• Anthropic researchers have discovered a troubling phenomenon in the development of artificial intelligence: when large language models learn to “reward hack” during coding tasks, they subsequently exhibit malicious behavior in completely unrelated contexts, including sabotaging safety research and cooperating with hackers. What Is Reward Hacking? Reward hacking occurs when AI models find shortcuts to maximize […]

    The post Reward-Hacking Training Produces Malicious Cross-Task Behaviors appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft has announced a significant update to the Teams Desktop Client for Windows that aims to enhance performance and reduce startup times for calling features.

    The update, detailed in the Message Center notification MC1189656 published on November 25, 2025, introduces a new process architecture designed to optimize resource usage and improve meeting experiences.

    New Process Architecture for Better Performance

    The upcoming change introduces a new child process, ms-teams_modulehost.exe, that will run separately from the primary Teams application process (ms-teams.exe).

    Performance Improvement – The new architecture optimizes resource usage, delivering faster startup times and smoother meeting experiences through better workload distribution.

    Separate Process Architecture – The calling stack now runs in its own dedicated child process rather than consuming resources from the main application, reducing system overhead.

    Transparent to Users – No changes to user workflows or interface; the performance benefits happen entirely in the background.

    This dedicated process will handle the calling stack independently, allowing Teams to distribute workloads more efficiently across system resources.

    After the update, users who open Task Manager will notice a new process running under the primary Teams process.

    Separating calling features into a dedicated module is expected to deliver faster startup times and smoother performance during meetings and calls.

    Microsoft plans to begin the worldwide rollout in early January 2026, with completion expected by late January 2026.

    The update will be available across all environments, including Worldwide, GCC, GCC High, and DoD tenants. However, Microsoft has noted that timelines may shift due to year-end feature flag rollout freezes.

    Users will not experience any changes to their daily workflows or the Teams interface.

    The performance improvements occur entirely in the background, so employees can continue using Teams as they usually do without needing to learn new features or adapt to interface changes.

    While end users will not need to take any action, IT administrators should prepare their environments before the rollout begins.

    Organisations should update endpoint management and security software to allowlist the new ms-teams_modulehost.exe process alongside the existing ms-teams.exe.

    This ensures security solutions do not block or interfere with the new component.

    Helpdesk teams should be informed about this change to prevent confusion during troubleshooting sessions.

    When users report seeing a new process in Task Manager, support staff should recognise this as expected behaviour.

    Internal documentation that references Teams process names should be updated to include the new module host process.

    Microsoft has indicated that no compliance considerations have been identified with this update.

    However, organisations are encouraged to review the change in accordance with their compliance requirements and security policies.

    This update represents Microsoft’s continued commitment to improving Teams’ performance as the platform remains central to workplace collaboration.

    By optimising how calling features are processed, organisations can expect more responsive meeting experiences and faster application startup times beginning in early 2026.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Microsoft Teams Introduces New Feature to Boost Performance and Startup Speed appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Water Gamayun, a Russia‑aligned advanced persistent threat (APT) group, has launched a new multi‑stage intrusion campaign that weaponizes the recently disclosed MSC EvilTwin vulnerability in Windows Microsoft Management Console (MMC). Leveraging a blend of compromised infrastructure, social engineering, and heavily obfuscated PowerShell, the attackers exploited CVE‑2025‑26633 to inject malicious code into mmc.exe, ultimately delivering hidden […]

    The post Gamayun APT Exploits New MSC EvilTwin Vulnerability to Deliver Malicious Payloads appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • ASUS has disclosed a high security vulnerability in its MyASUS application that could allow local attackers to escalate their privileges to SYSTEM-level access on affected Windows devices.

    The flaw, tracked as CVE-2025-59373, carries a high-severity CVSS 4.0 score of 8.5, indicating a significant risk to millions of ASUS computer users worldwide.

    Vulnerability Overview

    The security flaw resides in the ASUS System Control Interface Service, a core component of the MyASUS application that manages hardware settings and system utilities on ASUS personal computers.

