1010.cx

  • Trump freezes most training for non-ICE federal law enforcement

    ·

    The Trump administration is pausing training at the federal government's primary law enforcement academies for anyone not related to immigration enforcement, saying the change is necessary to meet the president’s “immediate priorities.” 

    The administration is in the midst of surging 10,000 employees to Immigration and Customs Enforcement after securing funding for the hires in the One Big Beautiful Bill Act, creating unprecedented demand at the Federal Law Enforcement Training Centers. Training needs could create bottlenecks as ICE seeks to rapidly onboard the new officers and agents, current and former officials have warned, and the administration is now taking drastic measures to avoid those pitfalls. 

    “To support the onboarding of 10,000 US Immigration and Customs Enforcement (ICE) Enforcement and Removal Operations personnel and 1,000 ICE Homeland Security Investigations personnel by Dec. 31st, 2025, we must focus our resources on surge-related training,” acting FLETC Director Paul Baker and his deputy, Ariana Roddini, said in a message to staff Wednesday. “As a result, training programs for agencies not directly involved in these efforts, originally scheduled between Sept. 9 and Dec. 31, 2025 will be rescheduled to later dates in Fiscal Year 2026.”

    More than 75 federal law enforcement agencies train at FLETC, which maintains its primary campus in Glynco, Georgia. Those agencies range from other Homeland Security Department components like Border Patrol and the Transportation Security Administration to the National Park Service, military police and inspectors general offices across government. 

    “We recognize the impact this decision may have on our partner agencies and the additional demands it places on our staff,” Baker and Roddini said. 

    The DHS component has stood up a Surge Training Operations Center to help manage the influx from ICE and “coordinate planning and execution.” That group is assembling daily to address challenges that arise and meet the administration’s priorities, while still supporting its partner agencies “as much as possible.”

    Baker and Roddini added they are examining whether other FLETC sites could accommodate critical training programs and are working with other agencies to find temporary solutions to meet their training needs. In addition to ICE’s 10,000 ERO hires, 1,000 HSI hires and normal federal law enforcement onboarding—which Trump has exempted from his governmentwide hiring freeze—the president’s signature immigration enforcement and tax bill funded 8,500 new employees for Customs and Border Protection and provided $3 billion for Bureau of Prisons hiring. 

    FLETC itself received $750 million to support those hiring efforts and current and former officials highlighted the need to quickly expand capacity at the training center to accommodate the surges. The current limitation on classrooms, instructors, firearms ranges and other assets could limit FLETC's throughout, they said. 

    Jason Owens, a longtime Border Patrol official who served as chief of the agency under President Biden and as its chief operating officer through March, recently told Government Executive that expanding capacity at FLETC could create its own speed bumps because construction “doesn’t happen overnight,” requires a buildup of procurement capacity and the typically-not-timely awarding of contracts.

    One FLETC employee said the agency did not “appear to be prioritizing the building of long term capabilities.” Instead, the employee said, “they look focused on short term, temporary fixes to accommodate the mission.”

    DHS did not immediately respond to a request for comment. For its part, FLETC stressed that it is committed to helping its own employees work through the changes. 

    “We understand the challenges this surge may present and are committed to providing the support and resources you need to carry out your responsibilities effectively,” Baker and Roddini said. 

    ICE has created a variety of incentives to identify new applicants, including recruitment bonuses of up to $50,000 and removing age caps for staff to serve. It has also slashed training time from six months to 48 days, The Atlantic reported this week. 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • South Korea Arrests Suspected Chinese Hacker Stolen Tens of Millions of Dollars from Victims

    ·

    , ,

    South Korean authorities have successfully extradited a Chinese national suspected of orchestrating one of the most sophisticated hacking operations targeting high-profile individuals and financial institutions.

    The 34-year-old suspect, identified only as Mr. G, was repatriated from Bangkok, Thailand, on August 22, 2025, following a four-month international manhunt that resulted in his arrest for allegedly stealing over 38 billion won (approximately $28.5 million) from victims’ financial and virtual asset accounts.

    The criminal organization, operating from overseas offices primarily in Thailand, executed a complex multi-vector attack campaign spanning from August 2023 to January 2024.

    The group’s primary methodology involved infiltrating mobile carrier websites and other web platforms to harvest personal information from wealthy individuals, celebrities, corporate executives, and venture company representatives.

    Using this stolen data, the hackers gained unauthorized access to victims’ banking accounts and cryptocurrency wallets, systematically transferring assets without detection for months.

