• Raleigh, United States, October 7th, 2025, CyberNewsWire Report Shows Cross-Training as Strategic Solution to Operational Friction Between Networking and Cybersecurity Teams  INE Security, a leading provider of cybersecurity training and certifications, today announced the results of a global study examining the convergence of networking and cybersecurity disciplines. “Wired Together: The Case for Cross-Training in Networking […]

    The post INE Security Releases Industry Benchmark Report: “Wired Together: The Case for Cross-Training in Networking and Cybersecurity” appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Raleigh, United States, October 7th, 2025, CyberNewsWire

    Report Shows Cross-Training as Strategic Solution to Operational Friction Between Networking and Cybersecurity Teams 

    INE Security, a leading provider of cybersecurity training and certifications, today announced the results of a global study examining the convergence of networking and cybersecurity disciplines.

    Wired Together: The Case for Cross-Training in Networking and Cybersecurity” is based on insights from nearly 1,000 IT and cybersecurity professionals worldwide.

    The report documents operational challenges created by this convergence and presents cross-training as the strategic solution.

    “Our research reveals that while three-quarters of professionals recognize networking and cybersecurity as integrated disciplines, the majority still struggle with daily operational friction between these teams,” said Lindsey Rinehart, CEO of INE Security.

    “Organizations with high levels of security and IT complexity face breach costs averaging $1.2 million higher than those with streamlined, integrated environments.

    This isn’t just about future preparedness—it’s about solving problems that are costing organizations money today.”

    The report reveals that only 33% of professionals feel “very well” or “extremely well” prepared to handle the intersection of networking and cybersecurity, while 41% report being only “moderately well” prepared.

    This preparedness gap creates significant operational challenges but also presents strategic opportunities for organizations that invest in cross-domain expertise.

    “Cross-trained professionals don’t just respond to incidents faster—they prevent the implement-break-fix cycles that plague most organizations,” Rinehart added.

    “When teams understand both networking and security domains, projects deploy successfully the first time, emergency rollbacks become rare, and operational costs decrease substantially.”

    Key findings from the report include:

    • Integration Reality: 75% of respondents view networking and cybersecurity as either “completely integrated” (29%) or “highly interconnected” (46%), with only 7% still viewing them as separate disciplines.
    • Preparedness Gap: Only 33% feel well-prepared to handle networking-cybersecurity intersection, creating operational vulnerabilities and increased costs.
    • Collaboration Challenges: While 37% collaborate with counterparts “most of the time” or “always,” 34% collaborate only “sometimes,” and 23% work together “about half the time.”
    • Critical Friction Points: Nearly one in five professionals (18%) identified knowledge gaps as their primary challenge, while organizational misalignment affects nearly a quarter of respondents.
    • Convergence Drivers: 77% cite growing cyber threat complexity as the primary convergence driver, with widespread cloud adoption, remote work, and IoT device proliferation accelerating integration.
    • Six Critical Overlap Areas: Network monitoring, security monitoring, firewalls, configuration management, detection, and access control represent the most significant convergence points where cross-training delivers immediate benefits.

    INE Security’s recommendations for organizations include:

    • Four-Step Cross-Training Implementation: Conduct skill assessments, deploy varied training methodologies, measure impact and ROI, and scale successful programs
    • Enhanced Threat Detection: Develop comprehensive visibility across network architecture and security implications to reduce incident response times
    • Operational Excellence: Streamline workflows to reduce handoffs between specialized teams and eliminate failed implementations
    • Cost Optimization: Reduce downtime costs (averaging $5,600 per minute) through improved incident response and integrated operations

    The report emphasizes that successful cross-training transforms organizational culture by creating common language between teams, enabling balanced decision-making, streamlining operations, and improving talent retention through reduced workplace friction.

    “Breaking down security silos and fostering cross-team cooperation is essential for responding to the accelerating pace of cyber threats,” Rinehart concluded.

    “Organizations that invest in developing professionals who can speak both languages will gain measurable advantages in threat detection, operational efficiency, and business resilience.”

    The full report is available for download at learn.ine.com/report/wired-together.

    About INE Security:

    INE Security is the premier provider of online networking and cybersecurity training and certification.

    Harnessing a powerful hands-on lab platform, cutting-edge technology, a global video distribution network, and world-class instructors, INE Security is the top training choice for Fortune 500 companies worldwide for cybersecurity training in business and for IT professionals looking to advance their careers.

