• Attackers can bypass Endpoint Detection and Response (EDR) tools and file locks by reading raw disk sectors directly, highlighting the urgent need for organizations to audit and secure the drivers installed on their Windows systems. In modern Windows environments, drivers provide low-level access to hardware and disk functions. A recent investigation by Workday’s Offensive Security […]

    The post Hackers Exploit Raw Disk Reads to Evade EDR and Steal Sensitive Files appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A sophisticated new botnet called NightshadeC2 that employs an innovative “UAC Prompt Bombing” technique to evade Windows Defender and compromise endpoint security systems. In August 2025, eSentire’s Threat Response Unit (TRU) identified this emerging threat, which represents a significant evolution in malware evasion tactics. The botnet demonstrates advanced capabilities including reverse shell access, credential theft, […]

    The post NightshadeC2 Botnet Exploits ‘UAC Prompt Bombing’ to Evade Windows Defender appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity researchers have flagged a new malware campaign that has leveraged Scalable Vector Graphics (SVG) files as part of phishing attacks impersonating the Colombian judicial system. The SVG files, according to VirusTotal, are distributed via email and designed to execute an embedded JavaScript payload, which then decodes and injects a Base64-encoded HTML phishing page masquerading as a

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A recently patched vulnerability in a core Windows driver could allow a local attacker to execute code with the highest system privileges, effectively taking full control of a target machine.

    The flaw, identified as CVE-2025-53149, is a heap-based buffer overflow discovered in the Kernel Streaming WOW Thunk Service Driver (ksthunk.sys). Microsoft addressed the issue in its security updates released on August 12, 2025.

    The vulnerability was discovered by security researchers who stumbled upon the flaw during internal analysis. Following a responsible disclosure process, the bug was reported to Microsoft, leading to the development and release of a patch.

    The affected component, ksthunk.sys, is a crucial driver for maintaining backwards compatibility on 64-bit versions of Windows.

    Its primary function is to serve as a “thunk” layer, a small piece of code that translates requests between different system architectures. Specifically, it bridges the gap between 32-bit user-mode applications and 64-bit kernel-mode drivers that manage real-time data streams for audio and video.

    This driver is part of the wider Kernel Streaming (KS) framework, a foundational Windows technology for handling high-performance, low-latency multimedia data.

    By allowing older 32-bit software to interact with modern 64-bit kernel components, KSThunk ensures that legacy applications can still function correctly. However, it is within this complex translation process that the security flaw was found.

    Windows Heap-based Buffer Overflow Vulnerability

    The vulnerability resides in the CKSAutomationThunk::HandleArrayProperty() function of the ksthunk.sys driver (SHA-1: 68B5B527550731DD657BF8F1E8FA31E895A7F176).

    An attacker can trigger this flaw by sending a specially crafted request from a 32-bit application to a device that uses the Kernel Streaming interface.

    Windows Heap-based Buffer Overflow Vulnerability

    The core of the issue lies in how the driver handles requests to get a specific property from a device, such as KSPROPSETID_VPConfig. The vulnerable code path first calls a function to determine the size of the data that needs to be returned.

    It then prepares to copy this data into an output buffer provided by the user-mode application.

    The critical mistake is a missing validation step. The function checks that the provided output buffer isn’t empty, but it fails to verify if the buffer is actually large enough to hold the data it is about to receive from the device.

    Consequently, when the driver proceeds to copy the data, it can write past the boundary of the allocated buffer. This action results in a heap-based buffer overflow within the kernel’s non-paged pool, a critical memory region.

    A successful exploit could allow an attacker to corrupt kernel memory and execute arbitrary code with kernel-level privileges.

    To trigger the vulnerability, an attacker would need to run code on a target system and make a specific DeviceIoControl call. However, there is a significant prerequisite: the system must have a hardware device installed that supports the vulnerable property set (KSPROPSETID_VPConfig or KSPROPSETID_VPVBIConfig).

    While the researchers were unable to find such a device on their test systems, the vulnerability remains a threat on systems where one is present.

    Microsoft has corrected the vulnerability in the patched version of ksthunk.sys. The updated driver now includes the necessary size check, ensuring that the output buffer is large enough before the copy operation begins. If the buffer is too small, the operation is safely aborted.

    Users and administrators are strongly advised to apply the latest Windows security updates to ensure their systems are protected against CVE-2025-53149 and other threats.

