1010.cx

  • MathWorks Confirms Cyberattack, User Personal Information Stolen

    ·

    , , ,

    MathWorks, Inc., the developer of the popular MATLAB and Simulink software, confirmed today that it was the target of a significant cyberattack, resulting in the theft of sensitive personal information belonging to an undisclosed number of users.

    In a notice sent to affected individuals, the company disclosed that it discovered a security incident on May 18, 2025, which involved unauthorized access to its internal networks and systems.

    A subsequent investigation revealed that the threat actor had maintained access to the systems for approximately one month, from April 17 to May 18, 2025.

    Investigation Results

    According to MathWorks, the compromised data may include a range of personally identifiable information (PII). The company stated the stolen information varies by individual but could include full names, addresses, dates of birth, Social Security Numbers, and other non-U.S. national identification numbers. The breach exposes affected users to a heightened risk of identity theft and fraud.

    Upon discovering the intrusion, MathWorks reported that it immediately initiated its incident response protocols, notified federal law enforcement, and engaged third-party cybersecurity experts to investigate the scope of the breach.

    The company has since worked to contain the threat, eradicate unauthorized access, and implement additional measures to safeguard its systems, according to the notice.

    “We have eradicated the unauthorized access and taken steps to safeguard our systems and information,” the company’s statement read. MathWorks has also engaged a third-party service to conduct dark web monitoring for any signs of the stolen data being sold or published.

    To date, the company claims there is no evidence that the stolen data has been sold, posted online, or actively misused. “While we are not aware of any actual or attempted misuse of personal information or any financial harm to involved individuals as a result of this incident, as a protective measure, we are providing notice of this incident and identity protection services,” the notice continued.

    MathWorks is urging all customers, especially those who received a notification, to remain vigilant. The company advises users to closely review their financial account statements and monitor their free credit reports for any suspicious activity or errors. It has provided an informational guide on general identity theft protection to all affected individuals.

    This incident places MathWorks among a growing list of technology companies targeted by sophisticated cybercriminals aiming to steal valuable user data. The company has not yet commented on the number of users impacted or the specific nature of the attack.

    Tired of Filling Forms for security & Compliance questionnaires? Automate them in minutes with 1up! Start Your Free Trial Now!

    The post MathWorks Confirms Cyberattack, User Personal Information Stolen appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The D Brief: Ousted DIU chief’s legacy; Russian UAVs over Germany; DDG of drones?; Robot wingman takes flight; And a bit more.

    ·

    Ousted DIU leader leaves behind a blueprint for faster tech. Defense Innovation Unit Director Doug Beck, a champion of acquisition reform who was instrumental in the Pentagon’s push to rapidly build and deploy new technology, resigned Friday due to political pressure, Defense Department sources told Defense One’s Patrick Tucker. Pentagon officials had raised concerns about Beck’s political donations to Democrats, Reuters reported Monday.

    Beck’s efforts had received broad endorsement from Republican lawmakers and SecDef Hegseth. A March memo from the Defense Secretary’s office essentially directed a scaling-up of DIU’s practices: removing barriers and contract restrictions so the services and the combatant commands can purchase new technology through streamlined contracts. The memo also gave DIU a central role in execution, directing the undersecretary for acquisition “in coordination with the Director of the Defense Innovation Unit” to produce an implementation plan.

    In July, Hegseth doubled down with a second memo building on Beck’s efforts, “delegating authorities to procure and operate drones from the bureaucracy to our warfighters” and giving brigade commanders greater authority to buy new tech. The changes, which had been urged for years by lawmakers and government watchdogs, were made possible by Beck, one former official said. Tucker has more, here.

    The 10-year-old DIU will be led in an acting capacity by Emil Michael, defense undersecretary for research and engineering, DOD officials have confirmed. 

    Report: The final draft of the National Defense Strategy has been distributed in the Pentagon. Nikkei Asia says the 80-page document draws from Vice President JD Vance's speeches and interviews and Pentagon policy chief Elbridge Colby's book Strategy of Denial.

