• Cybersecurity researchers at Kaspersky have uncovered a sophisticated supply chain attack targeting the npm ecosystem, where threat actors distributed the AdaptixC2 post-exploitation framework through a malicious package disguised as a legitimate proxy utility. The discovery highlights the growing risk of open-source software repositories as attack vectors for delivering advanced malware. In October 2025, Kaspersky experts […]

    The post AdaptixC2 Emerges in npm Supply-Chain Exploit Against Developers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Oracle E-Business Suite vulnerability to its Known Exploited Vulnerabilities catalog after detecting active exploitation in the wild. The security flaw, tracked as CVE-2025-61884, poses significant risks to organizations running the widely-deployed enterprise resource planning software. Critical SSRF Flaw Requires Immediate Action CVE-2025-61884 is a […]

    The post CISA Warns of Oracle E-Business Suite SSRF Vulnerability Actively Exploited in Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Pakistan-based advanced persistent threat group APT36, also known as TransparentTribe, is actively targeting Indian government entities with a sophisticated spear-phishing campaign using email lures themed as “NIC eEmail Services.” This campaign leverages lookalike domains and weaponized infrastructure to steal credentials and enable long-term espionage. The attack begins with email messages that convincingly mimic official notifications […]

    The post Pakistani Cyber Actors Impersonating ‘NIC eEmail Services’ to Target Indian Government appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Microsoft Windows Server Message Block (SMB) vulnerability to its Known Exploited Vulnerabilities catalog, warning that threat actors are actively exploiting the security flaw in the wild. The vulnerability, tracked as CVE-2025-33073, affects the Windows SMB Client and could allow attackers to escalate privileges on […]

    The post CISA Warns of Actively Exploited Windows SMB Vulnerability appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Russian state-sponsored threat actor COLDRIVER, long known for targeting high-profile NGOs, policy advisors, and dissidents, has been linked to a rapidly evolving malware campaign following the public disclosure of its LOSTKEYS malware in May 2025. After details of LOSTKEYS surfaced, COLDRIVER (also tracked as UNC4057, Star Blizzard, and Callisto) pivoted away from the compromised malware. […]

    The post New LOSTKEYS Malware Tied to Russian State-Sponsored Hacker Group COLDRIVER appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Amazon Web Services (AWS), the world’s largest cloud computing provider, has officially marked a widespread outage in its US-EAST-1 region as resolved, following nearly a full day of cascading failures that disrupted services for millions worldwide.

    The incident, which began late on October 19, 2025, and persisted until early afternoon on October 20, highlighted the fragility of global internet infrastructure reliant on AWS’s backbone.

    By 3:01 PM PDT, AWS confirmed all services had returned to normal operations, though some backlogs in data processing for tools like AWS Config and Redshift were expected to clear within hours.

    The outage originated from DNS resolution issues affecting the DynamoDB API endpoint in the US-EAST-1 region, AWS’s busiest data center in Northern Virginia.

    At 11:49 PM PDT on October 19, elevated error rates and latencies emerged across multiple services, initially pinpointed to DynamoDB, a core database service powering everything from user data to application backends.

    Engineers identified the root cause by 12:26 AM PDT on October 20, linking it to a faulty DNS update that prevented applications from locating server IP addresses, akin to a broken phonebook for the internet.

    This failure triggered a domino effect: EC2 instance launches stalled due to DynamoDB dependencies, Network Load Balancer health checks failed, and connectivity broke for services like Lambda, SQS, and CloudWatch.​

    100+ AWS Services Impacted

    The blast radius was immense, impacting over 100 AWS services and spilling over to consumer-facing platforms.

    Popular apps such as Snapchat, Fortnite, Roblox, and Coinbase went offline, with users unable to log in or access features amid surging complaints on DownDetector.

    Gaming services like Epic Games’ Fortnite reported server downtimes, while financial platforms including Venmo and banking apps from Lloyds and Halifax in the UK faced login hurdles.

    Even Amazon’s own ecosystem suffered Prime Video buffering spiked, Ring doorbells lost remote access, and e-commerce checkouts faltered.

