1010.cx

  • CISA Warns of Samsung Mobile Devices 0-Day RCE Vulnerability Exploited in Attacks

    ·

    , , , ,

    CISA has added a critical zero-day vulnerability affecting Samsung mobile devices to its Known Exploited Vulnerabilities catalog. Warning that threat actors are actively exploiting the flaw in real-world attacks.

    The vulnerability, tracked as CVE-2025-21042, is an out-of-bounds write vulnerability in the libimagecodec.quram.so library on Samsung mobile devices.

    This security flaw allows remote attackers to execute arbitrary code on vulnerable devices without user interaction, making it particularly dangerous and prone to widespread exploitation.

    Samsung 0-Day RCE Vulnerability Exploited

    The vulnerability is classified under CWE-787, which represents out-of-bounds write flaws that can lead to memory corruption and unauthorized code execution.

    The CISA researchers have confirmed that attackers are leveraging this zero-day to compromise Samsung smartphones. However, specific details about the attack campaigns remain limited.

    CISA’s decision to add CVE-2025-21042 to the KEV catalog on November 10, 2025, signals that federal agencies have confirmed active exploitation attempts targeting this vulnerability.

    While it remains unknown whether the flaw has been weaponized in ransomware campaigns, the remote code execution capability poses significant risks to both individual users and enterprise environments.

    CVE IDDescriptionImpactCWE
    CVE-2025-21042Out-of-Bounds Write Vulnerability in libimagecodec.quram.soRemote Code Execution (RCE)CWE-787

    Exploiting the vulnerability could enable attackers to gain complete control of affected devices, potentially leading to data theft, surveillance, or the use of compromised smartphones as entry points into corporate networks.

    Federal agencies must apply security patches and mitigations by December 1, 2025, according to CISA’s Binding Operational Directive 22-01.

    Samsung users across all sectors should immediately check for available security updates and install them without delay.

    Organizations that cannot immediately patch vulnerable devices should implement compensating controls or consider discontinuing use until fixes become available.

    Samsung’s September 2025 patch for CVE-2025-21043 addressed a related zero-day in the same library

    Users should remain vigilant and only download applications from trusted sources while monitoring their devices for suspicious activity.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post CISA Warns of Samsung Mobile Devices 0-Day RCE Vulnerability Exploited in Attacks appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Threat Actors Leverage RMM Tools to Deploy Medusa & DragonForce Ransomware

    ·

    , ,

    A sophisticated wave of ransomware attacks targeting UK organizations has emerged in 2025, exploiting vulnerabilities in the widely-used SimpleHelp Remote Monitoring and Management platform.

    Two prominent ransomware groups, Medusa and DragonForce, have weaponized three critical vulnerabilities (CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728) to gain unauthorized access through trusted third-party vendors and Managed Service Providers.

    The attack campaigns demonstrate a concerning shift in ransomware tactics, where threat actors compromise supplier-controlled RMM infrastructure rather than directly targeting victim organizations.

    By exploiting unpatched SimpleHelp instances running with SYSTEM-level privileges, attackers achieved comprehensive control over downstream customer networks with minimal resistance.

    This supply chain approach allows adversaries to bypass traditional perimeter defenses and leverage the inherent trust between organizations and their service providers.

    Zensec security researchers identified these coordinated campaigns after investigating multiple intrusions across the first and second quarters of 2025.

    The Medusa ransomware group struck first in Q1 2025, deploying their malicious payloads through compromised MSP environments.

    Following a similar playbook, DragonForce launched their offensive in Q2 2025, targeting organizations through the same vulnerable RMM infrastructure.

    Blog site (Source - Zensec)
    Blog site (Source – Zensec)

    Both groups demonstrated advanced operational capabilities, combining automated deployment tools with hands-on keyboard techniques to maximize impact.

    The financial and operational consequences have been severe for affected organizations. Beyond system encryption, both threat actor groups engaged in double extortion tactics, exfiltrating sensitive corporate data before deploying ransomware.

    Victims faced not only the immediate disruption of encrypted systems but also the threat of data exposure on dark web leak sites, compelling organizations to navigate complex decisions regarding ransom payments and public disclosure.