    ICYMI: “Civilian and uniformed Pentagon officials have said publicly that this administration is prioritizing the geographical United States in its national security policy, a departure from recent administrations—including Trump’s first—that have described conflict with China in the Indo-Pacific or terrorism in the Middle East as the biggest threats to America,” Defense One’s Meghann Myers reported earlier this month.

    Podcast: Ohio State University’s Angus Fletcher uses his work with U.S. special operations forces to explain a new neuroscientific approach to intuition, imagination, emotion, and common sense. He talked with your D Brief-er for Defense One Radio’s Ep. 191: “Primal Intelligence.” Listen, here.

    Could a flotilla of robot boats do the job of a destroyer? “We have a thesis in TF66 we call the ‘deconstructed DDG,” said Rear Adm. Michael Mattis, who leads an effort to figure out how low-cost, commercially available uncrewed systems might fit into the Navy’s Sixth Fleet. “We think that with 20 USVs of different, heterogeneous types, we could deconstruct a mission that a DDG could do. And we think we could do it at a cost point of essentially 1/30 of what a DDG would cost.” Mattis talked more about his team’s work Wednesday at the NDIA conference; Defense One’s Lauren C. Williams has more of that, here. 

    More reading:

    Welcome to this Thursday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson with Bradley Peniston. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1867, U.S. Navy Capt. William Reynolds of USS Lackawanna formally seized possession of the Midway Atoll for the United States.

    Around the Air Force

    A second B-21 Raider bomber will likely fly by year’s end, joining the pre-production test aircraft that first flew in late 2023 and has since been flying up to twice a week. That news comes from Lt. Gen. Andrew Gebara, Air Force deputy chief of staff for strategic deterrence and nuclear integration, who spoke Wednesday at an event hosted by the Mitchell Institute. Gebara added that the extra $4.5 billion for the aircraft provided in the reconciliation bill would go a “long way” to help move to full-rate production.

    The three-star joined other military officials in suggesting that the Air Force may need to buy more than the planned 100 B-21s, but he said it will be a “long time” before the service comes to an official conclusion about that. Defense One’s Audrey Decker has a bit more, here.

    Gebara added a rare public comment about the deployment of the B61-12 nuclear gravity bomb. Asked about recent reports that American nukes are back in the UK after almost two decades, he declined to answer directly but said, “We now have F-35, 5th-gen sensor-fused aircraft, many of our allies purchasing the same aircraft, common training, common TTPs [tactics, techniques, and procedures], with our modernized B61-12 weapon that has been fully deployed throughout the continent.”

    That almost, but not precisely, echoed what another senior nuclear-weapons official has said. “The new B61-12 gravity bombs are fully forward deployed, and we have increased NATO’s visibility to our nuclear capabilities through visits to our enterprise and other regular engagements,” Jill Hruby, who was then the administrator of the National Nuclear Safety Administration, said in January. 

    No successor: Hruby stepped down as NNSA director at the beginning of the Trump administration. Brandon Williams, a former GOP congressman, was quickly named as her successor but has not been confirmed by the U.S. Senate. The NNSA website says an acting director is in place.

    A “robot wingman” makes first flight. The YFQ-42A, General Atomics’ entry in the contest to build collaborative combat aircraft for the Air Force, took off Wednesday from its airport in Palmdale, California, according to a service press release. Anduril says its rival YFQ-44 will fly “soon.” Decker has more, here.

    Related reading:

    Trump 2.0

    ICE and CBP agents want to stage out of a naval base north of Chicago (Naval Station Great Lakes) during the month of September “as part of President Donald Trump’s plan to target Chicago,” the Chicago Sun-Times reported Wednesday. 

    “These operations are similar to what occurred in Los Angeles earlier this summer. Same [Department of Homeland Security] team,” the base’s commander said in an email Monday. He also said “there is the potential to also support National Guard units,” adding, “Not many details on this right now. Mainly a lot of concerns and questions.”

    One source told the paper that “about 30 to 40 ICE agents had been practicing riot control tactics at the military installation for months, using flash-bang grenades and marching in phalanxes with shields. The source said the planned operation would likely involve more agents than had been previously running drills, noting that the barracks can house 200 people.”

