation, Chrome Flaws, and RDP Attacks

    ·

    , ,

    Welcome to this week’s edition of the Cybersecurity Newsletter, where we dissect the latest threats, vulnerabilities, and disruptions shaping the digital landscape.

    As organizations navigate an increasingly complex threat environment, staying ahead of emerging risks has never been more critical.

    This week, we’re zeroing in on major incidents that underscore the fragility of cloud infrastructure, legacy update systems, and everyday browsing tools—from widespread service interruptions to sophisticated exploitation chains.

    Leading the headlines is the recent AWS outage that rippled across global services, leaving businesses scrambling. On October 20, 2025, a configuration error in Amazon Web Services’ US-East-1 region triggered a cascade failure, impacting everything from e-commerce platforms to streaming services.

    Reports indicate over 12 hours of downtime for key APIs, with cascading effects on dependent services like Netflix and Slack. While AWS cited a “networking misconfiguration” as the root cause, experts warn this highlights ongoing challenges in multi-region redundancy and automated failover mechanisms.

    In our deep dive, we explore the technical fallout, affected sectors, and best practices for building resilient cloud architectures to mitigate similar disruptions.

    Shifting to exploitation tactics, attackers are ramping up abuse of Windows Server Update Services (WSUS), Microsoft’s long-standing patch management framework. Security firm Mandiant disclosed a new campaign where threat actors leverage WSUS to deploy malware via tampered updates, bypassing endpoint detection.

    This WSUS exploitation technique, tracked as a variant of the “Living off the Land” strategy, has hit enterprises in finance and healthcare, with initial infections traced to phishing lures. CVEs like CVE-2025-29876 enable remote code execution if servers aren’t hardened. We’ll break down the attack vector, indicators of compromise, and hardening steps, including segmenting update servers and enabling WSUS signing enforcement.

    Finally, browser and AI security take center stage with flaws in Google Chrome and OpenAI’s ChatGPT Atlas plugin. Chrome’s CVE-2025-47219, a high-severity type confusion bug in the V8 engine, allows sandbox escapes and has been actively exploited in the wild, per Google’s advisory.

    Meanwhile, ChatGPT’s Atlas, a mapping tool for threat intelligence, suffers from an API key exposure flaw (CVE-2025-31942) that could leak user data. These vulnerabilities remind us that even cutting-edge tools aren’t immune. Our analysis covers patch timelines, zero-day risks, and tips for secure browser extensions.

    Threats

    Malicious WhatsApp Extensions in Chrome Store

    Cybersecurity researchers identified 131 fraudulent Chrome extensions posing as WhatsApp Web automation tools, all sharing the same codebase to enable unauthorized bulk messaging and scheduling. These extensions inject scripts into WhatsApp’s interface, bypassing rate limits and anti-spam measures while exploiting Manifest V3 for background operations. Marketed to small businesses in regions like Brazil, they use remote configurations for dynamic updates and employ evasion tactics such as randomized sends and periodic syncs to persist despite policy violations. The campaign operates via a reseller model, with all extensions still active as of mid-October 2025.​

    Read more: https://cybersecuritynews.com/131-malicious-extensions-targeting-whatsapp/

    GlassWorm Malware Targets VS Code Extensions

    A new self-propagating malware called GlassWorm has compromised over 35,800 VS Code extension installations on the OpenVSX Marketplace by hiding malicious code with invisible Unicode characters. Initially detected in the “CodeJoy” extension, it steals credentials from platforms like npm, GitHub, and 49 cryptocurrency wallets, then hijacks more extensions to spread. The campaign uses Solana blockchain for resilient C2 infrastructure, with fallbacks like Google Calendar, allowing real-time adaptations. This technique evades visual reviews and static analysis, turning infected devices into proxy nodes for further attacks.​

    Read more: https://cybersecuritynews.com/new-glassworm-using-invisible-code/

    Salt Typhoon Exploits Zero-Day Vulnerabilities

    China-linked APT group Salt Typhoon has conducted intrusions leveraging zero-day flaws, including a Citrix vulnerability, targeting telecommunications providers in Europe and the US. The group, attributed to China’s Ministry of State Security, uses supply chain compromises and unpatched weaknesses like ProxyLogon to infiltrate networks, enabling lateral movement and data exfiltration from critical infrastructure. Attacks involve custom tools for privilege escalation and stealth persistence, compromising entities across 12 sectors with stolen configuration files and credentials. Many exploited CVEs, such as those in Ivanti and Fortinet, remain unpatched in high percentages of environments.​

    Read more: https://cybersecuritynews.com/salt-typhoon-using-zero-day/

    Rust-Based ChaosBot Malware Emerges

    A new Rust-written backdoor named ChaosBot is targeting corporate networks via phishing with malicious LNK files, using Discord for covert C2 communications. It masquerades as Microsoft Edge processes, abuses service accounts for persistence, and includes anti-VM checks like VMware detection to evade analysis. Deployed through compromised credentials and WMI execution, ChaosBot enables reconnaissance, command execution, and data exfiltration while blending traffic with legitimate Discord activity. Its lightweight design and ETW patching make it resilient against endpoint protections.​

    Read more: https://cybersecuritynews.com/new-rust-based-chaosbot-malware/

    Rise of Stealer Malware Campaigns

    Threat actors are increasingly deploying info-stealer malwares like Stealerium, Lumma, and Atomic to harvest credentials from browsers, wallets, and apps at scale. Open-source variants such as Stealerium and Phantom allow opportunistic cybercriminals to modify and distribute payloads, targeting both Windows and macOS with techniques like AppleScript for data extraction. These stealers facilitate identity theft for ransomware or further attacks, with campaigns surging in 2025 via GitHub downloads and MaaS models. Adversaries sell captured data on underground markets, emphasizing the need for robust endpoint monitoring.​