    INE Security’s cybersecurity certifications are requested by HR departments worldwide, and its suite of learning paths offers an incomparable depth of expertise across cybersecurity and is committed to delivering advanced technical training while also lowering the barriers worldwide for those looking to enter and excel in an IT career.

    Contact

    Chief Marketing Officer
    Kim Lucht
    INE Security
    press@ine.com

    The post INE Security Releases Industry Benchmark Report: “Wired Together: The Case for Cross-Training in Networking and Cybersecurity” appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Google’s DeepMind division on Monday announced an artificial intelligence (AI)-powered agent called CodeMender that automatically detects, patches, and rewrites vulnerable code to prevent future exploits. The efforts add to the company’s ongoing efforts to improve AI-powered vulnerability discovery, such as Big Sleep and OSS-Fuzz. DeepMind said the AI agent is designed to be both reactive and

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • National Guard troops are headed to Chicago and could arrive as soon as Tuesday after a federal judge on Monday scheduled a hearing on the matter for Thursday in order to review what she said was more than 500 pages of filings. 

    The state of Illinois and the city of Chicago sued the Trump administration Monday over the Guard deployment, which would send up to 300 Illinois National Guard soldiers and up to 400 more Guard troops from Texas into Chicago ostensibly to protect Immigration and Customs Enforcement personnel and facilities, but over the objection of the governor of Illinois. “These advances in President Trump’s long-declared ‘War’ on Chicago and Illinois are unlawful and dangerous,” the suit alleges. 

    “The Trump administration is following a playbook: cause chaos, create fear and confusion, make it seem like peaceful protesters are a mob by firing gas pellets and tear gas canisters at night,” Illinois Gov. JB Pritzker said at a press conference Monday. “Why? To create the pretext for invoking the Insurrection Act so that he can send military troops to our city.”

    After a judge paused Guard deployments to Oregon on Sunday, Trump said Monday he’s open to invoking the Insurrection Act, which would authorize the U.S. military to assist civilian state or federal authorities, including police, to put down an insurrection. The act has been invoked just 30 times in the past 230 years; the last time was in 1992 during the Rodney King riots in Los Angeles. “I’d do it if it was necessary,” Trump said Monday. “If people were being killed and courts were holding us up, or governors, or mayors were holding us up.”

    Trump: Chicago is “like a war zone,” the president claimed Monday. (He’s made similar claims about Portland, Ore., though the judge hearing the matter on Sunday did not agree, and described the president’s characterization as “simply untethered to the facts.”) “You can go to Afghanistan, you can go to a lot of different places, and they probably marvel at how much crime we have,” Trump said of Chicago on Monday. 

    Pritzker: “There is no invasion here. There is no insurrection here,” he said Monday. “The folks in the neighborhoods do not want armed troops marching in their streets,” the governor said. 

    Critical reax: Trump’s use of an obscure statute (10 U.S. Code § 12406) to deploy troops over governors’ objections is “unprecedented,” said Hina Shamsi, director of the ACLU National Security Project. That law permits a Guard authorization if “there is a rebellion or danger of a rebellion” against the U.S. government. 

    “I think we've all got to be very, very, very concerned about armed federal agents and troops reporting to the president exercising claims of police power in this country,” Shamsi said, and cited the ruling Sunday from Judge Immergut. “We're only in the first year of this presidency,” and already—as Immergut pointed out Sunday—Trump tried “circumventing a court decision that reasoned that there was no justification” for National Guard troops in Portland. 

    Local reax: In addition to Tuesday’s military-style immigration raid on an apartment complex, “We are also seeing masked, heavily armed federal law enforcement officers, including ICE and Customs and Border Protection, marching through downtown Chicago heavily armed, in camouflage, and in masks threatening people and questioning others who are simply doing nothing more than visiting Millennium Park with their family on a Sunday afternoon,” said Colleen Connell, executive director the ACLU in Illinois. “We also tragically saw ICE agents shoot and kill one person at a traffic stop in Franklin Park, a near-in suburb, and misrepresented what happened at that scene.”

    “I want to be very, very clear that sending heavily armed federal agents and now National Guard troops from potentially thousands of miles away into our beautiful city of Chicago is unnecessary, it's inflammatory, and it puts public safety and human beings at risk,” Connell said Monday. 