    Second opinion: “We know that Donald Trump bringing in ICE and other federal enforcement to Chicago isn’t about ‘law and order’ because he is once again refusing to coordinate with our local officials,” said Army veteran and Sen. Tammy Duckworth, D-Illinois. She also called it “yet another unwarranted, unwanted and unjust move straight out of the authoritarian’s playbook that will only undermine our military’s readiness and ultimately weaken our national security.” 

    And: “May I remind the President that deploying the military to Chicago, and derailing critical operations at Naval Station Great Lakes, would be both unhelpful and illegal,” Duckworth’s Senate colleague Dick Durbin said. Full story, here. 

    Meanwhile, Reuters reports Trump’s police takeover and military occupation of the nation’s capital has yielded not one case “involv[ing] someone being charged with a violent offense” in the nearly two weeks since it began. 

    Out of more than 500 criminal cases filed since August 11, “records show Trump’s anti-crime task force was involved in at least 69 local cases over the past two weeks, of which nearly half were comparatively minor offenses, including misdemeanors,” the wire service reported Wednesday. “The rest were felonies under the local D.C. code, not the more serious federal felonies that agencies usually handle. About half of those were for carrying a firearm without a license, possessing drugs with intent to distribute, or both.” More, here. 

    ICYMI: “Just 38% of Americans support using troops for law enforcement in the U.S. capital, with 46% opposed,” Reuters reported Wednesday from new polling results. More than three-quarters of Republicans supported it compared to just 8% of Democrats. Among independents, “28% were in favor and 51% were opposed.” More, here. 

    Hoagie-hurler update: Federal prosecutors could not get a grand jury to indict the Air Force veteran and Department of Justice employee who tossed a Subway sandwich at a CBP officer in Washington on August 13, shouting “fascists” and said, “I don’t want you in my city!”  

    Why bring it up: “It is extremely unusual for prosecutors to come out of a grand jury without obtaining an indictment because they are in control of the information that grand jurors hear about a case and defendants are not allowed to have their lawyers in the room as evidence is presented,” the New York Times reports. “Prosecutors typically have 30 days to secure an indictment after a defendant is arrested. If they fail to do so within that window, they either have to reduce the charges to a misdemeanor or dismiss the case altogether.”

    Update: Florida’s “Alligator Alcatraz” migrant detention center will “probably [be] going to be down to 0 individuals within a few days,” Florida Division of Emergency Management Executive Director Kevin Guthrie said in an email last Friday, according to the Associated Press. 

    Background: This new development comes “less than a week after a federal judge in Miami ordered the detention center to wind down operations, with the last detainee needing to be out within 60 days.” Florida officials have asked the judge to delay her deadline, pending an appeal. More, here. 

    Additional reading: 

    Russia’s Ukraine war

    Russian drone and missile attacks killed at least 18 Ukrainians overnight, the Wall Street Journal reports from Kyiv, calling it “the worst death toll in the capital since Trump held talks in Alaska earlier this month with Russian leader Vladimir Putin.” 

    At least four of those killed were children, Ukrainian President Volodymir Zelenskyy said on social media. 

    “Russia has no intentions of ending this war,” Finland President Alexander Stubb wrote on social media after Russia’s latest deadly attacks. And “Russia has not changed its main strategic aim of destroying the independence, sovereignty and territorial integrity of Ukraine,” he stressed, and added, “Finland will continue to support Ukraine with all necessary diplomatic, financial and military efforts. For as long as it takes.”

    Italian Prime Minister Giorgia Meloni: “The intense attacks on Kyiv this night demonstrate who stands on the side of peace and who has no intention of believing in the negotiating path. Our thoughts go to the Ukrainian people, to civilians, to the families of defenseless victims, including children, of the senseless Russian attacks.” 

    New: Russians or their proxies are flying surveillance drones over eastern Germany, where the U.S. and its allies move weapons, the New York Times reported Thursday. “The flights, concentrated in the eastern German state of Thuringia, were also reported by WirtschaftsWoche, a German publication that has reported extensively on the [alleged Russian] sabotage campaign” throughout Europe since Russia’s full-scale Ukraine invasion began in 2022. 

