1010.cx

  • INE Expands Cross-Skilling Innovations

    ·

    Cary, North Carolina, USA, November 26th, 2025, CyberNewsWire

    New courses, certifications, and hands-on training strengthen workforce readiness.

    INE, the leading provider of hands-on IT and Cybersecurity training and industry-recognized certification prep, today announced a significant expansion of its learning portfolio, reaffirming its commitment to empowering technology professionals with the skills they need to thrive.

    As organizations across the globe accelerate their adoption of cloud, AI, automation, and advanced security technologies, IT teams must remain more adaptable than ever.

    INE continues to meet this demand by releasing new, high-impact content and refreshing existing learning paths to ensure learners stay aligned with industry standards, master emerging tools, and build real-world, muscle-memory expertise.

    Expanding Content for Today’s Most In-Demand Skills

    Over the last quarter, INE has rolled out a wide range of new courses, hands-on labs, and certification prep resources designed to help professionals cross-skill and upskill within one integrated training platform. New and updated content includes:

    • AI in Automation Course — Now part of INE’s Cisco certification prep, enabling learners to integrate AI-driven automation capabilities into modern enterprise infrastructures.
    • Enterprise Network Design Scenarios — Advanced modules supporting CCIE Enterprise Infrastructure candidates with realistic scenario-based design and troubleshooting.
    • Updated INE Security Certifications & Prep — Enhancements to Certified Incident Responder (CIR) and Certified Threat Hunting Professional (CTHP) programs, ensuring security specialists train on current adversarial tactics and defense strategies.
    • Expanded Certification Prep for Industry-Leading Vendors — Including updated pathways for CISSP, CompTIA Security+, and Network+.
    • New Junior Data Scientist (eJDS) Learning Path & Certification — A guided, practical path designed to introduce learners to Python, data analysis, machine learning foundations, and real-world data workflows.

    “Technology doesn’t stand still, and neither should the people who power it,” said Lindsey Rinehart, INE Chief Executive Officer.

    “Our goal is to give learners one place to grow from novice to expert, with continuously refreshed, hands-on content that reflects what top employers need right now.”

    A Platform Built for Real Skill Development

    INE’s training model emphasizes hands-on learning, scenario-based exercises, and progressive skill-building paths. Learners can practice concepts in real environments, gaining practical experience that transfers directly to on-the-job performance.

    Through this approach, INE enables individuals and teams to build lasting, applied knowledge rather than rely on passive video training.

    Supporting Professionals on Their Learning Journey

    In an effort to make high-quality technical training accessible to as many professionals as possible, INE is also offering limited-time pricing during the Black Friday period.

    These offers provide reduced-cost access to INE’s most comprehensive training plans and certifications, supporting learners at every stage of their career development.

    Learners can choose from bundles that include annual subscriptions, certification vouchers, and hands-on labs, saving up to $750! For the first time, INE is offering the INE Premium Subscription for 50% off to ensure the most comprehensive training subscription is accessible to learners at every level. 

    To learn more about INE’s commitment to accessible, high-impact training—and to explore this year’s limited-time Black Friday opportunities—users can visit https://learn.ine.com/promo/black-friday-2025. 

    About INE

    INE x INE Security is the premier provider of online networking and cybersecurity training and certification.

    Harnessing a powerful hands-on lab platform, cutting-edge technology, a global video distribution network, and world-class instructors, INE Security is the top training choice for Fortune 500 companies worldwide for cybersecurity training in business and for IT professionals looking to advance their careers.

    INE Security’s suite of learning paths offers an incomparable depth of expertise across cybersecurity and is committed to delivering advanced technical training while also lowering the barriers worldwide for those looking to enter and excel in an IT career.

