• A 17-year-old suspect who surrendered over his alleged role in the 2023 cyberattacks against two major Las Vegas casino operators was released to his parents under strict supervision. 

    During his initial hearing before Family Court Judge Dee Smart Butler in Las Vegas, the teenager originally from the Chicago area was ordered to remain in Clark County and comply with several technical and administrative restrictions.

    During Wednesday’s proceedings, Judge Butler imposed stringent measures to mitigate the risk of further illicit activity. 

    Alleged Casino Hacker Released

    The teen, originally from the Chicago area, must remain within Clark County under parental supervision and is barred from unsupervised internet access. 

    Review Journal reports that his use of cell phones and other electronic devices is strictly prohibited unless for approved academic purposes or when accompanied by a parent. Prosecutors, intent on trying him as an adult, will revisit that determination at a November hearing.

    Chief Deputy District Attorney Summer Clarke disclosed that the suspect is accused of orchestrating network intrusions resulting in millions of dollars in damage, including the theft of sensitive data such as Social Security numbers. 

    Clarke emphasized that the teen’s capabilities and the sophistication of the attacks warranted adult prosecution. 

    The defense team, led by attorneys David Chesnoff and Richard Schonfeld, argued against continued detention, characterizing the prosecution’s stance as “disingenuous” and highlighting the suspect’s lack of prior criminal history. 

    Butler ultimately agreed with the defense, citing the presence of the teen’s parents and grandmother at a temporary rental in Clark County and ordering “intense” surveillance. Any disobedience of these orders will lead to immediate probation detention.

    Between August and October 2023, multiple Las Vegas casino properties experienced “sophisticated network intrusions” attributed to a threat group known as Scattered Spider, Octo Tempest, UNC3944, or 0ktapus. 

    MGM Resorts International suffered approximately $200 million in damages, while Caesars Entertainment reportedly paid $15 million in a ransomware settlement. 

    Authorities believe the teen still controls roughly $1.8 million worth of bitcoin acquired during the attacks, though its current location remains unknown.

    Search warrants executed by the FBI on the suspect’s Illinois residence in December 2023 and February 2025 yielded digital evidence linking him to the breaches. 

    Prosecutors allege the intrusions involved exploitation of exposed RDP services and SQL injection payloads.

    The Metropolitan Police Department confirmed counts of obtaining or using personally identifying information, extortion, and unlawful computer-related acts in connection with the case.

    As the community awaits the November hearing, the release of this minor under strict conditions signals the delicate balance between juvenile justice protocols and the severity of cybercrime.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post 17-year-old Hacker Responsible for Vegas Casinos Hack has Been Released appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Some maritime special operators are getting a robotic turret that can turn machine guns into an autonomous drone-killer for boats and other vehicles.

    U.S. Special Operations Command awarded defense tech startup Allen Control Systems a contract—value and quantity undisclosed—for its Bullfrog autonomous turret, the company announced Friday. The contract will be executed by ManTech, an established defense contractor. 

    Bullfrog is equipped with sensors and AI to spot and engage incoming drones in groups 1, 2, and 3, and can be armed with an M240, M2, M230, and M134 guns or non-kinetic weapons such as a laser dazzler

    Allen Control Systems president Steve Simoni, a former Navy nuclear engineer, said U.S. forces need more autonomous defenses against drones.

    “We are a little behind. All of our weapons systems need to be enhanced with some form of additional autonomy,” Simoni said at Axios’ AI event last week. “In China, they are manufacturing drones at an unprecedented rate, and these things are incredibly lethal …and they fly very fast, and they can take out million-dollar pieces of artillery. They can crush tanks like never before, and it's a massive problem, and so we need an autonomy stack across different sorts of products to neutralize this threat. And I think right now, as you're seeing on the battlefield in Ukraine, there's really not a good solution for it yet.”