    “U.S. officials confirmed the flights but said they were unable to track their origin. They believe the drones have been flown by Russians or people working for Russian intelligence services,” the Times reports. More, here. 

    Related reading: 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Threat Actors Abuse Velociraptor Incident Response Tool to Gain Remote Access

    ·

    , , , ,

    A sophisticated intrusion in which threat actors co-opted the legitimate, open-source Velociraptor digital forensics and incident response (DFIR) tool to establish a covert remote access channel.

    This represents an evolution from the long-standing tactic of abusing remote monitoring and management (RMM) utilities, with attackers now repurposing DFIR frameworks to minimize custom malware deployment and evade detection.

    During the attack, the adversary leveraged the native Windows msiexec utility to download and install a malicious Velociraptor MSI package from a Cloudflare Workers–hosted staging domain, files.qaubctgg.workers.dev.

    This staging area also housed other attacker tools, such as a Cloudflare tunneling component and the Radmin remote administration tool. Once installed, Velociraptor was configured to communicate with a command-and-control (C2) server at velo.qaubctgg.workers[.]dev.

    Next, the intruder executed an obfuscated PowerShell command to retrieve Visual Studio Code (code.exe) from the same workers.dev folder and ran it with the built-in tunnel feature enabled.

    Process tree showing Velociraptor creating Visual Studio Code tunnel.
    Process tree showing Velociraptor creating Visual Studio Code tunnel.

    By installing code.exe as a Windows service and redirecting its output to a log file, the threat actor effectively created a persistent, encrypted tunnel to the attacker’s C2 infrastructure.

    This technique bypassed many traditional security controls, as the tunneling feature in Visual Studio Code is often used legitimately by developers for remote collaboration, according to Sophos’ investigation.

    In response, CTU analysts provided the affected organization with mitigation guidance, enabling rapid isolation of the compromised host. This containment measure prevented the adversary from advancing to their ultimate goal of ransomware deployment.

    Velociraptor Incident Response Tool Abused

    Although remote access abuse via RMM tools is a familiar tactic documented in previous incidents involving SimpleHelp vulnerabilities and virtual machine–based tools, this case marks one of the first observed instances in which DFIR software itself was weaponized.

    By pivoting to Velociraptor, the attackers reduced reliance on bespoke malware, lowering their operational footprint and complicating attribution.

    CTU’s analysis indicates that this tradecraft should be treated as a likely precursor to ransomware. Organizations are therefore advised to:

    • Monitor unauthorized deployments of DFIR and incident response tools, including Velociraptor, across endpoints and servers.
    • Implement comprehensive EDR systems capable of detecting atypical processes and suspicious command lines.
    • Enforce strict application allow-listing policies to block unapproved installers and service creations.
    • Regularly audit network traffic for unexpected encrypted tunnels or anomalous C2 beaconing.
    • Maintain robust, offline backups and rehearse ransomware recovery plans.

    Security teams should review and restrict access to these domains, taking into account the risk of interacting with potentially malicious content.

    Indicator TypeDomainDescription
    Installerfiles.qaubctgg.workers.dev/v2.msiVelociraptor MSI package
    Tunneling Toolfiles.qaubctgg.workers.dev/code.exeVisual Studio Code executable
    Additional MSIworkers.dev/sc.msiSecondary malware installer

    By treating unauthorized use of incident response tools as a high-risk event and adopting layered detection and prevention measures, organizations can significantly reduce the impact of such attacks and halt adversaries before they deploy ransomware.

    Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.

    The post Threat Actors Abuse Velociraptor Incident Response Tool to Gain Remote Access appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Nevada IT Systems Hit by Cyberattack – State Office Closed for Two Days

    ·

    , ,

    A significant cyberattack disrupted Nevada’s state government network on August 24, forcing all state office branches to shut down operations for 48 hours.

    The intrusion began with the exploitation of an unpatched VPN gateway, allowing the threat actor to gain initial foothold on the internal network.

    Within hours, the attackers deployed a custom malware payload designed to escalate privileges, move laterally across critical servers, and exfiltrate sensitive data.