    AI startup Perplexity attributed its disruptions directly to the AWS issue, with CEO Aravind Srinivas noting on X that funds remained safe but access was blocked.

    Government agencies, airlines like Delta, and media outlets including Disney+ and The New York Times also logged interruptions, underscoring AWS’s 33% market dominance in cloud infrastructure.​

    Critics pointed to the 75-minute diagnostic delay and initial “all clear” status page messages as transparency shortfalls, echoing past AWS critiques on outage notifications.

    No cyberattack was suspected; it stemmed from an internal update error in a foundational service.

    AWS Response

    AWS’s response involved parallel mitigations: flushing DNS caches, throttling EC2 launches to stabilize subsystems, and scaling up polling rates for SQS queues tied to Lambda.

    By 2:24 AM PDT, the core DynamoDB DNS fix was deployed, yielding early recovery signs, though network issues lingered into the morning.

    Temporary throttles on operations like asynchronous Lambda invocations helped prioritize critical paths, with full EC2 launch restoration by 2:48 PM PDT.

    Global features dependent on US-EAST-1, such as IAM updates and DynamoDB Global Tables, also rebounded, allowing support case creations to resume.

    AWS promised a detailed post-incident summary, emphasizing ongoing backlog processing for analytics in Connect and Redshift.

    Experts like those at ThousandEyes noted no external network anomalies, confirming the issue’s internal nature and rapid recovery post-mitigation.

    As services return to normal, affected users should try their operations again and check the AWS Health Dashboard for updates.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post AWS Declares Major Outage Resolved After Nearly 24 Hours of Disruption appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The cybersecurity community has raised a serious alarm following the recent daily reporting of vulnerable WatchGuard devices impacted by a major security flaw. According to new data published on October 18, 2025, security researchers at Shadowserver observed over 71,000 WatchGuard devices part of a global exposure that could allow remote code execution attacks. This surge […]

    The post Over 71,000 WatchGuard Devices Exposed to Remote Code Execution Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A persistent campaign targeting Microsoft Remote Desktop Protocol (RDP) services, with attackers deploying over 30,000 new IP addresses daily to exploit timing-based vulnerabilities.

    This coordinated effort, linked to a global botnet, has seen unique IPs surge past 500,000 since September 2025, primarily aiming at U.S.-based systems.

    The attacks focus on two key vectors: RD Web Access anonymous authentication timing attacks and RDP web client login enumeration checks. These methods allow hackers to probe for weaknesses without triggering alerts, using rapid IP rotations to dodge traditional blocking tools.

    GreyNoise first identified the botnet’s scale on October 8, 2025, when Brazilian-sourced traffic spiked dramatically, revealing a pattern of similar TCP fingerprints across thousands of endpoints.

    RDP Under Attack from New IPs

    By October 14, the botnet had expanded to approximately 300,000 IPs, tripling in size within days and originating from over 100 countries.

    Brazil dominates as the top source at 63%, followed by Argentina at 14% and Mexico at 3%, with nearly all targets located in the United States.

    This consistency in source-target dynamics underscores the operation’s centralized control, likely orchestrated by a single threat actor or group.

    Daily activity charts from GreyNoise illustrate the relentless pace, showing grey bars for total unique IPs and blue for newly observed ones peaking above 40,000 in mid-October.

    IP addresses observed
    IP addresses observed

    Cumulative graphs reveal a steep upward trajectory, crossing 500,000 unique IPs by October 15, highlighting the evolving risk of infrastructure churn.

    sum of IPs
    sum of IPs

    Experts warn that static IP blocking is ineffective against this high-turnover botnet, as new nodes activate daily to sustain the attack.

    This campaign exemplifies a broader trend where attackers complicate attribution and evasion through disposable infrastructure.

    As RDP remains a prime entry point for ransomware and data breaches, U.S. entities especially those reliant on remote access face heightened exposure. GreyNoise continues monitoring, urging log reviews for unusual RDP probes tied to these tags.

