• Security researchers at the AhnLab Security Intelligence Center (ASEC) have uncovered a sophisticated cyberattack campaign targeting Microsoft Windows Server Update Services (WSUS) infrastructure. The attackers are exploiting a critical remote code execution vulnerability tracked as CVE-2025-59287 to deploy ShadowPad, a notorious backdoor malware linked to multiple Chinese state-sponsored advanced persistent threat (APT) groups. On October 14, 2025, […]

    The post Chinese Hackers Exploiting WSUS Remote Code Execution Vulnerability to Deploy ShadowPad Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The U.S. Department of the Treasury, Australia, and the United Kingdom have announced coordinated sanctions against Media Land.

    This Russia-based bulletproof hosting company provides infrastructure to ransomware and other cybercriminals.

    The U.S. Federal Bureau of Investigation also coordinated the action targeting the company’s leadership team and related entities.

    Bulletproof hosting providers offer specialized servers designed to help criminals hide their activities and avoid law enforcement.

    These services give ransomware gangs, hackers, and other cybercriminals the infrastructure they need to launch attacks against businesses and critical infrastructure.

    Media Land’s Criminal Operations

    Media Land, headquartered in St. Petersburg, Russia, supplied hosting services to major ransomware groups, including LockBit, BlackSuit, and Play.

    The company’s infrastructure was also used for distributed denial-of-service (DDoS attacks targeting U.S. companies and critical systems. Company leadership played direct roles in the criminal operation.

    Aleksandr Volosovik, Media Land’s general director, advertised the company’s services on cybercriminal forums under the alias “Yalishanda” and provided servers to ransomware actors.

    Kirill Zatolokin, an employee, collected payments from customers and coordinated with other cyber actors. Yulia Pankova assisted Volosovik with legal matters and financial management.

    The Treasury also designated Hypercore Ltd., a UK-registered company created by the Aeza Group after it was sanctioned in July 2025. Aeza attempted to rebrand and hide its connections to avoid sanctions.

    Treasury officials designated new companies and individuals involved in the evasion effort, including directors Maksim Makarov and Ilya Zakirov. Related entities in Serbia and Uzbekistan were also targeted.

    All property and assets belonging to the designated individuals and companies in the United States are now frozen.

    U.S. persons and businesses are prohibited from conducting transactions with these entities. Financial institutions engaging with sanctioned parties risk enforcement actions.

    The U.S. Treasury emphasized that these coordinated international actions demonstrate a commitment to preventing ransomware and protecting citizens from cybercrime.

    The Cybersecurity and Infrastructure Security Agency released additional guidance on protecting against bulletproof hosting providers.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Authorities Sanctioned Russia-based Bulletproof Hosting Provider for Supporting Ransomware Operations appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The holiday shopping rush has always been the retail industry’s busiest and riskiest time of year. As e-commerce traffic, in-store digital systems, and supply-chain automation have evolved, so too have attackers. The weeks surrounding Black Friday and Cyber Monday now represent a perfect storm for cybercrime: overwhelmed IT teams, record transaction volumes, and high operational […]

    The post Ransomware Attacks Poised to Hit Retailers Hard This Holiday Season appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Salesforce has warned of detected “unusual activity” related to Gainsight-published applications connected to the platform. “Our investigation indicates this activity may have enabled unauthorized access to certain customers’ Salesforce data through the app’s connection,” the company said in an advisory. The cloud services firm said it has taken the step of revoking all active access and refresh

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The Google Threat Intelligence Group (GTIG) has unveiled a sophisticated three-year cyber espionage campaign orchestrated by APT24, a China-nexus threat actor, targeting organizations primarily in Taiwan through the deployment of BADAUDIO malware and strategic web compromises. APT24’s operations have undergone a significant transformation since November 2022. Initially, the threat actor compromised over 20 legitimate public […]

    The post APT24 Deploys New BadAudio Malware, Hijacks Legitimate Public Sites to Launch Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Security researchers have identified a dangerous flaw in the Windows Graphics Component that enables attackers to seize complete control of computers using nothing more than a crafted image file. The vulnerability, tracked as CVE-2025-50165, represents a severe threat to Windows users worldwide. Vulnerability Overview Zscaler ThreatLabz discovered this critical security flaw in May 2025 within the […]

    The post Windows Graphics Flaw Lets Hackers Take Over with Just One Image appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Salesforce has issued a critical security alert identifying “unusual activity” involving Gainsight-published applications connected to customer environments.