    Meanwhile, “The federal deployment of 300 National Guard troops in California has been quietly extended through January 2026,” the New York Times reported Monday, citing court documents filed this weekend in Oregon. 

    Coverage continues below…


    Welcome to this Tuesday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson and Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 2001, the U.S. military’s invasion of Afghanistan began.

    Trump delivered another overtly partisan speech to the military on Sunday, this time to sailors aboard the USS George H.W. Bush off the coast of Norfolk, Va., and less than a week since his wandering remarks to generals and admirals during an unprecedented meeting last Monday in Quantico.  

    “Now we’re in Memphis,” Trump said. “And we are going to Chicago,” he told the sailors. “We send in the National Guard…We send in whatever is necessary. People don’t care. They don’t want crime in their cities.” Trump also mocked his predecessor for falling down steps, and declared, “We're not politically correct anymore, just so you understand.”

    “And I want you to know that despite the current Democrat-induced shutdown, we will get our service members every last penny,” the president said. “Don't worry about it. Don't worry about it. Don't worry about it. Do not worry about it. It's all coming. It's coming. And even more, because I'm supporting the across-the-board pay raises for every sailor and service member.” 

    Shutdown trivia: U.S. service members could miss their first paycheck of the shutdown if negotiations drag beyond Oct. 15. 

    “But we have to take care of this little gnat that’s on our shoulder called the Democrats,” the president told members of the Navy. “They want to give all of our money to illegal aliens that pour into the country,” he said Sunday—less than three days after calling Democrats “The Party Of Hate, Evil, And Satan” amid Republican lawmakers and pundits blaming violence in the country on dangerous rhetoric from the left side of the political spectrum. 

    War on drug boats

    Update: The Justice Department’s Office of Legal Counsel has argued in a classified memo “that the president is allowed to authorize deadly force against a broad range of cartels because they pose an imminent threat to Americans,” CNN reported Monday. However, “At the Pentagon, some military lawyers, including international law experts within [DoD’s Office of General Counsel], have raised concerns about the legality of the lethal strikes on suspected drug traffickers,” with multiple current and former JAGs telling CNN “the strikes do not appear lawful.”

    ICYMI: The White House last week told lawmakers they believe the country is in a formal “armed conflict” with drug cartels, and that’s why they feel U.S. troops can kill people in speedboats instead of interdicting and arresting those inside the vessels traveling around the Caribbean Sea, north of Venezuela.  

    New: The New York City Bar Association called the Pentagon’s attacks on boats in Latin America “illegal summary execution” that are “prohibited by both U.S. and international law,” which is to say those military actions are akin to “murders,” the organization said in a statement Monday. 

    The group also asked “Congress to remind the President that he lacks authority to continue to misuse our military forces for similar unlawful attacks on foreign vessels and their civilian crews and that continuation of such attacks is unlawful.”

    For your ears only: Just Security recently posted a new podcast discussion about Trump’s lethal strikes in the Caribbean, which have killed at least 21 people so far. The guests “examine an important new chapter in the use of force against drug cartels” in a discussion that “explores how far presidential powers extend in such contexts.” Listen, here

    Extra reading: 

    Around the Defense Department

    OK for F/A-XX? Sources tell Reuters that SecDef Hegseth has approved the Navy’s effort to build a sixth-gen fighter of its own, clearing the way to choose between options offered by Boeing and Northrop Grumman after years of delay.

    Background, from August: “In March, the Navy was reportedly close to picking a company to build F/A-XX, but an announcement never came, and the service ended up gutting funding for the aircraft in its 2026 budget request, throwing the program into limbo,” Defense One wrote. “But Congress is on track to reverse those cuts: Senate appropriators added $1.4 billion to F/A-XX in their draft defense spending bill and House appropriators added $972 million to their version. Cheever’s comments today appear to confirm that F/A-XX is in fact moving ahead.”

    Industry had more than 1,500 questions for the Missile Defense Agency about the gigantic $151-billion, 10-year contract vehicle for work on the ambitious Golden Dome missile-defense project, so officials have pushed the deadline for pitches for slices of the work one week to Oct. 16, Defense One’s Thomas Novelly reports, here.

    The Army established Transformation and Training Command on Thursday, combining missions and assets from the now-deactivated Futures Command and Training and Doctrine Command. The merger is part of the service’s Army Transformation Initiative (ATI) effort announced by Hegseth in May. Breaking Defense has more, here.