    The operation’s growth from 100,000 to over 500,000 IPs signals potential for further escalation, demanding proactive defenses beyond conventional measures.

    With the botnet’s focus on U.S. infrastructure, immediate adoption of intelligence-driven blocking could prevent widespread compromise.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Hackers Attacking Remote Desktop Protocol Services With 30,000+ New IP Addresses Daily appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A critical security vulnerability in Microsoft Windows Cloud Minifilter has been patched, addressing a race condition that allowed attackers to escalate privileges and create files anywhere on the system. The vulnerability, tracked as CVE-2025-55680, was discovered by security researchers at Exodus Intelligence in March 2024 and patched by Microsoft in October 2025. Race Condition Allows […]

    The post Microsoft Windows Cloud Minifilter Flaw Enables Privilege Escalation appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A Reddit poster detailed how reinstalling Windows 11 unexpectedly encrypted two of their backup drives with BitLocker, locking away 3TB of irreplaceable data without any prior setup.

    The incident, shared onReddit, highlights the risks of Microsoft’s automatic encryption feature in Windows 11, which can activate silently during routine maintenance like OS reinstalls.​

    The user, running a high-end setup with an AORUS B550 Elite AX v2 motherboard, AMD Ryzen 7 5700X3D processor, 64GB of RAM, and an NVIDIA GeForce RTX 3060 GPU, sought to fix performance lag by performing a clean Windows 11 install.

    Despite never enabling BitLocker Microsoft’s full-disk encryption tool designed for data protection their D: and E: drives emerged encrypted post-installation, demanding a recovery key they didn’t possess.

    Initial attempts at data recovery using various software failed, revealing zero accessible files, while Google searches yielded advice only for boot drive issues, not secondary storage.​

    Silent Activation Triggers User Nightmare

    BitLocker’s default behavior in Windows 11 Pro and Enterprise editions, especially version 24H2, enables device encryption automatically if the system meets certain hardware and policy criteria, such as TPM 2.0 support and Secure Boot.

    This “seamless” setup aims to bolster security against theft or unauthorized access but often catches users off-guard, particularly during clean installs where network connectivity or local accounts might inadvertently trigger it.

    In this case, the user’s non-boot drives purely for data backups were affected, a scenario less commonly documented than OS drive lockouts.

    Desperate measures made the situation worse. The poster downloaded risky recovery tools and torrents, which likely brought in malware. This led to another clean install to remove the malware from the system.

    Shockingly, the BitLocker prompt reappeared on the boot drive, though they miraculously had that key, allowing access but the storage drives remained sealed.

    No specific glitch ties this hardware combo to BitLocker over-activation, but reports suggest AMD Ryzen systems with compatible motherboards can enable it if BIOS settings like fTPM are active.​

    Exhaustive trials with tools like UFS Explorer and Stellar Data Recovery Professional proved futile without a valid recovery key or password, as these require decryption first to scan for files.

    BitLocker recovery options include a 48-digit recovery password stored in Microsoft Entra ID, Active Directory, or printed files; a .bek recovery key file; or a key package for corrupted drives but none applied here.

    Without these, accessing encrypted data is nearly impossible, as the encryption uses AES-128 or AES-256 standards that resist brute-force attacks.​

    Ultimately, after hours of frustration, the user formatted the drives, erasing years of data with only outdated backups available.

    This echoes broader warnings: software-based BitLocker can degrade SSD performance by up to 45% due to CPU overhead, yet its auto-enable persists in Pro editions.​

    To avoid such pitfalls, users should disable BitLocker during Windows 11 installation via registry tweaks or tools like Rufus, ensuring local installs skip encryption prompts.

    Always back up recovery keys to a Microsoft account or external media post-setup, and monitor Group Policy for encryption defaults.

    For Home edition users, BitLocker isn’t native, but upgrading to Pro introduces these risks. As Windows 11 evolves, Microsoft’s push for default encryption prioritizes security over user awareness, underscoring the need for proactive data management.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Automatic BitLocker Encryption May Silently Lock Away Your Data appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