    The CRM giant’s investigation indicates that this activity may have enabled unauthorized access to Salesforce data through the applications’ external connections.

    In an immediate response to contain the threat, Salesforce has revoked all active access and refresh tokens associated with the affected Gainsight apps and temporarily removed them from the AppExchange.​

    Salesforce explicitly stated that this incident does not stem from a vulnerability within the Salesforce platform itself. Instead, it exploits the trust relationship between the platform and third-party integrations.

    The attack leverages compromised OAuth tokens and digital keys that allow apps to access data without sharing user credentials.

    Salesforce Gainsight Breach

    This mirrors the tactics used in the August 2025 campaign involving Salesloft Drift, in which attackers used stolen OAuth tokens to bypass authentication and access CRM-layer data, such as business contacts and case logs, across hundreds of organizations.​

    Gainsight had previously acknowledged its exposure to the Salesloft Drift incident, confirming that stolen secrets from that breach were the likely root cause. Now, threat actors appear to be replaying the same playbook: combining stolen OAuth tokens with over-permissioned applications to create a “perfect attack chain” that bypasses traditional perimeter defenses.​

    Security researchers have linked this campaign to ShinyHunters (also tracked as UNC6040), a threat group notorious for targeting SaaS ecosystems. This group typically employs social engineering to trick users into approving malicious apps or, as seen here, pivots from one compromised vendor to another.

    From a Third-Party Risk Management (TPRM) perspective, this incident exemplifies a “supply-chain blast radius” event, where a single compromised vendor serves as a gateway into dozens of downstream environments.

    Risk in modern SaaS ecosystems no longer travels linearly; it fans out, creating exponential exposure from a single point of failure.​

    Organizations using Gainsight integrations must assume their current connections are compromised until re-authenticated. Teams should immediately audit every connected app in their Salesforce instance, removing or restricting any integration that does not require wide API access.

    It is critical to rotate vendor OAuth tokens immediately and treat any token with broad permissions as high-risk. Furthermore, security teams should harden their approval processes for new integrations, as threat actors have previously used social engineering to get malicious apps approved.

    Ferhat Dikbiyik, Chief Research and Intelligence Officer (CRIO) at Black Kite, said to cybersecuritynews.com “that this wasn’t a breach of Salesforce’s core platform. Instead, attackers linked to ShinyHunters (ScatteredSpider Lapsu$ Hunters) exploited a third-party integration, using access from a compromised vendor to pull customer data out of Salesforce environments. And there’s an important pattern here”.

    “Gainsight has already acknowledged exposure in a previous campaign involving Salesloft Drift, where stolen OAuth tokens were used to access Salesforce data across many organizations. In that earlier case, Gainsight disconnected the Salesloft app and confirmed that only CRM-layer data, mostly business contact info and some Salesforce case text, had been accessed”.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Salesforce Confirms that Customers’ Data Was accessed Following the Gainsight Breach appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The notorious Clop ransomware gang has listed Oracle on its dark web leak site, alleging a successful breach of the tech giant’s internal systems.

    This development is part of a massive extortion campaign exploiting a critical zero-day vulnerability in Oracle E-Business Suite (EBS), designated as CVE-2025-61882.

    The group, tracked as Graceful Spider, claims to have exfiltrated sensitive data from Oracle and dozens of its high-profile customers, marking a significant escalation in supply chain attacks reminiscent of the MOVEit incident.​

    The Zero-Day Exploit: CVE-2025-61882

    The attack vector centers on a critical, unauthenticated remote code execution (RCE) vulnerability in Oracle E-Business Suite.

    Security researchers indicate that Clop affiliates began exploiting this flaw as early as August 2025, months before Oracle released a patch in October 2025.

    The exploit chain specifically targets the OA_HTML/SyncServlet endpoint to bypass authentication, followed by malicious XSLT template injection via OA_HTML/RF.jsp to execute arbitrary commands.