    Find this Story Interesting! Follow us on Google NewsLinkedIn, and X to Get More Instant Updates.

    The post Windows Heap-based Buffer Overflow Vulnerability Let Attackers Elevate Privileges appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A critical security vulnerability has been discovered in Microsoft Windows systems that allows attackers to escalate their privileges and potentially gain complete control over affected machines. The vulnerability, designated CVE-2025-53149, affects the Kernel Streaming WOW Thunk Service Driver and was patched by Microsoft in August 2025. Vulnerability Overview The security flaw is a heap-based buffer overflow located in […]

    The post Windows Heap Buffer Overflow Vulnerability Allows Attackers to Gain Elevated Privileges appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A sophisticated malware campaign targeting Colombian institutions through an unexpected vector: weaponized SWF and SVG files that successfully evade traditional antivirus detection. The discovery emerged through VirusTotal’s newly enhanced Code Insight platform, which added support for analyzing these vector-based file formats just as attackers began exploiting them to impersonate the Colombian justice system. Despite Adobe […]

    The post Colombian Malware Exploits SWF and SVG to Evade Detection appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Security researchers have detected massive scanning campaigns targeting Cisco Adaptive Security Appliance (ASA) devices, with attackers probing over 25,000 unique IP addresses in coordinated waves that may signal an upcoming vulnerability disclosure. GreyNoise cybersecurity researchers observed two significant scanning surges against Cisco ASA devices in late August. The first wave involved more than 25,000 unique […]

    The post Hackers Target Cisco ASA Devices in Massive Scan Across 25,000 IPs appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Chess.com, the world’s leading online chess platform, has confirmed a significant data breach that compromised personal information of thousands of users after hackers successfully exploited an external system connected to their network. The Orem, Utah-based company disclosed that the security incident affected 4,541 individuals across the United States, including one Maine resident. The breach occurred on June 5, […]

    The post Chess.com Confirms Data Breach After Hackers Exploit External System appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • An unprecedented surge in malicious scanning activity targeting Cisco Adaptive Security Appliances (ASAs) occurred in late August 2025, with over 25,000 unique IP addresses participating in coordinated reconnaissance efforts.

    GreyNoise, a threat intelligence company, observed two distinct scanning waves that represent a dramatic escalation from the typical baseline activity of fewer than 500 IPs per day. The August 22 spike involved approximately 25,000 unique addresses, followed by a smaller but related campaign days later.

    Analysis reveals that the August 26 wave was primarily driven by a single botnet cluster concentrated in Brazil. Of the roughly 17,000 active IPs that day, more than 14,000, representing over 80% were tied to this coordinated botnet campaign.

    Scans for thousands of IP
    Scans for thousands of IP

    The attackers used shared client signatures and spoofed Chrome-like user-agents, indicating deployment of common scanning toolkits across the infrastructure.

    “The client signature was seen alongside a suite of closely related TCP signatures, suggesting all nodes share a common stack and tooling,” researchers noted, confirming the coordinated nature of the campaign.

    Geographic Distribution and Targeting Patterns

    Over the past 90 days, scanning activity has shown distinct geographic patterns. Brazil dominates source countries at 64%, followed by Argentina and the United States at 8% each.

    However, the targeting is heavily focused on U.S. infrastructure, with 97% of attacks aimed at American networks, while the United Kingdom and Germany account for 5% and 3% respectively, GreyNoise observed.

    Vulnerabilities
    Vulnerabilities

    Both scanning surges specifically targeted the ASA web login path /+CSCOE+/logon.html, a common reconnaissance marker used to identify exposed devices. Subsets of the same IP addresses also probed Cisco Telnet/SSH and ASA software personas, indicating a deliberate Cisco-focused campaign rather than opportunistic scanning.

    The timing and scale of these scanning campaigns may signal an impending vulnerability disclosure. GreyNoise’s Early Warning Signals research has demonstrated that scanning spikes often precede the announcement of new Common Vulnerabilities and Exposures (CVEs). Historical data shows similar activity surges occurred shortly before previous Cisco ASA vulnerability disclosures.

    Cisco ASA devices have been prime targets for sophisticated threat actors. The ArcaneDoor espionage campaign previously exploited two zero-day vulnerabilities in Cisco ASA systems to infiltrate government networks.

    Ransomware groups, including Akira and LockBit, have also historically targeted these devices, while CVE-2020-3452 was weaponized globally within days of its disclosure.

