1010.cx

  • FortiWeb Authentication Bypass Vulnerability Exploited – Script to Detect Vulnerable Appliances

    ·

    , ,

    Threat actors are actively exploiting a critical authentication bypass vulnerability in Fortinet’s FortiWeb web application firewall (WAF) worldwide, prompting defenders to heighten vigilance.

    Researchers at watchTowr Labs have responded by releasing a Detection Artefact Generator script, designed to help organizations scan their environments for vulnerable FortiWeb appliances and mitigate risks swiftly.​

    The vulnerability, tracked as CVE-2025-52970, stems from improper parameter handling in FortiWeb, enabling unauthenticated remote attackers to log in as any existing user via crafted requests.

    With a CVSS score of 7.7, it requires some non-public knowledge of the device but poses severe risks, including privilege escalation and potential remote code execution on affected systems.

    Fortinet patched the flaw in versions 8.0.2 and later, but in-the-wild attacks have surged since a partial proof-of-concept surfaced publicly in August 2025, targeting exposed FortiWeb instances indiscriminately.

    Security firms report dozens of compromises, underscoring the urgency for immediate patching amid ongoing exploitation campaigns.​

    WatchTowr Labs’ open-source tool, hosted on GitHub at watchTowr-vs-Fortiweb-AuthBypass, simplifies detection by simulating the bypass mechanism. The Python script generates a unique username and password (e.g., “35f36895”) and sends an exploit payload to the target IP, such as python watchTowr-vs-Fortiweb-AuthBypass.py 192.168.1.99.

    If successful, it confirms vulnerability by creating a temporary user, alerting administrators to remediate. Authored by Sina Kheirkhah (@SinSinology) and Jake Knott (@inkmoro), the script targets FortiWeb versions below 8.0.2, with specifics available via FortiGuard Labs PSIRT.​

    Organizations should prioritize scanning internet-facing appliances, applying patches, and monitoring for anomalous logins. As supply chain attacks evolve, tools like this empower proactive defense in a threat landscape where WAFs ironically become entry points.​

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post FortiWeb Authentication Bypass Vulnerability Exploited – Script to Detect Vulnerable Appliances appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Feds should get at least most backpay by Nov. 19, administration says

    ·

    Most federal workers will receive their first paycheck in more than a month between Saturday and Wednesday of next week, and it should include at least most of the backpay that is due, Trump administration officials said Thursday.

    Lawmakers included a provision guaranteeing full backpay for furloughed workers in the deal to end the 43-day government shutdown after the White House repeatedly insinuated it might break a 2019 law enacted during President Trump’s first term requiring all feds be paid upon the restoration of appropriations.

    A senior administration official told Government Executive that federal HR workers are aiming to get the first post-shutdown checks out to employees within the next week. For many agencies, these paychecks will reflect pay furloughed and excepted workers would have earned from Oct. 1 through Nov. 1.

    General Services Administration and Office of Personnel Management employees can expect to see a paycheck Saturday, while Energy, Health and Human Services, Veterans Affairs and Defense Department civilian workers will be paid Sunday. On Monday, paychecks are set to go out for workers at the Education, State, Interior and Transportation departments, as well as the Environmental Protection Agency, NASA, National Science Foundation, Nuclear Regulatory Commission and the Social Security Administration.

    Another tranche of workers must wait until Wednesday, Nov. 19, to see their backpay, though their checks will also include pay for the Nov. 2-Nov. 15 biweekly pay period, effectively making them whole for time during the shutdown and paying them for their work between Thursday and Saturday of this week: the Agriculture, Commerce, Homeland Security, Housing and Urban Development, Justice, Labor and Treasury departments, and the Small Business Administration.

    Guidance issued Wednesday by OPM Associate Director for Workforce Policy and Innovation Veronica Hinton to agency chief human capital officers provides additional details on how that backpay will be calculated—with the caveat that in agencies’ haste to get checks out, there may be some mistakes.