    Additional reading:Marines retire ‘workhorse’ Assault Amphibious Vehicle after 50 years,” Military Times reported Monday.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Ransomware operators have shifted from opportunistic malware distribution to highly targeted campaigns that exploit legitimate software for stealth and persistence.

    Emerging in early 2025, several ransomware families began abusing popular remote access tools—such as AnyDesk and Splashtop—to establish footholds within enterprise networks.

    By hijacking or silently installing these utilities, adversaries bypass security controls that traditionally trust signed installers, enabling initial access without tripping conventional detection mechanisms.

    Organizations rapidly discovered anomalous remote sessions connecting from unexpected geolocations.

    Seqrite analysts identified that attackers leveraged credential stuffing and phishing to obtain privileged accounts, then deployed remote access tools to move laterally.

    Rather than relying solely on custom malware binaries, threat actors used existing administration frameworks to blend malicious activity into everyday IT operations, rendering their actions practically invisible to legacy endpoint protections.

    The impact of these campaigns has been profound. Victims report encrypted file shares, disabled backups, and altered Remote Access Tool credentials to lock out administrators.

    In high-profile intrusions attributed to LockBit and Black Basta variants, attackers combined RAT abuse with file-shredding commands to eradicate forensic traces, extend dwell time, and maximize ransom demands.

    Organizations suffered costly downtime and data loss, underscoring the urgency of reevaluating trust in routine IT utilities.

    Persistence Tactics of Remote Access Tool Abuse

    A critical enabler of these ransomware operations is the attackers’ ability to maintain persistent control through run-of-the-mill remote administration software.

    Two primary methods emerged: hijacking preinstalled tools to avoid file creation and deploying lightweight installers via command-line flags.

    In the hijacking scenario, adversaries enumerate installed applications through Windows Management Instrumentation or PowerShell, then inject malicious credentials or modify JSON configuration files to grant unattended access under the attacker’s account.

    This approach leaves no new executables on disk and evades antivirus scanning by abusing trusted executables already whitelisted in enterprise policies.

    When opportunistic targets lack preexisting remote access utilities, attackers fall back on silent installation.

    Using known installer parameters, they deploy signed binaries with minimal noise:-

    Start-Process -FilePath '.\AnyDesk.exe' -ArgumentList 'INSTALL=C','STARTWITHWINDOWS=1','SILENT=1' -NoNewWindow

    This command installs AnyDesk as a service that launches at boot, granting the adversary persistent entry points for follow-on operations.

    Similar flags—such as VERYSILENT and NORESTART—are documented in vendor manuals yet rarely monitored by defenders.

    Once embedded, the remote tool runs with elevated privileges if attackers escalate via utilities like TrustedInstaller or PowerRun.

    Combined with registry run-key manipulation and hidden scheduled tasks, this chain ensures that even if an incident responder removes one backdoor, a secondary access path remains.

    This layered persistence model frustrates remediation efforts and demands a shift toward behavior-based monitoring that flags anomalous tool usage rather than file signatures.

    By abusing trusted remote administration software, ransomware gangs have turned IT convenience into their most potent weapon.

    Defenders must implement strict application whitelisting, enforce multi-factor authentication, and monitor command-line arguments associated with common remote access tools to detect and disrupt these stealthy persistence tactics before encryption can occur.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post Ransomware Gangs Leverage Remote Access Tools to Gain Persistence and Evade Defenses appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A novel and alarming cybersecurity threat has emerged, turning an ordinary computer peripheral into a sophisticated eavesdropping device.

    Researchers have detailed a new technique, dubbed the “Mic-E-Mouse” attack, which allows threat actors to exfiltrate sensitive data by exploiting the high-performance optical sensors found in many modern computer mice.

    This method can covertly capture and reconstruct user speech, opening a new frontier for auditory surveillance. The vulnerability stems from the ever-increasing sensitivity and polling rates of optical sensors in consumer-grade mice.

    These advanced sensors, often found in gaming or high-performance models, can detect minute surface variations thousands of times per second.

    The Mic-E-Mouse attack capitalizes on this by using the sensor to pick up microscopic vibrations that travel through a desk or work surface when a person speaks.

    In effect, the mouse becomes a makeshift microphone, capturing the acoustic environment around it.

