1010.cx

  • Cavalry Werewolf APT Targets Multiple Sectors Using FoalShell and StallionRAT

    ·

    , ,

    From May to August 2025, an advanced persistent threat group known as Cavalry Werewolf—also tracked as YoroTrooper and Silent Lynx—executed a sophisticated attack campaign targeting Russia’s public sector and vital industries such as energy, mining, and manufacturing. The coordinated offensive leveraged trusted relationships for highly targeted spear-phishing and deployed a custom multi-language malware arsenal, marking […]

    The post Cavalry Werewolf APT Targets Multiple Sectors Using FoalShell and StallionRAT appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Critical ASP.NET Vulnerability Allows Attacker To Bypass Security Feature Remotely

    ·

    , , ,

    Microsoft has disclosed a serious security flaw in ASP.NET Core that enables authenticated attackers to smuggle HTTP requests and evade critical protections.

    Tracked as CVE-2025-55315, the vulnerability stems from inconsistent handling of HTTP requests, a classic issue known as HTTP request/response smuggling.

    Released on October 14, 2025, this flaw affects developers relying on the popular web framework for building secure applications.

    With a CVSS v3.1 base score of 9.9 rated as “Critical” in impact the bug poses risks to confidentiality, integrity, and even limited availability of affected systems.

    The vulnerability exploits a weakness classified under CWE-444, where servers misinterpret HTTP requests, allowing attackers to inject malicious payloads.

    An authorized user with low privileges can send a crafted request over the network, bypassing front-end security controls like web application firewalls.

    This could let them hijack other users’ sessions, steal sensitive credentials, or alter server files without detection. Microsoft’s analysis highlights that successful exploitation leads to high confidentiality and integrity losses (C:H, I:H), with low availability impact (A:L), potentially causing server crashes.

    The scope changes (S:C) mean the attack ripples beyond the vulnerable component, affecting unrelated resources under different security authorities.

    Exploitation Risks In Real-World Scenarios

    Attackers need only low privileges and no user interaction, making this a low-complexity threat accessible via the network (AV:N, AC:L, PR:L, UI:N).

    While no public exploits exist yet Microsoft deems exploitation “less likely” the unproven maturity (E:U) doesn’t diminish the urgency.

    Imagine a corporate intranet where an insider crafts a smuggling request to impersonate an admin, accessing payroll data or injecting malware Or in e-commerce sites, where smuggled requests could siphon customer info during peak traffic.

    The bug hits ASP.NET Core in .NET 8 and later versions, as well as older .NET 2.3 setups using the Kestrel server. Microsoft confirms no evidence of active exploitation, but the confirmed confidence (RC:C) and official fix (RL:O) underscore immediate action.

    Developers on .NET 8+ should apply the latest Microsoft Update and restart applications. For .NET 2.3, update the Microsoft.AspNetCore.Server.Kestrel.Core package to version 2.3.6, recompile, and redeploy.

    Self-contained apps require recompilation post-update. Broader remediation involves auditing HTTP parsing in custom middleware and enabling strict request validation.

    This flaw revives concerns over HTTP smuggling, a tactic seen in past attacks on cloud services. As remote work expands attack surfaces, organizations must prioritize patching.

    Microsoft urges scanning for vulnerable deployments and monitoring logs for anomalous requests. With the framework powering millions of web apps, unpatched systems risk data breaches or compliance violations.

    Security teams should integrate this into vulnerability management workflows, especially given the framework’s role in enterprise stacks.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Critical ASP.NET Vulnerability Allows Attacker To Bypass Security Feature Remotely appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Google Identifies Three New Russian Malware Families Created by COLDRIVER Hackers

    ·

    A new malware attributed to the Russia-linked hacking group known as COLDRIVER has undergone numerous developmental iterations since May 2025, suggesting an increased “operations tempo” from the threat actor. The findings come from Google Threat Intelligence Group (GTIG), which said the state-sponsored hacking crew has rapidly refined and retooled its malware arsenal merely five days following

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Hackers Used Snappybee Malware and Citrix Flaw to Breach European Telecom Network

    ·

    A European telecommunications organization is said to have been targeted by a threat actor that aligns with a China-nexus cyber espionage group known as Salt Typhoon. The organization, per Darktrace, was targeted in the first week of July 2025, with the attackers exploiting a Citrix NetScaler Gateway appliance to obtain initial access. Salt Typhoon, also known as Earth Estries, FamousSparrow,

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • AdaptixC2 Emerges in npm Supply-Chain Exploit Against Developers

    ·

    , ,

    Cybersecurity researchers at Kaspersky have uncovered a sophisticated supply chain attack targeting the npm ecosystem, where threat actors distributed the AdaptixC2 post-exploitation framework through a malicious package disguised as a legitimate proxy utility. The discovery highlights the growing risk of open-source software repositories as attack vectors for delivering advanced malware. In October 2025, Kaspersky experts […]

    The post AdaptixC2 Emerges in npm Supply-Chain Exploit Against Developers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • CISA Warns of Oracle E-Business Suite SSRF Vulnerability Actively Exploited in Attacks

    ·

    , ,

    The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Oracle E-Business Suite vulnerability to its Known Exploited Vulnerabilities catalog after detecting active exploitation in the wild. The security flaw, tracked as CVE-2025-61884, poses significant risks to organizations running the widely-deployed enterprise resource planning software. Critical SSRF Flaw Requires Immediate Action CVE-2025-61884 is a […]