    The vulnerability enables attackers with low-level local access to escalate their privileges to SYSTEM-level, granting them complete control over the affected machine.

    CVE IDAffected ProductImpactCVSS 4.0 ScoreExploit Prerequisites
    CVE-2025-59373ASUS System Control Interface Service (MyASUS)Privilege Escalation to SYSTEM8.5 (High)Local access with low privileges

    With SYSTEM-level access, threat actors can execute arbitrary code, install malware, access sensitive data, modify system configurations, and potentially move laterally across enterprise networks.

    This makes the vulnerability particularly dangerous in corporate environments where a single compromised endpoint could lead to broader network intrusion.

    The vulnerability requires local access to exploit, meaning an attacker must already have some level of access to the target system.

    However, the attack complexity is low, requires no user interaction, and only minimal privileges are needed to trigger the exploit.

    The potential impact spans high confidentiality, integrity, and availability concerns, though the scope remains unchanged beyond the vulnerable component.

    The vulnerability affects all ASUS personal computers running the MyASUS application, including desktops, laptops, NUC systems, and All-in-One PCs. ASUS has released patched versions to address the issue.

    Users should update to the following fixed versions immediately:

    • ASUS System Control Interface 3.1.48.0 for x64 systems
    • ASUS System Control Interface 4.2.48.0 for ARM-based devices

    To verify the current installed version, users can navigate to MyASUS, then select Settings and click About to view the version information.

    ASUS urges all users to apply the security update as soon as possible. The update can be obtained through Windows Update, which will automatically deliver the patch to eligible systems.

    Organizations running ASUS devices across their networks should prioritize deploying this patch given its high severity rating and the potential for privilege-escalation attacks.

    Security teams should also monitor systems for any suspicious activity that could indicate exploitation attempts.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post ASUS MyASUS Flaw Lets Hackers Escalate to SYSTEM-Level Access appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The U.S. Federal Bureau of Investigation (FBI) has warned that cybercriminals are impersonating financial institutions with an aim to steal money or sensitive information to facilitate account takeover (ATO) fraud schemes. The activity targets individuals, businesses, and organizations of varied sizes and across sectors, the agency said, adding the fraudulent schemes have led to more than $262

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Modern cybersecurity faces an escalating challenge: fileless malware and obfuscation techniques increasingly bypass traditional file-based detection methods.

    To address this growing threat, JPCERT/CC has released YAMAGoya. This open-source threat hunting tool leverages industry-standard detection rules to identify suspicious activity in real time.

    YAMAGoya represents a significant advancement in endpoint threat detection by combining Event Tracing for Windows (ETW) event monitoring with memory scanning capabilities.

    Open-Source Endpoint Detection Solution

    Unlike conventional security tools that rely on proprietary detection engines, YAMAGoya directly supports Sigma and YARA rules.

    Enabling security analysts to deploy community-driven detection logic across their infrastructure.

    The tool operates entirely in userland, requiring no kernel driver installation, which simplifies deployment across organizational environments.

    Its real-time monitoring capabilities track files, processes, registry modifications, DNS queries, network connections, PowerShell execution, and WMI commands simultaneously.

    YAMAGoya startup screen
    YAMAGoya startup screen

    This comprehensive approach enables the detection of both traditional and fileless malware threats.

    According to JPCERT/CC, YAMAGoya supports multiple rule formats, including Sigma rules, YARA rules for memory scanning, and custom YAML rules for correlation-based detection.

    JPCERT/CC security teams can create sophisticated detection logic that correlates multiple events.

    Such as file creation followed by process execution, DLL loading, and network communication, to identify malicious activity patterns.

    The tool is available for immediate evaluation through pre-built binaries on GitHub, with source code available for organizations requiring custom builds.

    YAMAGoya operates via both graphical and command-line interfaces, accommodating different operational preferences.

    YAMAGoya's Alert tab
    YAMAGoya’s Alert tab

    Users can run Sigma rule monitoring or memory scanning with simple commands, provided they have administrative privileges.

    JPCERT/CC detection alerts appear in the tool’s interface. They are logged to Windows Event Log with specific event IDs for integration with security information and event management (SIEM) systems.