    Read more: https://cybersecuritynews.com/threat-actors-with-stealer-malwares/

    Advanced Email Phishing Techniques Proliferate

    Cybercriminals are enhancing email phishing with QR codes in PDFs, password-protected attachments, and revived calendar invites to bypass filters and mobile security gaps. These multi-stage attacks use trusted file-sharing services and live API calls to harvest credentials, often mimicking secure communications from brands. In 2025, tactics like Axios abuse for session hijacking and deepfakes have boosted success rates by 241%, targeting remote workers and executives. AI-driven personalization scales these threats, combining email with voice and video for convincing social engineering.​

    Read more: https://cybersecuritynews.com/threat-actors-advancing-email-phishing-attacks/

    SideWinder APT Deploys ClickOnce Malware

    India-linked SideWinder APT group has launched a phishing campaign using malicious PDFs and ClickOnce apps to deploy StealerBot espionage malware against South Asian diplomatic targets. The infection chain abuses signed MagTek applications for DLL sideloading, leading to fileless payloads via process injection and geofenced delivery. Evolving from Word docs to this PDF/ClickOnce method, it includes dynamic URLs and brief payload windows to hinder analysis. The malware focuses on credential theft and intelligence gathering in sectors like government and maritime.​

    Read more: https://cybersecuritynews.com/sidewinder-hacking-group-uses-clickonce-based-infection-chain/

    Cyber Attacks

    RDP Services Targeted by Massive Botnet

    A coordinated botnet campaign has been exploiting Microsoft Remote Desktop Protocol services using over 30,000 new IP addresses daily to probe for timing-based vulnerabilities in RD Web Access and RDP web client authentication. Since September 2025, unique IPs have exceeded 500,000, with a focus on U.S. systems and origins primarily from Brazil, Argentina, and Mexico. Traditional IP blocking proves ineffective against this rapidly rotating infrastructure, emphasizing the need for advanced detection of anomalous RDP probes.​

    Read more: https://cybersecuritynews.com/rdp-services-under-attack/

    ASP.NET Machine Keys Abused in IIS Attacks

    Threat actors, tracked as REF3927, are leveraging publicly exposed ASP.NET machine keys from Microsoft documentation and forums to forge malicious ViewState payloads, enabling remote code execution on vulnerable Windows IIS servers. Once inside, attackers deploy the Z-Godzilla webshell for command execution and credential theft, followed by the TOLLBOOTH module to manipulate search engine rankings for SEO fraud via keyword-stuffed pages served to bots. Reinfection remains common due to unchanged keys post-cleanup, affecting servers globally except in China.​

    Read more: https://cybersecuritynews.com/hackers-abuse-asp-machine-keys-iis/

    ToolShell Vulnerability Exploits SharePoint Servers

    China-based threat actors are actively exploiting the critical ToolShell vulnerability chain in Microsoft SharePoint, combining CVE-2025-53770 (RCE, CVSS 9.8) and CVE-2025-53771 (spoofing) to deploy stealthy webshells without authentication. Attacks target on-premises SharePoint 2016, 2019, and Subscription Edition, bypassing MFA and granting access to integrated services like Teams and OneDrive, with victims including U.S. agencies and energy firms. Patching requires key rotation and IIS restarts, as over 400 systems have been compromised since July 2025.​

    Read more: https://cybersecuritynews.com/toolshell-vulnerability-compromise-networks/

    Adobe Magento RCE Flaw Under Active Exploitation

    Hackers are exploiting a critical remote code execution vulnerability in Adobe Commerce and Magento platforms (CVSS 9.8), allowing file reads and JavaScript injection via API modifications to steal customer data and payment details. The CosmicSting flaw (CVE-2024-34102) affects versions up to 2.4.7, with attackers compromising 3-5 sites hourly using stolen encryption keys from env.php to craft JWT tokens. Combined with CVE-2024-2961, it enables server-side code execution, urging immediate updates for e-commerce sites.​

    Read more: https://cybersecuritynews.com/adobe-magento-rce-vulnerability-exploited/

    Microsoft 365 Exchange Direct Send Abused for Phishing

    Attackers are misusing Microsoft 365’s Exchange Online Direct Send feature to bypass anti-spam filters and deliver spoofed emails from multifunction devices and legacy apps, facilitating phishing without account compromise. This method allows internal user impersonation and payload delivery, evading rigorous authentication checks inherent to standard SMTP relays. Organizations must monitor and restrict Direct Send usage to prevent widespread credential theft campaigns.​

    Read more: https://cybersecuritynews.com/hackers-abuse-microsoft-365-exchange-direct-send/

    Azure Blob Storage Under Threat Actor Siege

    Threat actors are using compromised credentials to infiltrate misconfigured Azure Blob Storage accounts, establishing persistence for data exfiltration targeting intellectual property across organizational repositories. This campaign exploits weak access controls to host phishing sites mimicking Office 365 logins and aid forensic evasion in broader attacks. Immediate reviews of storage permissions and logging enablement are critical to counter this growing cloud misconfiguration risk.​

    Read more: https://cybersecuritynews.com/threat-actors-attacking-azure-blob-storage/

    RedTiger Tool Repurposed for Gaming Attacks

    The open-source red teaming tool RedTiger is being weaponized against gamers and Discord users, spreading via malicious links in gaming communities to steal accounts and deploy info-stealers. Originally designed for penetration testing, its evasion capabilities make it ideal for targeting high-value social engineering vectors in entertainment sectors. Detection focuses on anomalous tool deployments outside authorized red team exercises.​

    Read more: https://cybersecuritynews.com/red-teaming-tool-redtiger/

    WSUS RCE Vulnerability Faces Active Exploits

    CISA warns of ongoing exploitation of a critical remote code execution flaw in Windows Server Update Services (WSUS), allowing unauthenticated attackers to execute arbitrary code on domain controllers via crafted update requests. PoC exploits have been released, heightening risks for unpatched environments, with Microsoft issuing an out-of-band patch. Federal agencies must apply updates immediately per KEV catalog addition.​