    Contact

    Chief Marketing Officer

    Kim Lucht

    INE

    press@ine.com

    The post INE Expands Cross-Skilling Innovations appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Qilin Ransomware Turns South Korean MSP Breach Into 28-Victim ‘Korean Leaks’ Data Heist

    ·

    South Korea’s financial sector has been targeted by what has been described as a sophisticated supply chain attack that led to the deployment of Qilin ransomware. “This operation combined the capabilities of a major Ransomware-as-a-Service (RaaS) group, Qilin, with potential involvement from North Korean state-affiliated actors (Moonstone Sleet), leveraging Managed Service Provider (MSP)

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Scaling SOC Team Expertise With AI-powered Insights for Faster, Easier Understanding of Threats

    ·

    , ,

    Building analyst expertise is a race against time that many Security Operations Centers (SOCs) are losing. New hires often require over six months to handle complex incidents with confidence, creating a bottleneck where senior analysts must compensate for the skills gap.

    Traditional training, reliant on theories and simulations, struggles to keep pace with the speed of real-world attacks. To bridge this gap, leading SOCs are shifting their strategy: turning daily investigations into a continuous learning environment where expertise scales alongside operations.​

    To build lasting expertise, security leaders are redesigning workflows to teach as they protect. The most effective teams now use interactive environments that allow analysts to explore, experiment, and learn from live data without risking organizational security.

    This “learning-while-doing” approach relies on safe experimentation. By allowing analysts to test hypotheses and trace attacker behavior in real-time, SOCs foster critical thinking rather than just reactive button-pushing tools like ANY.RUN Interactive Sandbox facilitates this by providing a safe, collaborative space where analysts at all levels can interact directly with threats. Instead of separating training from daily tasks, every analysis becomes a dual opportunity for defense and skill acquisition.​

    AI-Powered Insights Accelerate Process

    The integration of AI into analysis workflows is a primary driver for faster expertise scaling. Modern sandboxes now employ AI assistants to act as force multipliers for junior analysts. For example, ANY.RUN’s sandbox includes AI-powered summaries that instantly explain malicious processes and behaviors.​

    These features bridge the gap between complex data and analyst understanding:

    • Instant Explanations: AI reviews provide real-time context for specific malware behaviors, such as why a process is executing a particular command or connecting to a specific IP.​
    • Verdict Clarity: ChatGPT-powered analysis offers detailed verdicts, explaining why a file is malicious rather than just flagging it, which helps junior staff understand the “why” behind the alert.​
    • Reduced Learning Curve: By embedding these insights into routine investigations, the technology reduces the intimidation factor of complex threats, allowing newer analysts to make confident decisions faster.

    Expertise grows fastest when it is shared. Modern SOC platforms are moving away from isolated investigations toward collaborative environments. Features that allow teams to share sessions, add comments, and review investigations side-by-side enable junior specialists to learn directly from senior peers on live cases.​

    Beyond the internal team, access to a broader community plays a crucial role. Analysts can now tap into vast libraries of public analysis sessions, thousands of which are uploaded daily, to study the latest Indicators of Compromise (IOCs) and tactics mapped to the MITRE ATT&CK framework. This transforms scattered individual knowledge into a structured, globally accessible resource.​

    Shifting to an interactive, AI-supported workflow delivers quantifiable operational improvements. Organizations adopting these methods report significant gains in efficiency and speed, allowing them to handle higher alert volumes without expanding headcount.​

    Key Performance Metrics for Modernized SOCs

    MetricImpactDescription
    Investigation Speed94% FasterReal-time interaction and automation reveal malicious activity almost instantly, drastically cutting dwell time​.
    SOC Efficiency3x HigherTeams reduce manual work, allowing for more focus on validation, correlation, and proactive defense.
    Tier 1 Workload20% LowerStreamlined processes and AI assistance reduce the volume of repetitive tasks and noise for entry-level analysts.
    Escalation Rate30% ReductionBetter visibility and intuitive tools empower Tier 1 analysts to resolve more incidents independently, reducing Tier 2 bottlenecks.
    Onboarding TimeWeeks vs. MonthsHands-on access to real-world threats accelerates operational readiness for new hires.