    Organizations running Cisco ASA infrastructure should immediately review their exposure, ensure systems are fully patched, and monitor for unusual authentication attempts.

    Given the scale and coordination of this scanning activity, security teams should prepare for potential zero-day exploitation attempts and consider implementing additional monitoring around ASA devices.

    The unprecedented scale of this reconnaissance campaign suggests threat actors may be positioning for a significant vulnerability exploitation wave, making immediate defensive preparations critical for organizations relying on Cisco ASA security appliances.

    Find this Story Interesting! Follow us on Google NewsLinkedIn, and X to Get More Instant Updates.

    The post Hackers Scanning Cisco ASA Devices to Exploit Vulnerabilities from 25,000 IPs appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Autonomous cargo flights across the Pacific were a little-known highlight this summer at the Air Force’s massive Resolute Force Pacific exercise, designed to prepare for a potential conflict with China.

    The flights between multiple Hawaiian islands, operated by a Cessna 208B Grand Caravan powered by Joby Aviation’s Superpilot software, were remotely operated from Guam, which is about 4,000 miles away. The goal is to make logistics flights in the vast theater cheaper during wartime.  

    “A safety pilot was on board each flight to monitor the system and intervene, if necessary, though no manual inputs were required,” according to the command’s website

    The Air Force has previously tested autonomous cargo flights during military exercises, but this was the first time in the Indo-Pacific, and the first time they were tested “against real-world challenges such as long distances, dynamic routing, diverse weather, and operations with allies and partners,” a Pacific Air Forces spokesperson told Defense One via email.

    Logistics are a critical challenge in the Pacific, and the Air Force has been working for years to expand its total bases in the region, pre-position supplies, and become more survivable and mobile. The concept, known as Agile Combat Employment, was a big focus of the Department of the Air Force’s REFORPAC exercise, which featured more than 400 aircraft and more than 11,000 U.S. Air Force members, as well as joint troops and partner nations. It stretched from Hawaii to Guam and Japan, as well as other locations across the theater.

    “We receive the combat air forces from the force providers back in [the continental United States], and then we execute them in the theater to conduct [agile combat employment] operations and conduct combat air operations,” Lt. Col. Jarred Chamberland, who was the lead planner for REFORPAC, told reporters in July. The goal of the overall exercise was to “facilitate the movement of forces into theater…sustain those forces while they're operating within the theater for almost a month here” under real-world conditions, and learn from that while incorporating allies and partners.

    One of the main takeaways from the exercise was that autonomous flights using smaller planes, like a Cessna, can reduce the burden on larger cargo aircraft and airmen.

    “Instead of relying on a single aircraft, a network of autonomous cargo planes could create a resilient and unpredictable logistics web. This approach frees larger aircraft like the C-17 and C-130 to focus on strategic, long-haul missions, while smaller autonomous platforms take on shorter, riskier deliveries to austere or dispersed locations,” the spokesperson said. “REFORPAC also showed how autonomy can reduce the logistics burden on Airmen, enabling them to focus on higher-priority mission tasks.”

    The Air Force is still working on how to best incorporate autonomous logistics and plans to test products from a range of companies in future exercises and initiatives. Testing autonomous cargo flights during REFORPAC was an important step in “generating data and user feedback that will help refine both the technology and the operational concepts for contested and dynamic environments,” the spokesperson said.

    The Air Force recently signed a $17.4 million contract with Reliable Robotics to deploy a pilot-less C-208 for logistics operations in the Pacific, after testing it in military exercises last year. The company is also co-developing autonomous architecture with the service. 

    Moreover, AFWERX, the Air Force’s innovation agency, has been experimenting with electric aircraft by multiple vendors—including Joby Aviation—in recent years. 

    “AFWERX has partnered with Joby’s team for several years with increasingly complex development and demonstration efforts of autonomy to support contested logistics missions,” Lt. Col. Jonathan Gilbert, AFWERX prime division chief, said in a statement. “REFORPAC was an opportunity to demonstrate the technology in a realistic environment and highlight the potential impact of these autonomous systems. The lessons learned from this exercise participation are vital to guiding our focus as we continue development of affordable technologies that support the needs of our Airmen.”

    Joby Aviation also recently teamed up with L3Harris to develop turbine hybrid vertical take-off and landing, or VTOL, aircraft that can handle crewed and uncrewed operations. 

    Jennifer Hlad contributed to this report.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