    The Attack Pipeline

    While a mouse sensor can detect these vibrations, the raw signal it produces is of extremely poor quality. A high noise floor, non-uniform sampling, a non-linear frequency response, and extreme quantization heavily distort it.

    To overcome these significant challenges, the researchers developed a sophisticated pipeline of signal processing and machine learning techniques.

    Mic-E-Mouse Attack Pipeline
    Mic-E-Mouse Attack Pipeline

    The Mic-E-Mouse pipeline works in several stages. First, malicious software on the victim’s computer collects the high-frequency mouse movement data (Δx, Δy, and Δt).

    This data collection process is designed to be invisible to the average user. Once collected, the data can be exfiltrated and processed offline by the attacker.

    The pipeline then applies advanced algorithms to filter the noise, correct the distortions, and ultimately reconstruct an intelligible audio waveform from the compromised mouse data.

    The effectiveness of this method is striking. When tested against the VCTK and AudioMNIST speech datasets, the pipeline achieved a Signal-to-Interference-plus-Noise Ratio (SI-SNR) increase of +19dB, demonstrating a significant improvement in audio clarity.

    Furthermore, automated tests demonstrated an 80% accuracy in speaker recognition, and a human study yielded a Word Error Rate (WER) of 16.79%, indicating that the reconstructed speech is highly comprehensible.

    Threat Model and Delivery

    The researchers outlined a practical threat model for deploying this attack. The ideal delivery vehicle is open-source software, particularly applications where the collection of high-frequency mouse data is not inherently suspicious.

    This makes video games, creative software, and other high-performance, low-latency applications prime targets for injecting the malicious data-gathering code.

    Threat Model and Delivery
    Threat Model and Delivery

    An attacker could compromise such an application, and once it’s running on a victim’s computer, it would begin collecting the mouse sensor data.

    Many video games already contain networking code that the exploit can repurpose to exfiltrate the collected data without raising suspicion from security software.

    After the initial collection, all subsequent processing and analysis can be performed on the adversary’s own systems at any time.

    The growing accessibility and affordability of vulnerable hardware magnifies the threat. High-fidelity mice are already available for under $50, and as technology improves, their prices are expected to drop further.

    This trend will lead to the increased use of vulnerable mice by consumers, corporations, and government entities, dramatically expanding the attack surface for this type of surveillance.

    Researchers note that most human speech falls within the 200Hz to 2000Hz frequency range, which their pipeline can successfully detect and reconstruct.

    This new research demonstrates that auditory surveillance through high-performance optical sensors is not just a theoretical possibility, but an effective and efficient threat.

    Cyber Awareness Month Offer: Upskill With 100+ Premium Cybersecurity Courses From EHA's Diamond Membership: Join Today

    The post New Mic-E-Mouse Attack Let Hackers Exfiltrate Sensitive Data by Exploiting Mouse Sensors appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • In recent months, security researchers have turned their attention to Asgard Protector, a sophisticated crypter employed by cybercriminals to obfuscate and deploy malicious payloads.

    First advertised on underground forums in late 2023, Asgard Protector has gained traction among threat actors for its seamless integration with popular C2 platforms such as LummaC2.

    By wrapping infostealers and remote access trojans within seemingly benign installers, Asgard Protector undermines traditional antivirus defenses and complicates incident response efforts.

    The toolkit typically arrives as a Nullsoft self-extracting archive that, upon execution, unpacks several hidden components into the temporary directory.

    SpyCloud analysts noted that this installer disguises its batch script with mismatched file extensions—for example, renaming a .bat file to Belgium.pst—and employs obfuscation techniques to hide its true purpose.

    Once extracted, the installer assembles an AutoIt interpreter binary in memory, leveraging pieces from embedded CAB archives to reconstruct the executable before launching the next stage.

    SpyCloud analysts identified additional layers of evasion within the embedded AutoIt scripts. Encrypted payloads are stored inside the script and only decrypted in memory using an RC4 routine.

    The script then decompresses the binary using the LZNT1 algorithm before performing a process injection into explorer.exe, effectively hiding the malicious process under a trusted system host.

    Asgard Protector ad, which appeared on XSS (Source – SpyCloud)

    A unique sandbox-detection mechanism further complicates analysis: the script issues a ping to a randomly generated domain and exits if any response is received, indicating a monitored or emulated network environment.