    Initial investigations revealed that the malware employed sophisticated social engineering techniques combined with technical exploitation of web application vulnerabilities.

    Moj.go.kr analysts identified the attack pattern as a coordinated effort utilizing both automated tools and manual intervention to maximize financial extraction while avoiding traditional security monitoring systems.

    Hacker got arrested (Source – Moj.go.kr)

    The operation’s technical sophistication became apparent through its multi-stage infection mechanism, which relied heavily on exploiting vulnerabilities in mobile carrier authentication systems.

    The malware initially gained entry through compromised web portals, where attackers injected malicious scripts designed to harvest user credentials and session tokens.

    Once inside the network perimeter, the malicious code established persistent backdoors using encrypted communication channels to maintain long-term access.

    The persistence tactics employed by this threat actor demonstrated advanced knowledge of system administration and network security protocols.

    The malware utilized a combination of registry modifications and scheduled task creation to ensure continuous operation across system reboots.

    Code analysis revealed the use of obfuscated PowerShell scripts that executed at regular intervals, checking for network connectivity and updating command-and-control server addresses dynamically.

    $encoded = [System.Convert]::FromBase64String($data)
$decoded = [System.Text.Encoding]::UTF8.GetString($encoded)
Invoke-Expression $decoded

    Detection evasion mechanisms included the implementation of anti-analysis techniques such as environment checking, sandbox detection, and runtime packing.

    The malware consistently modified its file signatures and employed living-off-the-land techniques, utilizing legitimate system tools like PowerShell and Windows Management Instrumentation to execute malicious activities while appearing as normal system processes.

    The successful extradition represents a significant victory for international cybercrime cooperation, with Korean authorities working closely with Thai officials, Interpol, and the Southeast Asia Cooperation Network to track and apprehend the suspect within just four months of his entry into Thailand.

    Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

    The post South Korea Arrests Suspected Chinese Hacker Stolen Tens of Millions of Dollars from Victims appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • How SafeLine WAF Turns Hackers’ Scanners into Trash

    ·

    ,

    When web application protection is no longer a million-dollar luxury, and when every developer can build their own security perimeter with just a few clicks—that is when cybersecurity truly fulfills its mission. As a penetration tester, I’ve used zero-days to crush countless firewalls. But as a defender, I once found myself completely shut down by SafeLine […]

    The post How SafeLine WAF Turns Hackers’ Scanners into Trash appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Researchers Find VS Code Flaw Allowing Attackers to Republish Deleted Extensions Under Same Names

    ·

    Cybersecurity researchers have discovered a loophole in the Visual Studio Code Marketplace that allows threat actors to reuse names of previously removed extensions. Software supply chain security outfit ReversingLabs said it made the discovery after it identified a malicious extension named “ahbanC.shiba” that functioned similarly to two other extensions – ahban.shiba and ahban.cychelloworld –

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cisco UCS Manager Software Flaw Allows Attackers to Inject Malicious Commands

    ·

    , , ,

    Cisco has released urgent security updates to remediate two medium-severity command injection vulnerabilities in its UCS Manager Software that could allow authenticated administrators to execute arbitrary commands and compromise system integrity. Disclosed on August 27, 2025, the advisory (cisco-sa-ucs-multi-cmdinj-E4Ukjyrz) affects multiple UCS fabric interconnect platforms and underscores the importance of timely patching to prevent potential […]

    The post Cisco UCS Manager Software Flaw Allows Attackers to Inject Malicious Commands appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cisco IMC Virtual Keyboard Vulnerability Allows Attackers to Redirect Users to Malicious Websites

    ·

    , , ,

    Cisco has released urgent security updates to remediate a high-severity vulnerability in its Integrated Management Controller (IMC) virtual keyboard video monitor (vKVM) module that could allow unauthenticated, remote attackers to hijack sessions and redirect users to malicious websites. The flaw, tracked as CVE-2025-20317, carries a CVSS base score of 7.1 and affects a wide range […]

    The post Cisco IMC Virtual Keyboard Vulnerability Allows Attackers to Redirect Users to Malicious Websites appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Hackers Abuse Microsoft Teams to Gain Remote Access With PowerShell-based Malware

    ·

    , ,

    Cybercriminals are increasingly weaponizing Microsoft Teams, exploiting the platform’s trusted role in corporate communications to deploy malware and seize control of victim systems.

    In a sophisticated campaign, threat actors are impersonating IT support staff in Microsoft Teams chats to trick employees into granting remote access, marking a dangerous evolution from traditional email-based phishing attacks.