    This “pre-auth” nature allowed attackers to compromise servers without valid credentials, granting them full control over sensitive ERP data.​

    Vulnerability DetailTechnical Specification
    CVE IDCVE-2025-61882
    Affected ProductOracle E-Business Suite (Versions 12.2.3 – 12.2.14)
    Vulnerability TypeUnauthenticated Remote Code Execution (RCE)
    CVSS Score9.8 (Critical)
    Exploit VectorAuthentication Bypass via SyncServlet & XSLT Injection
    Patch StatusPatched (October 2025 Security Alert)

    Extortion Campaign and High-Profile Victims

    Evidence from Clop’s leak site displays a “PAGE CREATED” status for ORACLE.COM, appearing alongside major entities such as MAZDA.COM, HUMANA.COM, and the Washington Post.

    The listing of Oracle Corporation itself suggests the vendor may have fallen victim to its own software flaw, potentially exposing internal corporate data.

    Victims report receiving extortion emails from addresses like support@pubstorm[.]com, threatening the release of financial and personal records if ransom demands are not met.​

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Oracle Allegedly Breached by Clop Ransomware via E-Business Suite 0-Day Hack appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • President Donald Trump accused six Democratic lawmakers of sedition on social media Thursday and threatened them with punishment as severe as death, after they appeared in a video message encouraging U.S. armed forces to refuse “illegal orders.”

    Trump also shared another social media post that said the Democrats should be hanged.

    The video’s distribution online by Democrats comes as the Trump administration is mired in multiple legal cases objecting to the president’s deployment of National Guard troops to cities across the country, including a challenge to Guard troops in Chicago which is now before the U.S. Supreme Court.

    In several morning posts on his own social media platform Truth Social, Trump wrote, “This is really bad, and Dangerous to our Country. Their words cannot be allowed to stand. SEDITIOUS BEHAVIOR FROM TRAITORS!!! LOCK THEM UP??? President DJT” 

    “SEDITIOUS BEHAVIOR, punishable by DEATH!,” he added a couple of hours later.

    Prior to writing and publishing his own, the president reposted several messages from users on Truth Social, including one by a user with the handle @P78 who wrote, “HANG THEM GEORGE WASHINGTON WOULD !!” 

    Trump and his social media supporters were referring to the video, which featured Democratic U.S. lawmakers who served in the military telling current members of the military and the intelligence community to “refuse illegal orders.”

    Each line in the video is alternately delivered by Sens. Elissa Slotkin of Michigan and Mark Kelly of Arizona, and Reps. Chris Deluzio and Chrissy Houlahan of Pennsylvania, Maggie Goodlander of New Hampshire and Jason Crow of Colorado.

    “We know you are under enormous stress and pressure right now. Americans trust their military, but that trust is at risk. This administration is pitting our uniformed military and intelligence community professionals against American citizens. Like us, you all swore an oath to protect and defend this Constitution. Right now, the threats to our Constitution aren’t just coming from abroad but from right here at home. Our laws are clear: You can refuse illegal orders,” the lawmakers said.

    The video was titled “Don’t give up the ship.”

    Does Trump want to ‘execute’ Democrats?

    When asked by a CBS News reporter during the daily press briefing Thursday whether the president wants to “execute” members of Congress, White House press secretary Karoline Leavitt answered, “No.”

    Leavitt said Trump was reacting to sitting members of Congress who “conspired” on the video message to encourage active duty service members and national security officials to “defy the president's lawful orders.”

    Leavitt singled out the participation of Slotkin and Kelly, who respectively served as a CIA intelligence officer and a Navy captain. Leavitt also highlighted  Goodlander’s marriage to former National Security Advisor Jake Sullivan, who served under President Joe Biden.

    “They were leaning into their credentials as former members of our military, as veterans, as former members of the national security apparatus, to signal to people serving under this commander-in-chief, Donald Trump, that you can defy him, and you can betray your oath of office. That is a very, very dangerous message, and it perhaps is punishable by law,” Leavitt said.

    During the ongoing exchange, CBS’s Nancy Cordes pressed back, saying the lawmakers specifically say “illegal order” in the video.

    “They're suggesting, Nancy, that the president has given illegal orders, which he has not. Every single order that is given to this United States military by this commander in chief and through this chain of command, through the secretary of War, is lawful,” Leavitt responded.

    Democrats decry political violence 

    Democratic lawmakers sounded the alarm Thursday over Trump’s social media posts, accusing him of encouraging political violence.

