• Group-IB Threat Intelligence has uncovered a sophisticated phishing campaign orchestrated by the Iran-linked Advanced Persistent Threat group MuddyWater, targeting international organizations worldwide to gather foreign intelligence. The campaign demonstrates the threat actor’s evolving tactics and enhanced operational maturity in exploiting trusted communication channels to infiltrate high-value targets. MuddyWater launched the operation by accessing a compromised […]

    The post New Malware Toolkit from MuddyWater Delivers Phoenix Backdoor to Global Targets appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The Internet Systems Consortium (ISC) disclosed three high-severity vulnerabilities in BIND 9 on October 22, 2025, potentially allowing remote attackers to conduct cache poisoning attacks or cause denial-of-service (DoS) conditions on affected DNS resolvers.

    These flaws, tracked as CVE-2025-8677, CVE-2025-40778, and CVE-2025-40780, primarily impact recursive resolvers used by organizations for domain name resolution, leaving authoritative DNS servers largely unaffected.

    With BIND powering a significant portion of the internet’s DNS infrastructure, administrators are urged to apply patches immediately to mitigate risks of service disruptions and malicious redirections.

    Flaws Exposed In Resolver Logic

    CVE-2025-8677 involves resource exhaustion triggered by malformed DNSKEY records in specially crafted zones, leading to CPU overload on resolvers during queries.

    Rated at a CVSS score of 7.5, this vulnerability enables attackers to remotely overwhelm servers without authentication, severely degrading performance for legitimate users.

    ISC notes that while authoritative setups remain safe, resolvers in recursive mode are prime targets, echoing concerns from their knowledge base on unintended query behaviors.

    The other two issues center on cache poisoning, a technique reminiscent of the 2008 Dan Kaminsky attack that once threatened global DNS integrity.

    CVE-2025-40778 (CVSS 8.6) stems from BIND’s overly permissive handling of unsolicited resource records in responses, allowing forged data to infiltrate the cache and corrupt future resolutions.

    Similarly, CVE-2025-40780 (CVSS 8.6) exploits a weak pseudo-random number generator (PRNG), making source ports and query IDs predictable for spoofing malicious replies into the cache.

    Both flaws elevate the attack surface by enabling scope changes in impact, as tainted caches could redirect traffic across networks.

    Researchers from Nankai University, Tsinghua University, and Hebrew University of Jerusalem identified these issues, crediting their work in ISC’s advisories.

    No active exploits are known yet, but the remote, unauthenticated nature heightens urgency given BIND’s widespread deployment.

    Successful exploitation could lead to phishing, malware distribution, or man-in-the-middle attacks by diverting users to attacker-controlled sites.

    For instance, poisoned caches might replace legitimate IP addresses with malicious ones, mimicking trusted domains and eroding user trust in online services.

    DoS from CVE-2025-8677 risks operational downtime, financial losses, and reduced productivity for businesses reliant on stable DNS.

    Organizations using vulnerable versions spanning BIND 9.11.0 to 9.21.12 and Supported Preview Editions face elevated threats, especially in cloud and enterprise environments.

    ISC emphasizes that these vulnerabilities underscore ongoing DNS resilience challenges, even post-Kaminsky mitigations like randomized query IDs.

    Distributions like Ubuntu and Red Hat have begun issuing updates, with package maintainers encouraged to release patches swiftly.

    Mitigations

    No workarounds exist, so upgrading to fixed releases is essential: BIND 9.18.41, 9.20.15, or 9.21.14 for standard branches, and corresponding Supported Preview versions.

    Selective patches are available in release directories for those preferring minimal changes. Administrators should review ISC’s advisories and monitor for distribution updates to safeguard against these DNS threats.