    This event marks one of the most severe disruptions of state IT services in recent history, affecting email, public records access, and internal communication channels.

    Governor Lombardo Press Office analysts noted that the malware leveraged a multi-stage attack vector: a lightweight dropper written in PowerShell, which in turn fetched a second-stage binary from a compromised web server.

    This binary contained encrypted configuration files, indicating the attackers’ intent to remain undetected while mapping the network topology.

    As state technicians worked to isolate infected endpoints, normal user authentication services were rerouted to offline backups, further complicating the recovery process.

    Initial forensic analysis revealed that the dropper script used the following pattern to establish persistence on reboot:-

    $TaskAction = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument '-NoProfile -WindowStyle Hidden -File C:\Windows\Temp\svc_update.ps1'
$Trigger    = New-ScheduledTaskTrigger -AtStartup
Register-ScheduledTask -TaskName 'WindowsUpdateSvc' -Action $TaskAction -Trigger $Trigger -Description 'System Update Service'
    Incident report (Source – X)

    This technique allowed the malware to relaunch silently, even after endpoint patches were applied.

    Governor Lombardo Press Office researchers identified the dropper’s code similarities to known APT toolkits, suggesting that the perpetrators possess advanced capabilities and extensive reconnaissance data on state infrastructure.

    Infection Mechanism

    Delving deeper into the infection mechanism, the second-stage binary employs a custom communications protocol over HTTPS, masquerading its traffic as benign REST API calls to evade intrusion detection systems.

    Upon execution, the binary loads a DLL into the Windows Management Instrumentation (WMI) host process (wmiprvse.exe), effectively concealing its operations within legitimate system processes.

    The DLL decrypts embedded payloads in memory, deploying modules that scan for domain controllers and file shares.

    Once targets are identified, encrypted archives of critical files are staged for exfiltration using chunked uploads to a remote C2 server.

    The malware transition from initial code execution to data exfiltration without triggering standard network security alarms.

    Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

    The post Nevada IT Systems Hit by Cyberattack – State Office Closed for Two Days appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Electronics Manufacturer Data I/O Suffers Ransomware Breach

    ·

    , , ,

    Data I/O Corporation, a well-known electronics firm that specializes in device programming and security provisioning solutions, revealed a ransomware attack that penetrated its internal IT infrastructure in a major cybersecurity event. The incident, detected on August 16, 2025, prompted an immediate activation of the company’s incident response protocols, highlighting the persistent threat of ransomware in […]

    The post Electronics Manufacturer Data I/O Suffers Ransomware Breach appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cisco Nexus 3000 and 9000 Series Vulnerability Let Attackers Trigger DoS Attack

    ·

    , , ,

    Cisco has issued a High-severity security advisory alerting customers to a critical vulnerability in the Intermediate System-to-Intermediate System (IS-IS) feature of NX-OS Software for Cisco Nexus 3000 and 9000 Series switches. 

    Tracked as CVE-2025-20241 with a CVSS base score of 7.4, the flaw could allow an unauthenticated, Layer 2-adjacent attacker to send a malformed IS-IS packet that restarts the IS-IS process, potentially reloading the device and causing a denial-of-service (DoS) condition. 

    Key Takeaways
    1. Cisco Nexus 3000/9000 IS-IS flaw allows adjacent DoS.
    2 No workaround; enable IS-IS area authentication.
    3. Apply Cisco’s free NX-OS update.

    Cisco Nexus 3000 and 9000 Vulnerabilities

    The vulnerability stems from insufficient input validation when parsing ingress IS-IS packets. An attacker must be on the same broadcast domain as the target switch and can exploit the flaw by transmitting a specially crafted IS-IS L1 or L2 packet. 

    Upon receipt, the NX-OS IS-IS daemon may crash and subsequently reload the entire switch, disrupting network routing and traffic forwarding. This condition affects:

    • Cisco Nexus 3000 Series Switches
    • Cisco Nexus 9000 Series Switches in standalone NX-OS mode

    Only devices with IS-IS enabled on at least one interface are vulnerable. Products such as Nexus 9000 in ACI mode, Firepower 1000/2100/4100/9300, MDS 9000, and UCS Fabric Interconnects are confirmed not vulnerable. 