    “To facilitate making retroactive payments as quickly as possible, payroll providers may have to make some adjustments,” Hinton wrote. “Thus, the initial retroactive pay that an employee receives after a lapse in appropriations has ended may not fully reflect application of all the guidance in this document regarding the treatment of hours for pay, leave and other purposes. Payroll providers will work with agencies to make any necessary adjustments as soon as practicable.”

    Excepted employees should be paid for the time they worked during the shutdown, including overtime pay for any time in excess of their normal tour of duty. And furloughed employees should be paid for the time they would have spent at work, had they not been forced to stay home due to the appropriations lapse. That includes overtime, provided the employee is “regularly scheduled” to work excess hours.

    “A furloughed employee who, before the lapse in appropriations, had been regularly scheduled to perform, during the period subsequently covered by the lapse, overtime work or to perform work at night or during a period for which any other form of premium pay would otherwise be payable is entitled to receive overtime pay, night pay, or other premium pay as if the work had been performed,” OPM wrote. “Allowances, differentials and other payments otherwise payable on a regular basis (e.g., administratively uncontrollable overtime pay and law enforcement availability pay) must be paid as if the furloughed employee continued to work.”

    Ineligible for backpay are individuals who were scheduled to be in leave without pay status during the lapse, or suspended. And excepted employees placed in absent without leave status for “missed assigned work hours” similarly will not be paid for that time. The Social Security Administration controversially refused some employees’ request to be placed in intermittent furlough status and labeled them AWOL instead.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Russian Hackers Create 4,300 Fake Travel Sites to Steal Hotel Guests’ Payment Data

    ·

    A Russian-speaking threat behind an ongoing, mass phishing campaign has registered more than 4,300 domain names since the start of the year. The activity, per Netcraft security researcher Andrew Brandt, is designed to target customers of the hospitality industry, specifically hotel guests who may have travel reservations with spam emails. The campaign is said to have begun in earnest around

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Hackers Exploiting RMM Tools LogMeIn and PDQ Connect to Deploy Malware as a Normal Program

    ·

    , ,

    Cybercriminals are now exploiting remote monitoring and management tools to spread dangerous malware while avoiding detection by security systems.

    The attack campaign targets users who download what appears to be popular software, such as Notepad++, 7-Zip, or ChatGPT, from fake websites.

    Instead of getting the real program, victims unknowingly install LogMeIn Resolve or PDQ Connect, which gives hackers complete control over their computers.

    The attack begins when users visit websites that appear to be official download pages for trusted utilities.

    These fake pages offer downloads for programs such as notepad++.exe, 7-zip.exe, winrar.exe, and even chatgpt.exe.

    Download page of Digestive Utility (Source - ASEC)
    Download page of Digestive Utility (Source – ASEC)

    When someone clicks the download button, they receive a modified version of LogMeIn Resolve that connects directly to the attacker’s command server.

    The malicious installer files have been found using names like Microsoft.exe, OpenAI.exe, and windows12_installer.exe to trick users into thinking they are legitimate.

    ASEC security researchers identified this campaign after investigating unusual activity involving RMM tools in Korea.

    They discovered that three different threat actors were behind the attacks, each using unique company identification numbers embedded in the LogMeIn configuration files.

    The researchers found company IDs 8347338797131280000, 1995653637248070000, and 4586548334491120000 being used to control infected systems.

    Once the fake LogMeIn or PDQ Connect software gets installed, hackers can run PowerShell commands remotely to download additional malware.

    The attackers use these tools to drop a backdoor called PatoRAT onto victim computers. This malware, developed in Delphi, includes Portuguese-language strings in its code, suggesting the developers may be from Portuguese-speaking regions.

    How the Malware Gains Control

    PatoRAT operates by establishing a connection to command-and-control servers and sending detailed information about the infected computer.

    The malware collects the computer name, username, operating system details, memory usage, screen resolution, and active windows.

    This data gets encrypted using a simple XOR cipher with the key 0xAA and stored in the resource section under “APPCONFIG”.