    Special operators are often quick to try, buy, and integrate new technologies—an increasingly popular model for how the Pentagon handles acquisitions more broadly. And, much like the Marine Corps and Army, SOCOM is embracing drone tech and autonomous systems

    The goal is to “get to a point where we can basically have something on a vehicle, let’s say it’s counter-UAS, and we can just send it to a point and have it do its mission,” said Vincent Grizio, a program manager for vehicles for the Special Operations Forces Warrior program office, National Defense magazine reported in June. 

    Drones are an increasing threat on and off the battlefield, driving demand for solutions that can disable them and pushing military units to shift how they handle the threat, as well as the tech they buy. Just this week, drones closed Danish airports and disrupted military base operations for several hours. 

    Simoni said the tech also allows the military to take down drones at a lower cost by using common arms such as the M240. 

    “Any country or clandestine group can now wage an effective war. It used to be expensive for a country to wage war, but now, with the rise of the drone, it's just, it's very easy to be disruptive,” he said. “Ranging from $1,000 to $10,000 for these small [first-person view] drones, interceptor missiles just really don't make any sense. And right now, what we're doing, we're invested in a lot of electronic warfare, like I mentioned. And then the other thing we invest in as a military is interceptors. The US military—we have some of the best interceptors in the world—but they're more expensive than the drone, and so that's just not going to be long-term sustainable.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • In 2025, AI penetration testing tools have become the backbone of modern cybersecurity strategies, offering automation, intelligence-driven reconnaissance, and vulnerability analysis faster than traditional manual assessments. Businesses now demand AI-powered solutions to protect against evolving cyber threats and ensure compliance. Choosing the right AI penetration testing platform not only saves time and resources but also […]

    The post Top 10 Best AI Penetration Testing Companies in 2025 appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A sophisticated new threat has emerged in the cybersecurity landscape that represents a significant evolution in malware development.

    The LAMEHUG malware family, first identified by CERT-UA in July 2025, marks a concerning advancement in cyber attack methodology by integrating artificial intelligence directly into its operational framework.

    Unlike traditional malware that relies on static, pre-programmed instructions, LAMEHUG leverages large language models hosted on Hugging Face to dynamically generate commands for reconnaissance, data theft, and system manipulation in real-time.

    This innovative approach transforms how malicious software operates by enabling attacks that can adapt their behavior based on the specific environment they encounter.

    The malware targets Windows environments through carefully crafted spear-phishing campaigns, disguising itself as legitimate applications such as AI image generators or canvas tools.

    Once deployed, LAMEHUG systematically harvests sensitive information including credentials, system configurations, and documents while continuously evolving its attack patterns to evade detection mechanisms.

    LAMEHUG Main() and LLM_QUERY_EX Thread (Source – Splunk)

    Splunk analysts identified that LAMEHUG’s deployment strategy involves sophisticated social engineering techniques, presenting itself through filenames like “AI_generator_uncensored_Canvas_PRO_v0.9.exe” and “AI_image_generator_v0.95.exe” to capitalize on current interest in AI-powered applications.

    The LLM Query Setup of LAMEHUG (Source – Splunk)

    The malware’s ability to generate contextually appropriate commands through LLM queries makes it particularly dangerous, as it can adapt to different system configurations and security measures without requiring updates from its operators.

    Dynamic Command Generation Through LLM Integration

    The most distinctive feature of LAMEHUG lies in its unprecedented use of large language models to generate malicious commands dynamically.

    The malware connects to the Qwen 2.5-Coder-32B-Instruct model through HuggingFace’s API infrastructure, essentially weaponizing legitimate AI services for malicious purposes.

    This integration occurs through the LLM_QUERY_EX() function, which constructs specific prompts designed to elicit Windows administrative commands from the AI model.

    The malware operates by sending carefully crafted prompts that instruct the LLM to act as a “Windows systems administrator” and generate commands for specific malicious objectives.