    Social engineering remains a highly effective tactic for hackers, and as businesses have integrated platforms like Microsoft Teams into their core operations, attackers have followed. The inherent trust employees place in internal messaging makes it a fertile ground for deception.

    Recent campaigns analyzed by Permiso cybersecurity researchers reveal a multi-stage attack that begins with a simple message and culminates in the deployment of potent, multifunctional malware.

    PowerShell-based Malware via Microsoft Teams

    The attack chain often starts with a direct message or call from a newly created or compromised Microsoft Teams account. These accounts are designed to look legitimate, using display names like “IT SUPPORT ✅” or “Help Desk Specialist” to impersonate trusted personnel.

    Microsoft team Attack Chain
    Microsoft team Attack Chain

    Attackers often use checkmark emojis to simulate a verified status and leverage Microsoft’s onmicrosoft.com domain structure to appear as if they are part of the organization.

    Posing as IT staff addressing a routine issue like system maintenance, the attackers build rapport with their target.

    Once trust is established, they persuade the employee to install remote access software, such as QuickAssist or AnyDesk, under the guise of providing technical assistance. This critical step gives the attacker a direct foothold into the user’s machine and the corporate network.

    While similar techniques involving remote access tools have been linked to ransomware groups like BlackBasta since mid-2024, these newer campaigns are more direct, often forgoing the preliminary mass email campaigns seen in the past.

    The malicious payloads have also diversified, with recent incidents involving the DarkGate and Matanbuchus malware loaders.

    Once remote access is secured, the attacker executes a PowerShell command to download the primary malicious payload. This script is far from simple, equipped with capabilities for credential theft, establishing long-term persistence, and remote code execution, Permiso said.

    To evade detection and complicate removal, the malware can designate its own process as “critical,” which would cause the system to crash if terminated.

    It also uses a legitimate-looking Windows credential prompt to trick users into entering their passwords, which are then exfiltrated to an attacker-controlled server.

    Analysis of the payload’s code revealed hardcoded encryption keys that link the campaign to a known financially motivated threat actor tracked as Water Gamayun (also known as EncryptHub).

    This group has a history of combining sophisticated social engineering with custom malware to target English-speaking IT professionals and developers.

    Employees must be trained to remain vigilant against unsolicited contact, even on trusted internal platforms. All requests for credentials or the installation of remote access software should be independently verified through a known, separate communication channel.

    OHere is a table of the Indicators of Compromise (IoCs) based on the provided information.

    IndicatorType
    https://audiorealteak[.]com/payload/build.ps1URL
    https://cjhsbam[.]com/payload/runner.ps1URL
    104.21.40[.]219IPv4
    193.5.65[.]199IPv4
    Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) AppleWebKit/534.6 (KHTML, like Gecko) Chrome/7.0.500.0 Safari/534.6User Agent (UA)
    &9*zS7LY%ZN1thfIInitialization Vector
    123456789012345678901234r0hollahEncryption Key
    62088a7b-ae9f-2333-77a-6e9c921cb48eMutex
    Help Desk Specialist ✅User Display Name
    IT SUPPORT✅User Display Name
    Marco DaSilva IT Support ✅User Display Name
    IT SUPPORT ✅User Display Name
    Help DeskUser Display Name
    @cybersecurityadm.onmicrosoft[.]comUser Principal Name
    @updateteamis.onmicrosoft[.]comUser Principal Name
    @supportbotit.onmicrosoft[.]comUser Principal Name
    @replysupport.onmicrosoft[.]comUser Principal Name
    @administratoritdep.onmicrosoft[.]comUser Principal Name
    @luxadmln.onmicrosoft[.]comUser Principal Name
    @firewalloverview.onmicrosoft[.]comUser Principal Name

    As threat actors continue to innovate, a defense-in-depth strategy, combining technical controls with robust user education, is essential to protect against attacks that turn collaboration tools into conduits for compromise.

    Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.

      The post Hackers Abuse Microsoft Teams to Gain Remote Access With PowerShell-based Malware appeared first on Cyber Security News.