    By integrating AI-powered insights and interactive learning into the daily workflow, organizations are doing more than just closing tickets faster; they are building a resilient, self-improving security team capable of adapting to tomorrow’s threats.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Scaling SOC Team Expertise With AI-powered Insights for Faster, Easier Understanding of Threats appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Malicious Prettier Extension on VSCode Marketplace Delivers Anivia Stealer Malware to Exfiltrate Login Credentials

    ·

    , ,

    A dangerous malware campaign has targeted thousands of developers through a fake extension on the Visual Studio Code Marketplace.

    On November 21, 2025, security researchers discovered a malicious extension named “prettier-vscode-plus” designed to trick developers into installing it by mimicking the legitimate Prettier code formatter.

    The extension exploited brand recognition and targeted developers seeking formatting tools, posing a serious threat to the development community.

    The malicious extension operated as a brandjacking attack, using a nearly identical name and appearance to the genuine Prettier extension to deceive users into downloading it.

    This type of attack is particularly effective because developers often trust popular extensions they recognize.

    Checkmarx security researchers identified and reported the extension quickly, leading to its removal within four hours of publication.

    Despite the rapid response, the extension managed to accumulate six downloads and three installations before being taken down from the marketplace.

    Checkmarx security analysts identified that the extension deployed a variant of the Anivia Stealer malware, a credential-stealing tool designed to harvest sensitive information from Windows systems.

    The malware specifically targeted login credentials, metadata, and private communications, including WhatsApp chats.

    This discovery revealed a sophisticated and well-coordinated attack aimed at compromising developer accounts and stealing valuable authentication data.

    Multi-Stage Attack Infrastructure and Evasion Tactics

    The malware employed a multi-stage deployment process designed to evade detection by common security tools. The first stage involved acquiring payload data as a base64-encoded blob from a GitHub repository, then writing VBScript code to the system’s temporary directory for execution.

    The VBS script functioned as a bootstrap mechanism, triggering PowerShell commands that decrypted the blob using an AES encryption key (AniviaCryptKey2024!32ByteKey!HXX) directly in memory without writing files to disk.

    This approach significantly reduced detectable forensic artifacts, making the attack harder for endpoint security systems to track.

    The final stage employed Reflection.AssemblyLoad to execute the decrypted binary from memory, calling the entry point “Anivia.AniviaCRT” to activate the stealer functionality.

    This technique left minimal evidence of infection, with temporary file presence being the only notable disk activity. Additionally, the malware implemented advanced evasion techniques by detecting sandbox environments, checking for small CPU counts and limited RAM availability to avoid triggering in detonation chambers.

    The sophisticated architecture demonstrated skilled threat actors developing an attack specifically designed to bypass endpoint detection and response solutions.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Malicious Prettier Extension on VSCode Marketplace Delivers Anivia Stealer Malware to Exfiltrate Login Credentials appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • FBI Warns of Fake Internet Crime Complaint Center (IC3) Website Used for Phishing Attacks

    ·

    , ,

    The Federal Bureau of Investigation (FBI) has issued urgent warnings about cybercriminals spoofing the official Internet Crime Complaint Center (IC3) website to conduct phishing attacks and steal sensitive personal information.

    These fake sites mimic the legitimate www.ic3.gov portal with near-perfect replicas, borrowing content, layouts, and visuals to deceive users into submitting names, addresses, phone numbers, emails, and banking details.

    Recent screenshots reveal impostor domains like “ichelpindex.com,” flagged as non-official, appearing in security scans such as VirusTotal searches for “ic3.”

    Threat actors exploit victims’ trust in the IC3, the FBI’s primary hub for reporting cybercrimes like fraud and scams. Users often land on these fakes via search engines, sponsored links, or manipulated online forums where scammers pose as fellow victims, directing traffic to phony IC3 recovery services.

    In one variant, fraudsters impersonate IC3 staff via Telegram, promising fund recovery but extracting more data for account takeovers. The FBI noted over 100 such impersonation reports between late 2023 and early 2025, with spoofed sites surging in 2025, prompting PSAs in April and September.​

    Spotting Fake IC3 Sites

    Silent Push observed these phishing pages replicate the real site’s welcome message and complaint form but use altered domains with misspellings or non-.gov top-level domains.