    The backdoor supports dangerous functions, including mouse control, screen capture, keylogging, stealing browser passwords, and even installing port-forwarding tools.

    Security teams recommend downloading software only from official websites, checking digital certificates, and keeping antivirus programs up to date to prevent these attacks.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Hackers Exploiting RMM Tools LogMeIn and PDQ Connect to Deploy Malware as a Normal Program appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New Wave of Steganography Attacks: Hackers Hiding XWorm in PNGs 

    ·

    , , ,

    ANY.RUN experts recently uncovered a new XWorm campaign that uses steganography to conceal malicious payloads inside seemingly harmless PNG images.

    What appears to be an ordinary graphic actually contains encrypted loaders that execute entirely in memory, allowing the malware to bypass most traditional detection methods and signature-based defenses. 

    Let’s break down how this attack works and what analysts and hunters should look for. 

    Attack Overview with Real-World Example 

    The infection starts with a malicious JavaScript installer named PurchaseOrder_25005092.JS, delivered through phishing emails and web pages (T1566.001). 

    The script is obfuscated using an Immediately Invoked Function Expression (IIFE) pattern (T1027) and writes three staged files to: C:\Users\PUBLIC\  

    These files are named:  

    • Kile.cmd  
    • Vile.png  
    • Mands.png  

    While the .png extension suggests images, these are not image files. Instead, they act as storage containers for Base64-encoded and AES-encrypted payloads (T1036.008); a common trick to avoid quick signature-based detection. 

    You can view the full attack chain and download an actionable analysis report from a real-world run inside ANY.RUN’s interactive sandbox: 

    View Recent Attack Hiding XWorm in PNG 

    Steganography attack discovered inside ANY.RUN sandbox 

    See every stage of execution unfold in seconds, extract IOCs automatically, and transform hidden malware behavior into clear, shareable insights. 

    Get 14-Day Trial of ANY.RUN 

    Execution Chain Breakdown: What Analysts Need to Know 

    Below is a concise, step-by-step breakdown of the execution chain to help analysts quickly identify key artifacts and pivot points.

    Follow each stage to see where to hunt, which logs to inspect, and which indicators to extract for detection and response. 

    Persistence and setup 

    The JavaScript creates a scheduled task (T1053.005) to maintain persistence after reboot. It checks for required artifacts and recreates them using long Base64 blobs and AES-encrypted strings (T1027.013). 

    Obfuscated batch staging (Kile.cmd) 

    Kile.cmd contains heavy obfuscation: variable noise, percent-substitutions, and chunked Base64 fragments. At runtime it reassembles commands and launches the PowerShell loader (T1059). 

    Two-stage PowerShell loader 

    Stage 1 – Command runner: Reads Mands.png, Base64-decodes and AES-decrypts it, then decodes the contained commands and executes them via Invoke-Expression (IEX). 

    Stage 2 – In-memory assembly loader: Reads Vile.png, Base64-decodes and AES-decrypts it to raw bytes, then loads a .NET assembly directly into memory and invokes its entry point (T1620). 
    The combined result is a fileless, in-memory loader that launches XWorm. 

    XWorm execution chain with hidden PNG 

    Pro Threat Hunting Tips: Detecting Fileless and Steganographic Loaders 

    Below is a focused checklist for analysts and hunters to identify steganography-backed, in-memory loaders like XWorm. Use these steps to spot unusual patterns early and validate findings through behavioral analysis:  

    1. Inspect image files: Scan .png and .jpg files for unusually long Base64 strings, text chunks, or non-image data. High text-to-binary ratios or embedded AES-encrypted sections often indicate hidden payloads. 
    1. Monitor PowerShell activity: Track commands using Invoke-Expression, FromBase64String, or AES routines. Correlate these with script origins like wscript.exe or .cmd files to spot reflective execution and in-memory loaders. 
    1. Correlate scheduled task creation: Look for tasks created by JavaScript or batch scripts from user directories rather than system paths. Such entries often indicate persistence after initial compromise. 
    1. Use dynamic analysis: Static scans miss many steganographic loaders. Run suspicious scripts and files in an interactive sandbox like ANY.RUN to observe decryption, staging, and memory execution in real time, and extract IOCs from each stage. 