    After this unpacking and validation, the malicious payload gains persistence by modifying autorun registry keys or deploying scheduled tasks, depending on the operator’s configuration.

    The combination of in-memory decryption, compression, and sandbox checks enables Asgard Protector to slip past endpoint defenses and execute without dropping a traditional executable on disk.

    Infection Mechanism

    Delving deeper into the infection mechanism reveals how Asgard Protector engineers its defense evasion.

    The Nullsoft installer script leverages a simple yet effective obfuscation:-

    findstr /b /r /c:"MZ" *.dat > offset.txt
    for /f "tokens=1" %%A in (offset.txt) do set /A start=%%A
    certutil -decode input.cab temp.exe
    fsutil file createnew stub.bin %start%
    more +%start% input.cab >> stub.bin
    The obfuscated .bat file used by Asgard Protector for installation (Source – SpyCloud)

    In this snippet, the script locates the “MZ” header within a CAB archive to determine where the PE header begins.

    It then concatenates the extracted data past that offset to reconstruct the AutoIt binary. Once assembled, the script executes a companion AutoIt script that handles RC4 decryption and LZNT1 decompression before injecting the resulting payload into memory.

    This piecemeal assembly and execution model allows the malware to evade signature-based antivirus engines and thwart disk-based inspection tools.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post Researchers Reversed Asgard Malware Protector to Uncover it’s Antivirus Bypass Techniques appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A widespread campaign observed exploiting a novel zero-day vulnerability in Oracle E-Business Suite (EBS) applications, now tracked as CVE-2025-61882

    First observed on August 9, 2025, this unauthenticated remote code execution (RCE) flaw is being weaponized to bypass authentication, deploy web shells, and exfiltrate sensitive data from internet-exposed EBS instances. 

    CrowdStrike assesses with moderate confidence that the threat actor GRACEFUL SPIDER is behind the mass exploitation, although evidence suggests additional actors may be involved.

    Mass Exploitation Campaign 

    On September 29, 2025, GRACEFUL SPIDER allegedly sent Clop-branded emails to multiple organizations claiming successful data theft from Oracle EBS applications. 

    Shortly after the October 3, 2025 proof-of-concept (POC) disclosure and Oracle’s patch release, a Telegram channel post hinted at collaboration between SCATTERED SPIDER, SLIPPY SPIDER, and the ShinyHunters group. 

    The post included a purported EBS exploit with SHA256 hash 76b6d36e04e367a2334c445b51e1ecce97e4c614e88dfb4f72b104ca0f31235d and criticized GRACEFUL SPIDER’s tactics. 

    Oracle’s advisory incorporated this PoC as an indicator of compromise (IOC), implying vendor concerns over in-the-wild exploitation.

    CrowdStrike connects activity leveraging Java Servlets for initial compromise, indicating the POC aligns closely with observed intrusions. 

    Despite ongoing investigation into the exploit’s provenance and distribution, the timing of public POC release and patch deployment is likely to spur further weaponization by adversaries familiar with Oracle EBS.

    The exploit begins with an HTTP POST request to /OA_HTML/SyncServlet, triggering the authentication bypass. Confirmed incidents show adversaries leveraging administrative account privileges within EBS. 

    Following bypass, attackers target the XML Publisher Template Manager via GET /OA_HTML/RF.jsp and POST /OA_HTML/OA.jsp to upload a malicious XSLT template. 

    Commands embedded in the template execute upon preview, which captures sample GET and POST requests used to upload and preview the payload. 

    Template names retrieved from the xdo_templates_vl view correspond to TemplateCode URL references.

    Successful template execution establishes an outbound Java process connection over port 443 to the attacker-controlled infrastructure. 

    Analysis indicates this channel is used to load web shells, often via a two-step process: loading FileUtils.java to download a secondary backdoor Log4jConfigQpgsubFilter.java. 

    The backdoor engages through a doFilter chain at the public endpoint /OA_HTML/help/state/content/destination./navId.1/navvSetId.iHelp/, enabling command execution and persistence.

    CrowdStrike Intelligence emphasizes that CVE-2025-61882 presents a significant remote code execution (RCE) risk to Oracle EBS environments.

    Organizations are urged to apply the October 4, 2025, patch immediately, audit outbound connections for suspicious activity, review xdo_templates_vl for unauthorized templates, investigate icx_sessions for UserID 0 and UserID 6 anomalies, and deploy web application firewalls to protect exposed EBS services. 