    As BIND evolves, such disclosures highlight the need for proactive patching in critical infrastructure.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Multiple BIND 9 DNS Vulnerabilities Enable Cache Poisoning and Denial Of Service Attacks appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A sophisticated spearphishing campaign has targeted humanitarian organizations working on Ukrainian war relief efforts, employing weaponized PDFs and fake Cloudflare captcha pages to deploy a custom remote access trojan. The PhantomCaptcha campaign, launched on October 8th, 2025, specifically targeted individual members of the International Committee of the Red Cross, United Nations Children’s Fund (UNICEF) Ukraine […]

    The post PhantomCaptcha RAT Uses Weaponized PDFs and “ClickFix” Cloudflare CAPTCHA Pages to Deliver Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • AI-powered agents are increasingly relied upon to execute tasks like code analysis, file management, and automating workflows. However, a newly highlighted vulnerability argument injection shows how attackers can use these very capabilities to achieve remote code execution (RCE), even when certain safeguards are in place. CVE ID Product Vulnerability CVE-2025-54795 Claude Code Command injection in […]

    The post Critical Argument Injection Flaw in AI Agents Enables Remote Code Execution appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • E-commerce security company Sansec has warned that threat actors have begun to exploit a recently disclosed security vulnerability in Adobe Commerce and Magento Open Source platforms, with more than 250 attack attempts recorded against multiple stores over the past 24 hours. The vulnerability in question is CVE-2025-54236 (CVSS score: 9.1), a critical improper input validation flaw that could be

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A critical vulnerability in Smithery.ai, a popular Model Context Protocol (MCP) server hosting service, exposed over 3,000 AI servers and thousands of API keys to potential attackers. Security researchers discovered a simple path traversal flaw that enabled unauthorized access to sensitive infrastructure files, compromising administrative credentials and threatening entire AI ecosystems. The Discovery and Initial […]

    The post Critical MCP Server Flaw Exposes Over 3,000 Servers and Thousands of API Keys appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a critical security flaw impacting Motex Lanscope Endpoint Manager to its Known Exploited Vulnerabilities (KEV) catalog, stating it has been actively exploited in the wild. The vulnerability, CVE-2025-61932 (CVSS v4 score: 9.3), impacts on-premises versions of Lanscope Endpoint Manager, specifically Client

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Satellite imaging company Vantor—formerly Maxar Intelligence—has signed a contract with the U.S. Space Force to help run a “neighborhood watch” in space to monitor for space-based threats like rogue satellites or debris that ground sensors may miss. 

    Under the new contract, Vantor will use satellites it already has in orbit to monitor space and protect U.S. satellites, helping provide a sort of “neighborhood watch” in low earth orbit, the increasingly crowded area of space between 99 to 1,200 miles above the surface, Susanne Hake, Vantor’s general manager for U.S. government, told Defense One in an email.  

    The program will use “Vantor’s existing imaging satellites on orbit,” she said. “We have 10 satellites, 7 of which can collect space-to-space imagery, also called non-Earth imagery.” Vantor did not disclose the value of the contract.

    A brief timeline of new space weapons

    During the Cold War, both the United States and the Soviet Union researched potential space-based weapons, but little came of the efforts. —other than a lot of radiation from one particularly dangerous U.S. experiment. In 2010, observers spotted two Chinese satellites performing a type of rendezvous in space, the purpose of which was unclear. As former U.S. Air Force officer Brian Weeden observed at the time, Russia soon followed suit with its own satellites that appeared to be conducting “rendezvous and proximity operations” with one another. 

    In July 2020, U.S. Space Command said Russia was conducting space-based anti-satellite tests. In March 2023, U.S. Space Force Chief Gen.  Chance Saltzman told lawmakers that China was also “testing on-orbit satellite systems, which could be weaponized as they have already shown the capability to physically control and move other satellites.” 

    In March of this year, Space Force Vice Chief Gen. Michael Guetlein said the technology gap between the United States and China in space had significantly narrowed, and China was now rehearsing what appeared to be clear satellite military maneuvers, “dog fighting” in space.

    These developments have increased demand for space-based intelligence and space situational awareness. But those needs exist alongside the need for more earth imaging generally and, soon, missile interceptor satellites. 

    To that end, Hake says that Vantor has figured out how to modify its existing satellites so that they can not only collect images of the Earth, but also track space objects to reveal possible maneuvers and proximity operations, or the presence of possible weapons. 

    “Our constellation is capable of imaging LEO objects at less than 6-inch resolution and can also support tracking of objects across a much wider space volume. We have imaged objects as small as 24 cm, or about 9.5 inches,” she said. 