    Read more: https://cybersecuritynews.com/wsus-rce-vulnerability-exploited/

    YouTube Ghost Network Spreads Malware

    The “YouTube Ghost” malware network has hijacked over 3,000 channels to distribute info-stealers through videos promoting pirated software and game cheats, luring downloads of malicious payloads. This operation exploits YouTube’s vast reach for mass distribution, evading moderation by rotating compromised accounts. Users should verify download sources and enable two-factor authentication on linked services.​

    Read more: https://cybersecuritynews.com/youtube-ghost-malware-network/

    LockBit 5.0 Ransomware Resurges Aggressively

    LockBit 5.0 is actively targeting Windows, Linux, and ESXi environments with enhanced evasion tactics post-Operation Cronos, focusing on critical infrastructure for double-extortion via data leaks. The variant incorporates AI-driven encryption and multi-platform support, challenging previous dominance by groups like ShinySp1d3r in Q3 2025. Backup isolation and endpoint segmentation are essential defenses against this evolving threat.​

    Vulnerabilities

    WSUS RCE Vulnerability PoC Released

    A proof-of-concept exploit has emerged for CVE-2025-59287, a critical flaw in Microsoft’s Windows Server Update Services enabling unauthenticated remote code execution with SYSTEM privileges. The vulnerability arises from unsafe deserialization in the AuthorizationCookie handling, affecting all supported Windows Server versions from 2012 to 2025, and carries a CVSS v3.1 score of 9.8. Microsoft disclosed it during October 2025 Patch Tuesday, noting its wormable potential across networked servers, with no in-the-wild exploits reported yet but urgent patching recommended to prevent supply-chain attacks via malicious updates. Organizations should apply security updates immediately, isolate WSUS servers with firewalls, and consider migrating from the deprecated BinaryFormatter serializer.​ Read more

    LANSCOPE Endpoint Manager RCE Flaw

    Motex revealed CVE-2025-61932, a remote code execution vulnerability in LANSCOPE Endpoint Manager On-Premise Edition versions up to 9.4.7.1, scored at CVSS 3.0 9.8, allowing attackers to compromise endpoint devices without privileges or interaction. Active exploitation has been confirmed through malicious packets targeting client programs and detection agents, though the cloud edition remains unaffected. The flaw highlights risks in on-premise tools running with elevated privileges, potentially enabling malware deployment or network pivoting in hybrid environments. Motex urges immediate client-side patching via their portal, with no central manager updates needed.​ Read more

    Copilot Prompt Injection Vulnerability

    Microsoft 365 Copilot faces a prompt injection flaw that enables attackers to steal sensitive tenant data, including recent documents and emails, through malicious content in shared files or emails. The exploit combines prompt injection with automatic tool invocation and ASCII smuggling to hide exfiltrated information in invisible Unicode characters within hyperlinks, bypassing user awareness. Patched following January 2024 disclosure, the vulnerability affected data retrieval like Slack MFA codes or sales figures, underscoring risks in AI assistants processing untrusted inputs. Organizations should enforce strict content validation and monitor for anomalous AI interactions to prevent similar chains.​ Read more

    Chrome V8 Engine Vulnerability

    Google addressed a high-severity flaw in Chrome’s V8 JavaScript engine via an emergency update, preventing potential crashes or code execution through type confusion or memory corruption exploits. Tracked under recent CVEs like CVE-2025-5419, the issue stems from improper handling in the engine’s optimization processes, actively targeted in zero-click attacks. The update, version 129.0.6668.100 or later, mitigates risks for billions of users, with CISA warning of ongoing exploitation. Users must update browsers immediately and enable auto-updates to counter these engine-level threats.​ Read more

    Multiple GitLab Security Vulnerabilities

    GitLab patched several high-severity flaws, including DoS vectors and authorization bypasses, allowing attackers to crash instances, inject CI/CD jobs, or takeover accounts via XSS in search and snippet features. Vulnerabilities like CVE-2025-4278 (CVSS 8.7) and CVE-2025-5121 (CVSS 8.5) affect versions up to 18.0.2, impacting source code repositories and pipelines in self-managed setups. Emergency releases 18.0.2, 17.11.4, and 17.10.8 address HTML injection, infinite redirects, and unbounded token issues, with no widespread breaches noted. Administrators should upgrade promptly and review SAML configurations for added protection.​ Read more

    MCP Server Platform Vulnerability

    A critical issue in the MCP Server Platform from Smithery.ai exposes AI model registries to unauthorized access and potential data leaks, with attackers able to manipulate context protocols in deployed models. The flaw, affecting integrations in coding agents and IDEs, enables prompt injections via malicious issues in public repos, coercing AI to leak private data without direct compromises. Over 14,000 GitHub stars highlight its adoption, amplifying risks for development workflows. Developers should scan for toxic agent flows, restrict external data sources, and apply updates to mitigate these supply-chain vectors.​ Read more

    BIND 9 Vulnerabilities Enabling DoS

    Multiple flaws in BIND 9 DNS resolvers, including CVE-2025-40775 (CVSS 7.5), allow remote DoS via invalid TSIG handling or cache poisoning, crashing servers with single packets or floods. Affecting versions 9.20.0-9.20.8 and 9.21.0-9.21.7, over 706,000 instances remain vulnerable, disrupting internet infrastructure. Patches in 9.18.37, 9.20.9, and 9.21.8 fix assertion failures and memory exhaustion, with no workarounds available. Network admins must update urgently and monitor for anomalous DNS traffic to maintain resolver stability. Read more