    How a Sandbox Speeds Up Detection in Steganographic Attacks 

    Steganographic loaders like XWorm rely on multi-stage execution and memory-only payloads, which makes them nearly invisible to static scanners.

    A sandbox environment changes that by showing what’s actually happening under the surface; file writes, decryption routines, and PowerShell commands executed in real time. 

    With ANY.RUN’s interactive sandbox, analysts can: 

    • Watch the full chain unfold; from the initial JavaScript dropper to in-memory execution. 
    • Extract and visualize IOCs such as decoded scripts, file paths, and registry modifications. 
    • Confirm persistence and C2 activity without waiting for signatures or EDR alerts. 

    This level of visibility turns a stealthy, fileless infection into a transparent, traceable process, helping threat hunters respond faster and with evidence-based clarity. 

    Turn Complex Attacks into Clear Evidence in Seconds 

    Attackers are getting better at blending in; the only reliable defense is to observe their behavior, not just their dropped files.

    In nearly 90% of cases, ANY.RUN reveals full attack behavior in under 60 seconds, turning fleeting, fileless activity into concrete evidence analysts can act on immediately. 

    Key benefits for analysts & threat hunters: 

    • Real-time visibility for faster decisions: Instantly see how loaders unpack, decrypt, and execute without waiting for static scans or vendor signatures. 
    • Fewer false positives: Behavioral context makes it easy to distinguish real threats from benign automation or scripts. 
    • End-to-end understanding: Watch how each process connects, what files are written, and how persistence is achieved. 
    • Time savings in triage and investigation: Complete analysis and IOC extraction in minutes, not hours. 
    • Seamless workflow integration: Push results directly to SIEM, SOAR, or case management tools through ready-made connectors. 
    • Collaboration made easy: Share live sessions, findings, and visual reports across teams for quicker consensus. 
    • Continuous learning and hunting: Mapped MITRE ATT&CK TTPs and decoded artifacts enrich detection logic and threat intelligence feeds. 
    Ready to see it in action? Talk to ANY.RUN experts and discover how interactive analysis helps your team find and stop threats static tools miss. 

    The post New Wave of Steganography Attacks: Hackers Hiding XWorm in PNGs  appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Google Sues ‘Lighthouse’ Phishing-as-a-service Kit Behind Massive Phishing Attacks

    ·

    , ,

    Google security researchers recently uncovered a sophisticated criminal operation called “Lighthouse” that has victimized over one million people across more than 120 countries.

    This phishing-as-a-service platform represents one of the most damaging SMS-based scam networks in recent years, prompting Google to file litigation aimed at dismantling the entire operation.

    The attack’s scale reveals how well-organized cybercriminals have become, deploying coordinated attacks that exploit trusted brand names to trick victims into surrendering sensitive information.

    The Lighthouse platform enables attackers to launch massive “smishing” campaigns, which are phishing attacks delivered through text messages rather than email.

    Criminals using this kit send deceptive SMS messages pretending to come from legitimate companies like E-Z Pass, USPS, and toll collection services.

    These messages typically prompt recipients to click links that lead to fraudulent websites designed to steal credentials and financial data.

    Google security analysts identified at least 107 website templates featuring Google’s branding on sign-in screens specifically crafted to appear legitimate.

    These fraudulent websites asked unsuspecting users to enter email addresses, passwords, banking credentials, and other sensitive information.

    The operation has stolen between 12.7 million and 115 million credit cards in the United States alone, representing a significant financial impact to victims.

    Technical Infrastructure and Attack Mechanism

    The Lighthouse platform operates as a complete criminal service offering, providing bad actors with readily-made phishing kits and infrastructure to execute attacks at scale.