    The advisory notes that if IS-IS authentication is configured, the attacker must supply valid keys to exploit the issue.

    To verify IS-IS status, administrators can run the CLI command:

    Cisco Nexus 3000 and 9000 Series Vulnerability

    Presence of feature isis, router isis name, and at least one ip router isis name entry confirms exposure. To view live IS-IS peers, use:

    Cisco Nexus 3000 and 9000 Series Vulnerability
    Risk FactorsDetails
    Affected ProductsCisco Nexus 3000 Series SwitchesCisco Nexus 9000 Series Switches (standalone NX-OS)
    ImpactIS-IS process restart causing device reload (DoS)
    Exploit PrerequisitesLayer 2 adjacency; IS-IS enabled on interface
    CVSS 3.1 Score7.4 (High)

    No temporary workarounds exist; however, enabling area authentication for IS-IS can mitigate risk by requiring attackers to authenticate before sending malicious packets.

    Cisco strongly recommends that customers thoroughly evaluate this mitigation to ensure compatibility with their network requirements.

    Cisco has released free software updates to address the vulnerability. Customers with valid service contracts should download and install the fixed releases from the Cisco Support and Downloads portal. 

    For those without service contracts, contacting the Cisco TAC with the advisory URL and product serial number will enable entitlement to the necessary patches.

    Tired of Filling Forms for security & Compliance questionnaires? Automate them in minutes with 1up! Start Your Free Trial Now!

    The post Cisco Nexus 3000 and 9000 Series Vulnerability Let Attackers Trigger DoS Attack appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Farmers Insurance Cyber Attack – 1.1 Million Customers Data Exposed in Salesforce Attack

    ·

    , ,

    Farmers Insurance Exchange and its subsidiaries recently disclosed a significant security incident that compromised personal information of approximately 1.1 million customers through an unauthorized access to a third-party vendor’s database.

    The breach, which occurred on May 29, 2025, represents one of the largest insurance industry data exposures of the year, affecting customer records containing names, addresses, dates of birth, driver’s license numbers, and partial Social Security numbers.

    The attack timeline reveals a sophisticated intrusion that went undetected for approximately 24 hours before the vendor’s monitoring systems identified suspicious activity.

    On May 30, 2025, the unnamed third-party vendor alerted Farmers to the unauthorized database access, triggering immediate containment measures and blocking the threat actor.

    The vendor’s existing monitoring infrastructure proved crucial in limiting the exposure window, though investigators later confirmed that data acquisition had already occurred during the initial breach period.

    Following the incident discovery, Farmers analysts worked alongside external cybersecurity experts to conduct a comprehensive forensic investigation spanning nearly two months.

    The investigation revealed that the unauthorized actor had successfully penetrated the vendor’s database defenses and exfiltrated sensitive customer information before detection systems could intervene.

    Farmers researchers noted that the attack specifically targeted customer databases containing insurance policy holder information, suggesting a deliberate focus on high-value personal data.

    Database Infiltration and Persistence Mechanisms

    The attack vector analysis indicates the threat actor employed advanced persistent techniques to maintain unauthorized database access.

    While specific technical details remain undisclosed for security reasons, the prolonged investigation period suggests complex data extraction methods were utilized.

    The attacker’s ability to access and acquire substantial customer data within a compressed timeframe points to sophisticated database querying capabilities and potential privilege escalation within the vendor’s systems.

    Security experts noted that the incident highlights critical vulnerabilities in third-party vendor management, particularly regarding database access controls and real-time monitoring systems.

    The breach underscores the importance of implementing robust vendor security frameworks and continuous monitoring protocols to detect unauthorized database activities before data exfiltration occurs.

    Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

    The post Farmers Insurance Cyber Attack – 1.1 Million Customers Data Exposed in Salesforce Attack appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Hackers Attempted to Misuse Claude AI to Launch Cyber Attacks

    ·

    , , ,

    Anthropic has thwarted multiple sophisticated attempts by cybercriminals to misuse its Claude AI platform, according to a newly released Threat Intelligence report.