    TARmageddon Vulnerability in Rust Library

    The TARmageddon flaw (CVE undisclosed) in async-tar and tokio-tar Rust crates enables attackers to replace config files or execute remote code by exploiting path traversal during archive extraction. Affecting millions of downloads in async applications, the issue allows symlink following without checks, leading to arbitrary writes in supply-chain scenarios. No active exploits reported, but its presence in popular forks urges immediate upgrades to patched versions. Rust developers should validate paths strictly and audit dependencies for similar extraction risks.​ Read more

    Decoding PIN-Protected BitLocker

    Researchers demonstrated decoding PIN-protected BitLocker drives via TPM SPI bus interception, extracting keys even with physical access protections in place. The technique analyzes serial peripheral interface communications on laptops, bypassing software locks to mount encrypted volumes without passwords. Applicable to Windows devices using TPM 2.0, it reveals hardware-level weaknesses in full-disk encryption. Users should enable multi-factor recovery options and secure physical access to mitigate such forensic attacks.​ Read more

    ChatGPT Atlas Browser Jailbroken

    OpenAI’s ChatGPT Atlas browser, integrating AI for web tasks, has been jailbroken to disguise malicious activities as legitimate navigation, allowing hidden data exfiltration or script execution. The flaw exploits the browser’s agentic features, enabling attackers to override safeguards and perform unauthorized actions under AI assistance. Launched recently, it affects early adopters using the tool for automated browsing. OpenAI recommends limiting extensions and monitoring AI prompts to prevent jailbreak escalations in hybrid AI-web environments.​ Read more

    Tech News​

    AWS Outage Disrupts Global Services

    A widespread Amazon Web Services (AWS) outage struck on Monday, impacting millions of users and services including Amazon’s e-commerce site, Snapchat, Prime Video, Canva, Capital One banking, Delta Airlines, and DoorDash delivery. The incident originated from a DNS failure within AWS’s DynamoDB NoSQL database, preventing address resolution and causing cascading operational halts across dependent platforms. AWS engineers restored partial services by early afternoon, with no cyberattack suspected and a root-cause analysis promised; this event highlights the risks of single-provider dependency in cloud infrastructure.​ Read more

    Automatic BitLocker Encryption Locks User Data

    A Reddit user reported that reinstalling Windows 11 unexpectedly enabled BitLocker encryption on two backup drives, locking 3TB of irreplaceable data without prior configuration or recovery keys. This silent activation in Windows 11 Pro and Enterprise editions, particularly version 24H2, triggers on hardware like TPM 2.0 and Secure Boot during clean installs, affecting non-boot storage less commonly documented. Recovery attempts failed, leading to data loss after formatting; experts recommend disabling BitLocker via registry tweaks or tools like Rufus during installation and always backing up keys to Microsoft accounts.​ Read more

    Windows Updates Trigger Login Failures

    Microsoft confirmed that security updates released on and after August 29, 2025, are causing Kerberos and NTLM authentication failures on Windows 11 24H2, 25H2, and Windows Server 2025 devices with duplicate Security Identifiers (SIDs). These issues arise from enhanced SID checks blocking authentication on cloned systems not prepared via Sysprep, resulting in symptoms like failed logins, remote desktop errors, and “access denied” messages. Administrators should rebuild affected systems using supported cloning methods or contact Microsoft Support for a temporary Group Policy workaround to restore access.​ Read more

    Critical Vulnerabilities in Oracle VM VirtualBox

    Oracle disclosed multiple high-severity vulnerabilities in VM VirtualBox versions 7.1.12 and 7.2.2, tracked under CVEs like CVE-2025-62587 to CVE-2025-62590 and CVE-2025-62641, each scoring 8.2 on CVSS 3.1. These Core component flaws allow local high-privileged attackers to compromise confidentiality, integrity, and availability, potentially enabling full takeover of the virtualization environment and exposure of virtual machine data. Patched in the October 2025 Critical Patch Update, users must update immediately, restrict access, and monitor for unusual activity to mitigate risks in development and enterprise setups.​ Read more

    Microsoft Disables File Previews for Security

    As part of October 2025 security updates, Microsoft automatically disables the File Explorer preview pane for internet-downloaded files marked with the “Mark of the Web” to prevent NTLM hash theft attacks via malicious HTML elements. This change blocks threat actors from harvesting credentials when users simply preview files containing tags like <link> or <src> that reference attacker-controlled servers, a common vector in phishing campaigns. Trusted files can be unblocked via Properties, but the default protection enhances security without user intervention on Windows 11 and Server systems.​ Read more

    Teams Introduces Auto Work Location Detection

    Microsoft Teams is rolling out an opt-in feature in December 2025 to automatically detect and set users’ work locations based on connections to organizational Wi-Fi networks or desk peripherals like monitors. Enabled via PowerShell policy by admins, it updates locations to “In the Office” or specific buildings during set work hours from Outlook, requiring user consent and location sharing permissions for privacy. This aims to improve hybrid collaboration by syncing real-time presence, though it raises concerns over telemetry data and tracking in shared environments.​ Read more

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Cybersecurity Newsletter Weekly – AWS Outage, WSUS Exploitation, Chrome Flaws, and RDP Attacks appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • 706,000+ BIND 9 Resolver Instances Vulnerable to Cache Poisoning Exposed Online – PoC Released

    ·

    , , ,

    A high-severity vulnerability in BIND 9 resolvers has been disclosed, potentially allowing attackers to poison caches and redirect internet traffic to malicious sites.

    Tracked as CVE-2025-40778, the flaw affects over 706,000 exposed instances worldwide, as identified by internet scanning firm Censys.

    Assigned a CVSS score of 8.6, this issue stems from BIND’s overly permissive handling of unsolicited resource records in DNS responses, enabling off-path attackers to inject forged data without direct access to the network.​

    The Internet Systems Consortium (ISC), maintainers of the widely used BIND software, released details on October 22, 2025, urging administrators to patch immediately.

    BIND 9 powers a substantial portion of the internet’s domain name resolution, making this vulnerability particularly alarming for enterprises, ISPs, and governments relying on recursive resolvers.