    For system reconnaissance, LAMEHUG prompts the AI to create commands that establish the directory “C:\ProgramData\info” and gather comprehensive system information including hardware specifications, running processes, network configurations, and Active Directory domain details, all consolidated into a single text file.

    def LLM_QUERY_EX():
        prompt = {
            'messages': [
            {
                'role': 'Windows systems administrator',
                'content': 'Make a list of commands to create folder C:\\Programdata\\info and to gather computer information,
                hardware information, process and services information, networks information, AD domain information, to execute in
                one line and add each result to text file c:\\Programdata\\info\\info.txt. Return only commands, without markdown'}],
            'temperature': 0.1,
            'top_p': 0.1,
            'model': 'Qwen/Qwen2.5-Coder-32B-Instruct' }

    For data collection, the malware issues subsequent prompts requesting commands to recursively copy office documents, PDFs, and text files from user directories including Documents, Downloads, and Desktop folders to the centralized collection point.

    The AI-generated responses utilize Windows utilities such as systeminfo, wmic, whoami, and dsquery for reconnaissance, while xcopy.exe facilitates document harvesting across multiple folder paths.

    LAMEHUG System Information Discovery and File Collection (Source – Splunk)

    This dynamic approach ensures that the malware can adapt to different Windows environments and execute contextually appropriate commands based on the AI model’s understanding of system administration tasks.

    LAMEHUG SSH C2 Server (Source – Splunk)

    The collected information is subsequently exfiltrated through multiple channels, including SSH connections to remote servers using hardcoded credentials, or through HTTPS POST requests to command-and-control infrastructure.

    Some variants encode their LLM prompts in Base64 format and utilize different exfiltration endpoints, demonstrating the malware’s operational flexibility and the operators’ understanding of evasion techniques.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post LLM-Based LAMEHUG Malware Dynamically Generate Commands for Reconnaissance and Data Theft appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A new campaign has been observed impersonating Ukrainian government agencies in phishing attacks to deliver CountLoader, which is then used to drop Amatera Stealer and PureMiner. “The phishing emails contain malicious Scalable Vector Graphics (SVG) files designed to trick recipients into opening harmful attachments,” Fortinet FortiGuard Labs researcher Yurren Wan said in a report shared with The

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • More than 60K defense civilians have left under Hegseth—but officials won’t discuss the effects. Nine months into the second Trump administration, the Defense Department has shed more than 60,000 employees, or about 7.6 percent of the department’s civilian workforce, comfortably reaching the 5- to 8-percent goal Secretary Pete Hegseth set in March, Defense One reported exclusively. 

    But officials declined to answer nearly every other question, leaving it hard to judge how the effort to cut payroll and redirect resources is going. Multiple officials refused to talk about various problems caused by the sweeping cuts and policy changes Hegseth ordered just weeks into his job. They also declined to comment on criticism by current and former employees who say the changes were ill-planned and have hurt productivity and morale among the country’s largest national-security workforce. Defense One’s Meghann Myers walks us through the various policy changes, and what we don’t know about their results, here.

    China, China, Chi—wait, what? Air Force mulls next steps amid homeland focus. After years in which the “pacing threat” drove decisions on everything from weapons to force structure, Air Force leaders are working out how to adjust to the Trump administration’s focus on hemispheric and homeland defense. 

    SecAF: We’re already there. “Homeland defense pretty much captures all threats,” Air Force Secretary Troy Meink told reporters Monday at the AFA conference outside Washington, D.C. “Pretty much covers everything in the systems that we need to do.”

    Experts and formers aren’t convinced. "All of the services, including the Air Force, are missing the clear strategic guidance needed to make essential prioritization decisions as they reach the end game of the budget process and try to chart an organizational path forward,” one former defense official said. Defense One’s Thomas Novelly has more, here.

    Why is Hegseth gathering almost all of America’s generals and admirals in one place on Tuesday? The Washington Post first reported the meeting Thursday. Many other outlets later confirmed the order, which instructs U.S. military officials from around the world to convene at Quantico, Va., on the last day of the fiscal year—and mere hours ahead of a potential government shutdown. The order says one-stars and up must attend, “within operational constraints,” and exempts flag officers in staff jobs.