    Despite layered safeguards designed to prevent harmful outputs, malicious actors have adapted to exploit Claude’s advanced capabilities, weaponizing agentic AI to execute large-scale extortion, employment fraud, and ransomware operations.

    In one high-profile case dubbed “vibe hacking,” an extortion ring leveraged Claude Code to automate reconnaissance, credential harvesting, and network infiltration across at least 17 organizations, including healthcare providers, emergency services, and religious institutions.

    Instead of encrypting stolen data with ransomware, the group threatened to expose sensitive information to coerce ransoms exceeding $500,000 publicly.

    Claude Code autonomously selected which data to exfiltrate, determined ransom valuations based on financial records analysis, and generated alarming visual ransom notes on victim machines.

    Anthropic’s team simulated the criminal workflow for research purposes, then banned the offending accounts and developed a tailored classifier and new detection methods to flag similar behaviors in real-time.

    Another operation involved North Korean IT operatives using Claude to fabricate false identities and professional backgrounds, pass technical assessments, and secure remote positions at U.S. Fortune 500 companies.

    Where years of specialized training once throttled the regime’s capacity for such schemes, AI now enables unskilled operators to code, communicate professionally in English, and maintain lucrative employment all in violation of international sanctions.

    Upon discovery, Anthropic immediately suspended the implicated accounts, improved indicator-collection tools, and shared its findings with law enforcement and sanction-enforcement agencies.

    A third case detailed a lone cybercriminal marketing AI-generated ransomware-as-a-service on dark-web forums. Priced between $400 and $1,200 per package, the malware featured advanced evasion, encryption, and anti-recovery mechanisms, all developed with Claude’s assistance.

    Anthropic blocked the account, alerted industry partners, and enhanced its platform’s ability to detect suspicious malware uploads and code generation attempts.

    “These incidents represent an evolution in AI-assisted cybercrime,” the report warns, noting that agentic AI tools can adapt in real time to defensive measures such as malware detection systems.

    By lowering technical barriers, AI enables novices to carry out complex cyberattacks that previously required expert teams to execute. The report predicts such attacks will become more common as AI-assisted coding proliferates.

    Anthropic’s layers of protection include a Unified Harm Framework guiding policy development across physical, psychological, economic, societal, and autonomy dimensions; rigorous pre-deployment testing for safety, bias, and high-risk domains; real-time classifiers to steer or block harmful prompts; and ongoing threat-intelligence monitoring of usage patterns and external forums.

    These safeguards have already prevented misuse attempts in domains ranging from election integrity to chemical and biological weapons research, and continue to evolve in response to newly identified threats.

    In addition to account bans and detection enhancements, Anthropic has shared technical indicators and best practices with authorities and industry peers.

    Anthropic plans to prioritize further research into AI-enhanced fraud and cybercrime, expanding its threat intelligence partnerships and refining its guardrails to stay ahead of adversarial actors.

    Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.

    The post Hackers Attempted to Misuse Claude AI to Launch Cyber Attacks appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Anthropic Blocks Hackers Attempting to Exploit Claude AI for Cyber Attacks

    ·

    , , ,

    Anthropic, a leading AI research company, has successfully disrupted multiple attempts by cybercriminals to misuse its Claude AI model for sophisticated cyberattacks, as detailed in their latest Threat Intelligence report. The company has implemented advanced safeguards, including real-time classifiers and hierarchical summarization techniques, to detect and mitigate these abuses. By leveraging these technical measures, Anthropic […]

    The post Anthropic Blocks Hackers Attempting to Exploit Claude AI for Cyber Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Breaking the Passkey Promise: SquareX Discloses Major Passkey Vulnerability at DEF CON 33

    ·

    It is no secret that passwords are highly susceptible to phishing and brute force attacks. This led to the mass adoption of passkeys, a passwordless authentication method leveraging cryptographic key pairs that allows users to log in with biometrics or a hardware key. According to FIDO, over 15 billion accounts have been passkey-enabled, with 69% […]

    The post Breaking the Passkey Promise: SquareX Discloses Major Passkey Vulnerability at DEF CON 33 appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