    Attack Execution and Defense Evasion Techniques

    Once inside victim networks through the compromised SimpleHelp platform, both ransomware groups deployed sophisticated toolsets to disable security protections and establish persistence.

    Medusa Blog (Source - Zensec)
    Medusa Blog (Source – Zensec)

    The Medusa group leveraged PDQ Deploy to push PowerShell commands that systematically dismantled Microsoft Defender protections across the environment.

    The attackers executed base64-encoded commands to add exclusion paths and disable real-time monitoring:-

    Add-MpPreference -ExclusionPath "C:\"
Set-MpPreference -MAPSReporting Disable
Set-MpPreference -DisableRealtimeMonitoring $true

    The encoded PowerShell payload delivered through PDQ Deploy, while the decoded version reveals the defense disabling commands.

    Besides this, the specific Defender exclusion modifications implemented by the threat actors.

    The Medusa group deployed their ransomware payload, identified as “Gaze.exe,” alongside specialized drivers including Smuot.sys and CSAgent.sys to further inhibit antivirus products.

    Researchers have linked these drivers to the Abyssworker toolkit, a known security evasion framework.

    DragonForce operators took a different approach, creating local administrator accounts named “admin” and installing AnyDesk for persistent remote access.

    They also targeted Veeam backup servers using the Get-Veeam-Creds.ps1 script to extract plaintext credentials from SQL password stores, effectively compromising backup recovery capabilities.

    Data exfiltration methods varied between the groups. Medusa utilized RClone, cleverly renamed to “lsp.exe” to evade detection signatures, with filtering parameters designed to transfer files under 1500MB and older than 1500 days.

    DragonForce employed Restic, an open-source backup tool, to transfer stolen data to Wasabisys S3-compatible cloud storage endpoints.

    Following encryption, Medusa systems displayed the “.MEDUSA” file extension with ransom notes titled “!!!READ_ME_MEDUSA!!!.txt,” while DragonForce appended “*.dragonforce_encrypted” extensions and left “readme.txt” notes on affected machines.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Threat Actors Leverage RMM Tools to Deploy Medusa & DragonForce Ransomware appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Hackers Exploit Triofox 0-Day to Deploy Malicious Payloads Using Anti-Virus Feature

    ·

    , , , ,

    Cybersecurity researchers from Mandiant Threat Defense have uncovered a critical zero-day vulnerability in Gladinet’s Triofox file-sharing platform that allowed attackers to bypass authentication and execute malicious code with system-level privileges. The vulnerability, tracked as CVE-2025-12480, was actively exploited by the threat actor group UNC6485 as early as August 24, 2025. The flaw affected Triofox version 16.4.10317.56372 and has […]

    The post Hackers Exploit Triofox 0-Day to Deploy Malicious Payloads Using Anti-Virus Feature appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Threat Report: xHunt Targets Microsoft Exchange and IIS with Custom Backdoors

    ·

    , , ,

    The xHunt advanced persistent threat group continues to pose a significant cybersecurity risk through sophisticated attacks targeting Microsoft Exchange and IIS web servers with custom-built backdoors. This highly focused cyber-espionage operation has maintained persistent, multi-year campaigns primarily aimed at organizations in Kuwait, with particular emphasis on the shipping, transportation, and government sectors. First identified in […]

    The post Threat Report: xHunt Targets Microsoft Exchange and IIS with Custom Backdoors appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • OWASP Top 10 2025 Released: Major Revisions and Two New Security Classes Added

    ·

    , , ,

    The Open Web Application Security Project (OWASP) has officially unveiled the eighth edition of its influential Top 10 security risks list for 2025, introducing significant changes that reflect the evolving landscape of application security threats. The update features two new security categories and substantial shifts in risk rankings based on contributed data and community feedback. […]

    The post OWASP Top 10 2025 Released: Major Revisions and Two New Security Classes Added appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Funding for E-7 Wedgetail included in bipartisan deal to end 41-day government shutdown

    ·

    Funding for the Air Force’s new E-7 Wedgetail radar jet was included in the bipartisan agreement on Sunday evening to end the longest-ever government shutdown—despite the fact that the military wants to gut the program.