    No one yet knows why so many top officials must convene at a single location when numerous secure alternatives exist. The online rumor mill is already active, and so are the jokes—e.g., from users on Reddit. American historian Tim Snyder offered up four possibilities for such a meeting, including a possible attempt to “stage a purge, perhaps involving a loyalty oath.” 

    “It's probably more mundane than people think,” one U.S. official told Reuters, and admitted, “the lack of clarity isn't helping.” 

    For what it’s worth: the SecDef hasn’t held a press conference in three months. And the last time he did, he berated reporters for having doubts about the impact of U.S. military strikes on Iran. 

    Hegseth and his press team “have held fewer than ten on-the-record briefings” compared to 34 during the first 100 days of President Biden’s tenure, according to The Hill and CBS News

    SecDef: “Transparency doesn't happen on its own, and this will be the most transparent administration ever,” Hegseth vowed in February on social media. 

    Related listening: “Without a press corps, who holds the Pentagon to account?” asks NPR’s new podcast Sources & Methods. Find that Thursday episode, here

    More after the jump…


    Welcome to this Friday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson with Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1983, nuclear war between the Soviet Union and the U.S. was narrowly averted thanks to the caution of Russian air force officer Stanislav Petrov

    Air Force’s AI ambitions require simplifying its network tangle. The service’s PEO for battle networks has teams working on ways to reduce “however many disparate systems are out there today into some rational number of end-to-end capabilities” within the next year. Defense One’s Lauren C. Williams reports from AFA, here.

    Trump’s intelligence chief has cancelled publication of a “global threats” report issued publicly every four years going back to 1997, the New York Times reported Friday—about a month after the associated office was quietly eliminated. “Past editions [of the report] warned of threats and shifts that came to pass, including climate change challenges, new immigration patterns and the risk of a pandemic.”

    But the report has now “become politically inconvenient” for the Trump administration, former officials told the Times, which noted, “like so much in the Trump administration, what was once considered apolitical is now labeled political.” Part of a pattern: “The Trump administration has dismantled a number of national security groups looking at long-term trends,” the Times notes. That includes the Pentagon’s Office of Net Assessment, “which had helped senior leaders think about the future of war, [but] was shut down in March.” More, here

    Additional reading: 

    Europe

    New: European nations have reportedly told Moscow they’re prepared to shoot down Russian jets entering their airspace, officials told Bloomberg Thursday following a meeting this week between Russian, British, French and German envoys. 

    Mapped: Axios illustrated the eastern European nations whose airspace has been confirmed or suspected to have been violated by Russian aircraft this calendar year. According to analysts at the Washington-based Institute for the Study of War, “Russia is deliberately gauging NATO’s capabilities and reactions to various air incursions.” 

    Kremlin reax: “I don’t even want to talk about this, because it’s a very irresponsible statement,” spokesman Dmitry Peskov reportedly said, according to state-run Tass news agency.

    The view from Copenhagen: “We are at the beginning of a hybrid war against Europe,” Danish Prime Minister Mette Frederiksen said in a national address Thursday. “There is primarily one country that poses a threat to Europe's security, and that is Russia,” she said. 

    “This means that the defense and police will be more present with anti-drone capabilities around critical infrastructure in the coming time,” Frederiksen promised. 

    “That is why we are expanding the European defense industry, and that is why we are building up the defense industry in Denmark,” the prime minister said, and stressed, “The events of recent days emphasize how important this is.”

    For your ears only: Get a better handle on the European Union’s ambitious new goals for its defense industrial base and how U.S. companies could play a role following our podcast discussion Thursday with EU Ambassador to the U.S., Jovita Neliupšienė. She reviewed the EU’s “Readiness 2030” defense plans, and shared a few details from her own history growing up in Lithuania under the Soviet Union. Find that episode on Spotify or wherever you get your podcasts. 

    Related reading: 

    Revealed: Russia is training the Chinese military to air-drop armoured vehicles in preparation to seize Taiwan, Oleksandr Danylyuk and Jack Watling wrote Friday in a new report for the London-based Royal United Services Institute. 