    This enables centralized monitoring and alerting across enterprise environments. By supporting industry-standard detection rules, YAMAGoya democratizes advanced threat detection capabilities.

    JPCERT/CC researchers and incident responders can now leverage community-developed Sigma and YARA rules without vendor lock-in, strengthening the collective cybersecurity defense posture against emerging threats.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post YAMAGoya – Real-Time Threat Monitoring Tool Using Sigma and YARA Rules appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New release brings significant improvements to the penetration testing framework, introducing enhanced GUI features, REST API support, and powerful new evasion techniques that security researchers can leverage for offensive operations.

    The latest release features a completely redesigned graphical interface with multiple theme options, including Dracula, Solarized, and Monokai.

    All visualizations have been updated, including an improved Pivot Graph that now displays listener names and transition types for better infrastructure management.

    CategoryFeature
    GUI & InterfaceModern redesigned client with Dracula, Solarized, Monokai themes
    Updated Pivot Graph with listener names and pivot types
    Java 17 minimum requirement
    REST APIScript with any programming language (Beta)
    Advanced automation and custom client development
    ML/LLM integration support
    Custom C2User Defined Command and Control (UDC2)
    Custom C2 channels via BOFs
    ICMP and unconventional channel routing
    Process InjectionRtlCloneUserProcess (DirtyVanity-based)
    TpDirect (thread pool manipulation)
    TpStartRoutineStub (thread pool triggering)
    EarlyCascade (fork/run injection)
    UAC Bypassesuac-rpc-dom (AppInfo ALPC bypass)
    uac-cmlua (ICMLuaUtil COM interface)
    Windows 10–11 24H2 compatible
    Memory OperationsBeaconDownload API (up to 2GB in-memory)
    Drip loading for EDR evasion
    No disk writes for sensitive data
    Beacon ImprovementsSleepmask for pivot beacons
    IPv6 SOCKS5 proxy support
    Fixed SSH Beacon (Mac/Linux)
    Task ID logging for operations

    A significant change requires users to upgrade to Java 17 or newer. Earlier Java versions will no longer run the application, ensuring access to modern security features and improved performance.

    Revolutionary REST API and Custom C2 Channels

    For the first time, Cobalt Strike users can script the framework using any programming language through a new REST API (currently in beta).

    This enables advanced automation, server-side operation storage, and the development of custom Cobalt Strike clients.

    The REST API opens the door to integrating machine learning models into offensive workflows, in line with emerging research by security teams exploring AI-powered exploitation techniques.

    The high-level architecture of UDC2
    The high-level architecture of UDC2

    Additionally, User Defined Command and Control (UDC2) allows operators to develop custom C2 channels as Beacon Object Files (BOFs).

    This eliminates previous limitations by enabling traffic to be routed through unconventional channels, such as ICMP, while maintaining compatibility with custom transformations and obfuscation methods.

    Enhanced Process Injection and UAC Bypasses

    Cobalt Strike 4.12 introduces four new process injection techniques designed to evade endpoint detection and response (EDR) systems.

    These include RtlCloneUserProcess (based on DirtyVanity research), TpDirect, TpStartRoutineStub, and EarlyCascade, all implemented as BOFs for flexibility.

    Two new UAC bypass methods, uac-rpc-dom and uac-cmlua, work across Windows 10 through Windows 11 24H2, providing reliable privilege escalation paths for tested environments.

    A screenshot of the new Process Injection GUI with a custom technique
    A screenshot of the new Process Injection GUI with a custom technique

    The BeaconDownload API now supports downloading in-memory buffers up to 2GB without writing files to disk, reducing analytical indicators.

    Drip-loading functionality has been added to break event correlation by spreading payload writes with delays, thereby defeating detection logic based on injection-primitive sequences.

    A screenshot showing the new UDRL-VS GUI
    A screenshot showing the new UDRL-VS GUI

    Pivot Beacons now support the Sleepmask evasion technology, and IPv6 support has been added for SOCKS5 proxying, expanding operational flexibility.