    Tucked into the 31-page continuing resolution agreement that would fund the government through January is a nearly $200 million spending exception for “continued rapid prototyping activities to maintain program schedule and transition to production” of the Air Force’s E-7 program. Similar efforts to fund the early warning and control aircraft were included in versions of the National Defense Authorization Act and Defense Appropriations Act this summer, as well as a stopgap funding bill in September.

    “Other programs will be funded through January 30th, while the Senate and House continue work on the remainder of the year-long appropriations bills,” Sen. Susan Collins, a Maine Republican and Senate Appropriations Committee chair, said Sunday. “I look forward to voting for this legislation and ending the unnecessary harm to the security of our families and our nation.”

    While several procedural hurdles remain before Sunday’s agreement is finalized, the inclusion of the E-7 in the continuing resolution marks a win for Boeing, which makes the Wedgetail. 

    However, a company spokesperson declined to comment on the latest measure. The Air Force did not return a request for comment. 

    [[Related Posts]]

    The Congressional support for the radar plane more than 40 days into the government shutdown is at odds with Defense Secretary Pete Hegseth’s criticism of the E-7’s survivability and the Air Force’s 2026 budget request axing funding for the program. While officials have pointed to investments in space-based capabilities for intelligence, surveillance, and reconnaissance instead, defense experts said the inclusion of the Wedgetail shows lawmakers are concerned about the Space Force getting its Airborne Moving-Target Indication systems up and running quickly.

    “If it passes, this is a big win for Boeing, and it shows that many in Congress still have doubts about how quickly the Space Force can deploy the AMTI system it funded in the reconciliation bill a few months ago,” said Todd Harrison, a defense budget expert with the American Enterprise Institute think tank. “This is Congress hedging its bets on the airborne warning mission.”

    Hegseth told Congressional appropriators this summer that the E-7 was an example of a platform that was “not survivable in the modern battlefield or they don't give us an advantage in a future fight.” Additionally, defense officials this summer said the program was going to be cut “due to significant delays with cost increases.” 

    The E-7 was pitched as a replacement for the service’s aging E-3 Sentry aircraft. Boeing and the Air Force reached an agreement last year for two test planes, to be delivered in 2028 for a substantial $2.6 billion, the service previously announced. Those costs have risen by $884 million, a 33 percent increase, according to a June Government Accountability Office report. 

    In September, the British government announced that those two E-7 prototypes will be built in the United Kingdom. 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Just one prototype won’t cut it anymore, Pacific Marine commander tells industry

    ·

    HONOLULU—The defense industry is producing some great gear, but just one prototype isn’t enough to truly test out something new, the commander of Marine Corps Forces Pacific told an audience of tech company representatives.

    “What we need is: when you come with it, don’t come with one with the intention to take it home with you, and all the data that was collected while we conducted an exercise together,” Lt. Gen. Jim Glynn said during a keynote speech at AFCEA TechNet Indo-Pacific. “Come with five. Take one or two home and leave three with us, and we’ll continue to work with it. We’ll give you access to all the data that’s coming off of it, and we’ll do everything we can to break it, with the goal of making it better.”

    This type of experimentation and immediate feedback is critical because, Glynn said, “in this dynamic moment, we have to be ready to fight tonight. And we are going to fight with what we have, not what the acquisition system can get us five years from now.”

    Glynn cited the Joint Fires Network as an example, saying that it has evolved over the past five years from “the amalgamation of some prototypes” to a formal program.

    “Nine months ago, I had a colonel tell me, ‘But sir, that’s not a program of record.’ My response? I don’t care. It’s what we’re using. It’s what we’re going to have to use. We have to move at speed.”

    [[Related Posts]]

    In the Indo-Pacific in particular, he said, “we’re working in weeks and months, not years.”

    One of the most talked-about technologies in recent years is drones, and Glynn said the Marine Corps as a whole has an “energetic effort to use small unmanned systems.” But right now, he said, Marines are using those systems as one operator to one drone. They need to move to having one Marine able to control entire swarms of drones at once.