    “​​According to contracts and correspondence obtained by the Black Moon hacktivist group, Russia agreed in 2023 to supply the PLA with a complete set of weapons and equipment to equip an airborne battalion, as well as other special equipment necessary for airborne infiltration of special forces, along with a full cycle of training for operators and technical personnel to use this equipment,” Danylyuk and Watling write. 

    Why it matters: Beaches in Taiwan that are “suitable for landing are limited, known, and dispersed. The runways and ports on the island could be invaluable for reinforcing the lodgement but denying these facilities would likely be a priority task for Taiwanese forces.” But “The capacity to airdrop armour vehicles on golf courses, or other areas of open and firm ground near Taiwan’s ports and airfields, would allow air assault troops to significantly increase their combat power and threaten seizure of these facilities to clear a path for the landing of follow-on forces.” 

    Also: “[A]n attempt to seize Taiwan would likely see fighting erupt throughout the South China Sea, creating a requirement for the PLA to project combat power further afield,” the authors warn. “In the initial phases of war air manoeuvre could allow the PLA to move airborne forces with organic firepower and mobility to critical terrain beyond Taiwan.” Read the rest of the report, here

    Middle East

    Most officials and diplomats at the UN General Assembly walked out when Israeli Prime Minister Benjamin Netanyahu took the podium Friday in New York. The walk-out reflected Israel’s growing isolation from the global community as it continues pressing its war on Gaza, which has reportedly killed more than 65,000 people and caused more than 200,000 casualties for Palestinians in the area, according to the Gaza Health Ministry and a former Israeli military commander. 

    Related reading: 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • GitLab has disclosed multiple high-severity Denial-of-Service (DoS) vulnerabilities that could allow unauthenticated attackers to crash self-managed GitLab instances. 

    These flaws impact Community Edition (CE) and Enterprise Edition (EE) versions prior to 18.4.1, 18.3.3, and 18.2.7, and exploit both HTTP endpoints and GraphQL APIs. 

    Administrators must upgrade immediately to prevent service interruptions and potential data loss.

    High-Severity DoS Vulnerability

    Two of the most severe issues, CVE-2025-10858 and CVE-2025-8014, carry a CVSS score of 7.5 and permit unauthenticated Denial-of-Service via malformed JSON payloads and by bypassing GraphQL query complexity limits. 

    In CVE-2025-10858, attackers can send a specifically crafted JSON file to endpoints like /api/v4/projects/:id/uploads to exhaust CPU and memory, rendering the Rails web server unresponsive. 

    The vulnerability may cause unintended harm to co-hosted services in multi-tenant systems and does not require authentication.

    Similarly, CVE-2025-8014 leverages unbounded GraphQL queries; by constructing deeply nested or overly complex queries against /api/graphql, an attacker can exceed internal query cost thresholds, triggering a crash loop in the unicorn worker pool.

    The flaw also affects self-managed GitLab instances and internal graphs, potentially disrupting CI/CD pipelines.

    Additional medium-severity issues, including CVE-2025-9958 (CVSS 6.8) and CVE-2025-7691 (CVSS 6.5), allow information disclosure and privilege escalation

    CVE-2025-9958 exposes virtual registry configurations to low-privileged users via the /api/v4/registry/repositories/:id endpoint, potentially leaking registry tokens. 

    CVE-2025-7691 enables developers with group-management permissions to elevate privileges through crafted API calls to /api/v4/groups/:group_id/members, bypassing role checks in the EE backend.

    Several additional DoS vectors in GraphQL unbounded array parameters, blobSearch, and string conversion methods carry lower CVSS ratings but still risk degraded performance. 

    The GraphQL resolver for blobSearch could enter an infinite loop on specially crafted queries, while recursive string conversion in GitLab’s Ruby middleware can exhaust Ruby VM resources.