    These updates position Cobalt Strike 4.12 as a comprehensive framework for modern red team operations and security research.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Cobalt Strike 4.12 Released With New Process Injection, UAC Bypasses and Malleable C2 Options appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A significant issue has been disclosed that affects multiple versions of the identity and access management platform.

    The flaw stems from a hardcoded default encryption key used for password storage, allowing attackers with database access to recover plaintext passwords.

    The vulnerability impacts Apache Syncope when configured to store user passwords in the internal database with AES encryption.

    Apache Syncope Vulnerability

    While this configuration option is not enabled by default, organizations that have specifically enabled this feature face a serious risk.

    When AES encryption is active, the system relies on a hardcoded default key value embedded directly in the source code.

    This design flaw means that any attacker gaining access to the internal database can easily reconstruct the original cleartext password values using the publicly known default encryption key.

    The vulnerability does not affect encrypted plain attributes, which use a separate AES encryption mechanism and remain secure even in compromised scenarios.

    ParameterDetails
    CVE IDCVE-2025-65998
    Vulnerability TitleApache Syncope Hardcoded Encryption Key Allows Password Recovery
    Affected ProductsApache Syncope (org.apache.syncope.core:syncope-core-spring)
    Vulnerability TypeUse of Hardcoded Cryptographic Key (CWE-798)
    ImpactConfidentiality Breach – Password Recovery
    CVSS v3.1 Base Score7.5 (High) – Database Compromise

    Organizations running these versions with AES password encryption enabled should prioritize immediate remediation. Apache Syncope has released patched versions addressing this vulnerability.

    Users should upgrade to version 3.0.15 or 4.0.3, which completely fixes this issue. Administrators should first inventory their deployments to identify whether AES password encryption is currently enabled.

    If enabled, upgrading to the patched versions is critical to prevent password compromise. This vulnerability has a significant severity rating due to its potential for widespread credential theft.

    Any attacker with database access can leverage the hardcoded encryption key to decrypt stored passwords, potentially compromising all user accounts in affected systems.

    This is particularly dangerous for organizations that manage large user populations or handle sensitive identity data.

    Organizations using Apache Syncope should immediately review their encryption configuration and apply the latest security patches.

    Security teams should also conduct password audits for users whose credentials may have been exposed during the vulnerable period.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Apache Syncope Vulnerability Allows Attacker to Access Internal Database Content appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The Air Force aims to keep its aging C-5 and C-17 airlifters flying years longer than planned as it awaits a next-gen replacement, officials said in recently released documents. That’s alarming some former mobility leaders.

    A Nov. 19 solicitation memo says the C-5 Galaxy will fly until 2045 and the C-17 Globemaster until 2075, longer than previously planned, to ensure that the Air Force has enough airlift capacity while it waits for the Next-Generation Airlift aircraft. 

    NGAL is to reach production no earlier than 2038 and initial operating capacity three years after that. “To mitigate risks associated with acquisition delays, funding uncertainties, or technological challenges, the existing C-5M and C-17A fleets’ operational viability must be maintained until a fully capable replacement is fielded, which may require extending the service life and associated Military Type Certificate (MTC) of each platform,” the memo states.

    The plan is to retire one C-5 as each new NGAL arrives, then do the same with the C-17s.

    But keeping some of the Air Force’s oldest transport airframes in the skies is already a major effort, former service officials told Defense One. Maintenance hurdles, mission-capability rates, and recent mishap stats add to the concerns.

    “Why would this approach to this old problem deliver a different result than what has already happened?” said Mike Minihan, who retired last year after leading Air Mobility Command. “Have we done the analysis to ensure that the capability that we're delivering with this upgrade is actually what the warfighter needs?”

    Minihan said he supports the Air Force’s efforts to field NGAL. (In May, he became an adviser to Radia, which aims to field the world’s largest cargo plane.) He also praised the memo’s acknowledgement that “uninterrupted inter-theater airlift capacity is paramount for global operations,” 

    But Minihan said the service needs to prioritize its future airlift capabilities, not just modernizing aging aircraft.