    While no active exploitation has been reported, the public release of a proof-of-concept (PoC) exploit on GitHub heightens the urgency, as it provides a blueprint for potential attackers to craft targeted assaults.​

    BIND 9 Resolver Vulnerability

    At its core, CVE-2025-40778 exploits a logic flaw in BIND 9’s resolver, where it accepts and caches resource records (RRs) that were not part of the original query.

    During normal DNS operations, a recursive resolver sends queries to authoritative nameservers and expects responses containing only relevant answers, authority data, and additional sections.

    However, the affected versions fail to strictly enforce bailiwick principles, which limit records to the queried domain’s authority zone. This leniency allows an attacker to race or spoof responses, injecting fake address records like A or AAAA entries that point to controlled infrastructure.​

    The vulnerability impacts BIND 9 versions from 9.11.0 through 9.16.50, 9.18.0 to 9.18.39, 9.20.0 to 9.20.13, and 9.21.0 to 9.21.12, including Supported Preview Editions. Earlier versions prior to 9.11.0 are also believed to be vulnerable but unassessed.

    Only recursive resolver configurations are at risk; authoritative-only servers remain unaffected unless recursion is enabled. Once poisoned, the cache can misdirect downstream clients for hours or days, depending on TTL values, leading to phishing, data interception, or service disruptions without triggering new lookups.​

    Censys’s scan, conducted around the disclosure, revealed more than 706,000 vulnerable BIND instances openly accessible on the internet, underscoring the scale of exposure.

    This number likely underrepresents the total, as it excludes firewalled or internal deployments. The flaw’s remote exploitability over networks, with low complexity and no privileges required, classifies it under CWE-349 for accepting extraneous untrusted data.

    Although primarily an integrity threat, it could cascade into broader attacks, such as man-in-the-middle scenarios or amplifying denial-of-service via redirected traffic.​

    Proof-of-Concept and Exploitation Risks

    The PoC, published on GitHub by researcher N3mes1s, demonstrates the injection technique using a controlled environment to spoof responses and verify cache poisoning.

    It highlights how an off-path attacker can monitor query patterns and respond faster than legitimate servers, bypassing traditional protections like source port randomization in some cases.

    While the code is for educational purposes, security experts warn it could be adapted for real-world use, especially against unpatched systems.​

    No confirmed exploits in the wild exist as of October 25, 2025, but the vulnerability’s disclosure coincides with a surge in DNS-related threats, including related flaws like CVE-2025-40780, which also enables cache poisoning through predictable query IDs.

    ISC notes that the issue does not affect DNSSEC-validated zones directly, but incomplete implementations could still fall victim. Threat actors, including state-sponsored groups, have historically targeted DNS for persistence, making rapid patching critical.

    To counter CVE-2025-40778, ISC recommends upgrading to patched versions: 9.18.41, 9.20.15, 9.21.14, or later. For those unable to update immediately, restrict recursion to trusted clients via ACLs, enable DNSSEC validation to cryptographically verify responses, and monitor cache contents for anomalies using tools like BIND’s statistics channel. Disabling additional section caching or implementing rate limiting on queries can further reduce exposure.​

    Organizations should scan their networks for vulnerable BIND instances using tools from Censys or Shodan and prioritize high-traffic resolvers.

    As BIND remains foundational to internet stability, this incident serves as a reminder of the ongoing cat-and-mouse game in DNS security, with ISC committing to enhanced validation in future releases.​

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post 706,000+ BIND 9 Resolver Instances Vulnerable to Cache Poisoning Exposed Online – PoC Released appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • LockBit 5.0 Actively Attacking Windows, Linux, and ESXi Environments

    ·

    , ,

    The notorious LockBit ransomware operation has resurfaced with a vengeance after months of dormancy following Operation Cronos takedown efforts in early 2024.

    Despite law enforcement disruptions and infrastructure seizures, the group’s administrator, LockBitSupp, has successfully rebuilt the operation and launched LockBit 5.0, internally codenamed “ChuongDong.”

    This latest variant represents a significant evolution in the group’s ransomware capabilities, targeting organizations across multiple platforms with enhanced technical sophistication.

    Throughout September 2025, the revived operation demonstrated its operational recovery by compromising a dozen organizations across Western Europe, the Americas, and Asia.

    Half of these incidents involved the newly released LockBit 5.0 variant, while the remainder utilized LockBit Black.

    The attacks primarily focused on Windows environments, accounting for approximately 80% of infections, with ESXi and Linux systems comprising the remaining 20%.

    Check Point analysts identified these campaigns as clear evidence that LockBit’s Ransomware-as-a-Service model has successfully reactivated its affiliate network.

    The rapid return highlights the resilience of established cybercriminal enterprises.

    After announcing its comeback on underground forums in early September, LockBitSupp recruited new affiliates by requiring roughly $500 in Bitcoin deposits for access to the control panel and encryption tools.

    Enhanced Encryption and Evasion Capabilities

    LockBit 5.0 introduces several technical improvements designed to maximize impact while minimizing detection.

    LockBit 5.0 affiliate registration screen (Source – Check Point)

    The malware now supports multi-platform deployments with dedicated builds for Windows, Linux, and ESXi environments.

    Its encryption routines have been optimized to reduce the response window available to defenders, enabling faster system-wide file encryption.

    The variant employs randomized 16-character file extensions to evade signature-based detection mechanisms.

    Enhanced anti-analysis features obstruct forensic investigation and reverse engineering attempts, making it significantly more challenging for security researchers to analyze the malware’s behavior.

    Updated ransom notes identify themselves as LockBit 5.0 and provide personalized negotiation links with a 30-day deadline before stolen data publication.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post LockBit 5.0 Actively Attacking Windows, Linux, and ESXi Environments appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Hackers Weaponizing Telegram Messenger with Dangerous Android Malware to Gain Full System Control

    ·

    , ,

    A sophisticated backdoor named Android.Backdoor.Baohuo.1.origin has been discovered in maliciously modified versions of Telegram X messenger, granting attackers complete control over victims’ accounts while operating undetected.