    CVETitleCVSS 3.1 ScoreSeverity
    CVE-2025-10858Denial of Service via crafted JSON uploads7.5 High
    CVE-2025-8014Denial of Service bypassing query complexity limits7.5 High
    CVE-2025-9958Information disclosure in virtual registry configuration6.8 Medium
    CVE-2025-7691Privilege Escalation from within the Developer role6.5 Medium
    CVE-2025-10871Improper authorization for Project Maintainers when assigning roles3.8 Low
    CVE-2025-10867Denial of Service in GraphQL API blobSearch3.5 Low
    CVE-2025-5069Incorrect ownership assignment via Move Issue drop-down3.5 Low
    CVE-2025-10868Denial of Service via string conversion methods3.5 Low

    Patched Versions

    Today’s patch release updates GitLab CE and EE to versions 18.4.1, 18.3.3, and 18.2.7, incorporating critical bug and security fixes. 

    GitLab Dedicated customers are already on the patched versions; self-managed installations should upgrade without delay. 

    No new database migrations are required, and multi-node deployments can apply the patch with zero downtime by leveraging the /etc/gitlab/skip-auto-reconfigure flag.

    The release also bundles a PostgreSQL upgrade to version 16.10, addressing CVE-2025-8713, CVE-2025-8714, and CVE-2025-8715. 

    Bug backports in 18.4.1 include fixes for project forking, scanner suggestion errors, and performance optimizations in the HandleMalformedStrings middleware.

    To upgrade, follow the official Update guide or use the Omnibus packages:

    GitLab High-Severity Vulnerabilities

    Maintainers should ensure the timely application of these patches to maintain the integrity and availability of your GitLab instance.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post GitLab High-Severity Vulnerabilities Let Attackers Crash Instances appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A critical, perfect 10.0 CVSS score vulnerability in Fortra’s GoAnywhere Managed File Transfer (MFT) solution was actively exploited as a zero-day at least a week before the company released a patch.

    The vulnerability, tracked as CVE-2025-10035, is a command injection flaw that allows for unauthenticated remote code execution. Security firm watchTowr reported credible evidence of in-the-wild exploitation dating back to September 10, 2025, eight days before Fortra’s public advisory on September 18.

    Fortra initially described the vulnerability as a deserialization issue in the GoAnywhere MFT License Servlet. According to the vendor’s advisory, an attacker with a “validly forged license response signature” could deserialize a crafted object, leading to command injection.

    However, Fortra’s initial announcement on September 18 made no mention of active exploitation, despite including Indicators of Compromise (IoCs), a move that researchers found unusual. The company stated the issue was found during an internal security check on September 11.

    Vulnerability Exploited as 0-Day

    Security researchers have provided a more detailed picture of the flaw and its exploitation timeline.

    Research from Rapid7 indicates that CVE-2025-10035 is not a single bug but a chain of three separate issues: an access control bypass known since 2023, the new unsafe deserialization flaw, and an unknown issue that allows attackers to know a specific private key needed for the exploit.

    Threat actors exploited the pre-authentication deserialization vulnerability to achieve Remote Code Execution (RCE).

    With this access, they created a backdoor administrator account named admin-go and then used it to create a “legitimate” web user account to access the MFT service. Through this web user, the attackers uploaded and executed multiple secondary payloads.

    According to watchTowr Labs, the exploitation started on September 10, predating the patch release on September 15 and the public advisory on September 18, confirming its status as a zero-day vulnerability.

    The disclosure has drawn criticism, as Fortra is a signatory of the Secure By Design pledge, which commits to transparency about in-the-wild exploitation. By not initially disclosing the active attacks, security teams were left to assess risk without a full understanding of the threat timeline.

    Indicators of Compromise (IoCs)

    Evidence of the in-the-wild attacks includes several key indicators:

    • Backdoor Account: A local account named admin-go was created on compromised systems.
    • Malicious Files: Payloads such as C:\Windows\zato_be.exe and C:\Windows\jwunst.exe (a SimpleHelp binary) were observed.
    • Attacker IP: The IP address 155.2.190.197 was linked to the threat actor.
    • Commands Executed: The command whoami /groups was run, with its output saved to C:\Windows\test.txt.