    Security tools highlight discrepancies, such as suspicious search rankings excluding the official ic3.gov. Victims, believing they’ve filed legitimate reports, unwittingly aid further crimes like financial theft or identity fraud.​

    IndicatorReal IC3 (www.ic3.gov)​Fake Sites
    DomainEnds in .govAlternate spellings or TLDs like .com
    Access MethodType directly in browserSearch engines, sponsored ads
    RequestsNo payments for recoveryDemands personal/financial info
    Social MediaNoneFake profiles directing to sites
    GraphicsProfessional U.S. gov styleMay have low-quality artifacts

    The FBI urges typing www.ic3.gov directly into browsers, avoiding sponsored search results, and verifying .gov endings. Never share sensitive data on unverified sites, and report suspicions only via the official portal.

    malicious websites

    IC3 maintains no social media and never requests payments for fund recovery. Recent FBI social posts on November 25 reinforced these alerts amid rising complaints.​

    Public vigilance remains crucial as scammers evolve tactics, targeting prior scam victims seeking recourse. By sticking to direct navigation and skepticism, users can thwart these sophisticated phishing operations.​

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post FBI Warns of Fake Internet Crime Complaint Center (IC3) Website Used for Phishing Attacks appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Akira Ransomware Uses SonicWall VPN Exploit to Exfiltrate Sensitive Data

    ·

    , , ,

    The Akira ransomware group has begun weaponizing vulnerabilities in SonicWall SSL VPN devices, turning merger-and-acquisition (M&A) processes into high-speed launchpads for cyberattacks.

    This trend exposes dangerous blind spots for businesses acquiring smaller companies, as inherited SonicWall devices often serve as easy entry points for attackers.

    How Akira Ransomware Targets M&A Environments

    During mergers and acquisitions, acquiring companies often inherit IT infrastructure with outdated security practices.

    Akira operators exploit these weaknesses, swiftly exfiltrating sensitive data and deploying ransomware.

    According to Relia Quest, in recent incidents analyzed between June and October 2025, attackers gained initial access to larger enterprise networks using SonicWall SSL VPN appliances left over from smaller, acquired companies.

    Once inside, Akira’s operators seek out privileged credentials, many of which are carried over during the M&A transition.

    These credentials, usually unknown to the acquiring business and left unmonitored, provide rapid access to vital systems.

    In some cases, attackers moved from initial compromise to a domain controller in just five hours, well before defenders could respond.

    Small- and medium-sized businesses value SonicWall SSL VPNs for their affordability and ease of use. However, these benefits come with risks:

    • Widespread deployment: Popular among smaller firms, SonicWall devices often end up in environments acquired during M&A.
    • Default configurations: Many appliances operate with unchanged passwords, legacy admin accounts, and outdated settings.
    • Unpatched vulnerabilities: Hasty deployments and resource constraints often lead to patching being overlooked.
    • Exposed features: Remote access tools are sometimes accessible from the internet, leaving sensitive systems unprotected.

    These factors make SonicWall devices reliable entry points for ransomware groups looking to exploit inherited security weaknesses.

    Once Akira operators compromise a SonicWall device, they rapidly scan for high-value hosts.

    Predictable naming conventions inherited from the acquired business make it easy for attackers to locate targets such as domain controllers and file servers.

    In several cases, attackers exfiltrated data within minutes of gaining access, then laterally moved to deploy ransomware within an hour.

    One particular weakness was inconsistent endpoint protection. Inherited networks frequently lacked modern EDR (Endpoint Detection and Response) solutions or had disabled protection.

    Akira operators exploited these gaps by using DLL sideloading to disable defenses before encrypting systems.

    The rapid adoption of SonicWall devices in smaller companies, paired with inherited security debt, creates complex risks during M&A:

    • Stale credentials: Old admin accounts from managed service providers remain active and unmonitored post-acquisition.
    • Missing inventories: Not all assets are tracked during integration, giving attackers places to hide.
    • Mix-and-match security: Different security tools and protocols can leave gaps, which attackers exploit to move unobstructed.