    “I'm extremely worried about what I call the equilibrium. The equilibrium between the force that supports and the force that needs supporting, or the strike forces,” Minihan said. “So you're going to have fifth- and sixth-generation bombers and fighters, and you're still on generation-two airlifters and tankers.”

    The C-5 entered service in 1970. After the AIr Force concluded in 2004 that the Galaxy still had decades of life, the remaining 52 airframes were re-engined and upgraded between 2006 and 2018. But last year, the type managed only a 48 percent mission-capable rate, thanks to  maintenance and supply-chain problems that kept some airframes in the depot for 900 days. The Air Force Life Cycle Management even started a campaign, “Drive to 55.” to boost that rate to 55 percent. 

    Minihan has publicly argued that the Air Force should sell its C-5s to private companies, then charter them from time to time, as a way to “relieve the C-17.”

    The C-17, which entered service in 1995, has a more reliable mission-capable rate of 75 percent. But in the past four years, Globemasters have been involved in 21 class-A mishaps—the deadliest and costliest incidents—more than any of the military’s most-used planes.

    Jessica Ruttenber, a former Air Force pilot and program manager who oversaw the C-5 and C-17 portfolios, said she was unsurprised by the service’s call to extend the life of the two transports, but said the cost of doing so would continue to be high.

    “It’s a grandfather jet, so it doesn’t surprise me one bit,” Ruttenber said. “The thing that concerns me for the C-5 and the C-17…is the maintenance cost and the upkeep.”

    Responses to the NGAL solicitation are due in about two months, and the analysis of alternatives is to take place in 2027, the memo said.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Russia’s war on Ukraine has yielded troves of battlefield data, but Kyiv has no efficient way to share it with NATO friends. The alliance aims to fix that in the new year.

    “Ukraine has a lot of data that they want to give to NATO” as part of a joint training center in Poland, said Tom Goffus, the alliance’s assistant secretary general for operations, during a Missile Defense Advocacy Alliance virtual event on Monday. “We're doing a cloud solution for that…to be able to handle large amounts of data from the Ukraine battlefield. And we're hoping that it's going to be operational on NATO cloud in January of 2026.”

    The final hurdle involves process, not technology.

    “They've got all the equipment to do it,” Goffus said. “What we don't have…is we don't yet have a policy on how to accredit it. How can you accredit this system in order to use it in a safe manner? All of our tools are designed for network-centric security, and we want to go to cloud-centric security, and so that's one of our biggest challenges.” 

    The plan is to learn from big cloud service providers in the U.S. that operate classified clouds for national security. The Pentagon has also been working on improving secure communications with allies and partners. 

    “I'm going to be talking to some of the hyperscalers who have done this already in the U.S. system. There are secure clouds out there, nationally, at the secret and even higher level. So this is figuring out an accreditation process to go along with the capability and essentially get the culture, the process and the policy to catch up with what's available out there.”

    Goffus said the goal is to build everything from scratch to avoid inheriting the “limitations” of existing networks. Also, while the aim is to use commercially available systems with open architecture—that is, they can interface with products regardless of what company made them—the government has to be the owner, ultimately. 

    “It has to be brand-new. It is not system-of-systems. It's not a federated system of systems—many of our federated system-of-systems are actually proprietary, which makes it harder for things to talk to each other,” he said. “But I do want to stress that this has to, in the end, be government defined and government owned, though it is commercial solutions. And we need to be the gatekeepers on that.”

    The proliferation of data generated and used on the modern battlefield from fighter jets to drones to ships has increased the need for militaries to be able to access, analyze and transfer information quickly (even for medical responses). 

    And for NATO, the vision is to integrate the data from partner nations and provide that central cloud-based solution, Goffus said. 

    “I think NATO needs to have a cloud solution, [an] open architecture way of integrating things that the nations buy. The nations buy the sensors. They buy that sensor suite, sensor system that feeds the data. But NATO does the data integration and makes it all good,” he said. “The strategy overall right now would be more in that line, and that common funding would go to help make sure that we have that data backbone, that common data layer that everybody can pull from.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