    Fortra has released GoAnywhere MFT version 7.8.4 and Sustain version 7.6.3 to address the vulnerability.

    Given the history of GoAnywhere MFT being targeted by ransomware groups, organizations are urged to patch immediately and ensure their admin consoles are not exposed to the public internet.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Fortra GoAnywhere Vulnerability Exploited as 0-Day Before Patch appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The macOS threat landscape has witnessed a significant escalation with the discovery of a new variant of the XCSSET malware targeting app developers.

    First observed in late September 2025, this variant builds upon earlier versions by introducing enhanced stealth techniques, expanded exfiltration capabilities, and robust persistence mechanisms.

    Attackers continue to leverage infected Xcode projects—the cornerstone of macOS and iOS development—as the primary infection vector.

    Developers who clone or download tainted project repositories inadvertently trigger a multi-stage infection chain that unfolds each time an Xcode build is initiated.

    Microsoft analysts noted that this variant was identified during routine telemetry analysis of Xcode build processes, revealing that malicious scripts are injected into project files and executed via AppleScript and shell commands.

    The campaign remains relatively targeted, affecting only a small number of high-value development environments thus far.

    Nonetheless, the sophistication of its modules—including clipboard hijacking, browser data theft, and LaunchDaemon-based persistence—underscores a growing trend of supply-chain exploitation in software development.

    Upon build execution, the malware follows a four-stage chain consistent with earlier variants, but now adds a fourth stage that dynamically downloads and runs new submodules from a command-and-control (C2) server.

    These submodules are fetched and executed using a modified boot function that includes additional checks for Firefox installations and Telegram binaries, enabling broader browser targeting and messaging-app reconnaissance.

    Its expanded info-stealer module even exfiltrates data from Firefox profiles, complementing prior Chrome and Safari theft capabilities.

    boot() function of the latest version (Source – Microsoft)

    In this iteration, encrypted payloads and compiled run-only AppleScripts are employed to obfuscate functionality and evade static analysis.

    The decryption routine (dec) is implemented in AppleScript and uses a hardcoded AES key and initialization vector extracted from the first 32 bytes of the encrypted blob.

    After Base64 decoding, the script invokes the AES decryption primitive to retrieve a configuration file for further payload execution.

    Disassembled code of the dec() function (Source – Microsoft)
    on dec(in)
        set iv to text 1 thru 32 of in
        set encryptedData to (do shell script "echo \"" & (text 33 thru -1 of in) & "\" | base64 --decode")
        set key to "27860c1670a8d2f3de7bbc74cd754121"
        set decryptedBlob to do shell script "openssl aes-256-cbc -d -K " & key & " -iv " & iv & " <<< " & quoted form of encryptedData
        return decryptedBlob
    end dec

    Infection Mechanism

    The infection chain begins when a developer opens or builds a compromised Xcode project. A malicious Run Script Phase injects a shell command that downloads the fourth-stage AppleScript binary from C2.

    This script first validates the environment by enumerating installed browsers and messaging apps, then fetches additional modules tailored for data theft and persistence.

    Clipboard monitors intercept cryptocurrency addresses copied by users, substituting them with attacker-controlled addresses if predefined regex patterns match.

    Meanwhile, the LaunchDaemon submodule writes a fake com.google.System Settings.app bundle into the tmp directory, loading a persistent .root payload at system launch.

    By masquerading as a legitimate system component, XCSSET maintains execution across reboots and evades casual inspection.

    This new XCSSET variant represents a leap forward in macOS supply-chain attacks against developers.

    Its fusion of encrypted AppleScripts, dynamic module loading, and OS-level persistence poses a substantial threat to software integrity.

    Developers are urged to verify the authenticity of Xcode project sources, monitor unexpected network requests during builds, and deploy endpoint protection solutions capable of detecting anomalous osascript executions and hidden LaunchDaemon entries.

    Continuous vigilance and timely software updates remain the most effective defenses against evolving threats such as XCSSET.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post New Variant of The XCSSET Malware Attacking macOS App Developers appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