    “Let’s be crystal clear: the president of the United States is calling for the execution of elected officials. This is an outright threat, and it’s deadly serious. We have already seen what happens when Donald Trump tells his followers that his political opponents are enemies of the state,” Senate Minority Leader Chuck Schumer, D-N.Y., said on the Senate floor Thursday.

    “Every time Donald Trump posts things like this, he makes political violence more likely. None of us should tolerate this kind of behavior,” Schumer said, highlighting political violence in recent years, including the Jan. 6, 2021 attack on the U.S. Capitol, and political assassinations just this past year.

    House Committee on the Judiciary Chair Jamie Raskin, D-Md., called on Speaker Mike Johnson, R-La., to “immediately denounce these reckless statements.”

    The six Democratic lawmakers featured in the video issued a joint statement, saying they “love this country and swore an oath to protect and defend the Constitution of the United States.”

    “That oath lasts a lifetime, and we intend to keep it. No threat, intimidation, or call for violence will deter us from that sacred obligation. What’s most telling is that the President considers it punishable by death for us to restate the law,” the lawmakers said.

    This story was originally published by Stateline.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The Air Force is yanking most of its biggest programs out from its existing program-management structure and putting them under a new four-star who reports to the deputy defense secretary.

    On Tuesday, the White House nominated Air Force Lt. Gen. Dale White and to become the first Direct Reporting Portfolio Manager for Critical Major Weapons Systems, including the Sentinel and Minuteman III intercontinental ballistic missiles, the B-21 bomber, the F-47 fighter jet, and the VC-25B presidential aircraft, an Air Force spokesperson confirmed. If confirmed, White will be promoted to full general and report directly to Deputy Defense Secretary Steve Feinberg.

    “By directing the execution of critical Air Force programs, this DRPM role will help streamline the acquisition process, enabling faster decision-making and expediting the delivery of major systems,” the spokesperson said in an emailed statement.

    White’s nomination follows President Donald Trump’s April executive order calling for an overhaul of the defense industrial base. It also follows Defense Secretary Pete Hegseth’s push to speed up defense acquisition. 

    It’s unclear how the position is related to the defense secretary’s call to condense existing program executive offices under service-branch portfolio acquisition executives who oversee broader groups of programs.

    But one defense budget expert said the creation of the DRPM appears to be at odds with that directive.

    “I think the purpose is they want to centralize control of key programs or problem programs,” said Todd Harrison of the American Enterprise Institute. “But it is fundamentally at tension with some of the acquisition reforms that they're pushing, which talk about delegating down, pushing down the decision-making authority to lower levels. This is going in the exact opposite direction.”

    The service spokesperson defended the move, writing that the position “aligns with the Department of the Air Force’s ongoing acquisition reform efforts to enhance efficiency, reduce redundancy, and accelerate capabilities for our warfighters in direct support of Secretary Hegseth’s move to a Warfighting Acquisition posture.”

    All of the programs to be overseen by the new DRPM—except the months-old F-47 effort—have faced cost overruns, sudden delays and Congressional infighting. 

    Harrison said putting the position under the defense secretary “reflects a lack of trust in the services to be good stewards of these programs.”

    The Sentinel ICBM program was forcibly restructured last year after costs skyrocketed to $141 billion—more than 81% above initial estimates. Discussions for accelerating the B-21 production stalled due to the government shutdown. This summer, the Pentagon asked for permission to reprogram $150 million to speed-up delivery of two VC-25B aircraft to 2027. 

    Amid VC-25B delays, lawmakers have raised alarm over Trump’s use of a gifted luxury Qatari jet in the interim. Air Force Secretary Troy Meink said this summer that some funds from the Sentinel ICBM program were needed to upgrade the jet for use as Air Force One.

    White currently serves as the military deputy for the Air Force’s Assistant Secretary for acquisition, technology, and logistics, according to his service biography. Before that, he was the program executive officer overseeing fighters and advanced aircraft at Wright-Patterson Air Force Base in Ohio.

    If confirmed, White would be “assisted by a small, highly specialized staff resident in the Pentagon, with the current acquisition workforce supporting the DRPM critical major weapons systems programs to remain in place,” the Air Force spokesperson wrote, adding the service plans to stand up the new office “over the next few months.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