    Monitoring for Java process behaviors consistent with published Falcon LogScale and SIEM detection rules can further mitigate ongoing exploitation risks.

    Cyber Awareness Month Offer: Upskill With 100+ Premium Cybersecurity Courses From EHA's Diamond Membership: Join Today

    The post CrowdStrike Warns of New Mass Exploitation Campaign Leveraging Oracle E-Business Suite 0-Day appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • References to a 2019 law that guarantees back pay to all federal workers after a shutdown were quietly removed from guidance by the Office of Management and Budget on Friday.

    Until Oct. 3, OMB’s "Frequently Asked Questions During a Lapse in Appropriations" document highlighted the Government Employees Fair Treatment Act, the 2019 law enacted as part of the deal to end the 35-day partial government shutdown during President Trump’s first term. Signed into law by Trump, the law requires back pay for furloughed and excepted federal workers after government funding is restored after “any lapse in appropriations that begins on or after December 22, 2018.” Until the law’s passage, Congress had to OK back pay for furloughed workers after each lapse. 

    “All excepted employees are entitled to receive payment for their performance of excepted work during the period of the appropriations lapse when appropriations for such payments are enacted,” stated the document, which was updated Sept. 30 before this year's shutdown began. “The Government Employee Fair Treatment Act of 2019 (Public Law 116-1) provides that upon enactment of appropriations to end a lapse, both furloughed and excepted employees will be paid retroactively as soon as possible after the lapse ends, regardless of scheduled pay dates.”

    But the latest version of the document omits the latter sentence and references to OPM guidance on the topic. That removal is the only change between the two document versions, aside from the date.

    OPM’s shutdown guidance, last updated Sept. 28, still says that furloughed workers will receive back pay after the shutdown.

    “After the lapse in appropriations has ended, employees who were furloughed as the result of the lapse will receive retroactive pay for those furlough periods,” OPM wrote. “Retroactive pay will be provided on the earliest date possible after the lapse ends, regardless of scheduled pay dates.”

    After Government Executive asked the White House about the change on Monday evening, Axios on Tuesday reported that senior administration officials were developing guidance that furloughed federal workers are not entitled to back pay. The White House officials said it would take a novel interpretation of the back pay law and argue it applied only to the 2019 shutdown.  

    More than 620,000 employees are currently furloughed, a number that will continue to climb as the shutdown drags on.  

    Sen. Chris Van Hollen, D-Md., who helped write the 2019 back pay measure and shepherd it into law with then-Sen. Ben Cardin, D-Md., said the language of the statute left no room for interpretation. 

    “The law is the law," Van Hollen said. "After the uncertainty federal employees faced in the 2019 Trump Shameful Shutdown, Sen. Cardin and I worked to ensure federal employees would receive guaranteed back pay for any future shutdowns. That legislation was signed into law—and there is nothing this administration can do to change that.”

    Sen. Tim Kaine, D-Va., threatened legal action if the Trump administration follows through on its newly minted legal interpretation.

    "I was proud to work across the aisle in 2019 to pass legislation that President Trump himself signed to guarantee backpay to federal workers in the event of a shutdown," Kaine said. "If OMB chooses thuggish intimidation tactics over following the law, it better prepare to face the American people in court." 

    Matt Biggs, national president of the International Federation of Professional and Technical Engineers, described OMB’s decision to remove reference to the law “highly suspicious.”

    “The Federal Employee Fair Treatment Act is bipartisan law that has been in effect since 2019, and one that passed the House overwhelmingly with only seven no votes, passed the Senate on a voice vote without a single senator raising a concern, and was signed by President Trump,” he said. “Despite the OMB director’s clear disdain for our federal workforce, he can’t unilaterally ignore a law that overwhelmingly passed both chambers of Congress and was signed by President Trump himself. The OMB needs to stop playing games with the livelihoods of federal workers and their families.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert regarding a critical zero-day vulnerability in Oracle E-Business Suite that cybercriminals are actively exploiting to deploy ransomware attacks against organizations worldwide. The vulnerability, tracked as CVE-2025-61882, poses an immediate threat to enterprises running Oracle’s widely-used business management software. Critical Vulnerability Enables Complete System […]

    The post CISA Alerts on Oracle E-Business Suite 0-Day Actively Exploited for Ransomware Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