    The service simplifies the attack process by allowing operators with minimal technical expertise to launch convincing campaigns.

    Criminals can customize templates for different target brands, manage victim databases, and harvest stolen credentials through a centralized command-and-control infrastructure.

    Google’s legal action targets the operation under multiple laws, including the Racketeer Influenced and Corrupt Organizations Act, the Lanham Act for trademark violations, and the Computer Fraud and Abuse Act.

    The company is also implementing defensive measures, including AI-powered detection systems to flag suspicious messages and expanded account recovery options to help compromised users regain access to their accounts more safely.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Google Sues ‘Lighthouse’ Phishing-as-a-service Kit Behind Massive Phishing Attacks appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Anduril to build autonomous vessel prototype in Korea

    ·

    Anduril wants to build dozens of autonomous ships a year. So it’s teaming up with global shipbuilding titan HD Hyundai Heavy Industries to manufacture the type of autonomous ships the U.S. Navy wants for its hybrid fleet vision, Defense One has learned. 

    The first prototype, a dual-use autonomous surface vessel, will be built in Korea, but future vessels will be made in the U.S. at the former Foss Shipyard in Seattle, Wash., the company said. The Puget Sound facility “will serve as Anduril’s initial U.S. hub for low-rate vessel assembly, integration, and testing of ASVs for the MASC program,” Anduril said in a news release announcing the partnership.

    But the goal is to have infrastructure in place to compete for the Navy’s Modular Attack Surface Craft, or MASC program, which is a combination of the service’s previous large and medium unmanned surface vessel programs. The Navy requested, and is still evaluating, pitches from industry earlier this year for three prototypes: a standard MASC, one with high capacity, and one for a single payload. 

    “We've been working this for some time. So we're cutting steel in the U.S. We're cutting steel in Korea already, you know, we've been working in advance of this competition to get ready for it. So, you know, we're hopeful that it comes our way, and that will certainly accelerate the plans,” Shane Arnott, Anduril’s senior vice president of programs and engineering, told Defense One.

    The partnership with HD Hyundai will help Anduril—which has made unmanned submersibles but not surface vessels—produce the autonomous vessels more quickly if the Pentagon asks. 

    “We're talking dozens of ships per year…but it's an order of magnitude beyond what current production methods can achieve,” Arnott said. “Scale is the problem that we're trying to solve. We've been very deliberate in our partnership. We've been very deliberate in material selection. We've been very deliberate with the workforce. There's further things into the supply chain and advanced manufacturing approaches that we've taken from other industries.”

    HD Hyundai, already one of the world’s largest shipbuilders, has been expanding, including through partnerships with U.S. shipbuilders like HII to help increase domestic capacity. But shipbuilding is a historically challenging arena that newcomers such as Eureka Naval Craft, Havoc AI, Saronic, and Blue Water Autonomy are trying to navigate with shipyard partnerships and plans to build their own. 

    “Anduril has never built an autonomous warship like this. We've never delivered it at scale, but we're teamed with one of the world's largest and leading ship builders that does significantly more [deliveries] of far larger vessels,” said Chris Brose, Anduril’s president and head of strategy. “So with that [HD Hyundai] partnership, through the design, the development and then ultimately, the delivery of scale, we'll feel very confident that the Andrew Hyundai team can deliver what the U.S. Navy needs, and a lot more beyond that.” 

    The partnership also sets Anduril up to supply other countries with autonomous ships as global defense spending increases. 

    “There's an enormous global demand for maritime capacity and autonomous warships and thinking differently about how to change naval warfare,” Brose said. “We're eager to see where the U.S. Navy decides to go, but there's an enormous amount of global demand out there. And for a system that is relatively low cost in terms of the maritime capability that it brings to bear, I think it is something that will have a lot of interest from a lot of partners, allies and partners.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The D Brief: Shutdown ends; USAF’s new missile; New ONR chief; Norway mulls big defense bet; And a bit more.