    The malware infiltrates devices through deceptive in-app advertisements and third-party app stores, masquerading as legitimate dating and communication platforms.

    With more than 58,000 infected devices spread across approximately 3,000 smartphone models, tablets, TV boxes, and even Android-based vehicle systems, this threat represents a significant escalation in mobile malware sophistication.

    The backdoor’s distribution began in mid-2024, primarily targeting Brazilian and Indonesian users through Portuguese and Indonesian language templates.

    Victims encounter advertisements within mobile applications that redirect them to counterfeit app catalogs featuring fake reviews and promotional banners advertising “free video chats” and dating opportunities.

    These fraudulent websites deliver trojanized APK files that appear indistinguishable from legitimate Telegram X installations.

    One of the malicious sites from which the trojan version of Telegram X is downloaded (Source – Dr.WEB)

    Beyond malicious websites, the backdoor has infiltrated established third-party app repositories including APKPure, ApkSum, and AndroidP, where it was deceptively posted under the official messenger developer’s name despite having different digital signatures.

    Dr.Web analysts identified the malware’s exceptional capability to steal confidential information including login credentials, passwords, and complete chat histories.

    The backdoor conceals compromised account indicators by hiding third-party device connections from active Telegram session lists.

    Additionally, it autonomously adds or removes users from channels, joins chats on behalf of victims, and disguises these actions entirely, transforming compromised accounts into tools for artificially inflating Telegram channel subscribers.

    What distinguishes Android.Backdoor.Baohuo.1.origin from conventional Android threats is its unprecedented use of Redis database for command-and-control operations.

    Earlier versions relied exclusively on traditional C2 servers, but malware authors progressively integrated Redis-based command reception while maintaining C2 server redundancy.

    This represents the first documented instance of Redis database utilization in Android malware control mechanisms.

    When initialized, the backdoor connects to its C2 server to retrieve configuration parameters including Redis connection credentials, enabling threat actors to issue commands and update trojan settings remotely.

    Advanced Control Mechanisms and Data Exfiltration

    The backdoor employs multiple techniques to manipulate messenger functionality without detection.

    For operations that don’t interfere with core app features, cybercriminals utilize pre-prepared “mirrors” of messenger methods—separate code blocks responsible for specific tasks within Android program architecture.

    These mirrors facilitate displaying phishing messages within windows that perfectly replicate authentic Telegram X interfaces.

    For non-standard operations requiring deeper integration, the malware leverages the Xposed framework to dynamically modify app methods, enabling capabilities such as hiding specific chats, concealing authorized devices, and intercepting clipboard contents.

    Through Redis channels and C2 servers, Android.Backdoor.Baohuo.1.origin receives extensive commands including uploading SMS messages, contacts, and clipboard contents whenever users minimize or restore the messenger window.

    This clipboard monitoring enables sophisticated data theft scenarios where victims inadvertently expose cryptocurrency wallet passwords, mnemonic phrases, or confidential business communications.

    The backdoor systematically collects device information, installed application data, message histories, and authentication tokens, transmitting this intelligence to attackers every three minutes while maintaining the appearance of normal messenger operation.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Hackers Weaponizing Telegram Messenger with Dangerous Android Malware to Gain Full System Control appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Vault Viper Exploits Online Gambling Websites Using Custom Browser to Install Malicious Program

    ·

    , ,

    Southeast Asia’s online gambling ecosystem has become a breeding ground for sophisticated cyber threats, with criminal networks leveraging seemingly legitimate platforms to distribute malicious software to millions of unsuspecting users.

    A recently uncovered operation demonstrates how threat actors exploit the region’s thriving illegal gambling market by deploying a weaponized browser disguised as a privacy tool.

    The campaign centers on Universe Browser, a modified Chromium-based application distributed through online gambling websites operated by criminal networks across Southeast Asia.

    Marketed as a privacy-friendly solution capable of bypassing censorship, the browser routes all user connections through actor-controlled servers in China while covertly installing multiple programs that execute silently in the background.

    Behind this infrastructure lies Vault Viper, a threat actor tracked to the Baoying Group and its BBIN white label iGaming platform.

    The group maintains extensive operations throughout Cambodia and the Philippines, servicing both legitimate operators and criminal networks engaged in cyber-enabled fraud.

    Infoblox researchers identified the malicious browser after investigating illegal gambling platforms, uncovering connections between the software distribution network and transnational organized crime syndicates.

    The browser exhibits behavior consistent with remote access trojans, incorporating key logging capabilities, surreptitious network connections, and device configuration modifications.

    Analysis reveals sophisticated anti-analysis techniques including virtual machine detection, debugger evasion, and encrypted communication protocols designed to obstruct security research.

    Infoblox analysts noted that while Universe Browser cannot be definitively confirmed for overtly malicious use beyond privacy violations, the hidden technical elements and criminal distribution context raise significant security concerns.

    The browser’s ability to intercept all network traffic, coupled with distribution through criminal platforms documented in fraud cases, positions it as a high-risk exploitation tool.

    Technical Analysis: Installation and Persistence Mechanisms

    The Windows installer, distributed as UB-Launcher.exe, initiates the infection chain by performing environment checks before downloading the malicious payload.

    The installer validates victim locale settings and conducts virtual machine detection routines to evade analysis in sandboxed environments.

    # VM detection logic observed in Universe Browser
def check_vm_environment():
    vm_indicators = ['VBOX', 'VirtualBox', 'VMware', 'QEMU']
    return any(indicator in system_info for indicator in vm_indicators)

    Once validation succeeds, the installer downloads two components to %APPDATA%/local/UB: a legitimate Chrome installation and Application.7z containing dynamic link libraries and five binaries.