    The post CISA Warns of Oracle E-Business Suite SSRF Vulnerability Actively Exploited in Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Pakistani Cyber Actors Impersonating ‘NIC eEmail Services’ to Target Indian Government

    ·

    , ,

    Pakistan-based advanced persistent threat group APT36, also known as TransparentTribe, is actively targeting Indian government entities with a sophisticated spear-phishing campaign using email lures themed as “NIC eEmail Services.” This campaign leverages lookalike domains and weaponized infrastructure to steal credentials and enable long-term espionage. The attack begins with email messages that convincingly mimic official notifications […]

    The post Pakistani Cyber Actors Impersonating ‘NIC eEmail Services’ to Target Indian Government appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • CISA Warns of Actively Exploited Windows SMB Vulnerability

    ·

    , , ,

    The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Microsoft Windows Server Message Block (SMB) vulnerability to its Known Exploited Vulnerabilities catalog, warning that threat actors are actively exploiting the security flaw in the wild. The vulnerability, tracked as CVE-2025-33073, affects the Windows SMB Client and could allow attackers to escalate privileges on […]

    The post CISA Warns of Actively Exploited Windows SMB Vulnerability appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New LOSTKEYS Malware Tied to Russian State-Sponsored Hacker Group COLDRIVER

    ·

    , ,

    Russian state-sponsored threat actor COLDRIVER, long known for targeting high-profile NGOs, policy advisors, and dissidents, has been linked to a rapidly evolving malware campaign following the public disclosure of its LOSTKEYS malware in May 2025. After details of LOSTKEYS surfaced, COLDRIVER (also tracked as UNC4057, Star Blizzard, and Callisto) pivoted away from the compromised malware. […]

    The post New LOSTKEYS Malware Tied to Russian State-Sponsored Hacker Group COLDRIVER appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • AWS Declares Major Outage Resolved After Nearly 24 Hours of Disruption

    ·

    Amazon Web Services (AWS), the world’s largest cloud computing provider, has officially marked a widespread outage in its US-EAST-1 region as resolved, following nearly a full day of cascading failures that disrupted services for millions worldwide.

    The incident, which began late on October 19, 2025, and persisted until early afternoon on October 20, highlighted the fragility of global internet infrastructure reliant on AWS’s backbone.

    By 3:01 PM PDT, AWS confirmed all services had returned to normal operations, though some backlogs in data processing for tools like AWS Config and Redshift were expected to clear within hours.

    The outage originated from DNS resolution issues affecting the DynamoDB API endpoint in the US-EAST-1 region, AWS’s busiest data center in Northern Virginia.

    At 11:49 PM PDT on October 19, elevated error rates and latencies emerged across multiple services, initially pinpointed to DynamoDB, a core database service powering everything from user data to application backends.

    Engineers identified the root cause by 12:26 AM PDT on October 20, linking it to a faulty DNS update that prevented applications from locating server IP addresses, akin to a broken phonebook for the internet.

    This failure triggered a domino effect: EC2 instance launches stalled due to DynamoDB dependencies, Network Load Balancer health checks failed, and connectivity broke for services like Lambda, SQS, and CloudWatch.​

    100+ AWS Services Impacted

    The blast radius was immense, impacting over 100 AWS services and spilling over to consumer-facing platforms.

    Popular apps such as Snapchat, Fortnite, Roblox, and Coinbase went offline, with users unable to log in or access features amid surging complaints on DownDetector.

    Gaming services like Epic Games’ Fortnite reported server downtimes, while financial platforms including Venmo and banking apps from Lloyds and Halifax in the UK faced login hurdles.

    Even Amazon’s own ecosystem suffered Prime Video buffering spiked, Ring doorbells lost remote access, and e-commerce checkouts faltered.

    AI startup Perplexity attributed its disruptions directly to the AWS issue, with CEO Aravind Srinivas noting on X that funds remained safe but access was blocked.

    Government agencies, airlines like Delta, and media outlets including Disney+ and The New York Times also logged interruptions, underscoring AWS’s 33% market dominance in cloud infrastructure.​

    Critics pointed to the 75-minute diagnostic delay and initial “all clear” status page messages as transparency shortfalls, echoing past AWS critiques on outage notifications.

    No cyberattack was suspected; it stemmed from an internal update error in a foundational service.

    AWS Response

    AWS’s response involved parallel mitigations: flushing DNS caches, throttling EC2 launches to stabilize subsystems, and scaling up polling rates for SQS queues tied to Lambda.

    By 2:24 AM PDT, the core DynamoDB DNS fix was deployed, yielding early recovery signs, though network issues lingered into the morning.

    Temporary throttles on operations like asynchronous Lambda invocations helped prioritize critical paths, with full EC2 launch restoration by 2:48 PM PDT.

    Global features dependent on US-EAST-1, such as IAM updates and DynamoDB Global Tables, also rebounded, allowing support case creations to resume.

    AWS promised a detailed post-incident summary, emphasizing ongoing backlog processing for analytics in Connect and Redshift.

    Experts like those at ThousandEyes noted no external network anomalies, confirming the issue’s internal nature and rapid recovery post-mitigation.

    As services return to normal, affected users should try their operations again and check the AWS Health Dashboard for updates.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post AWS Declares Major Outage Resolved After Nearly 24 Hours of Disruption appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