    ·

    With the longest-ever U.S. government shutdown now over, the Air Force wants to build a $500,000 counter-air missile, Defense One’s Thomas Novelly reported Wednesday. That’s costlier than some missiles the service already has, but the main idea seems to be modularity: the effort would start with a ground-launched version that would develop components for an eventual air-to-air version, according to a Nov. 7 request for white papers posted on SAM.gov.

    For context: “The proposed cost is less than the service’s $1 million AIM-120D Advanced Medium-Range Air-To-Air Missile and comparable to the existing $472,000 AIM-9X Sidewinder, according to figures from the War Zone. But it is significantly more expensive than the service’s APKWS II jet-fired anti-drone rockets—the most costly components of those missiles run between $15,000 and $20,000,” Novelly writes. Read on, here.

    Commentary: The push for modularity is a key part of the Pentagon’s revolutionary new approach to acquisition, says Bryan Clark of the Hudson Institute, who helped advise the various parts of DOD in the runup to last Friday’s rollout. The U.S. military has finally acknowledged that taking years to build exquisite weapons won’t work on battlefields where tech and tactics change week to week. 

    “The last few years of war in Ukraine, the Red Sea, and Israel have been screaming the lesson that better kit doesn’t guarantee success. In fact, ‘better’ means something different than it did even a decade ago,” Clark writes in an oped for Defense One. A swift product pipeline is now more important than the products themselves. Read on, here.

    Additional reading: “OpenAI’s Open-Weight Models Are Coming to the US Military,” WIRED reported Thursday. However, “Initial results show that OpenAI’s tools lag behind competitors in desired capabilities, some military vendors tell WIRED. But they are still pleased that models from a key industry leader are finally an option for them.”

    Welcome to this Thursday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson and Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 2015, ISIS terrorists killed 130 people during a complex attack across multiple locations in Paris.

    Trump 2.0

    DOGE veteran could bring much-needed change to Navy research, observers say. Rachel Riley, the new head of the Office of Naval Research, is more than just an alum of the controversial Department of Government Efficiency, according to current and former military and defense officials. Indeed, they said, the 33-year-old Rhodes Scholar and former McKinsey consultant may have what it takes to bring urgent reform to the Navy’s top R&D office, Defense One’s Patrick Tucker reported Wednesday. 

    Riley was appointed acting chief of naval research sometime in October after nine months at Health and Human Services. She had never worked for the government before January, according to her LinkedIn profile. But Riley has completed significant academic work related to China, which sources we spoke to highlighted as relevant. She is also a military spouse, Tucker notes. 

    At McKinsey, much of her work focused on helping the government address the challenge of too much bureaucracy, too low a risk tolerance, devotion to committee meetings, and other rigid structures that inhibit timely deployment of technology. “There are entire enterprises within ONR that have never produced anything,” one former defense official said. “They continue to be justified as part of the research enterprise, the kind of thing Anduril would love to stand up a division to deliver on tomorrow, and Silicon Valley would respond to by founding a whole new company.” Continue reading, here. 

    Developing: A senior officer with no experience in cyber security or signals intelligence is now a top nominee to lead Cyber Command and the NSA, Martin Matishak of The Record reported Wednesday—roughly seven months after Trump fired NSA/CYBERCOM chief Air Force Gen. Timothy Haugh on the advice of far-right activist Laura Loomer. 

    The new candidate is Army Lt. Gen. Joshua Rudd, currently deputy commander at U.S. Indo-Pacific Command. Before that, he served as INDOPACOM chief of staff. And “He previously was the head of Special Operations Command Pacific. Among other leadership positions within special forces, he deployed multiple times to Iraq and Afghanistan,” Matishak reports. Read more, here. 

    You may remember a roughly 300-agent, special-operations-like immigration raid in Chicago in late September. Trump’s Department of Homeland Security was so enamored with the optics of the operation they turned footage of it into a sizzle reel for likes on social media. 