    “What we seek are, the ability for those unmanned systems to mesh themselves together,” he said.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Longest shutdown in history creating a readiness hole of unknown proportions

    ·

    As the government shutdown heads into its seventh week, leaders from four of the military’s professional advocacy groups came together to call on Congress to re-open the government, provide backpay to civilians who are looking at another missed paycheck, and pass legislation so that in the event of another shutdown, Defense Department civilians won’t be forced to work without pay.

    As of Wednesday, the government will have been shut down for about 13 percent of the fiscal year. At a time when the Pentagon is “laser-focused” on lethality, the department is hemorrhaging readiness, with training and maintenance hours lost due to lack of funding. Even as the House prepares to vote on a Senate continuing resolution to at least get some money flowing again, the services are looking at a long road to recovery.

    “We get a CR, which doesn’t really let us catch up or exceed,” Burt Field, president of the Air and Space Forces Association, told reporters. “We’re in a never-ending spiral of not being able to get where you need to be.”

    Senior military leaders beat the drum against continuing resolutions every year, pleading with Congress for a full appropriations bill that lets them increase operations, training, and maintenance over the previous year. But the prospect of another CR to patch over more than a month shut down means the services will have to pick and choose which missions to prioritize even more than usual. 

    “You’ve only got so many days to do a certain window, and the missions don't stop,” said Les Smith, vice president for leadership and education at the Association of the U.S. Army. “So how we make sure you put those back on the schedule is important for each one of the missions that we've asked the service members to do.”

    [[Related Posts]]

    A National Guard unit is preparing to deploy at the beginning of 2026, Frank McGinn, the president of the National Guard Association of the United States, told reporters. But the dual-status technicians who do the maintenance for that unit aren’t able to get their equipment ready.

    “It's going to affect the timeliness of their impending deployment. So that just makes it more challenging,” he said. “The availability of ranges—they're compressed to begin with anyway, especially from a reserve component, there's not as much availability. So you have a backlog there for training ranges and such.”

    The Guard has more than 30,000 of these dual-status technicians, who are technically civilians but are required to maintain active reserve military status in order to do their jobs. They haven’t been paid since the end of September.

    “We need to fix this. We need Congress to pass protections for our uniformed and technician personnel,” McGinn added. “Should we face a shutdown in the future, the stress and uncertainty of our people, families, and employers over the last six weeks can never happen again. Our people took an oath to uphold their duty. We call on Congress to do the same.”

    During previous shutdowns, Congress has passed emergency exceptions to keep Defense Department personnel paid. Advocacy groups are hoping that, should it happen again, there will be a law in place to make sure service members and military civilians receive their paychecks. But the Pay Our Troops Act, which was introduced on Sept. 16, hasn’t seen a vote. 

    “So you know, every day that the shutdown continues, it really kind of signals to those who volunteer that their service is conditional, so that's why we have to get this government back on target, get our folks paid and back on track,” said John Hashem, executive director of the Reserve Organization of America.

    There’s also concern that the uncertainty will cause DOD civilians to resign, Field said. However, that concern may not be shared by the current administration, since it has made whittling down the workforce one of its goals. 

    “If Congress has congressional duties to do and debates to have and arguments to win. That's fine. That's how their institution is built, and that's what they do,” Field added. “But they do not have to do that on the backs of service members, civilians, and their families. So they want to have these discussions and have these arguments and put their positions forward. Go ahead, but keep the government open while they're doing it. It's as simple as that.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Hackers Exploiting Triofox Flaw to Install Remote Access Tools via Antivirus Feature

    ·

    Google’s Mandiant Threat Defense on Monday said it discovered n-day exploitation of a now-patched security flaw in Gladinet’s Triofox file-sharing and remote access platform. The critical vulnerability, tracked as CVE-2025-12480 (CVSS score: 9.1), allows an attacker to bypass authentication and access the configuration pages, resulting in the upload and execution of arbitrary payloads.  The

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Konni Hackers Turn Google’s Find Hub into a Remote Data-Wiping Weapon

    ·

    The North Korea-affiliated threat actor known as Konni (aka Earth Imp, Opal Sleet, Osmium, TA406, and Vedalia) has been attributed to a new set of attacks targeting both Android and Windows devices for data theft and remote control. “Attackers impersonated psychological counselors and North Korean human rights activists, distributing malware disguised as stress-relief programs,” the Genians

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