    Without rigorous asset discovery and credential hygiene, defenders are left vulnerable, with inherited weaknesses exposing the entire organization.

    With fast-moving ransomware like Akira, early action is key to preventing devastating breaches and protecting sensitive data.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Akira Ransomware Uses SonicWall VPN Exploit to Exfiltrate Sensitive Data appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Chrome Extension Malware Secretly Adds Hidden SOL Fees to Solana Swap Transactions

    ·

    , , ,

    Security researchers at Socket have uncovered a deceptive Chrome extension called Crypto Copilot that masquerades as a legitimate Solana trading tool while secretly siphoning SOL from users’ swap transactions. The malicious extension, published on June 18, 2024, extracts undisclosed fees by injecting hidden transfer instructions into every transaction users execute. Crypto Copilot markets itself on […]

    The post Chrome Extension Malware Secretly Adds Hidden SOL Fees to Solana Swap Transactions appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New “JackFix” Attack Leverages Windows Updates into Executing Malicious Commands

    ·

    , , ,

    A sophisticated ClickFix campaign dubbed “JackFix” that uses fake adult websites to hijack screens with realistic Windows Update prompts, tricking users into running multistage malware payloads.

    Attackers mimic popular adult sites like xHamster clones to lure victims, likely via malvertising on shady platforms. Interaction with the phishing page triggers a full-screen overlay resembling a critical Windows security update, complete with animations, progress bars, and blue-screen styling.

    fake Windows update screen

    This “screen hijacking” combines urgency from the update theme with embarrassment from adult content, pressuring hasty compliance.

    The attack’s entry point often involves fake adult websites, such as clones of popular platforms like xHamster and PornHub, which are likely promoted through malvertising.

    Once a user interacts with one of these sites, the “JackFix” attack is triggered. The browser is forced into full-screen mode, displaying a convincing “Critical Windows Security Updates” screen, complete with animations and progress counters.

    Fake Jakefix Attack

    JackFix Attack Leverages Windows Updates

    This screen-locking technique, reminiscent of older screen-locker malware, pressures the victim into following on-screen instructions to resolve a fabricated security issue.

    The fake interface disables standard escape keys like Escape and F11, though not fully effectively in tested browsers. This method preys on a user’s sense of urgency and familiarity to compromise their systems.

    The threat actors have implemented several advanced methods to evade detection. The campaign not only obfuscates its malware payloads but also the very commands used to initiate the ClickFix attack, allowing it to bypass many current prevention tools.

    Furthermore, the malicious URLs used in the attack employ a clever redirection strategy. If accessed directly, they redirect to benign sites like Google or Steam, but they deliver the malicious payload only when accessed via specific PowerShell commands.

    powers

    This tactic helps the attacker’s infrastructure avoid being flagged as malicious by security analysis tools like VirusTotal.

    Once the victim is tricked into running the initial commands, a multistage attack chain is initiated. The process begins with mshta, which leads to a PowerShell downloader.

    This second-stage script bombards the user with User Account Control (UAC) prompts, effectively rendering the machine unusable until administrative privileges are granted. After gaining elevated access, the script proceeds to deploy a staggering number of malware samples simultaneously.

    In what researchers describe as a “spray and prey” strategy, a single infection can execute eight different malware variants. The deployed malware includes the latest versions of potent info-stealers like Rhadamanthys, Vidar 2.0, and RedLine, as well as the Amadey botnet client and various loaders and Remote Access Trojans (RATs).

    This massive deployment ensures that even if some payloads are blocked, others are likely to succeed, posing a severe risk of data theft, including passwords and cryptocurrency wallets.