    The dropper replaces Chrome.exe with UB-Launcher.exe, transforming a legitimate browser into the malicious Universe Browser.

    Persistence is established through registry modification, adding UB-Launcher.exe to the Windows startup registry key.

    The malware initiates a process chain with UBMaintenanceservice.exe invoking UBService.exe, the core component managing proxy connections and command-and-control communication.

    Simplified folder schema (Source – Infoblox)

    UBService handles encrypted communications with C2 domains including ac101[.]net and ub66[.]com, managing SOCKS5 proxy traffic routes in an encrypted SQLite database.

    This enables dynamic network behavior adjustment based on remote server instructions, using DNS TXT records for encryption key distribution and domain generation algorithms for evasion.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Vault Viper Exploits Online Gambling Websites Using Custom Browser to Install Malicious Program appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Google Warns of Threat Actors Using Fake Job Posting to Deliver Malware and Steal Credentials

    ·

    , ,

    Cybercriminals have adopted a sophisticated social engineering strategy that exploits the trust inherent in job hunting, according to a recent security advisory.

    A financially motivated threat cluster operating from Vietnam has been targeting digital advertising and marketing professionals through fake job postings on legitimate employment platforms and custom-built recruitment websites.

    The campaign, which leverages remote access trojans and credential-harvesting phishing kits, represents a growing threat to corporate advertising and social media accounts across multiple industries.

    The attack methodology centers on creating fake company profiles masquerading as digital media agencies on popular job boards.

    When unsuspecting applicants submit their resumes and contact information for these fabricated positions, they unknowingly establish a foundation of trust that threat actors later exploit.

    The self-initiated nature of the victim’s first contact makes subsequent communications from the attacker appear legitimate, as targets believe they are engaging with a potential employer about a position they actively pursued.

    The vulnerability extends beyond immediate exploitation. Threat actors can retain collected victim information for future cold email campaigns about additional fabricated opportunities or monetize curated lists of active job seekers by selling them to other criminal groups.

    This creates a persistent threat environment where a single job application can result in repeated targeting over extended periods.

    Google Threat Intelligence Group researchers identified the operation as UNC6229, noting the cluster primarily targets remote workers in contract or part-time positions who may actively seek employment while currently employed.

    Attack flow (Source – Google Cloud)

    The campaign specifically focuses on individuals with legitimate access to high-value corporate advertising and social media accounts, which threat actors can either use to sell advertisements or directly sell the compromised accounts to other criminal entities.

    Delivery Mechanisms and Technical Infrastructure

    Following the initial contact phase, UNC6229 employs two primary payload delivery methods depending on campaign specifics.

    The first approach involves sending password-protected ZIP attachments disguised as skills assessments, application forms, or preliminary hiring tasks.

    These archives contain remote access trojans that grant attackers complete device control, enabling subsequent account takeovers.

    The second method utilizes obfuscated phishing links, often shortened through URL services, directing victims to fraudulent interview scheduling portals or assessment platforms.

    The phishing infrastructure demonstrates technical sophistication, with analyzed kits configured to specifically target corporate email credentials while handling various multi-factor authentication schemes including Okta and Microsoft implementations.

    Google researchers noted that UNC6229 abuses legitimate customer relationship management platforms, including Salesforce, to send initial communications and manage campaigns.

    This abuse of trusted services increases email deliverability rates and bypasses traditional security filters, making malicious messages appear authentic to recipients.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Google Warns of Threat Actors Using Fake Job Posting to Deliver Malware and Steal Credentials appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Hackers Hijacking IIS Servers in The Wild Using Exposed ASP .NET Machine Keys to Inject Malicious Modules

    ·

    , ,

    A sophisticated cyberattack campaign targeting Microsoft Internet Information Services (IIS) servers has emerged, exploiting decades-old security vulnerabilities to deploy malicious modules that enable remote command execution and search engine optimization fraud.

    The operation, which came to light in late August and early September 2025, leverages publicly exposed ASP.NET machine keys to compromise servers worldwide, affecting approximately 240 server IP addresses and 280 domain names across diverse sectors including government agencies, small businesses, and e-commerce platforms.

    The attackers exploit a critical weakness in ASP.NET viewstate deserialization by utilizing machine keys that have been publicly available since 2003.

    These cryptographic secrets, originally published in a Microsoft Developer Network help page as configuration examples, were inadvertently adopted by countless administrators who implemented them verbatim in production environments.

    Microsoft had previously identified over 3,000 such exposed machine keys in code repositories and programming forums, creating a substantial pool of vulnerable targets.

    Once attackers obtain these keys, they can manipulate viewstate data to execute arbitrary code on targeted servers without requiring any additional credentials.

    HarfangLab analysts identified the malicious module, designated HijackServer, during routine security monitoring of compromised IIS servers.

    The infection chain demonstrates considerable sophistication, beginning with initial exploitation through POST requests targeting ASP.NET applications.

    Logs from compromised systems revealed multiple suspicious requests with Chinese language settings (zh-tw) hitting root pages of vulnerable applications.

    The attackers subsequently deployed a comprehensive toolkit archived as sys-tw-v1.6.1-clean-log.zip, containing 32-bit and 64-bit variants of the malicious IIS modules, installation scripts, and a customized rootkit derived from the open-source Hidden project.

    Google SEO results (Source – Harfanglab)

    Following initial access, threat actors employed privilege escalation techniques known as EfsPotato and DeadPotato to create hidden local administrator accounts.

    They then installed two malicious DLL files, scripts.dll and caches.dll, as IIS modules named ScriptsModule and IsapiCachesModule respectively.

    These modules operate at the earliest processing stage of HTTP requests, intercepting traffic before legitimate applications can respond.

    The installation process included establishing a working directory at C:\Windows\Temp\_FAB234CD3-09434-8898D-BFFC-4E23123DF2C and configuring the modules to download additional components from staging servers at c.cseo99[.]com and f.fseo99[.]com.