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

    1. State of Nevada Faces IT Outage Amid Cyberattack, Offices Suspended

      ·

      , ,

      The State of Nevada became the target of a significant cyberattack which resulted in a substantial network security incident impacting government infrastructure across multiple agencies. According to an official communication from the Governor’s Technology Office, state officials rapidly identified the breach and immediately commenced continuous recovery efforts aimed at containing the incident and restoring affected […]

      The post State of Nevada Faces IT Outage Amid Cyberattack, Offices Suspended appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

    2. BadSuccessor Post-Patch: Leveraging dMSAs for Credential Acquisition and Lateral Movement in Active Directory

      ·

      , , ,

      Microsoft’s recent patch for the BadSuccessor vulnerability (CVE-2025-53779) has successfully closed the direct privilege escalation path, but security researchers warn that the underlying technique remains viable for sophisticated attackers. 

      While the patch prevents immediate Domain Admin escalation through one-sided delegated Managed Service Account (dMSA) links, threat actors can still exploit the fundamental mechanics for credential harvesting and lateral movement in compromised Active Directory environments.

      Key Takeaways
      1. CVE-2025-53779 patch enforces mutual dMSA–account links at the KDC, blocking one-sided privilege escalations.
      2. dMSA mechanics still enable credential grabs and dumps.
      2. Mitigate by patching servers.

      The BadSuccessor vulnerability originally allowed low-privileged users to achieve instant Domain Admin privileges by abusing Windows Server 2025’s new dMSA account type. 

      By creating a controlled dMSA and linking it to high-privilege accounts, attackers could inherit both effective privileges and Kerberos keys without requiring group membership changes or exotic tooling. 

      The technique exploited how the Key Distribution Center (KDC) treated linked dMSAs as successors during authentication, merging target privileges into the dMSA’s Privilege Attribute Certificate (PAC) and returning credential packages containing the target’s authentication keys.

      BadSuccessor Post-Patch

      Microsoft’s patch implementation focuses on KDC-level validation rather than directory-side attribute protection. 

      Akamai reports that the kdcsvc.dll changes now require mutual linking between dMSA and target accounts, mirroring legitimate migration patterns. 

      However, this enforcement mechanism still permits two critical attack primitives that defenders must monitor. The first primitive enables credential and privilege acquisition as an alternative to shadow credential attacks. 

      When attackers control both a target principal and a dMSA, they can establish a mutual pairing to request dMSA tickets. 

      Error when authenticating a dMSA with a one-sided link- — failure occurs at ticket issuance
      Error when authenticating a dMSA with a one-sided link- — failure occurs at ticket issuance

      This approach offers several advantages: acting with target privileges while using dMSA identity for evasion, obtaining target keys more reliably than Kerberoasting attacks, and generating different telemetry signatures focused on link modifications and Ticket Granting Ticket (TGT) issuance to the dMSA.

      The second primitive provides a DCSync alternative for credential dumping in already-compromised domains. 

      Rather than using traditional replication-based techniques, attackers can leverage BadSuccessor mechanics to extract principal keys through normal ticket issuance processes. 

      This approach generates distinct behavioral signatures that may bypass existing detection mechanisms designed for conventional credential dumping methods.

      Mitigations

      Detection strategies should focus on System Access Control Lists (SACLs) auditing for dMSA creation and migration link attribute changes. 

      Behavioral indicators include repeated dMSA password fetch attempts within short timeframes, enabled users unexpectedly linked to dMSAs, and previously disabled accounts receiving new dMSA associations. 

      Organizations should prioritize patching Windows Server 2025 domain controllers while reviewing organizational unit permissions and tightening dMSA delegation controls to Tier 0 administrators only.

      The evolution of BadSuccessor from vulnerability to persistent technique highlights a broader industry challenge where patches close specific exploitation paths while underlying attack mechanics remain exploitable. 

      Security teams must adapt their monitoring and detection capabilities to account for these evolved threat vectors, recognizing that sophisticated attackers will continue leveraging dMSA relationships for credential acquisition and lateral movement even in patched environments.

      Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.

      The post BadSuccessor Post-Patch: Leveraging dMSAs for Credential Acquisition and Lateral Movement in Active Directory appeared first on Cyber Security News.

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

    3. Threat Actors Exploit Velociraptor Incident Response Tool for Remote Access

      ·

      , ,

      Researchers from the Counter Threat Unit (CTU) at Sophos uncovered a sophisticated intrusion where threat actors repurposed the legitimate open-source Velociraptor digital forensics and incident response (DFIR) tool to establish unauthorized remote access within targeted networks. Velociraptor, designed for endpoint visibility and forensic analysis, was deployed maliciously to download and execute Visual Studio Code, facilitating […]

      The post Threat Actors Exploit Velociraptor Incident Response Tool for Remote Access appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶

      ¶¶¶¶¶