    The researchers noted that this unique combination of psychological manipulation, advanced obfuscation, and multi-payload delivery makes the “JackFix” campaign a significant and evolving threat.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post New “JackFix” Attack Leverages Windows Updates into Executing Malicious Commands appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Massive Data Leak: ByteToBreach Offers Stolen Global Airline, Banking, and Government Records

    ·

    ,

    A cybercriminal operating under the alias ByteToBreach has emerged as a prominent figure in the underground data trade, orchestrating a series of high-profile breaches targeting critical sectors worldwide. Active since at least June 2025, ByteToBreach has leveraged a blend of technical proficiency, aggressive self-promotion, and cross-platform operations to become one of the most publicized threat […]

    The post Massive Data Leak: ByteToBreach Offers Stolen Global Airline, Banking, and Government Records appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Hackers Exploit NTLM Authentication Flaws to Target Windows Systems

    ·

    , , ,

    More than two decades after its initial discovery, the NTLM authentication protocol continues to plague Windows systems worldwide.

    What started in 2001 as a theoretical vulnerability has evolved into a widespread security crisis, with attackers actively weaponizing multiple NTLM flaws to compromise networks across different regions.

    The New Technology LAN Manager (NTLM) protocol was designed to authenticate clients and servers in Windows environments using a three-step handshake.

    Although Microsoft has announced plans to retire NTLM entirely, beginning with Windows 11 24H2 and Windows Server 2025, the protocol remains embedded in millions of systems.

    This persistence creates an open window for cybercriminals who continue to discover and exploit new vulnerabilities in NTLM’s outdated mechanisms.

    Multiple Attack Vectors Under Active Exploitation

    NTLM flaws enable several dangerous attack techniques. Hash leakage occurs when attackers craft malicious files that trick Windows into sending authentication hashes without requiring user interaction.

    CVE IDSeverityAffected SystemsImpactKnown Campaigns
    CVE-2024-43451HighWindows (Multiple Versions)Hash Leakage, Credential CompromiseBlindEagle (Remcos RAT), Head Mare
    CVE-2025-24054/CVE-2025-24071HighWindows 11, Windows ServerHash Leakage, Unauthorized AccessTrojan Distribution in Russia (AveMaria/Warzone)
    CVE-2025-33073HighWindows (SMB Client)Privilege Escalation to SYSTEM LevelUzbekistan Financial Sector Attack

    Coercion-based attacks force systems to authenticate to attacker-controlled services.

    Once credentials are compromised, attackers use credential-forwarding techniques such as Pass-the-Hash to move laterally across networks and escalate privileges without knowing the actual passwords.

    Man-in-the-middle attacks remain particularly effective, with NTLM relay remaining the most impactful method for two decades. Attackers position themselves between clients and servers to intercept authentication traffic and capture credentials.

    Security researchers have identified several critical NTLM vulnerabilities that are currently being actively exploited in 2024 and 2025.

    CVE-2024-43451 enables NTLMv2 hash leakage through malicious .url files. Simply interacting with these files clicking, right-clicking, or moving them automatically connects to attacker servers running WebDAV.

    The BlindEagle APT group exploited this vulnerability to distribute the Remcos RAT to Colombian targets. At the same time, the Head Mare hacktivists exploited it against Russian and Belarusian organizations.

    CVE-2025-24054 and CVE-2025-24071 target .library-ms files inside ZIP archives, causing automatic NTLM authentication to attacker-controlled servers. Researchers detected campaigns in Russia distributing the AveMaria Trojan using this method.

    CVE-2025-33073 represents a hazardous reflection attack. Attackers manipulate DNS records to trick Windows into treating external authentication requests as local, bypassing regular security checks and granting SYSTEM-level privileges.

    According to SecureList, suspicious activity exploiting this vulnerability was detected in Uzbekistan’s financial sector.

    Despite Microsoft addressing these vulnerabilities through patches, the legacy protocol’s continued presence in enterprise networks means attacks will persist.

    Organizations maintaining NTLM for compatibility with older applications remain particularly vulnerable. Security teams should prioritize migrating to Kerberos, implementing network segmentation, and monitoring for suspicious authentication attempts across their Windows infrastructure.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Hackers Exploit NTLM Authentication Flaws to Target Windows Systems appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