    The satellite software can be updated from Earth, and Vantor next is looking to use automation to speed up the collection rate, allowing for more pictures and faster delivery.

    “We’re aiming to collect as many as 1,000 [non-Earth] images a day. Most collections can be delivered in less than 4 hours—and many are delivered within 90 minutes.” 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cloud account takeover attacks have evolved into a sophisticated threat as cybercriminals and state-sponsored actors increasingly weaponize OAuth applications to establish persistent access within compromised environments.

    These malicious actors are exploiting the fundamental trust mechanisms of cloud authentication systems, specifically targeting Microsoft Entra ID environments where they can hijack user accounts, conduct reconnaissance, exfiltrate sensitive data, and launch subsequent attacks with alarming effectiveness.

    The security implications of this attack vector are particularly severe because attackers can create and authorize internal second-party applications with custom-defined scopes and permissions once they gain initial access to a cloud account.

    This capability enables persistent access to critical organizational resources including mailboxes, SharePoint documents, OneDrive files, Teams messages, and calendar information.

    Traditional security measures like password resets and multifactor authentication enforcement prove ineffective against these attacks, as the malicious OAuth applications maintain their authorized access independently of user credential changes.

    Proofpoint analysts identified this emerging threat pattern through extensive research and real-world incident analysis, developing an automated toolkit that demonstrates how threat actors establish resilient backdoors within cloud environments.

    Their investigation revealed that attackers typically gain initial access through reverse proxy toolkits accompanied by individualized phishing lures that enable the theft of both credentials and session cookies.

    Once inside, attackers leverage the compromised account’s privileges to register new internal applications that appear as legitimate business resources within the organization’s tenant.

    The persistence mechanism operates through a carefully orchestrated process where attackers create second-party applications that inherit implicit trust within the environment.

    Application creation process (Source – Proofpoint)

    These internal applications are more difficult to detect than third-party applications because they bypass security controls designed primarily for external application monitoring.

    The malicious applications can remain undetected within the environment indefinitely unless specifically identified through proactive security auditing, creating a substantial window of opportunity for data exfiltration and reconnaissance activities.

    Automated OAuth Persistence: Technical Implementation

    The technical sophistication of these attacks becomes evident through automated OAuth application registration and configuration processes.

    Attackers deploy tools that streamline post-exploitation activities, registering applications with pre-configured permission scopes aligned with their objectives.

    A critical aspect involves establishing the compromised user account as the registered owner of the newly created application, effectively positioning it as a legitimate internal resource that inherits trust relationships associated with internal systems.

    During the automated deployment, attackers generate cryptographic client secrets that serve as the application’s authentication credentials, typically configured with extended validity periods of up to two years.

    Tokens collected (Source – Proofpoint)

    The automation then collects multiple OAuth token types including access tokens, refresh tokens, and ID tokens, each serving distinct purposes in maintaining persistent access.

    Proofpoint researchers documented a real-world incident where attackers operating through US-based VPN proxies created an internal application named ‘test’ with Mail.Read and offline_access permissions, maintaining access for four days even after the victim’s password was changed.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post Hackers Weaponizing OAuth Applications for Persistent Cloud Access Even After Password Reset appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • "Our nation’s ability to protect itself and its allies from cyber threats is stalling and, in several areas, slipping," begins the summary of a landmark report by a congressionally chartered policy group.

    The analysis — delivered Wednesday by the Cyberspace Solarium Commission 2.0 — tracks the consequences of hollowing out the federal cyber workforce amid the Trump administration's efforts to reorganize the government and make it more efficient in the eyes of the White House and top agency leaders. 

    "Nearly a quarter of fully implemented recommendations have lost that status — an unprecedented setback that underscores the fragility of progress,” the report's summary says.

    The report urges the administration to restore workforce and funding to the Cybersecurity and Infrastructure Security Agency and cyber diplomacy staff within the State Department, both of which have been marked by significant cuts. The report also contends that the rollback of diversity, equity and inclusion initiatives in the second Trump administration have slowed the intake of skilled job candidates from nontraditional backgrounds, narrowing the government’s cyber talent pool.