    Recap: Shortly after midnight on Sept. 30 at Chicago’s South Shore, “Families were woken by flashbangs and helicopters as hundreds of federal agents raided their homes” and “detained nearly every resident of the 130-unit building—including children and babies—placing them in zip ties and separating them by race into vans for more than two hours early [that] morning,” the city’s South Side Weekly reported on location. 

    Update: Despite the enforcement optics and narrative pushed by DHS officials, five reporters from ProPublica investigated the aftermath and found almost an entirely different story, including: 

    • None of the 37 people arrested were criminally charged;
    • There was no evidence the building was “filled with TdA terrorists,” as White House advisor Stephen Miller alleged;
    • And there appears to have been no legitimate reason for agents to rappel down onto the building in the dark of night from a Blackhawk helicopter.

    Full story: “‘I Lost Everything’: Venezuelans Were Rounded Up in a Dramatic Midnight Raid but Never Charged With a Crime,” published Thursday morning.  

    Industry

    Norway’s public-wealth fund might invest in defense firms for the first time in two decades, spurred by Russia’s European invasion and fears it can no longer rely on the United States, Reuters reports.

    Additional reading: 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • MastaStealer Weaponizes Windows LNK Files, Executes PowerShell Command, and Evades Defender

    ·

    , ,

    A newly documented malware campaign demonstrates how attackers are leveraging Windows LNK shortcuts to deliver the MastaStealer infostealer.

    The attack begins with spear-phishing emails containing ZIP archives with a single LNK file that executes a multi-stage infection process.

    When victims click the malicious shortcut, it launches Microsoft Edge while opening the AnyDesk website in the foreground to appear legitimate.

    Meanwhile, in the background, the LNK file silently downloads and executes an MSI installer from a compromised domain.

    The infection chain reveals sophisticated evasion techniques. The MSI installer extracts its payload to a hidden directory structure under %LOCALAPPDATA%\Temp\MW-\files.cab, then decompresses the contents and drops the actual C2 beacon at %LOCALAPPDATA%\Microsoft\Windows\dwm.exe.

    This filename mimics legitimate Windows Display Window Manager processes, making detection harder for security tools.

    The campaign successfully bypassed traditional detection methods through careful file placement and process naming conventions.

    Maurice Fielenbach, Infosec Research and Security Trainings analyst, identified this infection after discovering Windows Installer event logs showing Application Event ID 11708 failures.

    The alert was triggered because the compromised user lacked local administrator privileges, causing the MSI deployment to fail unexpectedly.

    This failure, ironically, saved the system from full compromise and revealed the attack to defenders.

    PowerShell-Based Defender Exclusion

    The most critical aspect of this campaign involves the PowerShell command executed during installation to disable Windows Defender protections.

    The malware runs the following command to create an exclusion path for its C2 beacon: Add-MpPreference -ExclusionPath "C:\Users\admin\AppData\Local\Microsoft\Windows\dvm.exe".

    This single command removes the Windows Defender real-time scanning for the malware executable, allowing it to communicate freely with command and control servers at cmqsqomiwwksmcsw[.]xyz (38.134.148.74) and ykgmqooyusggyyya[.]xyz (155.117.20.75).

    The technique demonstrates how attackers bypass modern endpoint protection by exploiting legitimate Windows administration features rather than forcing their way through security controls.

    Organizations should monitor for unusual PowerShell execution with MpPreference parameters and implement application whitelisting to prevent unauthorized Defender modifications.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post MastaStealer Weaponizes Windows LNK Files, Executes PowerShell Command, and Evades Defender appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Phishing Emails Alert: How Spam Filters Can Steal Your Email Logins in an Instant

    ·

    , ,

    Cybercriminals have launched a sophisticated phishing campaign that exploits trust in internal security systems by spoofing email delivery notifications to appear as legitimate spam-filter alerts within organizations. These deceptive emails are designed to steal login credentials that could compromise email accounts, cloud storage, and other sensitive systems. ​ The attack begins with an email claiming […]

    The post Phishing Emails Alert: How Spam Filters Can Steal Your Email Logins in an Instant appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