    Persistence and Detection Evasion Through Rootkit Deployment

    The attackers demonstrated advanced operational security awareness by deploying a customized Windows kernel driver rootkit to conceal their presence.

    The Wingtb.sys driver, a modified version of the publicly available Hidden rootkit, operates as a signed kernel component using an expired certificate from Anneng Electronic Co. Ltd.

    Despite the certificate’s expiration in 2014, it remains loadable on modern Windows systems due to Microsoft’s driver signing policy exceptions for certificates issued before July 2015.

    The rootkit provides comprehensive hiding capabilities for files, registry keys, and processes, managed through a companion command-line tool WingtbCLI.exe with commands translated into Chinese transliteration.

    The post-installation script lock.bat systematically conceals critical artifacts including the deployed IIS module files, modified application configuration files, and the rootkit’s registry service key.

    Perhaps most notably, the script executes a sweeping deletion of all Windows Event log files using the command: for /f "tokens=*" %%1 in ('wevtutil el') do wevtutil cl "%%1".

    This noisy anti-forensics technique contradicts the otherwise stealthy approach of using a rootkit, potentially indicating operational security inconsistencies or the work of less experienced operators deploying pre-packaged tools.

    The HijackServer module’s primary purpose appears focused on search engine optimization fraud for cryptocurrency investment schemes.

    When Google’s web crawler requests pages from compromised servers, the module dynamically generates HTML content containing numerous links to dubious cryptocurrency websites.

    These generated pages successfully appear in legitimate Google search results, demonstrating the effectiveness of the poisoning technique.

    However, the module also exposes an unauthenticated remote command execution capability through the /scjg URL path, creating a persistent backdoor that any third party could exploit regardless of whether they coordinated with the original attackers.

    This functionality transforms what might appear as financially motivated SEO fraud into a far more serious security compromise with potential espionage implications.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Hackers Hijacking IIS Servers in The Wild Using Exposed ASP .NET Machine Keys to Inject Malicious Modules appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Top 10 Best Cloud Workload Protection Platforms (CWPP) in 2025

    ·

    , , ,

    The cloud landscape in 2025 continues its unprecedented growth, with organizations of all sizes rapidly migrating critical workloads to public, private, and hybrid cloud environments. While cloud providers meticulously secure their underlying infrastructure, the onus of protecting everything within that infrastructure from virtual machines (VMs) and containers to serverless functions and data squarely falls on […]

    The post Top 10 Best Cloud Workload Protection Platforms (CWPP) in 2025 appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Hackers Use ClickFix Technique to Deploy NetSupport RAT Loaders

    ·

    , , ,

    Cybercriminals are increasingly using a technique known as “ClickFix” to deploy the NetSupport remote administration tool (RAT) for malicious purposes. According to a new report from eSentire’s Threat Response Unit (TRU), threat actors have shifted their primary delivery strategy from fake software updates to the ClickFix initial access vector throughout 2025. This method abuses a […]

    The post Hackers Use ClickFix Technique to Deploy NetSupport RAT Loaders appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • North Korean Hackers Attacking Unmanned Aerial Vehicle Industry to Steal Confidential Data

    ·

    , ,

    North Korean state-sponsored hackers from the Lazarus APT group launched a cyberespionage campaign targeting European companies involved in unmanned aerial vehicle development.

    Starting in late March 2025, attackers compromised three defense organizations across Central and Southeastern Europe, deploying advanced malware to steal proprietary UAV technology.

    The campaign, tracked as Operation DreamJob, employed social engineering using fraudulent job offers to gain initial access.

    The attacks focused on companies manufacturing drone components and developing UAV software, aligning with North Korea’s efforts to expand its drone program.

    Researchers discovered compromised systems contained malicious droppers with the internal DLL name DroneEXEHijackingLoader.dll, providing evidence of the campaign’s focus on drone technology theft.

    Targets received fake job descriptions with trojanized PDF readers that initiated multi-stage infection processes.

    Welivesecurity analysts identified the main payload as ScoringMathTea, a sophisticated remote access trojan serving as Lazarus’s flagship malware since late 2022.

    The RAT provides comprehensive control over compromised machines through approximately 40 commands, enabling file manipulation, process control, and data exfiltration.

    ScoringMathTea maintains communication with command-and-control infrastructure through compromised servers hosted within WordPress directories.

    The malware’s C&C traffic employs multiple encryption layers, utilizing the IDEA algorithm followed by base64 encoding.

    Examples of 2025 Operation DreamJob execution chains delivering BinMergeLoader and ScoringMathTea (Source – Welivesecurity)

    Network analysis revealed connections to compromised domains including coralsunmarine[.]com, mnmathleague[.]org, and spaincaramoon[.]com.

    Advanced Infection Mechanism and Evasion Tactics

    The Lazarus group demonstrated technical sophistication by incorporating malicious loading routines into legitimate open-source projects from GitHub.

    Attackers trojanized software including TightVNC Viewer, MuPDF reader, and plugins for WinMerge and Notepad++.

    This provides dual advantages: the malware inherits legitimate appearance of trusted applications while executing malicious payloads.

    The infection chain employs DLL side-loading and proxying techniques. Legitimate executables such as wksprt.exe and wkspbroker.exe side-load malicious libraries like webservices.dll and radcui.dll.

    These compromised DLLs contain two export sets: functions for proxying to preserve application behavior, and malicious code loading subsequent stages.

    The malware employs robust encryption throughout the infection lifecycle. Early-stage droppers retrieve encrypted payloads from file system or registry, decrypt them using AES-128 or ChaCha20 algorithms, then load them into memory.

    This leverages the MemoryModule library for reflective DLL injection, allowing code execution entirely in-memory without writing decrypted components to disk.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post North Korean Hackers Attacking Unmanned Aerial Vehicle Industry to Steal Confidential Data appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