    Among the most grievous setbacks includes government work on countering disinformation and foreign malign influence, especially within the Department of Homeland Security, where CISA is housed. The Trump administration has framed that work largely as a censorship regime that’s suppressed Americans’ First Amendment rights.

    Cyber foreign assistance — a core aspect of State Department operations and work under the now defunct U.S. Agency for International Development — has also regressed significantly, the report concludes. 

    The yearly findings have measured progress on goals outlined by the original Cyberspace Solarium Commission, which was established five years ago via legislation to build a governmentwide strategy for cybersecurity. The report is one of the few comprehensive blueprints that regularly examines nearly every arm of U.S. government work on cyber matters, including agencies, commissions, standards-setting bodies and research funding.

    Mark Montgomery, a former Navy rear admiral who serves as senior director of FDD’s Center on Cyber and Technology Innovation, is most concerned by the cuts inside CISA. To date, around a third of the agency’s workforce has been terminated or left through deferred resignation and early retirement programs made available to its staff. 

    “35 years in the military, I never had a head or subordinate come up to me and say, ‘Sir, what I really need right now is a 35% reduction in workforce,’” Montgomery said at a Wednesday FDD event discussing the findings.

    “I think [the CISA cuts] sting the most,” he added. “And I just wish they could get over it and say ‘We made a mistake, we’re putting the money back in there.’”

    CSC has been deemed a major force behind contemporary U.S. cyber policy decisions. Lawmakers in the original commission — which included then-Reps. Jim Langevin, D-R.I., and Mike Gallagher, R-Wis., as well as Sen. Angus King, I-Maine — formed the backbone that created the Office of the National Cyber Director, which has helped the federal government pursue various cyber priorities. Sean Cairncross, the first national cyber director under Trump, was confirmed to his post in August.

    Many of the elements that stood up under the CSC’s direction still exist but haven’t endured or been set on the right path, said Jiwon Ma, an FDD senior policy analyst who also authored the findings.

    “I know that that is a strong language, but I think that we haven’t been doing well in terms of preparing,” said Ma. “We’re good at standing up things like the [Office of the National Cyber Director]. “We gave them funding, we brought the personnel, but then we didn’t consistently think about what it needed as it grew.” 

    ONCD in the past has had tensions with cyber elements in the National Security Council, both of which sit in the White House.

    A White House spokesperson did not immediately return a request for comment. An automated email said there may be response delays due to the ongoing government shutdown.

    At the Wednesday event, King, in prerecorded remarks, called the report’s results “frustrating.”

    “At a time when we’re seeing the cyber threat increase dramatically, we’re unilaterally disarming, and we’re not making the progress that we ought to make,” he said.

    On the sidelines of the event, Langevin told reporters that he hopes the Trump administration will give Cairncross and Sean Plankey — nominated but not yet confirmed to lead CISA — the runway they need to achieve their goals. Gallagher, also speaking with reporters, agreed and said he is “bullish” on the opportunity to hammer out mission sets across the government’s cyber enterprise.

    Cybersecurity has been historically a bipartisan darling of Washington, but CISA, deemed the nation’s core civilian cyberdefense agency, has become a recent subject of political scuffles due to its prior work combatting mis- and disinformation.

    The agency has faced scrutiny from the Trump administration for some time. Top officials have aimed to “refocus” its mission amidst GOP accusations that the agency engaged in censorship of Americans’ free speech. Those claims stem from CISA’s earlier collaboration with social media platforms to remove false information online concerning the COVID-19 pandemic, elections and other divisive subjects around 2020.

    That dynamic has carried over to other offices handling cyber and disinfo work, including inside the State Department, FBI and Office of the Director of National Intelligence, which oversees that nation’s 18 spy agencies.

    All told, the Trump cyber team is still getting into place, and the ongoing shutdown has slowed progress in those areas.

    “I’m deeply concerned about the level of cuts. You have to have the people doing the job, and it’s really important that you continue to build capacity there. So I don’t know how they’re going to recover from [the reductions],” Langevin said. “But I’m willing to give the administration the benefit of the doubt that we are going to build that capacity and … continue the mission.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